argon2id best practices, generating and database storage

2023-07-11 Thread David Mehler
Hello, To users of argon2id as a password hash, what are best practices/what do you use to generate the argon2id password hashes? I want to know if I should do more than: doveadm pw -s ARGON2ID Also, for storing an argon2id password hash in a database (mysql/mariadb in this example) what

Re: Motion for OCSP Support in Dovecot

2023-07-11 Thread Shawn Heisey
On 7/10/23 21:47, Sean Gallagher wrote: While I am always for security improvements, the utility of this unclear. I will ABSTAIN from this poll. Presently, any system administrator who intends to issue must-staple certificates, faces the dilemma to either chose to a) Refrain from issuing

Re: Proper way to enable statistics on Dovecot 2.3.20?

2023-07-11 Thread rixati6186--- via dovecot
And if possible, how to disable statistics completely and safely? Without the "0" trick, that leads getting; "Jul 12 02:20:55 mail dovecot: auth: Error: net_connect_unix(/var/dovecot/stats-writer) failed: No such file or directory Jul 12 02:20:55 mail dovecot: auth: Error: stats:

Proper way to enable statistics on Dovecot 2.3.20?

2023-07-11 Thread rixati6186--- via dovecot
Hi. I'm using Dovecot on OpenBSD OS. "dovecot --version" reports: 2.3.20 (80a5ac675d) and this is my configuration file: https://termbin.com/m4to How to properly set the statistics for the version I use? I have both "service stats" and "service old-stats" and it seems I'm not really getting

SOLVED Re: mail-crypt key sharing

2023-07-11 Thread Robert Senger
Okay, after digging into the source code of mail-crypt-plugin.c and doveadm-mail-crypt.c, it was clear that doveadm should do the trick. But it didn't... Further digging into doveadm-mail-crypt.c lead me to mail-crypt-acl- plugin.c which revealed that there must be an additional plugin called

Re: Shared folders?

2023-07-11 Thread joe a
On 7/10/2023 11:18 AM, Anthony Carrico wrote: On 7/9/23 13:19, joe a wrote: My attempts thus far seem without results. What should I expect to see, if anything, in each account for a successful "share"?  Sadly, I see no apparent change in the displayed folder structure using Thunderbird

Re: mail-crypt key sharing, current error log

2023-07-11 Thread Robert Senger
This is the error I get in the dovecot logs when a user tries to access a shared mailbox encrypted with another user's folder key: Jul 11 18:45:27 prokyon dovecot: imap(us...@mydomain.net)<5015>: Error: Mailbox Shared/us...@mydomain.net/INBOX: UID=2306: read() failed:

mail-crypt key sharing

2023-07-11 Thread Robert Senger
Hi all, I am trying to setup mailbox sharing (not public mailboxes) together with mail-crypt plugin and encrypted folder keys. According to the source code of the mail-crypt plugin (there's code trying to retrieve private keys for shared mailboxes), and its documentation, this should be

Re: Public mailboxes and mailcrypt

2023-07-11 Thread Robert Senger
Am Montag, dem 10.07.2023 um 07:52 +0300 schrieb Aki Tuomi via dovecot: > > > > Technically you could return a keypair for the public user from > userdb, when the public user is being looked up. > mail_crypt_global_public/private_key takes precedence over generated > keys. > > Aki Thanks.

Re: Motion for OCSP Support in Dovecot

2023-07-11 Thread help--- via dovecot
Sean Gallagher wrote: > On 11/07/2023 5:33 pm, novoMedia via dovecot wrote: > > I am not exactly sure what hosts have to do with this. The must-staple > > extension is a (cryptographically ensured) flag that is 'ingrained' > > into a certificate. It tells a client to only accept the certificate

Re: Motion for OCSP Support in Dovecot

2023-07-11 Thread Sean Gallagher
On 11/07/2023 6:18 pm, Sean Gallagher wrote: No confrontation here. I support you with your quest. It's just not something I think I would ever use or need - so I didn't vote for it. I also didn't vote against it - it would be nice to have,. I should clarify. When I say "vote" I mean

Re: Motion for OCSP Support in Dovecot

2023-07-11 Thread Sean Gallagher
On 11/07/2023 5:33 pm, novoMedia via dovecot wrote: I am not exactly sure what hosts have to do with this. The must-staple extension is a (cryptographically ensured) flag that is 'ingrained' into a certificate. It tells a client to only accept the certificate if a valid and recent OCSP

Re: Motion for OCSP Support in Dovecot

2023-07-11 Thread novoMedia via dovecot
Hello Sean, Thank you for your fast reply. > or c) use must-staple on a host-by-host basis I am not exactly sure what hosts have to do with this. The must-staple extension is a (cryptographically ensured) flag that is 'ingrained' into a certificate. It tells a client to only accept the