About:
Dovecot is an IMAP server whose major goals are security and extreme reliability. It uses index files to optimally store the mailbox state, which makes it very fast even with huge mailboxes. Indexes won't prevent external mailbox updates, so Dovecot is still fully compatible with standard Maildir and mbox formats. There's also a fully featured POP3 server included.

Release focus: Minor security fixes

Changes:
A new security hole where users could log in without a valid password was fixed.

Author:
Timo Sirainen [contact developer]

Rating:	reset 1 2 3 4 5 6 7 8 9 10
8.37/10.00 (23 votes)

Homepage:
http://www.dovecot.org/
Tar/GZ:
http://dovecot.org/releases/1.0/dovecot-1.0.13.tar.gz
Changelog:
http://www.dovecot.org/doc/NEWS
Mailing list archive:
http://www.dovecot.org/list/dovecot/

Trove categories: [change]

[Development Status]		4 - Beta
[Environment]		No Input/Output (Daemon)
[Intended Audience]		System Administrators
[License]		OSI Approved :: GNU Lesser General Public License (LGPL)
[Operating System]		POSIX
[Programming Language]		C
[Topic]		Communications :: Email :: Post-Office :: IMAP, Communications :: Email :: Post-Office :: POP3

Dependencies: [change]
No dependencies filed

 Branches

Branch	Version	Last release	License	URLs
Default	1.0.13	10-Mar-2008	GNU Lesser General Public License (LGPL)

 Releases

Version	Focus	Date
1.0.13	Minor security fixes	10-Mar-2008 11:04
1.0.12	N/A	06-Mar-2008 09:24
1.0.2	Minor bugfixes	15-Jul-2007 21:58
1.0.1	Minor bugfixes	15-Jun-2007 17:44
1.0.0	Major bugfixes	13-Apr-2007 17:40
1.0 beta8	Minor security fixes	12-May-2006 18:27
1.0beta6	Minor bugfixes	12-Apr-2006 16:57
1.0beta1	Major feature enhancements	17-Jan-2006 08:55
0.99.12	Major bugfixes	05-Dec-2004 10:34
0.99.10.7	Minor bugfixes	14-Jul-2004 14:02

 Articles referencing this project

• Red Hat: An updated dovecot package fixes several security issues
  by Patrick Lenz , in Security
  Sun, May 25th 2008 23:42
  
• Debian: New dovecot packages fix privilege escalation
  by Patrick Lenz , in Security
  Sun, Mar 16th 2008 12:14
  
• Debian: New dovecot packages fix information disclosure
  by Patrick Lenz , in Security
  Sun, Jan 13th 2008 01:00
  
• Debian: New dovecot packages fix directory traversal
  by Patrick Lenz , in Security
  Mon, Sep 3rd 2007 04:36
  

 Comments

[»] Thank you!
by Apollyon - Dec 5th 2004 18:05:42

I have been using courier-imap for the past 3 years and I must say I have not been impressed with it. It is difficult to set up out of the box. This software package took me all of 5 minutes to compile, install and configure - and it WORKS! I love the extensive variety of configuration options. Thank you.

[reply] [top]

[»] Reliability
by Ryan Grove - Jul 28th 2002 21:08:28

Maybe it's just me, but I've always thought of reliability as a major component of security. If you've got great security but your server crashes every three days, then what good is the security?

[reply] [top]

[»] Re: Reliability
by Timo Sirainen - Jul 28th 2002 21:20:06

Maybe it's just me, but I've always
thought of reliability as a major
component of security. If you've got
great security but your server crashes
every three days, then what good is the
security?

Well, yes, I wouldn't consider a crashy software very secure. Especially if it crashes randomly. Besides meaning crashes with the "reliability", I also mean that it functions properly in all cases, even if you have tons of IMAP clients accessing and modifying the same mailbox, or even in case of (system) crashes while indexes were just in the middle of being written to.


[reply] [top]

---

[»] Re: Reliability
by Timo Sirainen - Feb 25th 2003 14:25:33

Just clarifying: By reliability I especially mean the index files. Often programs that use binary database files don't allow any kind of problems in it, or it crashes. If they got corrupted, you have to run some special fsck to fix it, or even recreate it manually and maybe lose some information.

Dovecot trusts index files very little. It tries to check every possible error condition in them, if anything is found the error is logged and the indexes will be automatically rebuilt. Indexes don't contain any unique information so rebuilding them won't lose anything.

Also, if Dovecot can't use indexes for any reason (eg. quota full), it can work without them. Then it just builds the them in memory.

[reply] [top]

---

[»] Re: Reliability
by Rich Dougherty - Sep 22nd 2003 04:22:22

I run Dovecot on a usermode Linux instance with very little memory. Occasionally the system will run out of memory and kill Dovecot. It seems to handle this very well. I see error messages in the log about corrupt indexes, but it keeps on working.

[reply] [top]

---

[»] Re: Reliability
by Apollyon - Mar 20th 2005 14:25:39

I am assuming you are using procmail to get your e-mail into Maildir/ folders. If so, this is probably where you are getting the corrupt indexes. If you have $HOME/Maildir/new in your .procmailrc file, change it to $HOME/Maildir/. The trailing '/' tells procmail to expect a Maildir format folder. This should eliminate the corrupt index alerts. Basically with your current configuration you are using MH style messages and not Maildir. `man procmailrc` for more information.

[reply] [top]

---

[»] Re: Reliability
by Rich Dougherty - Jun 9th 2005 02:18:28

I am assuming you are using procmail to get your e-mail into Maildir/ folders.

Email is stored in mbox format, but thanks for the tip.

[reply] [top]

---