from:"mj"




On 03/22/2018 11:34 AM, Jochen Bern wrote:

The configuration guide describes (in 4.3.) a scenario where SOGo's user
population backend (LDAP) is set up from scratch, which implies that the
preexisting IMAP server supposedly is*not*  using the same
backend/data/passwords.

I'ld guess that*if*  you have the IMAP server configured to look up the
same backend/data (including support for exotic authentication methods,
"Exchange style" cross-user access rights management, yadda yadda), the
requirement to defeat authentication from SOGo to the IMAP server may
become moot.

But until then - Exchange takes its entire auth from AD, and SOGo's
LDAP,*not*  the IMAP server's passdb, is the analogue of that.


I have read the above again and again, but I don't understand what you 
are trying to say, I'm sorry.


Chapter 4.3 doesn't apply to us and my question, since we are (and were) 
always using (samba) AD.


Everything connects to this same AD backend, including SOGo and imap.

MJ

Re: why is dovecot "Allowing any password"




On 03/22/2018 09:56 AM, Aki Tuomi wrote:


I would recommend using master password (that is, replace nopassword=y
with password=staticpassword). I know that from localhost perspective
this isn't much different, but it will reduce accidents.


ok, I'll see if I can get the SOGo developers attention on this. :-)

MJ

Re: why is dovecot "Allowing any password"




On 03/22/2018 09:34 AM, Aki Tuomi wrote:

I have no idea*WHY*  it is required by SOGo. It does not make sense.


Well, the thing is: SOGo has this ability to behave like a *real* 
exchange server, as if it's running on a windows server. And this 
enables Outlook to connect to it like it would to an exchange server. 
(so: not in imap mode, and not using regular username/password 
authentication)


Normally, SOGo simply reuses the provided username/password to connect 
to the imap server, but in the above scenario, these are not available.


The same goes for a SAML2 authenticated SOGo webmail logon.

In these scenarios, SOGo uses the 127.0.0.1 connection, to logon to 
imap. Since it does know the username.


I guess a better solution would be for SOGo to be able to do 
'transformations' to the username/password, to change the regular 
username/unknownpassword into username*master/masterpassword, and get 
rid of the 127.0.0.1 passwordless listener.


Right?

But SOGo doesn't do that. (afaik)

MJ

Re: why is dovecot "Allowing any password"




On 03/21/2018 10:34 PM, @lbutlr wrote:

The question is does it allow remote users to login with no password?

Yes, and the answer is: no.


If not, then the message ie nearly notification that login without a password 
is potentially possible.

Yes, but a worrying one. That's why i decided to post here.


I have no idea why you would have nopassword=y set in the first place, so it 
seems the simplest way to eliminate this problem is to take that out and have a 
secure environment for sending mail.


Yes, however, for SOGo with Native Outlook compatibility or SAML logon, 
the config is required.


(https://sogo.nu/files/docs/v2/SOGoNativeOutlookConfigurationGuide.html)

Thanks,
MJ

Re: why is dovecot "Allowing any password"


ok, fyi:

I have now also tested/confirmed this, while looking at the logs, and 
indeed:


Even when the connection is denied because of a wrong password, the 
message "Allowing any password" is showing up in the logs.


Perhaps it is because we have set debug options:


auth_debug = yes
auth_debug_passwords = yes
auth_verbose = yes


It would be nice if the "Allowing any password" could be rephrased, or 
taken out. It really had me scared for a while.


Thanks Aki,
MJ

Re: why is dovecot "Allowing any password"


Hi Aki,

On 03/21/2018 05:43 PM, Aki Tuomi wrote:

Mar 21 07:13:48 mail dovecot: auth: 
static(username,1.2.3.4,): allow_nets check failed: IP not in 
allowed networks

this indicates that the request is marked failed.


So, what you are saying is: the logline "Allowing any password" is 
'wrong'? Access was actually DENIED, even though it says "Allowing any 
password" and even though one line later it says: "auth: Debug: auth 
client connected (pid=6174)"?


This is all very misleading

MJ

Re: why is dovecot "Allowing any password"


Hi AKi,

Thanks for the quick answer!

On 03/21/2018 05:24 PM, Aki Tuomi wrote:

This is what 'nopassword=y' does. I'm guessing this is an attempt to allow 
logging in from localhost without password, but I'd use master password (for 
applications or webmails), or


Yes, the config is taken from the SOGo configuration guide, which can be 
seen here:

https://sogo.nu/files/docs/v2/SOGoNativeOutlookConfigurationGuide.html

Yes, but we have args = nopassword=y allow_nets=127.0.0.1/32
so it should only allow passwordless logins from localhost, right..?

And in "Debug: static(username,1.2.3.4,): Allowing any 
password" 1.2.3.4 is NOT localhost...


(obviously 1.2.3.4 is not the *real* ip, bit it's a *real* ip from the 
internet, NOT localhost...


MJ

why is dovecot "Allowing any password"


Hi,

I noticed the following in the logs of our debian wheezy server:


Mar 21 07:13:47 mail dovecot: auth: Debug: 
ldap(username,1.2.3.4,): bind search: base=CN=Users, DC=samba, 
DC=company, DC=com filter=(&(objectclass=person)(sAMA
ccountName=username)(!(userAccountControl=514)))
Mar 21 07:13:47 mail dovecot: auth: Debug: 
ldap(username,1.2.3.4,): result: uid=username; uid unused
Mar 21 07:13:47 mail dovecot: auth: Debug: 
ldap(username,1.2.3.4,): result: uid=username
Mar 21 07:13:48 mail dovecot: auth: ldap(username,1.2.3.4,): 
invalid credentials (given password: invalid_password)
Mar 21 07:13:48 mail dovecot: auth: Debug: 
static(username,1.2.3.4,): lookup
Mar 21 07:13:48 mail dovecot: auth: Debug: 
static(username,1.2.3.4,): allow_nets: Matching for network 
127.0.0.1/32
Mar 21 07:13:48 mail dovecot: auth: 
static(username,1.2.3.4,): allow_nets check failed: IP not in 
allowed networks
Mar 21 07:13:48 mail dovecot: auth: Debug: 
static(username,1.2.3.4,): Allowing any password
Mar 21 07:13:54 mail dovecot: auth: Debug: auth client connected (pid=6174)


The line second last line "Allowing any password" comes as a surprise..? 
Why would dovecot Allow any password..?


We had the following bit in our config, but I removed it now:


#passdb {
#  driver = static
#  args = nopassword=y allow_nets=127.0.0.1/32
#}


Could anyone expain the "Allowing any password"?

And lastly our current doveconf -n:


# 2.2.13: /etc/dovecot/dovecot.conf
# OS: Linux 3.2.0-5-amd64 x86_64 Debian 7.11 xfs
auth_debug = yes
auth_debug_passwords = yes
auth_failure_delay = 10 secs
auth_master_user_separator = *
auth_mechanisms = plain login
auth_username_format = %Ln
auth_verbose = yes
auth_verbose_passwords = plain
deliver_log_format = %f | %s | msgid=%m: %$
disable_plaintext_auth = no
lda_mailbox_autocreate = yes
lda_mailbox_autosubscribe = yes
login_greeting = Dovecot ready.
mail_gid = vmail
mail_location = maildir:/var/vmail/%Ln/Maildir:LAYOUT=fs:DIRNAME=mAildir
mail_plugins = acl lazy_expunge zlib quota mail_log notify
mail_uid = vmail
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope encoded-character 
vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy 
include variables body enotify environment mailbox date ihave
namespace {
  list = children
  location = 
maildir:/var/vmail/%%u/Maildir:LAYOUT=fs:DIRNAME=mAildir:INDEX=/var/vmail/%u/shared/%%u
  prefix = shared/%%n/
  separator = /
  subscriptions = no
  type = shared
}
namespace inbox {
  inbox = yes
  location = 
  mailbox "Deleted items" {

special_use = \Trash
  }
  mailbox Drafts {
special_use = \Drafts
  }
  mailbox Junk {
special_use = \Junk
  }
  mailbox Sent {
special_use = \Sent
  }
  mailbox "Sent items" {
special_use = \Sent
  }
  mailbox Trash {
special_use = \Trash
  }
  mailbox inbox {
auto = subscribe
  }
  prefix = 
  separator = /

  type = private
}
passdb {
  args = /etc/dovecot/master-users
  driver = passwd-file
  master = yes
}
passdb {
  args = /etc/dovecot/dovecot-ldap.conf.ext
  driver = ldap
}
plugin {
  acl = vfile
  acl_shared_dict = file:/var/lib/dovecot/db/shared-mailboxes.db
  mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename 
append
  mail_log_fields = uid box msgid from subject
  quota = maildir
  quota_rule = ?:storage=5G
  quota_rule2 = Trash:storage=+100M
  quota_warning = storage=97%% quota-warning 97 %u
  quota_warning2 = storage=95%% quota-warning 95 %u
  quota_warning3 = storage=90%% quota-warning 90 %u
  quota_warning4 = storage=85%% quota-warning 85 %u
  quota_warning5 = storage=80%% quota-warning 80 %u
  quota_warning6 = -storage=100%% quota-warning below %u
  sieve = ~/.dovecot.sieve
  sieve_default = /var/lib/dovecot/default.sieve
  sieve_dir = ~/sieve
}
protocols = imap lmtp sieve
service auth {
  unix_listener /var/spool/postfix/private/auth {
mode = 0666
  }
  unix_listener auth-userdb {
group = vmail
mode = 0666
user = vmail
  }
}
service imap-login {
  process_limit = 500
  process_min_avail = 2
}
service quota-warning {
  executable = script /usr/local/bin/quota-warning.sh
  unix_listener quota-warning {
user = vmail
  }
  user = dovecot
}
shutdown_clients = no
ssl_ca = 

MJ

Re: Howto authenticate smartPhone via Active Directory

2017-12-05 Thread mj

Hi,

Not much time to reply now.

On 12/05/2017 05:21 AM, Mark Foley wrote:

mj - thanks! That the first useful example I've received from any forum/list.
I'm getting ready
to try my config (have to do so after hours), but I have some probably
simple-minded questions:
Well, that looks as if you are testing/trying out on your production
machine. Why not setup a seperate (virtual?) test server to play with..?
Use the same os version, with the same dovecot version.
Or clone your production machine, so you can test as much as you like,
without time pressure, at any given time.

Your example is not the complete dovecot-ldap.conf.ext file, right? Have you
just given me
differences in your config from the "original"? You've kept the hosts, base,
ldap_version,
scope, deref, debug_level, and auth_bind_userdn settings in your config, right?

Not the complete file, no. I just provided the essentials.

Your dn is:

dn = cn=search_dovecit,cn=users,dc=company,dc=com

Mine (original) is:

dn = cn=user_for_bind,cn=Users,dc=dom

Can you tell me why you have "search_dovecit" versus "user_for_bind"? Is that
something I need
in order to make this work?
It's the user that dovecot uses to search for your user, Can be
anything, as long as it can authenticate using the password in:

My dnpass (original) is:

dnpass =

your example is:

dnpass = top_secret

Use the password of whatever user you use.

If meta, what is actually supposed to go there?

The password of user_for_bind

With your "this user/passwd filter". Can you tell me why you have
"userAccountControl=514"? Is
that 514 bit documented somewhere? Your user_filer/pass_filter is *completely*
different from
my installed original.

https://social.msdn.microsoft.com/Forums/vstudio/en-US/77f48af7-bbef-4cd7-9c83-d9359b255534/ldap-query-get-nonlockeddisabled-accounts?forum=netfxbcl

For the rest: my advise is that you *really* need to pay around with
this much more. Get yourself a test environment, and play and test.

Plus: read some dovecot/ad howto's, and try things in your own environment.

Quick google returns:
https://www.howtoforge.com/postfix-dovecot-authentication-against-active-directory-on-centos-5.x

Enjoy :-)

Re: Howto authenticate smartPhone via Active Directory

2017-12-04 Thread mj




On 12/04/2017 09:01 AM, Aki Tuomi wrote:

It seems you'd have to configure OpenLDAP backend for Samba to have LDAP.


No. As far as I know, samba in AD mode always does ldap. (AD *is* just 
that: microsoft-ized ldap)


And you should configure dovecot simply as a regular ldap client. That's 
what we do, anyway.


MJ

Re: Howto authenticate smartPhone via Active Directory

2017-12-04 Thread mj

Hi Mark,

Just to let you know that we are running dovecot with AD. (and I guess: 
*many* people are running that combination)

It worked without issues, we are using in dovecot-ldap.conf.ext:

> auth_bind = yes

this user/passwd filter:

= (&(objectclass=person)(sAMAccountName=%n)(!(userAccountControl=514)))

> dn = cn=search_dovecit,cn=users,dc=company,dc=com
> dnpass = top_secret

And not the 3268 port, but regular 389.

Hope that helps.

MJ

On 12/04/2017 01:38 AM, Mark Foley wrote:

Unfortunately, I tried for weeks to figure out passdb ldap without success. I 
guess I'm just
not knowledgeable enough about how to use ldap and Active Directory. The 
dovecot wiki
https://wiki2.dovecot.org/AuthDatabase/LDAPm doesn't help me much. All it says 
is:

Active Directory

When connecting to AD, you may need to use port 3268. Then again, not all LDAP 
fields are
available in port 3268. Use whatever works. 
http://technet.microsoft.com/en-us/library/cc978012.aspx

I have not been able to find an example of someone using Dovecot and ldap with 
AD.

However, I have had some success with CheckPassword
(https://wiki2.dovecot.org/AuthDatabase/CheckPassword).  Using a program I 
wrote to do
ntlm_auth, I am able to authenticate the smartPhone user and pass the required 
parameters back
to Dovecot.  My auth-checkpasswd.conf.ext is the as-shipped standard except 
pointing to my
checkpassword executable.

passdb {
  driver = checkpassword
args = /user/util/bin/checkpassword
}
userdb {
  driver = prefetch
}

The one issue I have with this at the moment is that dovecot runs checkpassword 
for every user,
smartphone or otherwise:

Dec 03 18:56:32 auth-worker(14903): Info: 
shadow(charmaine,192.168.0.52,): unknown user  - trying the 
next passdb
Dec 03 18:56:32 auth: Debug: 
checkpassword(charmaine,192.168.0.52,): execute: 
/user/util/bin/checkpassword /usr/local/libexec/dovecot/checkpassword-reply
Dec 03 18:56:32 auth: Debug: 
checkpassword(charmaine,192.168.0.52,): Received input:
Dec 03 18:56:32 auth: Debug: 
checkpassword(charmaine,192.168.0.52,): exit_status=1
Dec 03 18:56:32 auth: Debug: 
checkpassword(charmaine,192.168.0.52,): Credentials:
Dec 03 18:56:32 auth: Debug: client passdb out: OK  1   user=charmaine  
original_user=charmaine@HPRS.LOCAL
Dec 03 18:56:32 auth: Debug: master in: REQUEST 1884160001  14902   1   
586863e54c57c999ee5731906a59257csession_pid=14907 request_auth_token
Dec 03 18:56:32 auth-worker(14903): Debug: 
passwd(charmaine,192.168.0.52,): lookup
Dec 03 18:56:32 auth-worker(14903): Debug: 
passwd(charmaine,192.168.0.52,): username changed charmaine 
-> HPRS\charmaine
Dec 03 18:56:32 auth: Debug: master userdb out: USER1884160001  
HPRS\charmaine  system_groups_user=HPRS\charmaineuid=10003gid=1 
  home=/home/HPRS/charmaine   
auth_token=d8d39ec4cc71923806ca7f539427e8aac44e90f7 
auth_user=charmaine@HPRS.LOCAL
Dec 03 18:56:32 imap-login: Info: Login: user=, method=GSSAPI, 
rip=192.168.0.52, lip=192.168.0.2, mpid=14907, TLS, session=
Dec 03 18:56:50 auth: Debug: auth client connected (pid=14913)

Notice after the "shadow" auth fails it says, "unknown user - trying the next 
passdb", which is
checkpassword (which apparently succeeds), then it goes on to gssapi which also 
succeeds.  Is
there a way to only have it do checkpassword if all shadow and gssapi fail? My 
mechanisms are:

auth_mechanisms = plain login gssapi

THX, --Mark

--Mark

-Original Message-
Date: Sun, 03 Dec 2017 22:28:53 +0200
Subject: Re: Howto authenticate smartPhone via Active Directory
From: Aki Tuomi <aki.tu...@dovecot.fi>
To: Mark Foley <mfo...@ohprs.org>, dovecot@dovecot.org

with passdb ldap i guess.

---Aki Tuomi
Dovecot oy

 Original message 
From: Mark Foley <mfo...@ohprs.org>
Date: 03/12/2017  21:18  (GMT+02:00)
To: dovecot@dovecot.org
Subject: Re: Howto authenticate smartPhone via Active Directory

Yes, you are right. This link: 
https://www.redips.net/linux/android-email-postfix-auth/#section2
shows:

passdb pam {
}

used for authenticating Android.  Problem #1 is that Slackware does not ship 
with PAM and the
AD/DC Samba4 does not use it. It is used on Slackware for a domain member, but 
I'm not sure I
should try configuring PAM on the AD/DC.

Is there some otherway I can get authentication using domain credentials 
besides pam? the phone
can send user and password.

--Mark

-Original Message-

Date: Sun, 03 Dec 2017 15:22:56 +0200
Subject: Re: Howto authenticate smartPhone via Active Directory
From: Aki Tuomi <aki.tu...@dovecot.fi>
To: Mark Foley <mfo...@ohprs.org>, dovecot@dovecot.org

Actually you are authenticating gssapi clients from ad and everyone else from 
shadow. maybe you need to configure pam module?
---Aki TuomiDovecot oy

 Original message 
From: Mark Foley <mfo...@ohprs.org>
Date: 03/12/2017  06:03  (G

Re: My sub-folder with Outlook work-around to date

2017-10-06 Thread mj


Hi,

What we do, on the dovecot side, is:

mail_location = maildir:~/Maildir:LAYOUT=fs:DIRNAME=mAildir

See: https://wiki2.dovecot.org/MailLocation/Maildir

This has been working out very nicely for many years.

I'm not sure though that there is a way to 'move' to that config without 
having to basically migrate all your mailboxes.


MJ

On 10/06/2017 04:08 AM, David.M.Clark wrote:

Hi All, please be kind, this is my first e-mail to the list :-)

I actively support CentOS based e-mail servers running Dovecot, 
Sendmail, Spammassassin and 3 x SOGo based setups.


Dovecot is my goto IMAP server and have used it and modifications to it 
to net excellent results for years.


Then we have people who insist on only using Outlook (and in some 
instances the MS Live Messenger thingy).


Some shenanigans in recent years have arose with using sub-folders in 
the Outlook clients (2013 and 2016).


Traditionally, placing a "/" after the name of a newly desired e-mail 
folder has netted the result of something like:


"Rentals/"

creating:

/u/home/someuser/mail/Rentals/

Under which users then create actual e-mail folders under the "Rentals" 
Linux directory as such.


With Outlook 2013 and 2016 this seems to have stopped working and so I 
implemented a work-around where the user creates a normal folder, 
example "Rentals++", and I have written a cron script that trawls the 
$HOMEs each minute and if it finds a folder with a "++" at the end, it 
creates the folder as a directory, so:


/u/home/someuser/mail/Rentals++

becomes:

/u/home/someuser/mail/Rentals/

and adds this new subscription to their .subscription folder. It also 
sends an e-mail to the user advising that the new folder is created and 
they can proceed to use the "Rentals" folder for adding sub-folders (as 
in real text based mail folders).


The script was a quick work-around one weekend in a mad flurry to get 
things working and to date works but is not 'user-proof'. So I am now 
looking at developing an internal web interface to do the same thing and 
hoping with more controls, has no or far less margin for user error. 
Long times of Outlook folder refreshes don't help and users sometimes 
end up with issues that require my Linux command line help.


I have been trawling e-mail forums for some time now and have not seen 
any other work-arounds (or perhaps I am living under a rock) but before 
I embark on this web interface adventure, I just wanted to make sure I 
had not missed some fundamental 'bit' that I should be observing.


All servers are either CentOS 6.9 (or slightly less) and CentOS 7 with 
the latest updates and for things like Thunderbird and Roundcube and 
SOGo, work well. I need to experiment with the whole "/" for these but I 
am currently driven by the enforced Outlook chains.


Any input from you guys on whether this is my best approach or 'hey 
mate, just do this', would be much appreciated.


I am happy to share my travels script/web-wise if this is the only 
option to date.

librmb: Mail storage on RADOS with Dovecot

2017-09-22 Thread mj


Hi ceph-ers,

The email below was posted on the ceph mailinglist yesterday by Wido den 
Hollander. I guess this could be interesting for user here as well.


MJ

 Forwarded Message 
Subject: [ceph-users] librmb: Mail storage on RADOS with Dovecot
Date: Thu, 21 Sep 2017 10:40:03 +0200 (CEST)
From: Wido den Hollander <w...@42on.com>
To: ceph-us...@ceph.com

Hi,

A tracker issue has been out there for a while:
http://tracker.ceph.com/issues/12430

Storing e-mail in RADOS with Dovecot, the IMAP/POP3/LDA server with a 
huge marketshare.


It took a while, but last year Deutsche Telekom took on the heavy work 
and started a project to develop librmb: LibRadosMailBox


Together with Deutsche Telekom and Tallence GmbH (DE) this project came 
to life.


First, the Github link:
https://github.com/ceph-dovecot/dovecot-ceph-plugin

I am not going to repeat everything which is on Github, put a short summary:

- CephFS is used for storing Mailbox Indexes
- E-Mails are stored directly as RADOS objects
- It's a Dovecot plugin

We would like everybody to test librmb and report back issues on Github 
so that further development can be done.


It's not finalized yet, but all the help is welcome to make librmb the 
best solution for storing your e-mails on Ceph with Dovecot.


Danny Al-Gaaf has written a small blogpost about it and a presentation:

- https://dalgaaf.github.io/CephMeetUpBerlin20170918-librmb/
- http://blog.bisect.de/2017/09/ceph-meetup-berlin-followup-librmb.html

To get a idea of the scale: 4,7PB of RAW storage over 1.200 OSDs is the 
final goal (last slide in presentation). That will provide roughly 1,2PB 
of usable storage capacity for storing e-mail, a lot of e-mail.


To see this project finally go into the Open Source world excites me a 
lot :-)


A very, very big thanks to Deutsche Telekom for funding this awesome 
project!


A big thanks as well to Tallence as they did an awesome job in 
developing librmb in such a short time.


Wido

Re: Problem w/ Dovecot authentication against AD

2017-09-13 Thread mj


Hi,

Perhaps you need auth_bind = yes?

MJ

On 09/13/2017 01:34 PM, Garry Glendown wrote:

Hi,

I had to start using Dovecot on a machine as the new OS does not come
with Cyrus IMAP anymore. After multiple problems, I managed to get
everything working, including LDAP authentication against the (old)
Novell LDAP server.
Anyway, the authentication is supposed to be migrated to the new Windows
AD. For other tools, I successfully migrated the config to use AD, but
somehow Dovecot does not work as it should.

I've been going back and forth, trying everything I could think of, but
still can't get it to work.

Here's the excerpt from the config file:

hosts = 10.10.10.210
uris = ldap://10.10.10.210:389
dn = cn=Administrator,cn=Users,dc=srv,dc=SLD,dc=net
dnpass = PASSWORD
tls = no
debug_level = -1
auth_bind = yes
ldap_version = 3
base = DC=srv,dc=SLD,dc=net
deref = never
scope = subtree
user_attrs =  sAMAccountName=user
user_filter = (&(sAMAccountName=%n)(objectclass=person))
pass_attrs = sAMAccountName=user
pass_filter = (&(sAMAccountName=%n)(objectclass=person))
iterate_attrs = mail=user
iterate_filter = (objectclass=person)
default_pass_scheme = PLAIN

The problem might be caused by the referal-info sent by the AD, which I
can see both in the results dovecot gets (checked with tcpdump), as well
as in ldapsearch ... apart from the actual search result, I always get
three additional results:

#
refldap://DomainDnsZones.srv.SLD.net/DC=DomainDnsZones,DC=srv,DC=SLD,DC=net

#
refldap://ForestDnsZones.srv.SLD.net/DC=ForestDnsZones,DC=srv,DC=SLD,DC=net

# refldap://srv.SLD.net/CN=Configuration,DC=srv,DC=SLD,DC=net

 From what I can see in the pcap as well as some of the logs, dovecot
binds to the AD, sends out the LDAP query correctly, gets the lookup
result with the user queried plus the above three referrals, then
unbinds from the (named) bind, attempts a simple bind without dn/dnpass
(multiple times), and finally sends three additional search requests
under the search bases

cn=Configuration,DC=srv,DC=SLD,DC=net
DC=ForestDnsZones,DC=srv,DC=SLD,DC=net
DC=DomainDnsZones,DC=srv,DC=SLD,DC=net

These three requests are denied by the AD as they are not permitted
without a successful prior bind.
Dovecot then fails the auth process.

Is there a way to stop Dovecot from using the referals? Openldap seems
to have an option to disable referals, but Dovecot does not allow that
option in its LDAP config, and having the option set in the global
ldap.conf doesn't seem to help any, either. Is there possibly a way to
disable the referal information on the AD side?

Thanks, Garry

Re: Dovecot - Postfix Calender Synchronisation

2017-08-24 Thread mj


Hi,

I realise that this is in fact off-topic, but: like others, I'd also 
like to recommend SOGo.


Someone in this thread said: it has too many dependancies, but I 
disagree, and in fact I consider it a good thing that it depends on 
other components.


Consider SOGo like an exchange server. And they (inverse.ca) only 
implemented the missing bits, and for the rest they depend on stable and 
mature other components.


While that means dependancies, yes, it also means: do what you're good 
at and what's missing, and for the rest: reuse what is readily 
available. Don't reinvent the wheel.


Besides that: most places will have many of the requirements in place 
already.


MJ


On 08/24/2017 07:38 AM, Rupert Gallagher wrote:

We tried installing Radicale months ago, and decided to postpone testing. Its 
footprint exceeds 140MB, because of python. It requires python, which is a 
security hazard on production servers. Security mitigations are absent: must 
use a virtual machine.

Sent from ProtonMail Mobile

On Thu, Aug 24, 2017 at 12:11 AM, Marcus Rueckert <da...@opensu.se> wrote:


Lookup radicale. -- openSUSE - SUSE Linux is my linux openSUSE is good for you 
www.opensuse.org

Re: unexpected delivery location

2017-08-23 Thread mj


Hi,

On 08/23/2017 09:56 PM, Noel wrote:

Perhaps you can adjust your query or your database to return the
desired result.  Otherwise, use your scripting skills to generate a
file, then automate the procedure.


Thanks for the suggestion, I try something like that.

Still feel that some simple config to make one domain an alias to 
another domain would be very useful. :-)


MJ

Re: unexpected delivery location

2017-08-23 Thread mj


Hi Noël,

Thanks for your response!

On 08/23/2017 06:03 PM, Noel wrote:

Don't use wildcard aliases.  They break recipient validation and
cause postfix to accept all addresses.

Instead use 1-1 aliases, such as
user1@olddomaon  user1@newdomain
user2@olddomaon  user2@newdomain


But we have 500+ addresses in ldap, surely there must be some 
'automated' way to 'transform' any incoming mail sent to 
ran...@olddomain.com into ran...@newdomain.com?


(and then have it processed regularly, so that bounces still work for 
non-existant addresses and such)


MJ

Re: under another kind of attack

2017-07-29 Thread mj




On 07/29/2017 07:44 PM, Doug Barton wrote:

On 07/25/2017 07:54 AM, mj wrote:

Since we implemented country blocking,


Please don't do that. Balkanizing the Internet doesn't really benefit 
anyone, and makes innovation a lot more difficult.


Perhaps I need to be more specific:

I block certain countries from accessing imap/smtp directly, as that is 
where all the botnets seem to be trying their passwords.


I do not block entire countries from accessing us completely (the 
hammer) but rather block their access of imap and smtp for my 
mailserver. (this is what I like to see as a precision tool)


For the record I improved my iptables rules a lot compared to the mail 
you replied to. I am now using a chain, like this:



$IPTABLES -N filter_countries
$IPTABLES -A filter_countries -m geoip --src-cc CN,AG,MX,etc -j DROP
$IPTABLES -A filter_countries -m geoip --src-cc MD,SD,SS,etc -j DROP


and then:


$IPTABLES -I INPUT 1 -p tcp --dport 143 -j filter_countries
$IPTABLES -I INPUT 1 -p tcp --dport 993 -j filter_countries
$IPTABLES -I INPUT 1 -p tcp --dport 465 -j filter_countries


This makes it a lot more efficient, compared to the (many) rules I was 
using earlier.


MJ

Re: under another kind of attack

2017-07-29 Thread mj


Hi Doug,

On 07/29/2017 07:44 PM, Doug Barton wrote:
Instead, take a look at the fail2ban scenarios in this thread, which 
solve the actual problem with a precision tool, instead of a hammer.


I have implemented (most of) those as well, and additionally choose to 
also block certain countries. It helps tremendously.


MJ

Re: under another kind of attack

2017-07-25 Thread mj


Hi Olaf,

Since we implemented country blocking, everything seems nicely under 
control, with only 'normal levels' of knocking.


We first have impemented:
http://blog.jeshurun.ca/technology/block-countries-ubuntu-iptables-xtables-geoip

Then we did:
https://github.com/firehol/blocklist-ipsets

And finale iptables rules like these:


iptables -A INPUT -p tcp --dport 143 -m geoip --src-cc 
CN,AG,MX,NI,MF,VE,CO,AR,RU,UA -j DROP
iptables -A INPUT -p tcp --dport 143 -m geoip --src-cc 
MD,SD,SS,GA,CN,AZ,IN,ID,KZ,LA -j DROP
iptables -A INPUT -p tcp --dport 143 -m geoip --src-cc 
MY,MN,SG,VN,TH,TW,HK,KR,KP,HT -j DROP
iptables -A INPUT -p tcp --dport 143 -m geoip --src-cc CR,MZ -j DROP

iptables -A INPUT -p tcp --dport 993 -m geoip --src-cc 
CN,AG,MX,NI,MF,VE,CO,AR,RU,UA -j DROP
iptables -A INPUT -p tcp --dport 993 -m geoip --src-cc 
MD,SD,SS,GA,CN,AZ,IN,ID,KZ,LA -j DROP
iptables -A INPUT -p tcp --dport 993 -m geoip --src-cc 
MY,MN,SG,VN,TH,TW,HK,KR,KP,HT -j DROP
iptables -A INPUT -p tcp --dport 993 -m geoip --src-cc CR,MZ -j DROP

iptables -A INPUT -p tcp --dport 465 -m geoip --src-cc 
CN,AG,MX,NI,MF,VE,CO,AR,RU,UA -j DROP
iptables -A INPUT -p tcp --dport 465 -m geoip --src-cc 
MD,SD,SS,GA,CN,AZ,IN,ID,KZ,LA -j DROP
iptables -A INPUT -p tcp --dport 465 -m geoip --src-cc 
MY,MN,SG,VN,TH,TW,HK,KR,KP,HT -j DROP
iptables -A INPUT -p tcp --dport 465 -m geoip --src-cc CR,MZ -j DROP


I tried to combine the various dports in one single rule, but that 
didn't seem to work. Perhaps someone here knows how to combine --match 
"geoip" and "multiport" in one single rule?


Anyway: for us these combined measures did the tric.

Users in one of the imap-blocked countries will have to use ActiveSync 
(works over https), the webmail-interface, or launch the VPN first.


This works for us.

Only one thing on my wishlist: application specific passwords. I would 
very much appreciate a respond on that thread... (posted yesterday 
evening, with a pseudo-dovecot-config file...)


Hope the above helps you a bit, Olaf.

MJ

On 07/25/2017 04:37 PM, Olaf Hopp wrote:

Hi folks,

"somehow" similar to the thread "under some kind oof attack" started by 
"MJ":


I have dovecot shielded by fail2ban which works fine.
But since a few days I see many many IPs per day knocking on
my doors with wron password and/or users. But the rate at which they are 
knocking

is very very low. So fail2ban will never catch them.

For example one IP:

Jul 25 14:03:17 irams1 dovecot: auth-worker(2212): 
pam(eurodisc,101.231.247.210,): unknown user
Jul 25 15:16:36 irams1 dovecot: auth-worker(11047): 
pam(gergei,101.231.247.210,): pam_authenticate() 
failed: Authentication failure (password mismatch?)
Jul 25 16:08:51 irams1 dovecot: auth-worker(3379): 
pam(icpe,101.231.247.210,): unknown user
Jul 25 16:10:47 irams1 dovecot: auth-worker(4250): 
pam(endsulei,101.231.247.210,): unknown user


Note the timestamps.
If I look the other way round (tries to one account) I'll get

Jul 25 01:30:48 irams1 dovecot: auth-worker(11276): 
pam(endsulei,60.166.12.117,): unknown user
Jul 25 01:31:26 irams1 dovecot: auth-worker(11276): 
pam(endsulei,222.243.211.200,<s0+6nBhVabHe89PI>): unknown user
Jul 25 13:29:22 irams1 dovecot: auth-worker(4745): 
pam(endsulei,60.2.50.114,<4elhpCJVtcw8AjJy>): unknown user
Jul 25 13:30:27 irams1 dovecot: auth-worker(4747): 
pam(endsulei,222.84.118.83,): unknown user
Jul 25 16:10:47 irams1 dovecot: auth-worker(4250): 
pam(endsulei,101.231.247.210,): unknown user
Jul 25 16:11:45 irams1 dovecot: auth-worker(5933): 
pam(endsulei,206.214.0.120,): unknown user


Also note the timestamps!

And I see many many distinct IPs per day (a few hundred) trying many 
many existing and non-existings accounts.
As you see in the timestamps in my examples, this can not be handled by 
fail2ban without affecting

regular users with typos.
Is anybody observing something similar ?
Anybody an idea against this ?
Many of these observed IPs are chinese mobile IPs, if this matters. But 
we have also chinese students and

researchers all abroad.


Regards,
Olaf

Re: under some kind of attack

2017-07-21 Thread mj


Hi Joseph,

On 07/21/2017 10:17 PM, Joseph Tam wrote:

As per my post: checkpassword.  You can then use one password on Mondays,
Wednesdays, and Fridays, alternate passwords on Tuesdays and Thursday
fetched from a rot-13 database, and only from prime numbered IP addresses
on weekends, if that's what you want.


Having read the wiki page on checkpassword, I am unsure how this would 
work with an ldap backend.


Could you elaborate on that?

Best,
MJ

Re: application specific passwords


Hi Kirill,

Thanks for your reply. Such a simple flat file approach would be 
perfect, and I don't mind at all to require app specific usernames *and* 
passwords.


However, I am unsure how to combine your recipe below with our regular 
AD userdb/passdb.


Perhaps someone can give me some pointers in that direction?

MJ

On 07/20/2017 06:50 PM, Kirill Miazine wrote:

I'm not familiar with samba AD and with it's features and limitation.
For my simple system I'm using plain files for passdb and userdb (aka.
passwd-file). Application (or rather device) specific passwords are
implementing by using having an additional "username" with a specific
password for a particular application or device. E.g. some entries for
myself:

 bbmutt:*:10001:10001::/krot/mail/km::userdb_mail=maildir:~/Maildir 
userdb_quota_rule=*:bytes=10240M
 kmozilla:*:10001:10001::/krot/mail/km::userdb_mail=maildir:~/Maildir 
userdb_quota_rule=*:bytes=10240M
 sailpad:*:10001:10001::/krot/mail/km::userdb_mail=maildir:~/Maildir 
userdb_quota_rule=*:bytes=10240M
 workphone:*:10001:10001::/krot/mail/km::userdb_mail=maildir:~/Maildir 
userdb_quota_rule=*:bytes=10240M

The files are generated automatically from a Single Source of Truth.

In my case I'm selecting the username myself, but there's nothing
preventing you from generating a username/password combination for your
users.

Note that in my setup users will have application specific username and
password, not only application specific password. It was easier to
implement it quickly this way.

Greetz
Kirill

Re: application specific passwords


Hi,

Let me ask a more specific question.

What I would like to configure, is:

- for our internal users to use their regular AD usernam/passwords, just 
as everybody can currently do.


but, new:
- for external users, to ONLY be allowed to use an application specific 
password. (or username and password, fine as well)


Step one: making ldap password authentication valid only from our 
internal network. I though: using allow_nets=192.168.1.0/24 for that passdb


But I can't get that to work. :-( Unsure where exactly to define the 
allow_nets, tried many variations on the theme already.


Perhaps someone can help with the step one, and also tell me if the 
approach outlined above is smart, valid and do-able in dovecot.


Here are our sanitised configs:


root@mails:/etc/dovecot# doveconf -n
# 2.2.26.0 (23d1de6): /etc/dovecot/dovecot.conf
# Pigeonhole version 0.4.16 (fed8554)
# OS: Linux 3.16.0-4-amd64 x86_64 Debian 8.7 xfs
auth_debug = yes
auth_failure_delay = 2 secs
auth_master_user_separator = *
auth_mechanisms = plain login
auth_username_format = %Ln
auth_verbose = yes
auth_verbose_passwords = plain
debug_log_path = /var/log/dovecot/dovecot.debug
deliver_log_format = %f | %s | msgid=%m: %$
disable_plaintext_auth = no
info_log_path = /var/log/dovecot/dovecot.info
lda_mailbox_autocreate = yes
lda_mailbox_autosubscribe = yes
log_path = /var/log/dovecot/dovecot.err
login_greeting = Dovecot ready.
mail_gid = vmail
mail_location = maildir:/var/vmail/%Ln/Maildir:LAYOUT=fs:DIRNAME=mAildir
mail_plugins = acl lazy_expunge zlib quota mail_log notify
mail_uid = vmail
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope encoded-character 
vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy 
include variables body enotify environment mailbox date ihave
namespace {
  list = children
  location = 
maildir:/var/vmail/%%u/Maildir:LAYOUT=fs:DIRNAME=mAildir:INDEX=/var/vmail/%u/shared/%%u
  prefix = shared/%%n/
  separator = /
  subscriptions = no
  type = shared
}
namespace inbox {
  inbox = yes
  location = 
  mailbox "Deleted items" {

special_use = \Trash
  }
  mailbox Drafts {
special_use = \Drafts
  }
  mailbox Junk {
special_use = \Junk
  }
  mailbox Sent {
special_use = \Sent
  }
  mailbox "Sent items" {
special_use = \Sent
  }
  mailbox Trash {
special_use = \Trash
  }
  mailbox inbox {
auto = subscribe
  }
  prefix = 
  separator = /

  type = private
}
passdb {
  args = /etc/dovecot/master-users
  driver = passwd-file
  master = yes
}
passdb {
  args = /etc/dovecot/dovecot-ldap.conf.ext
  driver = ldap
  skip = authenticated
}
plugin {
  acl = vfile
  acl_shared_dict = file:/var/lib/dovecot/db/shared-mailboxes.db
  mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename 
append
  mail_log_fields = uid box msgid from subject
  quota = maildir
  quota_rule = ?:storage=5G
  quota_rule2 = Trash:storage=+100M
  quota_warning = storage=97%% quota-warning 97 %u
  quota_warning2 = storage=95%% quota-warning 95 %u
  quota_warning3 = storage=90%% quota-warning 90 %u
  quota_warning4 = storage=85%% quota-warning 85 %u
  quota_warning5 = storage=80%% quota-warning 80 %u
  quota_warning6 = -storage=100%% quota-warning below %u
  sieve = ~/.dovecot.sieve
  sieve_default = /var/lib/dovecot/default.sieve
  sieve_dir = ~/sieve
}
protocols = imap lmtp sieve
service auth {
  unix_listener /var/spool/postfix/private/auth {
mode = 0666
  }
  unix_listener auth-userdb {
group = vmail
mode = 0666
user = vmail
  }
}
service imap-login {
  process_limit = 500
  process_min_avail = 2
}
service quota-warning {
  executable = script /usr/local/bin/quota-warning.sh
  unix_listener quota-warning {
user = vmail
  }
  user = dovecot
}
ssl_ca = 

and our dovecot-ldap.conf.ext:


hosts = ldap1 ldap2 ldap3
dn = cn=search,cn=
dnpass = secretashell
tls = no
debug_level = 0
auth_bind = yes
base = CN=Users, DC=.
scope = subtree
user_attrs = 
=home=/var/vmail/%n/Maildir:LAYOUT=fs:DIRNAME=mAildir:INDEX=/var/vmail/%n/shared/%n,=mail=maildir:/var/vmail/%n/Maildir:LAYOUT=fs:DIRNAME=mAildir:INDEX=/var/vmail/%n/shared/%n,allow_nets=192.168.1.0/24
user_filter = 
(&(objectclass=person)(sAMAccountName=%n)(!(userAccountControl=514)))
pass_filter = 
(&(objectclass=person)(sAMAccountName=%n)(!(userAccountControl=514)))
iterate_attrs = sAMAccountName=user
iterate_filter = (objectClass=person)


MJ

Re: under some kind of attack



On 07/20/2017 08:47 PM, Robert Schetterer wrote:

Ok I understand, not a bad idea, report how it works for you


That "report how it works for you" was exactly why I posted the fail2ban 
failregex back to the list. :-) So others can use it too.


It works fantastic, and I ombined it now with blocking complete 
countries at the firewall-level.


Users have their regular three login tries, and get a password dialogue 
if they changed their password.


(which many did, in the light of this attack)

And the last botnet attempts remaining, using "password" etc are blocked 
instantly.


Works nicely. :-)

Now I want to implement application specific passwords, I will post 
about that in a seperate message. As you have been such a great help, 
perhaps you can also help a little bit in that thread...?


Thanks again,
MJ

Re: under some kind of attack


Hi Robert,


i dont understand why you focused on that ldap strings
fail2ban should trigger on some "Authentication failure" regex in the
related syslog

perhaps this will help to make it more clear

http://www.stefan-seelmann.de/wiki/fail2ban#postfix-and-dovecot


Yes, but I have that as well. :-)

I wanted two kinds of blockings:

#1: Everybody trying the well-known passwords (password, 123321, 1q2w3e, 
etc, etc) to become blocked *immediately* and for *always*.


#2: I wanted all others have to have the 'regular' settings, with three 
shots at typing a password, etc.


#2 being the 'regular fail2ban' settings, but during this attack, I 
wanted special settings, #1, for anyone trying one of the malicious 
passwords.


I did NOT want to have them the usual three opportunities to try.

In fact: this is a bit similar to your iptables solution, but that only 
works for non-ssl/non-tls connections.


Your iptables solution makes sure that thy cannot authenticate *at all*, 
while the above solution makes sure they can only authnticate *once*.


MJ

application specific passwords


Hi,

Further to the other thread about password guessing activities against 
our dovecot, I would like to implement application specific passwords on 
our dovecot.


Googling results in some documents, but they are all a bit older:


https://www.happyassassin.net/2014/08/26/adding-application-specific-passwords-to-dovecot-when-using-system-user-accounts/



https://www.dgsiegel.net/news/2013_05_21-application_specific_passwords_for_dovecot



http://www.justinbuchanan.com/blog/category/RoundCube



http://www.justinbuchanan.com/blog/post/2012/12/02/Application-Specific-Passwords-for-Dovecot-and-Postfix


Those articles are interesting, but also rather old. (I realse that this 
does not neccesarily mean: irrelevant or bad)


Is there anone here with some additional notes, ideas, tips, trics on 
setting up application specific passwords with dovecot with virtual 
users? We are using samba AD as an authentication backend.


MJ

Re: under some kind of attack

I have concoted something that seems to work. And for the archives, this 
is it:



failregex = auth: Info: ldap\(.+,,.+\): invalid credentials \(given 
password: .+ssword\)
auth: Info: ldap\(.+,,.+\): invalid credentials \(given 
password: 1qaz2wsx\)
auth: Info: ldap\(.+,,.+\): invalid credentials \(given 
password: 123321\)
auth: Info: ldap\(.+,,.+\): invalid credentials \(given 
password: 1234567890\)
auth: Info: ldap\(.+,,.+\): invalid credentials \(given 
password: 1q2w3e4r.+\)


It's still reactive, and not pro-active.

All the other suggestions are very much appreciated, including 
weakforced, however implementing that is a much larger project.


Next I have to find out how to feed my fail2ban logs back to 
blocklist.de, to improve their mail.txt hit rate.


Thanks again for all kind assistance.

MJ

On 07/20/2017 11:16 AM, mj wrote:

Hi all,

If I may, one more question on this subject:

I would like to  create a fail2ban filer, that scans for these lines:

Jul 20 11:10:09 auth: Info: 
ldap(user1,60.166.35.162,): invalid credentials 
(given password: password)
Jul 20 11:10:19 auth: Info: ldap(user2,61.53.66.4,<V+nyHbxU+wA9NUIE>): 
invalid credentials (given password: password)


(as you can see, I have enabled auth_verbose_passwords to do this, 
making me very uncomfortable...)


Anyway: since there are only a few password variations, I would like to 
block anyone using those passwords.


(since the connections are over TLS/SSL, I cannot use iptables, as 
suggested earlier)


So I need a specific fail2ban rule that extracts the  from that 
line, and matches on "(given password: password)"


Can anyone here help out with a failregex line that would match..?

Re: under some kind of attack