Re: [Dovecot] v2.2.rc5 released

2013-04-06 Thread Michael Grimm
Oscar del Rio wrote: > On 04/ 5/13 02:07 PM, Timo Sirainen wrote: >> Please test before that. :) > > so far so good, on Solaris 11.1 :) +FreeBSD 9-STABLE Regards, Michael

Re: [Dovecot] password encryption

2013-04-06 Thread Noel Butler
On Fri, 2013-04-05 at 23:36 -0700, Jim Pazarena wrote: > I have just come to the realization that password encryption using the > crypt function in linux, ONLY USES THE FIRST 8 CHARS. I have written > routines using crypt allowing 16+ chars, and find that anything past 8 > is ignored. Wow. >

Re: [Dovecot] password encryption

2013-04-06 Thread Professa Dementia
On 4/5/2013 11:36 PM, Jim Pazarena wrote: I have just come to the realization that password encryption using the crypt function in linux, ONLY USES THE FIRST 8 CHARS. I have written routines using crypt allowing 16+ chars, and find that anything past 8 is ignored. Wow. Is there a way around this

Re: [Dovecot] password encryption

2013-04-06 Thread Robin
On 4/5/2013 11:36 PM, Jim Pazarena wrote: > I have just come to the realization that password encryption using the > crypt function in linux, ONLY USES THE FIRST 8 CHARS. I have written > routines using crypt allowing 16+ chars, and find that anything past 8 > is ignored. Wow. > > Is there a wa

[Dovecot] script to detect dictionary attacks

2013-04-06 Thread Reindl Harald
Hi has someone a script which can filter out dictionary attacks from /var/log/maillog and notify about the source-IPs? i know about fail2ban and so on, but i would like to have a mail with the IP address for two reasons and avoid fail2ban at all because it does not match in the way we maintain fi

Re: [Dovecot] script to detect dictionary attacks

2013-04-06 Thread Marcin Mirosław
W dniu 2013-04-06 13:18, Reindl Harald pisze: > Hi Hi! > has someone a script which can filter out dictionary attacks > from /var/log/maillog and notify about the source-IPs? > > i know about fail2ban and so on, but i would like to have > a mail with the IP address for two reasons and avoid fail

Re: [Dovecot] script to detect dictionary attacks

2013-04-06 Thread Robert Schetterer
Am 06.04.2013 13:18, schrieb Reindl Harald: > Hi > > has someone a script which can filter out dictionary attacks > from /var/log/maillog and notify about the source-IPs? > > i know about fail2ban and so on, but i would like to have > a mail with the IP address for two reasons and avoid fail2ban

Re: [Dovecot] replicator/dsync over tcp

2013-04-06 Thread Michael Grimm
Timo Sirainen wrote: > On 24.3.2013, at 23.07, Michael Grimm wrote: > >> First of all I did need to extend http://wiki2.dovecot.org/Replication to >> get dsync over tcp running without ssl: > .. >> | dovecot: doveadm(test): Error: doveadm_password not set, can't >> authenticate to remote serv

Re: [Dovecot] script to detect dictionary attacks

2013-04-06 Thread Benny Pedersen
Reindl Harald skrev den 2013-04-06 13:18: has someone a script which can filter out dictionary attacks from /var/log/maillog and notify about the source-IPs? yes i have :) pflogsumm i know about fail2ban and so on, but i would like to have a mail with the IP address for two reasons and avoi

Re: [Dovecot] script to detect dictionary attacks

2013-04-06 Thread Reindl Harald
Am 06.04.2013 14:24, schrieb Benny Pedersen: > Reindl Harald skrev den 2013-04-06 13:18: > >> has someone a script which can filter out dictionary attacks >> from /var/log/maillog and notify about the source-IPs? > > yes i have :) > > pflogsumm has to do what with IMAP/POP3 Logins? >> i know

Re: [Dovecot] script to detect dictionary attacks

2013-04-06 Thread Benny Pedersen
Reindl Harald skrev den 2013-04-06 14:43: has to do what with IMAP/POP3 Logins? patch / hack it to dovecot but nobody speaks about postfix and nobody use sql logs i speak about a simple way to get a notify of the brute-forcing IP and the both are MANUAL tasks i do since virtually forever

Re: [Dovecot] script to detect dictionary attacks

2013-04-06 Thread Reindl Harald
Am 06.04.2013 14:52, schrieb Benny Pedersen: > Reindl Harald skrev den 2013-04-06 14:43: > >> has to do what with IMAP/POP3 Logins? > > patch / hack it to dovecot f**k yourself >> but nobody speaks about postfix > and nobody use sql logs are you drunken or what has this to do with sql logs?

Re: [Dovecot] script to detect dictionary attacks

2013-04-06 Thread voytek
> > http://wiki.dovecot.org/HowTo/Fail2Ban not sure if relevant, apologize if not: fwiw, I think csf/lfd (that came on my server) does similar job, detecting login failures and blocking offenders/suspects v

Re: [Dovecot] Sync errors trying to sync old mbox inboxes to dovecot

2013-04-06 Thread Charles Marcus
On 2013-04-05 5:10 PM, Michael Smith wrote: We are currently running dovecot 2.2.rc3. I am trying to 'dsync mirror' old Qpopper/mbox inboxes to our new Dovecot/mdbox servers. For most of the several thousand accounts, it works without issue. But there are a handful of accounts that are gene

Re: [Dovecot] script to detect dictionary attacks

2013-04-06 Thread Benny Pedersen
Reindl Harald skrev den 2013-04-06 14:59: keep your silly smilies for yourself haha [root@mail:~]$ rpm -q dovecot dovecot-2.1.16-4.fc17.20130405.rh.x86_64 you live in a precompiled problem learn grep, cut, sort, and more on how to use fail2ban, just ignore my help will not solve it for y

Re: [Dovecot] script to detect dictionary attacks

2013-04-06 Thread Reindl Harald
Am 06.04.2013 16:04, schrieb Benny Pedersen: > Reindl Harald skrev den 2013-04-06 14:59: > >> keep your silly smilies for yourself > haha what haha? you are a young boy with no knowledge proven many times >> [root@mail:~]$ rpm -q dovecot >> dovecot-2.1.16-4.fc17.20130405.rh.x86_64 > you live in

[Dovecot] autocreate mailbox but no sub folders

2013-04-06 Thread Arnaud Abélard
Hello, We have been using lda_mailbox_autocreate to avoid to intialize empty mailboxes upon account creations. This does the job allright except that dovecot-lda is also allowed to autocreate sub folders which is a problem when using addresses extensions (adress+fol...@domain.tld). It's easy

Re: [Dovecot] repeating dsync - questions

2013-04-06 Thread Ken A
Maybe take a look at "vmstat 2" and see if i/o is blocking a lot or you are hitting swap space? Someone else may be more informed about the inner workings of dsync and how it handles maildir as opposed to mbox. Best of luck, Ken On 4/6/2013 1:09 AM, Bob Gustafson wrote: > Something must be wrong

Re: [Dovecot] repeating dsync - questions

2013-04-06 Thread Bob Gustafson
I whacked Maildir and sdbox and started over. Tweek of rsync script - removed trailing / on destination. Did yum update, restart Avoided running Firefox on that machine.. It is now running the 1st pass of dsync - estimated finish is about 4.3 hours on 14G of mails vmstat 2 shows no swapping (

[Dovecot] mdbox and folders containing both messages and sub-folders

2013-04-06 Thread Rich Wales
I've got Dovecot 2.2r5 (Ubuntu package version 2:2.2.0~rc5-0~auto+1 from the "testing-auto/dovecot-2.2" repository on xi.rename-it.nl) running on a brand-new Ubuntu 12.04.2 server. I'm trying to configure Dovecot (using the "mdbox" mailbox format) to allow folders to contain both messages and sub-

Re: [Dovecot] script to detect dictionary attacks

2013-04-06 Thread Max Pyziur
On Sat, 6 Apr 2013, Reindl Harald wrote: Hi has someone a script which can filter out dictionary attacks from /var/log/maillog and notify about the source-IPs? i know about fail2ban and so on, but i would like to have a mail with the IP address for two reasons and avoid fail2ban at all because

[Dovecot] Released Pigeonhole v0.3.4 for Dovecot v2.1.16

2013-04-06 Thread Stephan Bosch
Hello Dovecot users, Much time passed since I last released a new Pigeonhole, so quite a few unreleased fixes were pending until now. Development of new features is shifted to the upcoming Pigeonhole v0.4 for Dovecot v2.2. I intend to release v0.4.0 shortly after Dovecot v2.2.0. Changelog v

Re: [Dovecot] script to detect dictionary attacks

2013-04-06 Thread Reindl Harald
Am 06.04.2013 22:55, schrieb Max Pyziur: > On Sat, 6 Apr 2013, Reindl Harald wrote: >> has someone a script which can filter out dictionary attacks >> from /var/log/maillog and notify about the source-IPs? >> >> i know about fail2ban and so on, but i would like to have >> a mail with the IP addre

Re: [Dovecot] script to detect dictionary attacks

2013-04-06 Thread Max Pyziur
On Sat, 6 Apr 2013, Reindl Harald wrote: Am 06.04.2013 22:55, schrieb Max Pyziur: On Sat, 6 Apr 2013, Reindl Harald wrote: has someone a script which can filter out dictionary attacks from /var/log/maillog and notify about the source-IPs? i know about fail2ban and so on, but i would like to

Re: [Dovecot] script to detect dictionary attacks

2013-04-06 Thread Professa Dementia
On 4/6/2013 2:13 PM, Max Pyziur wrote: On Sat, 6 Apr 2013, Reindl Harald wrote: if it is some ISP from a country far away -> block it if it is the fivth attempt from this ISP -> block the whole subnet if it is a major ISP of the country i live (asutria) -> only absue mail to the ISP I under

Re: [Dovecot] script to detect dictionary attacks

2013-04-06 Thread Reindl Harald
Am 06.04.2013 23:48, schrieb Professa Dementia: > Both of the following I have experienced: > > 1) Excessive spam and hacking from China. I blocked China. Then I got a > client that did business in China and had > a branch office there. Suddenly I cannot block login attempts from China. > A

Re: [Dovecot] script to detect dictionary attacks

2013-04-06 Thread Stephen Davies
Here is the simplex script that I use to filter attacking sites. I should be easy to add your extra bits (email etc). Cheers, Stephen #! /bin/sh d=`date +"%b %d"` grep "$d" /var/log/mail/info.log|grep ruleset=check_rcp | gawk '{split($0,q,/[\[\]]/);print "/sbin/iptables -A INPUT -s " q[4] "/32 -

[Dovecot] The sieve_extprograms plugin included in main Pigeonhole 0.4 source tree

2013-04-06 Thread Stephan Bosch
Hi, I think the sieve_extprograms is mature enough for an initial release and that is why I've included the sieve_extprograms plugin into the main Pigeonhole v0.4 source tree. It is still a plugin, but is no longer provided as a separate package. This should make things easier. It will be re