Hello,
after switching from version 2.2.7 to 2.2.7 I miss the loglines which say:
ssl-params: Generating SSL parameters
ssl-params: SSL parameters regeneration completed
The configuration has not been changed and reads:
| # 2.2.7: /usr/local/dovecot/etc/dovecot/dovecot.conf
| # OS: Linux 2.6.35.14-106.fc14.i686.PAE i686 Fedora release 14 (Laughlin)
ext3
| auth_mechanisms = plain login
| default_vsz_limit = 512 M
| first_valid_uid = 200
| last_valid_uid = 65534
| listen = *
| lmtp_save_to_detail_mailbox = yes
| login_greeting = c64.shuttle.de - IMAPs Service (dovecot) ready.
| login_log_format_elements = %u %r %c
| mail_location = maildir:/var/spool/mail/%u
| mail_log_prefix = "%Us(%u,%r): "
| mail_plugin_dir = /usr/dovecot/lib/dovecot/
| mail_plugins = notify quota fts fts_squat
| namespace inbox {
| inbox = yes
| list = yes
| location =
| mailbox Drafts {
| special_use = \Drafts
| }
| mailbox Gesendet {
| special_use = \Sent
| }
| mailbox SPAM {
| special_use = \Junk
| }
| mailbox Sent {
| special_use = \Sent
| }
| mailbox Trash {
| special_use = \Trash
| }
| prefix =
| subscriptions = yes
| type = private
| }
| passdb {
| args = dovecot
| driver = pam
| }
| plugin {
| fts = squat
| fts_squat = partial=4 full=10
| mail_log_events = delete undelete expunge copy mailbox_delete
mailbox_rename flag_change append
| mail_log_fields = uid box from subject msgid size flags
| mail_log_group_events = yes
| quota = maildir:User quota
| quota_rule = *:storage=2G
| quota_rule2 = Trash:storage=+100M
| }
| postmaster_address = postmaster at moltke28.b.shuttle.de
| protocols = imap
| service anvil {
| client_limit = 1027
| }
| service auth {
| unix_listener auth-client {
| group = exim
| mode = 0660
| user = exim
| }
| }
| service imap-login {
| inet_listener imap {
| port = 143
| }
| inet_listener imaps {
| port = 993
| ssl = yes
| }
| process_limit = 512
| process_min_avail = 10
| }
| service imap-postlogin {
| executable = script-login /usr/local/sbin/dovecot-imap-post-login
| }
| service imap {
| executable = imap imap-postlogin
| }
| service lmtp {
| inet_listener lmtp {
| address = 0.0.0.0
| port = 24
| }
| }
| service pop3-login {
| inet_listener pop3 {
| port = 110
| }
| inet_listener pop3s {
| port = 995
| ssl = yes
| }
| }
| service pop3 {
| process_limit = 1024
| }
| ssl_cert = </usr/local/etc/c64.shuttle.de.CRT
| ssl_key = </usr/local/etc/c64.shuttle.de-dovecot.KEY
| ssl_parameters_regenerate = 1 hours
| userdb {
| driver = passwd
| }
| verbose_proctitle = yes
| protocol lmtp {
| mail_plugins = notify quota fts fts_squat
| }
| protocol lda {
| mail_plugins = notify quota fts fts_squat
| }
| protocol imap {
| imap_client_workarounds = delay-newmail tb-extra-mailbox-sep tb-lsub-flags
| imap_logout_format = [%i/%o]
| mail_max_userip_connections = 0
| mail_plugins = notify quota fts fts_squat quota mail_log imap_quota
listescape fts fts_squat
| }
What's going on? No more logging or no regeneration?
Greetings, Frank Elsner
On Tue, 5 Nov 2013 20:01:54 +0100 Frank Elsner wrote:> Hello, > > after switching from version 2.2.7 to 2.2.7 I miss the loglines which say:Sorry, typo. Should read "after switching from version 2.2.6 to 2.2.7" ^ --Frank
Am 05.11.2013 20:01, schrieb Frank Elsner:> after switching from version 2.2.6 to 2.2.7 I miss the loglines which say: > > ssl-params: Generating SSL parameters > ssl-params: SSL parameters regeneration completed > > What's going on? No more logging or no regeneration?it is intentional i guess http://hg.dovecot.org/dovecot-2.2/rev/43ab5abeb8f0 ssl-params: Added ssl_dh_parameters_length & removed ssl_parameters_regenerate setting ssl-params: Added ssl_dh_parameters_length & removed ssl_parameters_regenerate setting. ssl_parameters_regenerate was based on some text from GNUTLS documentation a long time ago, but there's really not much point in doing it. Ideally we should also support "openssl dhparam" input files, but for now there's the ssl_dh_parameters_length setting that can be used to specify the wanted DH parameters length. If the current ssl-parameters.dat has a different length, it's regenerated. We should probably at some point support also built-in DH parameters which are returned while the ssl-params runs. -------- Original-Nachricht -------- Betreff: Re: [Dovecot] DH parameter length too small? Datum: Sat, 2 Nov 2013 15:28:33 +0200 Von: Timo Sirainen <tss at iki.fi> Antwort an: Dovecot Mailing List <dovecot at dovecot.org> An: J?rg L?bbert <j.luebbert at kaladix.org> Kopie (CC): Dovecot Mailing List <dovecot at dovecot.org> On 14.10.2013, at 19.08, J?rg L?bbert <j.luebbert at kaladix.org> wrote:> from my understanding, using 1024bit DH parameters results in a not > sufficiently secure key exchange for DH(E). Therefore I think it would > be advisable to have parameters of at least 2048bit . In fact, I would > see a great benefit in chosing parameter length arbitrarily. > > I also do not see the benefit of parameter regeneration. What were the design goals here?http://hg.dovecot.org/dovecot-2.2/rev/43ab5abeb8f0 -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 263 bytes Desc: OpenPGP digital signature URL: <http://dovecot.org/pipermail/dovecot/attachments/20131106/9b936264/attachment.bin>