Let us now configure Dovecot which will do several things for us:
Before we get to the actual configuration for security reasons it is suggested you create a new system user that will own all virtual mailboxes. The following shell commands will create a system group "vmail" with GID (group ID) 5000 and a system user "vmail" with UID (user ID) 5000. (Make sure that UID and GID are not yet used or choose another - the number can be anything between 1000 and 65000 that is not yet used):
$> groupadd -g 5000 vmail $> useradd -g vmail -u 5000 vmail -d /var/vmail -m
The configuration files for Dovecot are found under /etc/dovecot. Start with the main file...
See the line protocols and define the protocols you want to offer. By default this line reads:
protocols = imap imaps pop3 pop3s
so that Dovecot starts the IMAP and POP3 services and also its equivalents that work over an encrypted SSL (secure socket layer) connection.
Although this is a less secure setting you will probably still need it:
disable_plaintext_auth = no
This will allow plaintext passwords over an unsecured (non-SSL) connection. By default it is set to 'yes' for security reasons. Setting it to 'no' will mean less security but may help users of a "certain" Microsoft email software that is broken in many ways.
A more important setting is:
mail_location = maildir:/var/vmail/%d/%n/Maildir
which will tell that the users' mailboxes are always found at /var/vmail/DOMAIN/USER/Maildir and that it should be in maildir format.
There is already a section "namespace private" in your dovecot.conf which is commented out by "#" characters. The "private" namespace is the personal mailbox this is only available for a certain user. You can leave this section disabled and get a maildir directory schema like:
/var/vmail/christoph.haas/email/Maildir/.spam
If you followed previous ISPmail tutorials then your directories may be different. If you rather have:
/var/vmail/christoph.haas/email/Maildir/.INBOX.spam
then you need to declare that in the "namespace private" section as follows. Enable this section and make sure these variables are set:
namespace private {
separator = .
inbox = yes
}
Next look for a section called "auth default". First define the allowed authentication mechanisms:
mechanisms = plain login
As you browse through the section you see many backends that Dovecot can access to get the email users' data. Inside this section you need to set:
passdb sql {
args = /etc/dovecot/dovecot-sql.conf
}
which tells Dovecot that the passwords are stored in an SQL database and:
userdb static {
args = uid=5000 gid=5000 home=/var/vmail/%d/%n allow_all_users=yes
}
to tell Dovecot where the mailboxes are located. This is similar to the mail_location setting. The user gets authenticated in the "passdb sql" section. So the "userdb static" section defined where the mail folders are located. Using "userdb sql" is not needed as all mailboxes follow a fixed directory schema.
You will want to comment out the section called "passdb pam that deals with system users. Otherwise Dovecot will also look for system users when someone fetches emails which leads to warnings in your log file.
Now look for another section called socket listen. Here you define socket files that are used to interact with Dovecot's authentication mechanism. Make the section read:
socket listen {
master {
path = /var/run/dovecot/auth-master
mode = 0600
user = vmail
}
client {
path = /var/spool/postfix/private/auth
mode = 0660
user = postfix
group = postfix
}
}
The "master" section is needed to give Dovecot's delivery agent (the program that saves a new mail to the user's mailbox) access to the userdb information. The "client" section creates a socket inside the "chroot" directory of Postfix. chroot means that parts of Postfix are jailed into /var/spool/postfix and can only access files in that directory or its subdirectories. It is a good security measure so that even if Postfix had bugs and were hacked then the attacker would not be able to access /etc/passwd for example because it's outside of /var/spool/postfix.
And finally the "protocol lda" section needs to be customized. The LDA (local delivery agent) is more capable than Postfix's built-in virtual delivery agent. It allows for quotas and Sieve (ships with the dovecot-common package) filtering. Let the section be:
protocol lda {
log_path = /var/vmail/dovecot-deliver.log
auth_socket_path = /var/run/dovecot/auth-master
postmaster_address = postmaster@example.com
mail_plugins = cmusieve
}
Please change the above postmaster email address to a valid address where the administrator can be reached.
The log_path setting is optional but may help you figure out why a certain server-side filter is not doing what you expect. As the dovecot-deliver.log may grow pretty fast you should create a logrotate configuration file /etc/logrotate.d/dovecot-deliver for it:
/var/vmail/dovecot-deliver.log {
weekly
rotate 14
compress
}
Edit the /etc/dovecot/dovecot-sql.conf and change these settings:
driver = mysql connect = host=127.0.0.1 dbname=mailserver user=mailuser password=mailuser2009 default_pass_scheme = PLAIN-MD5 password_query = SELECT email as user, password FROM virtual_users WHERE email='%u';
Restart Dovecot:
$> /etc/init.d/dovecot restart
Now look at your /var/log/mail.log logfile. You should see:
dovecot: Dovecot v1.0.rc15 starting up dovecot: auth-worker(default): mysql: Connected to 127.0.0.1 (mymailserver)
Before you send a first test email you will need to fix file system permissions for the /etc/dovecot/dovecot.conf file so that the vmail user can access the Dovecot configuration. The reason is that Postfix starts the delivery agent with vmail permissions:
$> chgrp vmail /etc/dovecot/dovecot.conf $> chmod g+r /etc/dovecot/dovecot.conf