authenticate plain, and virtual users

2014-10-21 Thread Eric Abrahamsen
I'm running dovecot 2.2.14 on Archlinux. I've been using it with the isync syncing utility for quite some time with no problems, using the LOGIN authentication mechanism. Recently Isync was updated to support PLAIN, and I'm having trouble moving to that. The authenticate string that isync is sendin

Re: dictionary attack defense

2014-10-21 Thread Cliff Hayes
a) I read about auth_failure_delay even before I posted my question and I could not figure out the one-line explanation in the dovecot wiki: "Number of seconds to delay before replying to failed authentications." It's delaying a reply. Does that mean the hacker can keep asking as fast as he w

Re: dictionary attack defense

2014-10-21 Thread Reindl Harald
Am 22.10.2014 um 01:12 schrieb Benny Pedersen: On October 22, 2014 12:57:34 AM Anders Wegge Keller wrote: On Tue, 21 Oct 2014 16:28:46 -0500 Cliff Hayes wrote: > Does dovecot have any dictionary attack defenses yet? In my opinion, fail2ban is the right strategy to deal with a dictionary at

Re: dictionary attack defense

2014-10-21 Thread Anders Wegge Keller
On Wed, 22 Oct 2014 01:12:02 +0200 Benny Pedersen wrote: > On October 22, 2014 12:57:34 AM Anders Wegge Keller wrote: > > > On Tue, 21 Oct 2014 16:28:46 -0500 > > Cliff Hayes wrote: > > > Does dovecot have any dictionary attack defenses yet? > > In my opinion, fail2ban is the right strategy

Re: dictionary attack defense

2014-10-21 Thread Benny Pedersen
On October 22, 2014 12:57:34 AM Anders Wegge Keller wrote: On Tue, 21 Oct 2014 16:28:46 -0500 Cliff Hayes wrote: > Does dovecot have any dictionary attack defenses yet? In my opinion, fail2ban is the right strategy to deal with a dictionary attack. Fokus should just be reversed to allow ip

Re: dictionary attack defense

2014-10-21 Thread Anders Wegge Keller
On Tue, 21 Oct 2014 16:28:46 -0500 Cliff Hayes wrote: > Does dovecot have any dictionary attack defenses yet? > In the past I have had to implement defense from outside dovecot, but > since dovecot is at the front lines and therefore is the first to know > I'm hoping by now there is something w

Re: dictionary attack defense

2014-10-21 Thread Reindl Harald
Am 21.10.2014 um 23:28 schrieb Cliff Hayes: Does dovecot have any dictionary attack defenses yet? In the past I have had to implement defense from outside dovecot, but since dovecot is at the front lines and therefore is the first to know I'm hoping by now there is something we can set. For ex

dictionary attack defense

2014-10-21 Thread Cliff Hayes
Does dovecot have any dictionary attack defenses yet? In the past I have had to implement defense from outside dovecot, but since dovecot is at the front lines and therefore is the first to know I'm hoping by now there is something we can set. For example, a limit on access failures per minut/

Re: Properly "locking" a useraccount (on a proxy)

2014-10-21 Thread Benny Pedersen
for the "locked" user. But I'm lazy and would prefer a single place / a single query to lock the account Setup postfix to check the recipient account is active, then set a temp new password while move mail to the new server, when its done change password back to user, and setup postfix to kn

Re: What is the correct way to configure the mail_location option for Mailidr format?

2014-10-21 Thread Benny Pedersen
On October 21, 2014 7:04:38 PM deoren wrote: On 10/21/2014 11:44 AM, Benny Pedersen wrote: > On October 21, 2014 6:18:07 PM deoren > wrote: > >> mail_location = maildir:/var/vmail/%d/%n/Maildir >> sieve_dir = /var/vmail/sieve/%d/%n/sieve_dir > > mail_location = maildir:/var/vmail/%d

Re: Permissions for shared mail don't work

2014-10-21 Thread Damien Desfontaines
On Sun, Oct 19, 2014 at 10:52:59AM +0200, Steffen wrote: > >> how do you deliver new messages to spam's INBOX? > > > > By sending an e-mail to spam.whate...@desfontain.es ? > > > > (I'm not sure I understand the question?) > > > > How does your MTA deliver the messages to the INBOX, do you use

Re: Properly "locking" a useraccount (on a proxy)

2014-10-21 Thread Robert Schetterer
Am 21.10.2014 um 20:37 schrieb Ralf Hildebrandt: > * Ralf Hildebrandt : > >> 2) defer LMTP delivery somehow (Postfix is talking to dovecot's LMTP server) > > I could of course put a mysql: query into postfix which would return > > user@domain retry: > > for the "locked" user. But I'm lazy and

Multiple user attributes in LDAP userdb query strings

2014-10-21 Thread BINOTTO Luis SIDOR
Hello list, I have an issue with dovecot and Ldap... Any help will be grateful... I have my virtual users stored in an Active Directory database. I am using 2 attributes in AD to locate the user account: mail (their primary email address) and proxyAddresses (a multivalue attribute containing t

2.2.14 and "Panic: file virtual-sync.c"

2014-10-21 Thread Michael Köhler
Hi, after upgrading to 2.2.14 (debian wheezy with apt source from rename-it.nl) I´ve got from time to time a panic in virtual plugin. Here are an excerpt from the log file: -- Oct 21 20:44:15 mailserver dovecot: imap(michael@DOMAIN): flag_change: box=Virtual.Ung

Re: Properly "locking" a useraccount (on a proxy)

2014-10-21 Thread Urban Loesch
Hi, Am 21.10.2014 20:37, schrieb Ralf Hildebrandt: * Ralf Hildebrandt : 2) defer LMTP delivery somehow (Postfix is talking to dovecot's LMTP server) I could of course put a mysql: query into postfix which would return user@domain retry: for the "locked" user. But I'm lazy and would prefer

Re: Properly "locking" a useraccount (on a proxy)

2014-10-21 Thread Ralf Hildebrandt
* Ralf Hildebrandt : > 2) defer LMTP delivery somehow (Postfix is talking to dovecot's LMTP server) I could of course put a mysql: query into postfix which would return user@domain retry: for the "locked" user. But I'm lazy and would prefer a single place / a single query to lock the account

Properly "locking" a useraccount (on a proxy)

2014-10-21 Thread Ralf Hildebrandt
I'm preparing a migration of several mailboxes to another machine. The different useraccounts are distributed to different backend machines by means of a dovecot LMTP/IMAP/POP proxy. Proxying is working really well (now that the kernel does as it should). But how can I "lock" a user during migrat

Re: What is the correct way to configure the mail_location option for Mailidr format?

2014-10-21 Thread deoren
On 10/21/2014 11:44 AM, Benny Pedersen wrote: On October 21, 2014 6:18:07 PM deoren wrote: mail_location = maildir:/var/vmail/%d/%n/Maildir sieve_dir = /var/vmail/sieve/%d/%n/sieve_dir mail_location = maildir:/var/vmail/%d/%n/.maildir sieve_dir = /var/vmail/%d/%n/.sieve More simpl

Re: Proxy problem: "imap-login: Error: proxy(USERNAME): connect(10.x.x.178, 993) failed: Cannot assign requested address (after 0 secs, local=10.x.x.104)"

2014-10-21 Thread Ralf Hildebrandt
* brd : > Ralf Hildebrandt wrote: > [...] > > We already optimized: > > snip > > net.ipv4.tcp_fin_timeout=5 > > # down from 30s > > net.ipv4.tcp_tw_reuse=1 > > net.ipv4.tcp_tw_recycle=1 > > # > > http://redis4you.com/articles.php?id=012&name=Redis+high+traffic+connection+issue > > just

Re: What is the correct way to configure the mail_location option for Mailidr format?

2014-10-21 Thread Benny Pedersen
On October 21, 2014 6:18:07 PM deoren wrote: mail_location = maildir:/var/vmail/%d/%n/Maildir sieve_dir = /var/vmail/sieve/%d/%n/sieve_dir mail_location = maildir:/var/vmail/%d/%n/.maildir sieve_dir = /var/vmail/%d/%n/.sieve More simple, and more easy to tarball backup

only inbox folder after courier-imap migration

2014-10-21 Thread Luciano Gabriel Andino
Hello, after courier-dovecot-migrate.pl, the only folder appears in webmail menu is "Inbox". The others still are in Maildir "Maildir/.myfolder" and contains its "dovecot-uidlist" and "dovecot-keywords" files. May I need to edit some file? -- Saludos!! Luciano Andino GNU/Linux user #185103 Santa

What is the correct way to configure the mail_location option for Mailidr format?

2014-10-21 Thread deoren
Short version: What is the correct way to configure the mail_location option for Mailidr format? I've long had it setup this way: mail_location = maildir:/var/vmail/%d/%n based on this guide: https://www.linode.com/docs/email/postfix/email-with-postfix-dovecot-and-mysql Is that c

Re: Proxy problem: "imap-login: Error: proxy(USERNAME): connect(10.x.x.178, 993) failed: Cannot assign requested address (after 0 secs, local=10.x.x.104)"

2014-10-21 Thread brd
Ralf Hildebrandt wrote: [...] > We already optimized: > snip > net.ipv4.tcp_fin_timeout=5 > # down from 30s > net.ipv4.tcp_tw_reuse=1 > net.ipv4.tcp_tw_recycle=1 > # > http://redis4you.com/articles.php?id=012&name=Redis+high+traffic+connection+issue just a note on enabling tcp_tw_recycl

Dovecot Auth Issue

2014-10-21 Thread Austin Einter
Dear All I have been able to setup postfix and dovecot. Through command line, I can send mail out. Now I have installed roundcube in mail server side, and I am able to access like https://mydomain/webmail.com Login was failing. Then I debugged and modified settings in dovecot and using PAM for au

Re: SMTP authentication setup

2014-10-21 Thread deoren
On 2014-10-21 07:40, Brian wrote: At my company we've had a longstanding problem of not being able to send email from devices outside of our internal network and any specific IP address that we open the relay to. As it turns out, SASL has never been set up. I need to set up SASL ASAP but none of

Re: 90-sieve.conf syntax - moving from v2.0.x to v2.2.x

2014-10-21 Thread deoren
On 2014-10-20 11:59, deoren wrote: Hi, I'm currently running version v2.0.x in production (using Maildir storage) and it's been working well. I'm interested in moving to version 2.2.x and am preparing a test server to do so. As I have been merging the conf file changes between the two versions I

Re: SMTP authentication setup

2014-10-21 Thread Charles Marcus
On 10/21/2014 8:49 AM, Reindl Harald wrote: > Am 21.10.2014 um 14:45 schrieb Charles Marcus: >> On 10/21/2014 8:40 AM, Brian wrote: >>> Also, instead of >>> submission inet n - - - - smtpd >>> I did: >>> 127.0.0.1:1025 inet n - - - - smtpd >>> >>> After all is done, however, I'm unable to send an

Re: SMTP authentication setup

2014-10-21 Thread Reindl Harald
Am 21.10.2014 um 14:45 schrieb Charles Marcus: On 10/21/2014 8:40 AM, Brian wrote: Also, instead of submission inet n - - - - smtpd I did: 127.0.0.1:1025 inet n - - - - smtpd After all is done, however, I'm unable to send any mail. No surprise there. You *must* use the submission port if y

Re: SMTP authentication setup

2014-10-21 Thread Reindl Harald
Am 21.10.2014 um 14:40 schrieb Brian: At my company we've had a longstanding problem of not being able to send email from devices outside of our internal network and any specific IP address that we open the relay to. As it turns out, SASL has never been set up. I need to set up SASL ASAP but non

Re: SMTP authentication setup

2014-10-21 Thread Charles Marcus
On 10/21/2014 8:40 AM, Brian wrote: > Also, instead of > submission inet n - - - - smtpd > I did: > 127.0.0.1:1025 inet n - - - - smtpd > > After all is done, however, I'm unable to send any mail. No surprise there. You *must* use the submission port if you want it to work. Not sure why you tho

SMTP authentication setup

2014-10-21 Thread Brian
At my company we've had a longstanding problem of not being able to send email from devices outside of our internal network and any specific IP address that we open the relay to. As it turns out, SASL has never been set up. I need to set up SASL ASAP but none of the guides I've found seem to wo

Re: Proxy problem: "imap-login: Error: proxy(USERNAME): connect(10.x.x.178, 993) failed: Cannot assign requested address (after 0 secs, local=10.x.x.104)"

2014-10-21 Thread Ralf Hildebrandt
> >FYI: It was a kernel bug. > > Do you mind sharing the actual technical background. Which kernel > was affected and how? We didn't track it down to a specific bug, but we finally decided that our setup using multiple IPs for source and destination was OK and should work as intended - but it did

Re: Proxy problem: "imap-login: Error: proxy(USERNAME): connect(10.x.x.178, 993) failed: Cannot assign requested address (after 0 secs, local=10.x.x.104)"

2014-10-21 Thread lst_hoe02
Zitat von Ralf Hildebrandt : * Ralf Hildebrandt : > I'd guess you're running out of TCP ports. I think so too, but it's somewhat unlikely! We're using 10 outbound IP adresses! In a random fashion (and I'm seeing this on the backend server!) FYI: It was a kernel bug. Do you mind sharing t

Re: Proxy problem: "imap-login: Error: proxy(USERNAME): connect(10.x.x.178, 993) failed: Cannot assign requested address (after 0 secs, local=10.x.x.104)"

2014-10-21 Thread Ralf Hildebrandt
* Ralf Hildebrandt : > > I'd guess you're running out of TCP ports. > > I think so too, but it's somewhat unlikely! We're using 10 outbound IP > adresses! In a random fashion (and I'm seeing this on the backend > server!) FYI: It was a kernel bug. -- [*] sys4 AG http://sys4.de, +49 (89) 30 9