Let us now configure Dovecot which will do several things for us:
- get emails from Postfix and save them to disk
- execute user-based "sieve" filter rules (can be used to put away emails to different folders)
- allow the user to fetch emails using POP3 or IMAP
Before we get to the actual configuration for security reasons I recommend that you create a new system user that will own all virtual mailboxes. The following shell commands will create a system group "vmail" with GID (group ID) 5000 and a system user "vmail" with UID (user ID) 5000. (Make sure that UID and GID are not yet used or choose another - the number can be anything between 1000 and 65000 that is not yet used):
groupadd -g 5000 vmail
useradd -g vmail -u 5000 vmail -d /var/vmail -m
Also make sure that this directory has the proper permissions:
chown -R vmail:vmail /var/vmail
chmod u+w /var/vmail
The configuration files for Dovecot are found under /etc/dovecot. Start editing the main file...
/etc/dovecot/dovecot.conf
See the line protocols and define the protocols you want to offer. By default this line reads:
protocols = imap imaps pop3 pop3s
so that Dovecot starts the IMAP and POP3 services and also its equivalents that work over an encrypted SSL (secure socket layer) connection. If you want to be strict about not allowing insecure connections then leave out the "imap" and "pop3" keywords here.
Although this is a less secure setting you will probably still need it:
disable_plaintext_auth = no
This will allow plaintext passwords over an unsecured (non-SSL) connection. By default it is set to 'yes' for security reasons. Setting it to 'no' will mean less security but may help users of a "certain" Microsoft email software that is problematic in many ways.
An important setting is:
mail_location = maildir:/var/vmail/%d/%n/Maildir
which will tell that the users' mailboxes are always found at /var/vmail/DOMAIN/USER/Maildir and that it should be in maildir format.
There is already a section "namespace private" in your dovecot.conf which is commented out by "#" characters. The "private" namespace is the personal mailbox of a certain user. You can leave this section disabled and get a maildir directory schema like:
/var/vmail/christoph.haas/email/Maildir/.spam
If you followed previous ISPmail tutorials then your directories may be different. If you rather have:
/var/vmail/christoph.haas/email/Maildir/.INBOX.spam
then you need to declare that in the "namespace private" section as follows. Enable this section and make sure these variables are set:
namespace private {
separator = .
inbox = yes
}
Next look for a section called "auth default". First define the allowed authentication mechanisms:
mechanisms = plain login
Usually "plain" is used but a certain Micros*oft email client insists on using "login". Both mechanism use plain text so it is strongly recommended that your users use IMAPS and POP3S which are the SSL/TLS encrypted equivalents to IMAP and POP3.
As you browse through the section you see many backends that Dovecot can access to get the email users' data. We are using SQL lookups for the passdb (=password) but static information to get the users's (because all users follow the same scheme). Inside this section you need to set:
passdb sql {
args = /etc/dovecot/dovecot-sql.conf
}
which tells Dovecot that the passwords are stored in an SQL database and:
userdb static {
args = uid=5000 gid=5000 home=/var/vmail/%d/%n allow_all_users=yes
}
to tell Dovecot where the mailboxes are located. This is similar to the mail_location setting. The user gets authenticated in the "passdb sql" section. So the "userdb static" section defined where the mail folders are located. Using "userdb sql" is not needed as all mailboxes follow a fixed directory schema. This saves an SQL query for each access. The "allow_all_users=yes" setting means that it is not necessary for Dovecot to check if a certain user exists. We can do that because Postfix has already ensured (in the virtual_mailbox_maps query) that the users existed before their email was handed over to Dovecot's "deliver" agent.
You will want to comment out the section called "passdb pam that deals with system users. Otherwise Dovecot will also look for system users when someone fetches emails which leads to warnings in your log file.
Now look for another section called socket listen. Here you define socket files that are used to interact with Dovecot's authentication mechanism. Make the section read:
socket listen {
master {
path = /var/run/dovecot/auth-master
mode = 0600
user = vmail
}
client {
path = /var/spool/postfix/private/auth
mode = 0660
user = postfix
group = postfix
}
}
The "master" section is needed to give Dovecot's delivery agent (the program that saves a new mail to the user's mailbox) access to the userdb information. The "client" section creates a socket inside the "chroot" directory of Postfix. This socket file will be used by Postfix for SMTP authentication when users send their email through your mail server as a relay.
(chroot means that parts of Postfix are jailed into /var/spool/postfix and can only access files in that directory or its subdirectories. It is a good security measure so that even if Postfix had bugs and were hacked then the attacker would not be able to access /etc/passwd for example because it's outside of /var/spool/postfix.)
And the "protocol lda" section needs to be customized. The LDA (local delivery agent) is more capable than Postfix's built-in virtual delivery agent. It allows for quotas and Sieve (ships with the dovecot-common package) filtering. Let the section be:
protocol lda {
auth_socket_path = /var/run/dovecot/auth-master
postmaster_address = postmaster@example.com
mail_plugins = sieve
log_path =
}
Please change the above postmaster email address to a valid address where a real human administrator can be reached.
The log_path setting is optional but may help you figure out why a certain server-side filter is not doing what you expect. Leaving it empty as shown above will log delivery details in your normal /var/log/mail.log but you can also use a file name here to create a seperate logfile.
Finally edit the /etc/dovecot/dovecot-sql.conf and change these settings:
driver = mysql
connect = host=127.0.0.1 dbname=mailserver user=mailuser password=mailuser2011
default_pass_scheme = PLAIN-MD5
password_query = SELECT email as user, password FROM virtual_users WHERE email='%u';
Whenever Dovecot needs to check an email user's password if will run the above query. It will create an MD5 hash of the user's password and look for that in the "virtual_users" database table.
Restart Dovecot:
/etc/init.d/dovecot restart
Now look at your /var/log/mail.log logfile. You should see:
... dovecot: Dovecot v1.2.15 starting up (core dumps disabled)
... dovecot: auth-worker(default): mysql: Connected to 127.0.0.1 (mailserver)
Before you send a first test email you will need to fix file system permissions for the /etc/dovecot/dovecot.conf file so that the vmail user can access the Dovecot configuration. The reason is that Postfix starts the delivery agent with vmail permissions:
chgrp vmail /etc/dovecot/dovecot.conf
chmod g+r /etc/dovecot/dovecot.conf
We should also make sure that only root can access the SQL configuration file so nobody else is reading your database access passwords:
chown root:root /etc/dovecot/dovecot-sql.conf
chmod go= /etc/dovecot/dovecot-sql.conf
69 Comments
Disable PAM to speed up IMAP access
Submitted by Anonymous (not verified) on
http://flexrails.blogspot.de/2008/04/dovecot-imap-authorization-slow.html
default mailboxes for Sent mail etc
Submitted by marco (not verified) on
Thanks to the author.
I spent my share of time following the tutorial, being me i obviously wanted something slightly different and that obviously complicated things. Maybe it trivial to you.. i had to try and find it out myself so i thought i'd share..
I was wondering where my sent messages went in roundcube and i found that i needed to setup some default folders which roundcoube apperntly regognises.
Adding
autocreate = Trash
autocreate2 = Junk
autocreate3 = Sent
autocreate4 = Drafts
autosubscribe = Trash
autosubscribe2 = Junk
autosubscribe3 = Sent
autosubscribe4 = Drafts
in the plugin { .. } section of dovecot.conf
and
mail_plugins = autocreate
to applicable protocol sections sections (for me:)
protocol imap { .. }
protocol pop3 { .. }
protocol lda { .. }
now makes dovecot automatically create the folders for any user, and thes names are recognised by roundcube.
quota icw postfixadmin
Submitted by marco (not verified) on
after my mail got sorted in the Sent and Draft boxes from my previous post i wanted to have quota for the individual users.
I incorporated postfixadmin in my setup so i ended up with a slightly different database configuration, by that database holds a "quota" field, and postfix admin allows me to change it ;)
Start by enabling the quota plugin for the respective protocols. Buiding on autocreate from my prev post, just add the quota plugings to the mail_plugins definition
protocol imap {
mail_plugins = autocreate quota imap_quota
}
protocol pop3 {
mail_plugins = autocreate quota
}
protocol pop3 {
mail_plugins = quota
}
To actually configure the quota, start with some entries in the plugin { .. } section. There are many options to choose from, just check the dovecot wiki
# backend definition ( how quota is calculated)
quota = maildir:User quota
# Quota limits are set using "quota_rule" parameters, either in here or in
# userdb. It's also possible to give mailbox-specific limits, for example:
# quota_rule = *:storage=1048576
# quota_rule2 = Trash:storage=102400
# User has now 1GB quota, but when saving to Trash mailbox the user gets
# additional 100MB.
# Now set the actual default quota for
quota_rule = *:storage=400M
# define absolute, or as a percentage
#quota_rule2 = Trash:storage=100M
quota_rule2 = Trash:storage=10%%
# quota_rule3 = SPAM:ignore
quota_rule3 = Spam:storage=20%%
Having done all this gives you default quota, meaning all the same for all users. A good start, but not practical.To have "individual" quota we have to disable the userdb static { .. } section as defined in the tutorial. Just put # in front of all lines
#userdb static {
# args = uid=5000 gid=5000 home=/var/vmail/%d/%n allow_all_users=yes
#}
now we have to "dynamically" recreate this for every user. Since i use postfix admin and this is in myql, activalte the
userdb sql { .. } section similar to the password fetching
userdb sql {
# Path for SQL configuration file
args = /etc/dovecot/dovecot-sql.conf
}
Having done that we have to modify /etc/dovecot/dovecot-sql.conf to define the sql query to "learn" about quota and the other items we omitted by disabling userdb static.
Adding
user_query = SELECT concat('*:storage=', quota, 'B') as quota_rule \
, concat('/var/vmail/%d/', maildir) AS home \
, '5000' as uid \
, '5000' as gid \
, 'yes' as allow_all_users \
FROM mailbox WHERE username='%u';
does the trick. You can see the uid and gid that were in the static definition are returned and we use SQL to build the quota_rule. Table and fieldnames are for default postfixadmin debian installation database but it should be 'obvious" how to "map" that to any other db configuration.
share and enjoy ..
Error
Submitted by nd (not verified) on
Thanks for the tutorial.
But;
Any idea of this error?
Restarting IMAP/POP3 mail server: dovecotError: Error in configuration file /etc/dovecot/dovecot.conf line 1191: Plugin section not allowed here (section changed in /etc/dovecot/dovecot.conf at line 1190)
Fatal: Invalid configuration in /etc/dovecot/dovecot.conf
failed!
--------------
socket listen {
master {
path = /var/run/dovecot/auth-master
mode = 0600
user = vmail
}
client {
path = /var/spool/postfix/private/auth
mode = 0660
user = postfix
group = postfix
}
}
The above curly-bracket is line 1190
AND
The line 1191 starts with the word dict;
dict {
#quota = mysql:/etc/dovecot/dovecot-dict-quota.conf
#expire = db:/var/lib/dovecot/expire.db
}
Thanks .
In your "client {" section,
Submitted by Anonymous (not verified) on
In your "client {" section, try resetting your mode to just 660 (not 0600) and see if it makes a difference. That's how mine is set and it works fine.
Struggeling with Dovecot 2.1.7 changes to this howto
Submitted by Trying-hard (not verified) on
I'm currently struggeling with getting dovecot to work. For the box (Raspberry Pi) there is only a dovecot 2.1.7 available so I went through all the comments which refer to the alterations from this howto to 2.0
I thought I did everything exactly like it was described in the comments and I can restart dovecot and postfix without errors but :
I do not see the dovecot: auth-worker(default): mysql: Connected to 127.0.0.1 (mailserver) line in my mail-log only that dovecot started up
and I guess closely related to this are the errors when I send an email to an accout existing in the database
Sep 15 19:46:33 minipi dovecot: auth: Fatal: Unknown database driver 'mysql'
Sep 15 19:46:33 minipi dovecot: master: Error: service(auth): command startup failed, throttling for 4 secs
Sep 15 19:46:33 minipi dovecot: lda: Error: userdb lookup(admin@testing.lan): Disconnected unexpectedly
another error is got is that the sieve plugin was not found in /usr/lib/dovecot/modules so for now I removed it from the lda config file just to avoid that error
In 10-auth.conf I have the !include auth-sql.conf.ext line uncommented so it should find the sql configuration...
Any help of why the auth service does not start ?
My head went through the table too ...
Submitted by Thomas (not verified) on
aptitude install dovecot-sieve dovecot-mysql
That should help you. ;)
Dovecot 2 removing "auth" when doing doveconf -n
Submitted by trying-hard (not verified) on
I'm really confused about the behaviour of dovecot 2.1.7. In my 10-master.conf file I have the following lines :
service auth {
unix_listener auth-master {
mode = 0600
user = vmail
group = vmail
}
# Postfix smtp-auth
unix_listener /var/spool/postfix/private/auth {
mode = 0660
user = postfix
group = postfix
}
}
When I use the doveconf -n command I get the following output of this section :
# 2.1.7: /etc/dovecot/dovecot.conf
# OS: Linux 3.2.27+ armv6l Debian wheezy/sid ext4
auth_mechanisms = plain login
disable_plaintext_auth = no
listen = *
mail_location = maildir:/var/vmail/%d/%n/Maildir
namespace {
inbox = yes
location =
prefix =
name = inbox
}
passdb {
args = /etc/dovecot/dovecot-sql.conf.ext
driver = sql
}
protocols = " imap pop3"
service replication-notify-fifo {
name = aggregator
}
service anvil-auth-penalty {
name = anvil
}
service auth-worker {
name = auth-worker
}
service {
unix_listener {
group = postfix
mode = 0660
user = postfix
path = /var/spool/postfix/private/auth
}
unix_listener {
group = vmail
mode = 0600
user = vmail
path = auth-master
}
name = auth
}
.....
For some weird reason the "auth" is getting removed from the service line and I assume that is the reason why I do not see auth-worker getting started in mail.log
Any idea why the auth might get removed from the service line and being added in the name = auth line ?!?
dovecot - authentication failures message by restart
Submitted by Dušan (not verified) on
Hello,
I installed dovecot and it seams everything works fine, but
by restarting dovecot I still get this message:
# /etc/init.d/dovecot restart
Restarting IMAP/POP3 mail server: dovecotIf you have trouble with authentication failures,
enable auth_debug setting. See http://wiki.dovecot.org/WhyDoesItNotWork
This message goes away after the first successful login.
I enabled auth_debug_passwords=yes
# cat /var/log/mail.log
Nov 11 16:32:01 dero dovecot: dovecot: Killed with signal 15 (by pid=2279 uid=0 code=kill)
Nov 11 16:32:01 dero dovecot: Dovecot v1.2.15 starting up (core dumps disabled)
Nov 11 16:32:01 dero dovecot: auth-worker(default): mysql: Connected to 127.0.0.1 (mailserver)
Nov 11 16:32:02 dero dovecot: auth(default): new auth connection: pid=2292
Nov 11 16:32:02 dero dovecot: auth(default): new auth connection: pid=2297
Nov 11 16:32:02 dero dovecot: auth(default): new auth connection: pid=2293
Nov 11 16:32:02 dero dovecot: auth(default): new auth connection: pid=2294
Nov 11 16:32:02 dero dovecot: auth(default): new auth connection: pid=2295
Nov 11 16:32:02 dero dovecot: auth(default): new auth connection: pid=2296
Any idea, what is wrong, how to fix it please?
Thanks
dovecot - authentication failures message by restart
Submitted by Dušan (not verified) on
The solution is
auth_debug = yes
dovecot.conf for 1.2.15 ??
Submitted by LePousson (not verified) on
Hi guys !!
Anyone could help me a bit by posting a full dovecot.conf file that works with 1.2.15 ?
I'm getting many many errors when restarting dovecot like :
Restarting IMAP/POP3 mail server: dovecotError: Error in configuration file /etc/dovecot/dovecot.conf line 1120: Unknown section
type (section changed in /etc/dovecot/dovecot.conf at line 1063)
Fatal: Invalid configuration in /etc/dovecot/dovecot.conf
Thanks in advance ...
LePousson
You haven't given us much
Submitted by Christoph Haas on
You haven't given us much information about your configuration file. But I would guess that you made a mistake in your /etc/dovecot/dovecot.conf configuration file near line 1063.
Hello PLEASE PLEASE give an
Submitted by Anonymous (not verified) on
Hello PLEASE PLEASE give an update how to install this with dovecot2. I got 2.1.7 (debian wheezy) and I am not able to set this server up with the new configuration sheme. The examples in /usr/doc/dovecot give aload of options and I have no clue what to use and where. When I try to write a .conf with the parameters from this tutorial, I get only errors with dovecot -n
The default installation gives a set up with passdb driver pam and userdb driver passwd which is USELESS for a server.
I walked thru the whole tutorial (which is great) until I came to dovecot only finding out that version 2x is incompatible with the old .config
dovecot2 debian wheezy
Submitted by Andrews (not verified) on
Hi,
I had the same problem :(
And problem with "Error in configuration file /etc/dovecot/dovecot.conf line 1121: Unknown section type (section changed in /etc/dovecot/dovecot.conf at line 1078) "
Service auth {
..
.
.
.
I'm trying troubleshoot second day and still no result :(( But great manual and very helpful comments!
dovecot 2.1.7
Submitted by Stefan (not verified) on
Hi Andrews,
I'm using Ubuntu 12.10, it also comes with Dovecot 2.1.7.
I had to install dovecot-mysql and make changes in various configuration files in /etc/dovecot/ and /etc/dovecot/conf.d.
Here is my configuration (doveconf -n):
_____
# 2.1.7: /etc/dovecot/dovecot.conf
# OS: Linux 3.5.0-25-generic x86_64 Ubuntu 12.10 ext4
auth_mechanisms = plain login
disable_plaintext_auth = no
mail_location = maildir:/var/vmail/%d/%n
namespace inbox {
inbox = yes
location =
prefix =
separator = .
}
passdb {
args = /etc/dovecot/dovecot-sql.conf.ext
driver = sql
}
postmaster_address = postmaster@MyServerName.example
protocols = " imap"
service auth {
unix_listener /var/spool/postfix/private/auth {
group = postfix
mode = 0660
user = postfix
}
unix_listener auth-userdb {
mode = 0600
user = vmail
}
}
ssl_cert = </etc/ssl/certs/dovecot.pem
ssl_key = </etc/ssl/private/dovecot.pem
userdb {
args = uid=5000 gid=5000 home=/var/vmail/%d/%n allow_all_users=yes
driver = static
}
_____
Regards,
Stefan
Problem mit Sieve & "fileinto"
Submitted by Mathias (not verified) on
Hello,
thank you very much for this very helpful tutorial. It works great for me.
I do have a problem with filtering and sorting mails into folders. I have installed spam assassin-milter and the header modifications are working as intended.
But I can't get dovecot to sort mails, specifically the ones with "X-Spam-Status" "No", into a different folder than INBOX.
My test-script is supposed to send "non-spam"-mails to the folder "spam" and looks like this:
require ["fileinto"];
# rule:[NoSpam]
if header :contains "X-Spam-Status" "No"
{
fileinto "spam";
stop;
}
The folder /var/vmail/%n/Maildir/.spam exists and I can move mails there e.g. with roundcube oder Outlook. In general, sieve scripts also work, we use it succesfully as an auto responder and i can forward mails based on header contents as well.
The only thing that doesn't seem to work is the "fileinto"-command.
Any help would be greatly appreciated.
for some reason it's working
Submitted by Mathias (not verified) on
for some reason it's working now. /close.
SOLVED: Error: Can't open log file /var/log/dovecot.log
Submitted by Jesse (not verified) on
This is the error I get in my log file mail.log when I attempt to send an email from an external mail account (Yahoo) to my server:
.....temporary failure. Command output: Can't open log file /var/log/dovecot.log: Permission denied )
The issue is due to the user "vmail" not having correct permissions. This will fix it (run from /var/log/ )
# chgrp vmail dovecot.log
# chmod g+w dovecot.log
I'm not sure which operating
Submitted by Christoph Haas on
I'm not sure which operating system you are using or how you configured your Dovecot server. But in Debian by default Dovecot logs to the "mail" facility which puts its output into /var/log/mail.log.
Also the dovecot processes do not run as user "vmail". So that user does not need access to such a log file. Your permissions in /var/log should be "drwxr-xr-x 26 root root" and your mail.log should be "-rw-r----- 1 root adm".
Pages