Setting up Dovecot

Let us now configure Dovecot which will do several things for us:

  • get emails from Postfix and save them to disk
  • execute user-based "sieve" filter rules (can be used to put away emails to different folders)
  • allow the user to fetch emails using POP3 or IMAP

Before we get to the actual configuration for security reasons I recommend that you create a new system user that will own all virtual mailboxes. The following shell commands will create a system group "vmail" with GID (group ID) 5000 and a system user "vmail" with UID (user ID) 5000. (Make sure that UID and GID are not yet used or choose another - the number can be anything between 1000 and 65000 that is not yet used):

groupadd -g 5000 vmail
useradd -g vmail -u 5000 vmail -d /var/vmail -m

Also make sure that this directory has the proper permissions:

chown -R vmail:vmail /var/vmail
chmod u+w /var/vmail

The configuration files for Dovecot are found under /etc/dovecot. Start editing the main file...

/etc/dovecot/dovecot.conf

See the line protocols and define the protocols you want to offer. By default this line reads:

 protocols = imap imaps pop3 pop3s

so that Dovecot starts the IMAP and POP3 services and also its equivalents that work over an encrypted SSL (secure socket layer) connection. If you want to be strict about not allowing insecure connections then leave out the "imap" and "pop3" keywords here.

Although this is a less secure setting you will probably still need it:

 disable_plaintext_auth = no

This will allow plaintext passwords over an unsecured (non-SSL) connection. By default it is set to 'yes' for security reasons. Setting it to 'no' will mean less security but may help users of a "certain" Microsoft email software that is problematic in many ways.

An important setting is:

 mail_location = maildir:/var/vmail/%d/%n/Maildir

which will tell that the users' mailboxes are always found at /var/vmail/DOMAIN/USER/Maildir and that it should be in maildir format.

There is already a section "namespace private" in your dovecot.conf which is commented out by "#" characters. The "private" namespace is the personal mailbox of a certain user. You can leave this section disabled and get a maildir directory schema like:

/var/vmail/christoph.haas/email/Maildir/.spam

If you followed previous ISPmail tutorials then your directories may be different. If you rather have:

/var/vmail/christoph.haas/email/Maildir/.INBOX.spam

then you need to declare that in the "namespace private" section as follows. Enable this section and make sure these variables are set:

namespace private {
    separator = .
    inbox = yes
}

Next look for a section called "auth default". First define the allowed authentication mechanisms:

 mechanisms = plain login

Usually "plain" is used but a certain Micros*oft email client insists on using "login". Both mechanism use plain text so it is strongly recommended that your users use IMAPS and POP3S which are the SSL/TLS encrypted equivalents to IMAP and POP3.

As you browse through the section you see many backends that Dovecot can access to get the email users' data. We are using SQL lookups for the passdb (=password) but static information to get the users's (because all users follow the same scheme). Inside this section you need to set:

passdb sql {
    args = /etc/dovecot/dovecot-sql.conf
}

which tells Dovecot that the passwords are stored in an SQL database and:

userdb static {
    args = uid=5000 gid=5000 home=/var/vmail/%d/%n/Maildir allow_all_users=yes
}

to tell Dovecot where the mailboxes are located. This is similar to the mail_location setting. The user gets authenticated in the "passdb sql" section. So the "userdb static" section defined where the mail folders are located. Using "userdb sql" is not needed as all mailboxes follow a fixed directory schema. This saves an SQL query for each access. The "allow_all_users=yes" setting means that it is not necessary for Dovecot to check if a certain user exists. We can do that because Postfix has already ensured (in the virtual_mailbox_maps query) that the users existed before their email was handed over to Dovecot's "deliver" agent.

You will want to comment out the section called "passdb pam that deals with system users. Otherwise Dovecot will also look for system users when someone fetches emails which leads to warnings in your log file.

Now look for another section called socket listen. Here you define socket files that are used to interact with Dovecot's authentication mechanism. Make the section read:

 socket listen {
    master {
        path = /var/run/dovecot/auth-master
        mode = 0600
        user = vmail
    }

    client {
        path = /var/spool/postfix/private/auth
        mode = 0660
        user = postfix
        group = postfix
    }
}

The "master" section is needed to give Dovecot's delivery agent (the program that saves a new mail to the user's mailbox) access to the userdb information. The "client" section creates a socket inside the "chroot" directory of Postfix. This socket file will be used by Postfix for SMTP authentication when users send their email through your mail server as a relay.

(chroot means that parts of Postfix are jailed into /var/spool/postfix and can only access files in that directory or its subdirectories. It is a good security measure so that even if Postfix had bugs and were hacked then the attacker would not be able to access /etc/passwd for example because it's outside of /var/spool/postfix.)

And the "protocol lda" section needs to be customized. The LDA (local delivery agent) is more capable than Postfix's built-in virtual delivery agent. It allows for quotas and Sieve (ships with the dovecot-common package) filtering. Let the section be:

 protocol lda {
    auth_socket_path = /var/run/dovecot/auth-master
    postmaster_address = postmaster@example.com
    mail_plugins = sieve
    log_path =
}

Please change the above postmaster email address to a valid address where a real human administrator can be reached.

The log_path setting is optional but may help you figure out why a certain server-side filter is not doing what you expect. Leaving it empty as shown above will log delivery details in your normal /var/log/mail.log but you can also use a file name here to create a seperate logfile.

Finally edit the /etc/dovecot/dovecot-sql.conf and change these settings:

driver = mysql
connect = host=127.0.0.1 dbname=mailserver user=mailuser password=mailuser2011
default_pass_scheme = PLAIN-MD5
password_query = SELECT email as user, password FROM virtual_users WHERE email='%u';

Whenever Dovecot needs to check an email user's password if will run the above query. It will create an MD5 hash of the user's password and look for that in the "virtual_users" database table.

Restart Dovecot:

/etc/init.d/dovecot restart

Now look at your /var/log/mail.log logfile. You should see:

... dovecot: Dovecot v1.2.15 starting up (core dumps disabled)
... dovecot: auth-worker(default): mysql: Connected to 127.0.0.1 (mailserver)

Before you send a first test email you will need to fix file system permissions for the /etc/dovecot/dovecot.conf file so that the vmail user can access the Dovecot configuration. The reason is that Postfix starts the delivery agent with vmail permissions:

chgrp vmail /etc/dovecot/dovecot.conf
chmod g+r /etc/dovecot/dovecot.conf

We should also make sure that only root can access the SQL configuration file so nobody else is reading your database access passwords:

chown root:root /etc/dovecot/dovecot-sql.conf
chmod go= /etc/dovecot/dovecot-sql.conf

35 comments

What about changing

Submitted by Anonymous on Wed, 05/04/2011 - 17:15.

What about changing permission for file /etc/dovecot/dovecot-sql.conf? It contains very important info like password to database. I know that mailuser has only SELECT but we should secure it.

I wonder how I could miss

Submitted by Christoph Haas on Wed, 05/04/2011 - 17:43.

I wonder how I could miss that. Thanks.

secure file

Submitted by Anonymous on Mon, 11/07/2011 - 04:18.

Could you please tell how to secure the file? Thanks

dovecot

Submitted by Anonymous on Sat, 05/14/2011 - 02:05.

I installed yesterday to test your fine tutorial. Have Dovecot 2.0.12 installed and the configuration file is completely different. Stumped!!!!

This tutorial

Submitted by Anonymous on Sat, 05/14/2011 - 15:14.

is for squeeze where dovecot is version is 1.2.15.

And yes, in dovecot 2.0.12 the configuration file for dovecot are changed.

Settings for Dovecot 2.x ?

Submitted by Anonymous on Wed, 06/08/2011 - 15:25.

Any chance that the tutorial is updated to be used with Dovecot 2.x ?

No. In Debian Squeeze the

Submitted by Christoph Haas on Wed, 06/08/2011 - 15:41.

No. In Debian Squeeze the version 1.2.15 is the latest version. So this tutorial will not cover 2.x

It's 'a bit' different

Submitted by Anonymous on Wed, 06/08/2011 - 15:51.

Hello,

debian version of dovecot 2.x  differing from 1.x in too many files so actually, if you follow this howto, it's not possibile.

However I do not think that it is impossible, but you need to adapt /change all the configuration files.

I don't have a test machine for trying, but it would be interesting know how this setup will be fine into dovecot2.

working dovecot.conf for Dovecot 2.0 from w3sz

Submitted by Anonymous on Sat, 10/22/2011 - 03:10.

Here is a working Dovecot 2.0 dovecot.conf file that I am using successfully.  Otherwise, the implementation was as per this excellent tutorial.

# 2.0.13: /etc/dovecot/dovecot.conf
# OS: Linux 3.0.0-12-generic i686 Ubuntu 11.10 ext4
auth_verbose = yes
disable_plaintext_auth = no
login_greeting = Dovecot Available
mail_location = mbox:/mail:INBOX=/var/mail/%u
mail_privileged_group = mail
passdb {
  args = /etc/dovecot/dovecot-sql.conf
  driver = sql
}
passdb {
  driver = pam
}
plugin {
  sieve = ~/.dovecot.sieve
  sieve_dir = ~/sieve
}
protocols = imap pop3 imap pop3
service auth {
  unix_listener /var/spool/postfix/private/auth {
    mode = 0666
  }
  unix_listener auth-userdb {
    mode = 0600
    user = vmail
  }
}
ssl_cert = </etc/ssl/certs/dovecot.pem
ssl_key = </etc/ssl/private/dovecot.pem
userdb {
  args = uid=5000 gid=5000 home=/mail allow_all_users=yes
  driver = static
}
userdb {
  driver = passwd
}
protocol lda {
  auth_socket_path = /var/run/dovecot/auth-master
  log_path = /var/log/dovecot.log
  mail_plugins = sieve
  postmaster_address = w3sz@w3sz.net
}

Perhaps not exactly...from w3sz

Submitted by Anonymous on Sat, 10/22/2011 - 03:21.

What I posted above was generated from my dovecot.conf file by using:
 doveconf -n > dovecot-new.conf.  I assumed that this just removed the comments from my newly created dovecot.conf file, but that is not the case.
 It changed some things, and added pam which I did not invoke.

This dovecot.conf file is created by cutting and pasting from my current working version.  Perhaps a guru can comment on the differences.  I have no intention of trying the 'new' version above, as what I am posting here works, and I am not curious enough to see if the automatically generated one does too.  Here is the actual working version:

protocols=imap pop3
disable_plaintext_auth = no

auth_verbose = yes
login_greeting = Dovecot Available

mail_location=mbox:/mail:INBOX=/var/mail/%u
mail_privileged_group = mail

auth_mechanisms=plain login

passdb {
    driver=sql
    args =/etc/dovecot/dovecot-sql.conf
   }

userdb {
    driver=static
    args = uid=5000 gid=5000 home=/mail allow_all_users=yes
   }

service auth {
  unix_listener auth-userdb {
    path = /var/run/dovecot/auth-master
    mode = 0600
    user = vmail # User running dovecot-lda
   }

  # Postfix smtp-auth
  unix_listener /var/spool/postfix/private/auth {
    mode = 0666
  }

}

protocol lda {
    auth_socket_path = /var/run/dovecot/auth-master
    postmaster_address = w3sz@w3sz.net
    mail_plugins = sieve
    log_path = /var/log/dovecot.log
}

dict {
  #quota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext
  #expire = sqlite:/etc/dovecot/dovecot-dict-sql.conf.ext
}

!include_try local.conf

Thanks a lot! That seems to

Submitted by Anonymous on Sat, 11/19/2011 - 17:54.

Thanks a lot! That seems to work.

Uhm... I would probably add

Submitted by Anonymous on Tue, 05/17/2011 - 22:13.

Uhm... I would probably add -s /usr/sbin/nologin when creating the user.

You can comment out userdb

Submitted by Anonymous on Tue, 05/17/2011 - 23:10.

You can comment out userdb passwd too.

dovecot.conf

Submitted by Anonymous on Tue, 06/14/2011 - 06:21.

is this really necessary ? 

chgrp vmail /etc/dovecot/dovecot.conf
chmod g+r /etc/dovecot/dovecot.conf

the default is already world readable (644)

error in mail.log

Submitted by Anonymous on Tue, 06/28/2011 - 23:24.

Hi, I have this error in mail.log 

 

dovecot: Dovecot v1.2.15 starting up (core dumps disabled)

dovecot: auth(default): bind(/var/spool/postifx/private/auth) failed: No such file or directory

dovecot: auth(default): Fatal: net_listen_unix(/var/spool/postifx/private/auth) failed: No such file or directory

dovecot: dovecot: Fatal: Auth process died too early - shutting down
and this in mail.err
	dovecot: auth(default): bind(/var/spool/postifx/private/auth) failed: No such file or directory

dovecot: auth(default): Fatal: net_listen_unix(/var/spool/postifx/private/auth) failed: No such file or directory

dovecot: Fatal: Auth process died too early - shutting down
an ideas?

You've got a

Submitted by Anonymous on Wed, 06/29/2011 - 06:33.

You've got a typo: /var/spool/postifx/private/auth should be /var/spool/postfix/private/auth.

it's a stupid mistake

Submitted by Anonymous on Wed, 06/29/2011 - 09:40.

thanks

mail_location problem

Submitted by Anonymous on Tue, 07/12/2011 - 18:57.

When I try to send an email, I always get the following response:

Diagnostic-Code: x-unix; procmail: Couldn't create "/var/mail/john"

I don't know why the mail_location option doesn't works. Meybe I made a mistake somewhere else, but I don't know how to debug this issue. Can everyone give me hint?

chmod 777

Submitted by Anonymous on Thu, 01/19/2012 - 17:00.

chmod 777 /var/spool/mail

 

Not a good solution. will help to figure out

That recommendation is

Submitted by Anonymous on Fri, 01/20/2012 - 01:57.

That recommendation is neither related nor in any way decent. Please don't do that.

trouble with e-mails receive ...

Submitted by Anonymous on Wed, 08/31/2011 - 07:04.

I installed all as described. I was stuck in a time when I send mail. It goes to the proper directory, but the attempt to read the post fails.
referrals: telnet localhost pop3, then logs, password, and the commandos, "stat" returns "+ OK 0 0", whilethere are messages in the directory / home / vmail / domain / user / Maildir ... .
My impression is that not pop3 link referral to the proper directory, or is poorly set some path, but where?
Surely somewhere there is an error, because the logs do not currently have any irregularities.
Any idea?

This runs but...

Submitted by Anonymous on Sat, 09/24/2011 - 20:02.

Hello

i tried this tutorial until this Topic.

I see this logmessage but on which option will be set that the Mailhome is on /var/vmail....?

about the logfile

Submitted by Anonymous on Tue, 11/15/2011 - 16:26.

You should make a comment about which permissions to use if you want to use a different log-file than the mail.log from below

protocol lda {
    auth_socket_path = /var/run/dovecot/auth-master
    postmaster_address = postmaster@example.com
    mail_plugins = sieve
    log_path =
}

I got an error saying

(temporary failure. Command output: Can't open log file /var/log/another-filenamename.log: Permission denied )

And I don't know which permissions to set on this file.

Update for Dovecot 2.x

Submitted by Anonymous on Tue, 11/22/2011 - 18:02.

Can you please update the configuration setting for Davecot 2.x?

It seems quite different from 1.x

 

Thank you so much....

Squeeze doesn't come with

Submitted by Anonymous on Tue, 11/22/2011 - 18:52.

Squeeze doesn't come with 2.x. So if you are on 2.x then you are not on a stable system any more.

Help

Submitted by Anonymous on Wed, 11/23/2011 - 19:53.

This doesnt change the fact that I need help.

Are you able to help me?

Well, this tutorial deals

Submitted by Christoph Haas on Thu, 11/24/2011 - 09:58.

Well, this tutorial deals with Squeeze. So adding information on how to deal with Dovecot 2.x wouldn't help in the context of this tutorial. I might be able to help. But basically if you got Dovecot 1.x running then upgrading to 2.x shouldn't be that hard. A few parameters have changed which is documented in the README.Debian. But the general principle and the connection to Postfix doesn't change much.

I have error in

Submitted by Anonymous on Sun, 12/25/2011 - 04:09.

I have error in mail.log

dovecot: Dovecot v1.2.15 starting up (core dumps disabled)
dovecot: auth(default): Fatal: static userdb: Empty key (=)
dovecot: dovecot: Fatal: Auth process died too early - shutting down

What is the problem?

Dovecot 2.x "Translation"

Submitted by Anonymous on Sun, 01/08/2012 - 15:17.

I'm trying to setup dovecot 2.x right now and thought that I might share some information with you ..

protocols = imap imaps pop3 pop3s
>> to be found in /usr/share/dovecot/protocols.d/ (in 2 files; they are included by /etc/dovecot/dovecot.conf)

disable_plaintext_auth = no
mechanisms = plain login AS auth_mechanism = plain login
>> to be found in /etc/dovecot/conf.d/10-auth.conf

mail_location = maildir:/var/vmail/%d/%n/Maildir
namespace private {
separator = .
inbox = yes
}
>> /etc/dovecot/conf.d/10-mail.conf

passdb sql {
  args = /etc/dovecot/dovecot-sql.conf
}
userdb static {
  args = uid=5000 gid=5000 home=/var/vmail/%d/%n/Maildir allow_all_users=yes
}
AS
passdb {
  driver = sql
  args = /etc/dovecot/dovecot-sql.conf.ext
}
userdb {
  driver = static
  args = uid=5000 gid=5000 home=/var/vmail/%d/%n/Maildir allow_all_users=yes
}
# you should create an empty file "conf.d/auth-sql.conf.ext" and uncomment the line "!include auth-sql.conf.ext" in 10-auth.conf (at the end of the file)
>> /etc/dovecot/conf.d/auth-sql.conf.ext

socket listen {
  master {
    path = /var/run/dovecot/auth-master
    mode = 0600
    user = vmail
  }
  client {
    path = /var/spool/postfix/private/auth
    mode = 0660
    user = postfix
    group = postfix
  }
}
(maybe) AS
Service auth {
  unix_listener /var/run/dovecot/auth-master {
    mode = 0600
    user = vmail
    group = vmail
  }
  # Postfix smtp-auth
  unix_listener /var/spool/postfix/private/auth {
    mode = 0660
    user = postfix
    group = postfix
  }
}
# have to test it ...
>> /etc/dovecot/conf.d/10-master.conf

protocol lda {
  auth_socket_path = /var/run/dovecot/auth-master
  postmaster_address = postmaster@example.com
  mail_plugins = sieve
  log_path =
}
#postmaster_adress isn't included in protocol lda, has it's own line at the beginning of the file.
#Maybe auth_socket_path is not needed here anymore, will test it and report ...
>> /etc/dovecot/conf.d/15-lda.conf

driver = mysql
connect = host=127.0.0.1 dbname=mailserver user=mailuser password=mailuser2011
default_pass_scheme = PLAIN-MD5
password_query = SELECT email as user, password FROM virtual_users WHERE email='%u';
>> /etc/dovecot/dovecot-sql.conf.ext (all lines are commented out)

And finally you have to chgrp and chmod the dovecot.conf,the whole conf.d/ directory and /usr/share/dovecot/protocols.d/ (as it gets included during runtime or you just replace the include in dovecot.conf with "protocols = imap imaps pop3 pop3s")

Something absofuckinglutely useful ...

Submitted by Anonymous on Sun, 01/08/2012 - 16:35.

sudo /usr/sbin/dovecot -F -c /etc/dovecot/dovecot.conf

Debug output when trying to start dovecot. Helps a lot tracking down errors ...

Reporting ...

Submitted by Anonymous on Mon, 01/09/2012 - 20:24.

Except that

unix_listener /var/run/dovecot/auth-master

is just

unix_listener auth-master

everything seems to be correct and Dovecot works fine.



please note the changes from dovecot 2.0.12 to 2.0.13

Submitted by Anonymous on Mon, 02/20/2012 - 21:30.
Service auth {
  unix_listener /var/run/dovecot/auth-master {
    mode = 0600
    user = vmail
    group = vmail
  }

...

 }

is not  accepted anymore--->

unix_listener /var/run/dovecot/auth-master

<---is not accepted anymore.

it needs to be :

 Service  auth {

  #
  # be aware!: unix_listener auth-master <-
  # stays for /var/run/dovecot/auth-master !without the base-dir prefix!
  #
  unix_listener auth-master {
    mode = 0600
    user = vmail
    group = vmail
    }

  ...

mail_location and home

Submitted by Anonymous on Mon, 01/09/2012 - 21:21.

Hi!

According to the dovecot homepage, it is not advisable to have the same location for home and mail, i.e.:

   mail_location = maildir:/var/vmail/%d/%n/Maildir

and in userdb

   home=/var/vmail/%d/%n/Maildir 

This apparently could lead to conflicts, for example with sieve. For details see http://wiki.dovecot.org/VirtualUsers/Home

That's true

Submitted by Anonymous on Thu, 02/16/2012 - 10:05.

Thanks for this comment. I changed it: 

mail_location = maildir:/var/vmail/%d/%n/mail

and in the userdb static { section I used 

args = uid=5000 gid=5000 home=/var/vmail/%d/%n/home allow_all_users=yes

Hope this is ok ?

user vmail

Submitted by Anonymous on Sun, 02/05/2012 - 19:31.

hi,

does the user vmail really needs a valid shell or can i type

useradd -g vmail -u 5000 vmail -d /var/vmail -m -s /bin/false

best regards

The contents of this web site is Copyright © 2000-2011 Christoph Haas - Impressum/Imprints -  Donations welcome

Drupal theme by Kiwi Themes.