Package: dovecot-imapd
Version: 1:2.2.13-12~deb8u1
Severity: normal
Tags: upstream
See my Dovecot configuration below. This is the "corrected" version in which I
get the behaviour I want
Dovecot listens on port 993 only, not 143.
Previously, I did not have the "inet_listener imaps" block, relying on ssl =
required to force the use
of 993 (this is the configuration generated by doveconf on reading my old
configuration from before the
upgrade to jessie, where I had protocols = imaps).
The config without the "inet_listener imaps" block behaves in /almost/ the
desired manner, but leaves TCP
port 143 in a strange state: attempts to bind a socket to it are rejected with
"address already in use", but
it does not appear in the output of netstat or ss. It also does not actually
seem to accept connections.
This is a problem because the port being in this state can trigger some
intrusion detection tools. For example
tcp-unhide, as used as part of rkhunter, will regard this as a "hidden TCP
port".
-- Package-specific info:
dovecot configuration
---------------------
# 2.2.13: /etc/dovecot/dovecot.conf
# OS: Linux 3.16.0-4-amd64 x86_64 Debian 8.2
log_timestamp = "%Y-%m-%d %H:%M:%S "
login_greeting = Welcome to my mailserver. Dovecot awaits your command.
mail_location = maildir:~/Maildir
mail_privileged_group = mail
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope encoded-character
vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy
include variables body enotify environment mailbox date ihave
passdb {
driver = pam
}
plugin {
sieve = ~/sieve/main.sieve
sieve_dir = ~/sieve/
sieve_extensions = +editheader
}
protocols = sieve imap
recipient_delimiter = -
service auth {
user = root
}
service imap-login {
inet_listener imap {
port = 0
}
inet_listener imaps {
port = 993
}
process_min_avail = 3
service_count = 0
}
service managesieve-login {
process_min_avail = 3
service_count = 0
}
service pop3-login {
process_min_avail = 3
service_count = 0
}
ssl = required
ssl_cert = </etc/dovecot/imap.cert
ssl_key = </etc/dovecot/imap.key
userdb {
driver = passwd
}
protocol imap {
mail_max_userip_connections = 25
}
protocol pop3 {
pop3_uidl_format = %08Xu%08Xv
}
protocol lda {
mail_plugins = sieve
postmaster_address = postmaster@mydomain
}
-- System Information:
Debian Release: 8.2
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 3.16.0-4-amd64 (SMP w/1 CPU core)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=C (charmap=UTF-8) (ignored: LC_ALL set to
en_GB.UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
Versions of packages dovecot-imapd depends on:
ii dovecot-core 1:2.2.13-12~deb8u1
ii libbz2-1.0 1.0.6-7+b3
ii libc6 2.19-18+deb8u1
ii liblzma5 5.1.1alpha+20120614-2+b3
ii ucf 3.0030
ii zlib1g 1:1.2.8.dfsg-2+b1
dovecot-imapd recommends no packages.
dovecot-imapd suggests no packages.
Versions of packages dovecot-imapd is related to:
ii dovecot-core [dovecot-common] 1:2.2.13-12~deb8u1
pn dovecot-dbg <none>
pn dovecot-dev <none>
ii dovecot-gssapi 1:2.2.13-12~deb8u1
ii dovecot-imapd 1:2.2.13-12~deb8u1
ii dovecot-ldap 1:2.2.13-12~deb8u1
pn dovecot-lmtpd <none>
ii dovecot-managesieved 1:2.2.13-12~deb8u1
ii dovecot-mysql 1:2.2.13-12~deb8u1
ii dovecot-pgsql 1:2.2.13-12~deb8u1
pn dovecot-pop3d <none>
ii dovecot-sieve 1:2.2.13-12~deb8u1
ii dovecot-sqlite 1:2.2.13-12~deb8u1
-- no debconf information
