[Dovecot] Dovecot security

Hi, THIS IS URGENT I have Debian Linux machine which I installed as a mail server with postfix, and dovecot. my mail server is setup to use SMTP relay. I currently have ports 143, 995, 25 SSMTP ports open. in the last few days I have been under attack where email is being sent to fake email

Re: [Dovecot] Dovecot security

* Jay Khashan jkhas...@msn.com: Hi, THIS IS URGENT I have Debian Linux machine which I installed as a mail server with postfix, and dovecot. my mail server is setup to use SMTP relay. I currently have ports 143, 995, 25 SSMTP ports open. in the last few days I have been under attack

[Dovecot] Patch to log the cipher suite used for TLS

Hello, the attached patch for Dovecot 2.2.4 improves the logging to include information about the cipher suite used for a TLS connection. Here is an example log line: Aug 13 21:49:55 colwyn dovecot: imap-login: Login: user=tron, method=CRAM-MD5, rip=2001:8b0:114:1::2,

Re: [Dovecot] Dovecot security

On Wed, Aug 14, 2013 at 06:12:02AM +, Jay Khashan wrote: Hi, THIS IS URGENT I have Debian Linux machine which I installed as a mail server with postfix, and dovecot. my mail server is setup to use SMTP relay. I currently have ports 143, 995, 25 SSMTP ports open. in the last few

Re: [Dovecot] Patch to log the cipher suite used for TLS

Dear Matthias, Am 14-08-2013 08:48, schrieb Matthias Scheler: Hello, the attached patch for Dovecot 2.2.4 improves the logging to include information about the cipher suite used for a TLS connection. Here is an example log line: Aug 13 21:49:55 colwyn dovecot: imap-login: Login: user=tron,

[Dovecot] SA54438

http://secunia.com/advisories/54438/ Since I already got 3 private mails about this, here's the same reply for everyone (actually updated, now that I looked at the code): This was a v2.2-only bug. And it isn't really a DoS.. It only caused the one pop3 process to crash in assert, which was

Re: [Dovecot] Dovecot security

On Wed, 14 Aug 2013 10:17:12 +0100 Darac Marjal articulated: On Wed, Aug 14, 2013 at 06:12:02AM +, Jay Khashan wrote: Hi, THIS IS URGENT I have Debian Linux machine which I installed as a mail server with postfix, and dovecot. my mail server is setup to use SMTP relay. I

Re: [Dovecot] SA54438

Hi Timo, Thanks for the info, the version of dovecot installed is root@gwvmdmzmail01:~# dovecot --version 1.2.15 root@gwvmdmzmail01:~# Whats the safest way, without loosing data or breaking the mail system is recommended to upgrade dovecot to version 2.2.5? many thanks ~Jay From:

[Dovecot] Dovecot mailbox in read-only mode, Permanentflags empty

Hi, I have installed Postfix + Dovecot 2.2.5 on a Fresh Arch Linux server (using Arch Linux repository packages). When accessing mailbox through Dovecot IMAP, all user mailboxes are in READ-ONLY mode. Here is a snippet from IMAP telnet conversation (after successful login). a LIST * *

Re: [Dovecot] SA54438

On 2013-08-14 6:48 AM, Jay Khashan jkhas...@msn.com wrote: Whats the safest way, without loosing data or breaking the mail system is recommended to upgrade dovecot to version 2.2.5? Follow the documented instructions? http://wiki2.dovecot.org/Upgrading -- Best regards, */Charles/*

Re: [Dovecot] Dovecot mailbox in read-only mode, Permanentflags empty

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Wed, 14 Aug 2013, Tommi A wrote: When accessing mailbox through Dovecot IMAP, all user mailboxes are in READ-ONLY mode. Here is a snippet from IMAP telnet conversation (after successful login). a EXAMINE INBOX * FLAGS (\Answered \Flagged

Re: [Dovecot] Dovecot mailbox in read-only mode, Permanentflags empty

What are the log entries for the telnet login? # 2.2.5: /etc/dovecot/dovecot.conf # OS: Linux 3.10.5-1-ARCH x86_64 [...] mail_debug = yes good, then plenty of info should be in the logs, about home directory, uids etc.pp. Logfiles entries: # dovecot.log Aug 14 15:32:11 imap-login: Info:

Re: [Dovecot] Dovecot mailbox in read-only mode, Permanentflags empty

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Wed, 14 Aug 2013, Tommi A wrote: a LIST * * LIST (\HasNoChildren) . INBOX a OK List completed. a EXAMINE INBOX try with: a SELECT INBOX - -- Steffen Kaiser -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.11 (GNU/Linux)

[Dovecot] proxy: get rid of redundant log-informations

Hi login_log_format_elements = user=%u method=%m rip=%r %k is it possible to get rid of the proxy(t...@testserver.rhsoft.net): started proxying to 127.0.0.1:143: part because on a proxy-only server i know that and it is explicitly not listed in login_log_format_elements as well as for the

Re: [Dovecot] proxy: get rid of redundant log-informations

Am 14.08.2013 16:37, schrieb Reindl Harald: Hi login_log_format_elements = user=%u method=%m rip=%r %k is it possible to get rid of the proxy(t...@testserver.rhsoft.net): started proxying to 127.0.0.1:143: part because on a proxy-only server i know that and it is explicitly not listed

[Dovecot] force ciphers order for clients

Hi Timo, reading this http://www.kuketz-blog.de/perfect-forward-secrecy-mit-apple-mail/ it looks like DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA can be forced in use with apple mail ( if no ECDHE is possible ,by missing openssl 1.x etc, seems that apple mail tries ECDHE first if fails its going to

Re: [Dovecot] force ciphers order for clients

Am 14.08.2013 18:54, schrieb Robert Schetterer: http://www.kuketz-blog.de/perfect-forward-secrecy-mit-apple-mail/ it looks like DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA can be forced in use with apple mail ( if no ECDHE is possible ,by missing openssl 1.x etc, seems that apple mail tries

Re: [Dovecot] Patch to log the cipher suite used for TLS

On Wed, Aug 14, 2013 at 11:49:50AM +0200, Aleksandar Lazic wrote: the attached patch for Dovecot 2.2.4 improves the logging to include information about the cipher suite used for a TLS connection. Here is an example log line: Aug 13 21:49:55 colwyn dovecot: imap-login: Login: user=tron,

Re: [Dovecot] force ciphers order for clients

Am 14.08.2013 19:03, schrieb Reindl Harald: Am 14.08.2013 18:54, schrieb Robert Schetterer: http://www.kuketz-blog.de/perfect-forward-secrecy-mit-apple-mail/ it looks like DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA can be forced in use with apple mail ( if no ECDHE is possible ,by missing

Re: [Dovecot] force ciphers order for clients

Am 14.08.2013 20:42, schrieb Robert Schetterer: Am 14.08.2013 19:03, schrieb Reindl Harald: ssl_cipher_list = EECDH+AES:EDH+AES:-SHA1:EECDH+RC4:EDH+RC4:RC4-SHA:EECDH+AES256:EDH+AES256:AES256-SHA:HIGH:!aNULL:!eNULL:!EXP:!MD5:!LOW:!SSLv2 is what is *higly* recommended after testing webservers

Re: [Dovecot] force ciphers order for clients

Am 14.08.2013 20:54, schrieb Reindl Harald: Am 14.08.2013 20:42, schrieb Robert Schetterer: Am 14.08.2013 19:03, schrieb Reindl Harald: ssl_cipher_list = EECDH+AES:EDH+AES:-SHA1:EECDH+RC4:EDH+RC4:RC4-SHA:EECDH+AES256:EDH+AES256:AES256-SHA:HIGH:!aNULL:!eNULL:!EXP:!MD5:!LOW:!SSLv2 is what is

Re: [Dovecot] force ciphers order for clients

Am 14.08.2013 21:19, schrieb Robert Schetterer: thx Harald, upgrading openssl to 1.x and using dove 2.2.5 is no option at my setup lucid ubuntu yeter so you can practically forget it perhaps true forever, as long old clients are around, cause the server can only workaround them not

Re: [Dovecot] force ciphers order for clients

Am 14.08.2013 21:30, schrieb Reindl Harald: Am 14.08.2013 21:19, schrieb Robert Schetterer: thx Harald, upgrading openssl to 1.x and using dove 2.2.5 is no option at my setup lucid ubuntu yeter so you can practically forget it perhaps true forever, as long old clients are around, cause

[Dovecot] weird situation with pop3/imap proxy and postfix authentication

Hello dovecot mailing list, I have a server running postfix and dovecot. I havea configuration on dovecot that allows me to provide imap4/pop3 messages for local hosted users as well as for proxied users on other servers. Basically, i have a simple MySQL table (imapproxy) with two

Re: [Dovecot] force ciphers order for clients

third try - a limit of 40 KB is ridiculous given the base64 overhead for e-mail and i hardly can cut more of the screenshot before it renders unusable at all... Am 14.08.2013 22:04, schrieb Robert Schetterer: Am 14.08.2013 21:30, schrieb Reindl Harald: Am 14.08.2013 21:19, schrieb Robert

Re: [Dovecot] proxy: get rid of redundant log-informations

Am 14.08.2013 17:12, schrieb Reindl Harald: is it possible to get rid of the proxy(t...@testserver.rhsoft.net): started proxying to 127.0.0.1:143: part because on a proxy-only server i know that and it is explicitly not listed in login_log_format_elements got it

Re: [Dovecot] force ciphers order for clients

I would like to contribute this suggestion (assuming nobody has already) : ssl_cipher_list = TLSv1+HIGH:!SSLv2:!aNULL:!eNULL:!3DES:!PSK:@STRENGTH I have not tested it incredibly thoroughly, but I do believe the @STRENGTH at the end is the little secret that puts the order into the chaos.

Re: [Dovecot] force ciphers order for clients

Am 14.08.2013 22:04, schrieb Robert Schetterer: Am 14.08.2013 21:30, schrieb Reindl Harald: Am 14.08.2013 21:19, schrieb Robert Schetterer: thx Harald, upgrading openssl to 1.x and using dove 2.2.5 is no option at my setup lucid ubuntu yeter so you can practically forget it perhaps true

[Dovecot] dovecot is working, sort of

I have dovecot setup and authenticating away for local users, but when I try to add MySQL users from postfix admin, not only does that fail, but all authentication fails. This configuration does not work: doveconf -n # 2.2.5: /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 9.1-RELEASE i386