Block specific MUAs

ecdlguy

Hi,
According to information security guidelines of our university, we need to block certain MUAs like e.g. Outlook-App for iOS and Android or Xiaomi Mail / MiMail. This can be achieved by enabling the dovecot option “imap_id_retain” and adding a password database which blocks the specific MUAs by evaluating a LUA script:

passdb {
   driver = lua
   args = file=/path/to/dovecot-badimapid.lua blocking=yes # default is yes
}

Is it possible to configure mailcow accordingly so specific MUAs can be blocked?

Thanks, Thorsten

esackbauer

That should work, if you create an extra.conf for those options:
https://docs.mailcow.email/manual-guides/Dovecot/u_e-dovecot-extra_conf/
Do never change the dovecot.conf directly, it will be overwritten.

The LUA script should go to data/conf/dovecot/lua

ecdlguy

Sounds great! Thanks for the information.

ecdlguy

Hi, I’m currently trying to implement this. However, I don’t manage to obtain the client_id in my lua-script.
Here is the content of “/opt/mailcow-dockerized/data/conf/dovecot/extra.conf”:

imap_id_retain = yes
imap_id_log = *
passdb {
  driver = lua
  args = file=/etc/dovecot/lua/badimapid.lua blocking=yes
}

Logging (imap_id_log = *) works, the dovecot log has entries like:
imap(thorsten@iap.physik.tu-darmstadt.de)<226><pWFZx9siRt+CUwMp>: ID sent: name=Thunderbird, version=115.15.0

Here is the content of the lua-script file:

function auth_passdb_lookup(req)
    req.log_info('badimapid info: user="'..req.user..'", client_id="'..req.client_id..'"')
    return dovecot.auth.PASSDB_RESULT_NEXT, ""
end

function script_init()
    return 0
end

function script_deinit()
end

In principle, req.client_id should contain the client id string according to https://doc.dovecot.org/2.3/configuration_manual/authentication/lua_based_authentication/

However, dovecot log reads:
auth-worker(163): Error: conn unix:auth-worker (pid=162,uid=401): auth-worker<27>: lua(thorsten@iap.physik.tu-darmstadt.de): db-lua: lua_pcall(auth_passdb_lookup, 1, 2) failed: /etc/dovecot/lua/badimapid.lua:2: attempt to concatenate a nil value (field 'client_id')

Why is client_id nil?

Thanks, Thorsten