Gero Treuner (Author and Copyright 2018-03-04)
Stuttgart (Germany)
www.70t.de/projects/dovecot_backport_2018-03-03/
License GPLv3+
On the occasion of the current Debian security advisory (DSA-4130-1) I started investigating whether a security fix for "oldoldstable" — which I am still using on my mail server — can likely expected.
The Security Tracker Information and the QA page (maybe moved forward at the time of your reading) usually gives an overview. In the research I stumbled over a setuid security issue here. This kind of things is generally serious. In the situation that the Wheezy version is older than the fixed version and that's a significant structural change, the work to backport it to the old sources is not worth for a distribution first released back in 2013.
So it's strongly advisable to upgrade to at least the next minor version, where one can be found in wheezy backports, but ... without any security fixes: I learned that wheezy backports is closed, so definetely no hope. Ok, it's open source, so probably my turn to jump in ...
You can download the result here — unsecurely because neither signed nor encryped. So please build the package by yourself following the instructions below rather than just downloading the binary packages! I bother writing this also to show that you can do that.
This is the right place to express a big thank you to all Debian contributors to make all this possible — in current and in outdated (via the Debian LTS programme) releases. The "old" wheezy machine works too well to have a real need for a general upgrade, so I can be lazy most of the time (but not today) ... The Exim security fix last year in 2017 was a bit of a pain because it broke my setup, but nevertheless highly welcome because it must be done for security reasons ;-)
Of course your build machine must be prepared with a compiler and all other necessary packages for a Debian build. Usually this is achieved with the packages build-essential and fakeroot. For further reading klick the right chapter in the Debian New Maintainers' Guide..
I chose the next Debian release as a base, because risk that something goes wrong increases with advanced releases, and Debian 8 (jessie) is still getting security fixes.
If you have a Jessie machine (easier to check signatures):
apt-get source dovecot
Otherwise:
dpkg-source -x dovecot_2.2.13-12~deb8u4.dsc
The instructions here apply to this specific situation and can't be used as a template for backporting. In the general situation of seeking for a package with new security fixes you should examine the changes between the given backported and original package.
There are 2 issues here:
The backport is done by editing the relevant Debian files, which are located in the directory dovecot-2.2.13/debian. The generic dumb approach to remove things is to search for keywords and think about the scope of change. This can be removal of an element, switching an option to a different value, removal of a whole section or even a file. This works pretty well here, but if doing yourself you won't know it before actually building the packages ...
Here are all changes in unified diff format. This can be downloaded from www.70t.de/download/dovecot-wheezy-backport/dovecot-2.2.13-bpo-wheezy.diff.
Note for those not familiar with diff format:
Just try, with little exercise it is easy to read:
Lines starting with
diff, ---, +++ describe 2 compared files.
Lines surrounded by @@ open a comparison chunk by the line numbers
(you can ignore the numbers, chunks are in order of appearance).
Within a chunk the first character indicates the type of change:
" " (blank) means unchanged
(present in both files), "-" (minus) means deleted (present only in
first/old file), "+" (plus) means added (present only in second/new file).
Lines starting with Only in ... reference files which are only present on
one side: Which one is seen from the path.
Note for the rest ;-)
As guessed, patches can be automatically applied using the patch command.
For details use the command man patch (and don't forget to have the package
of that name installed).
diff -ur dovecot-2.2.13-jessie/debian/changelog dovecot-2.2.13-bpo/debian/changelog
--- dovecot-2.2.13-jessie/debian/changelog 2018-03-01 18:12:05.000000000 +0100
+++ dovecot-2.2.13-bpo/debian/changelog 2018-03-04 12:59:57.745971388 +0100
@@ -1,3 +1,11 @@
+dovecot (1:2.2.13-12~bpo70+1) wheezy-backports; urgency=high
+
+ * Rebuild for wheezy-backports from recent version with security fixes
+ * Disable systemd which is not in wheezy
+ * Disable lucene because liblucene is too old in wheezy
+
+ -- Gero Treuner <gt_72_debian.org@innocircle.com> Sat, 03 Mar 2018 13:21:28 +0100
+
dovecot (1:2.2.13-12~deb8u4) jessie-security; urgency=high
* [eb6eab8] Fix CVE-2017-14461: rfc822_parse_domain information leak
diff -ur dovecot-2.2.13-jessie/debian/control dovecot-2.2.13-bpo/debian/control
--- dovecot-2.2.13-jessie/debian/control 2018-03-01 18:12:05.000000000 +0100
+++ dovecot-2.2.13-bpo/debian/control 2018-03-04 12:54:06.842176516 +0100
@@ -3,7 +3,7 @@
Priority: optional
Maintainer: Dovecot Maintainers <jaldhar-dovecot@debian.org>
Uploaders: Jaldhar H. Vyas <jaldhar@debian.org>, Fabio Tranchitella <kobold@debian.org>, Joel Johnson <mrjoel@lixil.net>, Marco Nenciarini <mnencia@debian.org>, Jelmer Vernooij <jelmer@debian.org>, Apollon Oikonomopoulos <apoikos@debian.org>
-Build-Depends: debhelper (>= 7.2.3~), dh-autoreconf, dpkg-dev (>= 1.16.1), pkg-config, libssl-dev, libpam0g-dev, libldap2-dev, libpq-dev, libmysqlclient-dev, libsqlite3-dev, libsasl2-dev, zlib1g-dev, libkrb5-dev, drac-dev (>= 1.12-5), libbz2-dev, libdb-dev, libcurl4-gnutls-dev, libexpat-dev, libwrap0-dev, dh-systemd, po-debconf, lsb-release, libclucene-dev (>= 2.3), liblzma-dev, libexttextcat-dev, libstemmer-dev, autotools-dev
+Build-Depends: debhelper (>= 7.2.3~), dh-autoreconf, dpkg-dev (>= 1.16.1), pkg-config, libssl-dev, libpam0g-dev, libldap2-dev, libpq-dev, libmysqlclient-dev, libsqlite3-dev, libsasl2-dev, zlib1g-dev, libkrb5-dev, drac-dev (>= 1.12-5), libbz2-dev, libdb-dev, libcurl4-gnutls-dev, libexpat-dev, libwrap0-dev, po-debconf, lsb-release, liblzma-dev, libexttextcat-dev, libstemmer-dev, autotools-dev
Standards-Version: 3.9.6
Homepage: http://dovecot.org/
Vcs-Git: git://anonscm.debian.org/collab-maint/dovecot.git
@@ -12,7 +12,7 @@
Package: dovecot-core
Architecture: any
Depends: ${shlibs:Depends}, ${misc:Depends}, libpam-runtime (>= 0.76-13.1), openssl, adduser, ucf (>= 2.0020)
-Suggests: ntp, dovecot-gssapi, dovecot-sieve, dovecot-pgsql, dovecot-mysql, dovecot-sqlite, dovecot-ldap, dovecot-imapd, dovecot-pop3d, dovecot-lmtpd, dovecot-managesieved, dovecot-solr, dovecot-lucene
+Suggests: ntp, dovecot-gssapi, dovecot-sieve, dovecot-pgsql, dovecot-mysql, dovecot-sqlite, dovecot-ldap, dovecot-imapd, dovecot-pop3d, dovecot-lmtpd, dovecot-managesieved, dovecot-solr
Provides: dovecot-common, dovecot-abi-${dovecot:ABI-Version}
Replaces: dovecot-common (<< 1:2.0.14-2~), mailavenger (<< 0.8.1-4)
Breaks: dovecot-common (<< 1:2.0.14-2~), mailavenger (<< 0.8.1-4)
@@ -180,18 +180,6 @@
.
This package provides Solr full text search support for Dovecot.
-Package: dovecot-lucene
-Architecture: any
-Depends: ${shlibs:Depends}, ${misc:Depends}, dovecot-core (= ${binary:Version})
-Description: secure POP3/IMAP server - Lucene support
- Dovecot is a mail server whose major goals are security and extreme
- reliability. It tries very hard to handle all error conditions and verify
- that all data is valid, making it nearly impossible to crash. It supports
- mbox/Maildir and it's own dbox/mdbox formats, and should also be pretty
- fast, extensible, and portable.
- .
- This package provides Lucene full text search support for Dovecot.
-
Package: dovecot-dbg
Section: debug
Priority: extra
Only in dovecot-2.2.13-jessie/debian: dovecot-lucene.dirs
Only in dovecot-2.2.13-jessie/debian: dovecot-lucene.links
Only in dovecot-2.2.13-jessie/debian: dovecot-lucene.lintian-overrides
Only in dovecot-2.2.13-jessie/debian: dovecot-lucene.triggers
diff -ur dovecot-2.2.13-jessie/debian/rules dovecot-2.2.13-bpo/debian/rules
--- dovecot-2.2.13-jessie/debian/rules 2018-03-01 18:12:05.000000000 +0100
+++ dovecot-2.2.13-bpo/debian/rules 2018-03-04 12:54:49.033670547 +0100
@@ -41,7 +41,6 @@
--with-solr \
--with-ioloop=best \
--with-libwrap \
- --with-lucene \
--host=$(DEB_HOST_GNU_TYPE) \
--build=$(DEB_BUILD_GNU_TYPE) \
--prefix=/usr \
@@ -52,7 +51,6 @@
--infodir=\$${prefix}/share/info \
--with-moduledir=\$${prefix}/lib/dovecot/modules \
--disable-rpath \
- --with-systemdsystemunitdir=auto \
--disable-static
$(MAKE) dovecot-config
# Pigeonhole
@@ -186,9 +184,6 @@
mv $(CURDIR)/debian/dovecot-core/usr/lib/dovecot/modules/lib??_fts_solr_* $(CURDIR)/debian/dovecot-solr/usr/lib/dovecot/modules
mv $(CURDIR)/doc/solr-schema.xml $(CURDIR)/debian/dovecot-solr/usr/share/dovecot
- # lucene
- mv $(CURDIR)/debian/dovecot-core/usr/lib/dovecot/modules/lib??_fts_lucene_* $(CURDIR)/debian/dovecot-lucene/usr/lib/dovecot/modules
-
# dev
mv $(CURDIR)/debian/dovecot-core/usr/include/* $(CURDIR)/debian/dovecot-dev/usr/include
mv $(CURDIR)/debian/dovecot-core/usr/lib/dovecot/dovecot-config $(CURDIR)/debian/dovecot-dev/usr/lib/dovecot
@@ -223,9 +218,7 @@
dh_installexamples -a
dh_installpam -a
mv $(CURDIR)/debian/dovecot-core/etc/pam.d/dovecot-core $(CURDIR)/debian/dovecot-core/etc/pam.d/dovecot
- dh_systemd_enable
dh_installinit -pdovecot-core --init-script=dovecot -u"defaults 20"
- dh_systemd_start
dh_installman -a
dh_installman -p dovecot-core debian/maildirmake.dovecot.1
dh_installdebconf -a
Now when editing is done, let's cross fingers and the computer sweat. From within the source directory the build is triggered by
dpkg-buildpackage
On successful build a couple of *.deb files appear, ready for installation. Please see /usr/share/doc/dovecot-core/README.Debian.gz . Probably you want to create a new group for the dovecot user for security reasons.
For my scenario with IMAP/POP3 service and Exim authenticating against dovecot configuration files could remain as-is. Smoke test also covering authentication were fine.
[Legal Info / Impressum / Data Protection Declaration] / Last change 2018-03-04