Re: Can dovecot be leveraged to exploit Solr/Log4shell?

2021-12-15 Thread John Fawcett
On 15/12/2021 08:52, Aki Tuomi wrote: The suggested configuration is good, and although we did some checking to ensure that dovecot escapes the search queries and usernames sent to solr, so it is not trivial to send the JNDI expansion strings to be logged by solr, it is still good idea to set

Re: Can dovecot be leveraged to exploit Solr/Log4shell?

2021-12-15 Thread Jochen Bern
On 15.12.21 08:45, Alessio Cecchi wrote: SOLR_OPTS="$SOLR_OPTS -Dlog4j2.formatMsgNoLookups=true" and should be enough to prevent this vulnerability. Possibly not anymore, see CVE-2021-45046 ("re-opened" CVE-2021-44228 for v2 prior to 2.16.0) and CVE-2021-4104 (variant for v1, in the meantime -

Re: quota warnings not sent out anymore

2021-12-15 Thread mj
Hi Christian, Thanks for replying! It seems that your comments (or perhaps some of my recent config tinkering) helped, because once I tried just now to make it go from 89% to 91%, and I did receive the quota warning! Thanks! MJ Op 15-12-2021 om 15:23 schreef Christian Mack: Hello Just to

Re: quota warnings not sent out anymore

2021-12-15 Thread Christian Mack
Hello Just to clarify. You only will getting an over quota once, you step over one or multiple of those quota warning limits while storing an email. Therefore you will not get any warning, just because you are over that 85% limit. If you receive another email in that account, and go at least over

Re: quota warnings not sent out anymore

2021-12-15 Thread mj
Hi, I am still struggling with this, and would appreciate any help ayone can give. Let me try to explain step for step. I created a test account t...@company.com: root@dovecot:/# doveadm quota get -u test Quota name TypeValue Limit