Raspberrypi.mail: Unterschied zwischen den Versionen
Zur Navigation springen
Zur Suche springen
Root (Diskussion | Beiträge) Keine Bearbeitungszusammenfassung |
|||
(68 dazwischenliegende Versionen von 2 Benutzern werden nicht angezeigt) | |||
Zeile 1: | Zeile 1: | ||
Internet | == Konzept == | ||
smtp | Internet | Raspi | ||
pop3 | | | ||
:25 (smtp) -> [ Postfix ] -> Filesystem "/var/mail/<i>user</i>" | |||
| -> dovecot User API | |||
| | |||
:110 (pop3) -> [ dovecot ] -> Filesystem "/var/mail/<i>user</i>" | |||
| -> Linux User API | |||
* Mein Ziel ist ein ordentlicher eigenständiger Mailserver (er braucht keinen anderen Mailserver zum versenden der Mail) | |||
* Es soll keine Datenbank nötig sein | |||
* Mail-Accounts sind native Linux-<code><i>user</i></code>, über den Kernel läuft somit auch die Authentifizierung | |||
* Ein Mail-Account heisst so wie der <code><i>user</i></code> | |||
* Mail-Speicherung erfolgt im mbox Format in /var/mail so wie das Linux vorsieht | |||
* alle eMail-Adressen/eMail-Domains sind in der Text-Datei "/etc/postfix/virtual" aufgelistet | |||
== Vorarbeiten == | |||
=== benötigte Software === | |||
apt-get install dovecot-pop3d postfix dnsutils | |||
== Ordentlich starten == | |||
* postfix ist von dovecot abhängig, deshalb sollte postfix erst starten wenn dovecot schon Aktiv ist, hier definiere ich die Abhängigkeit | |||
=== erst dovecot === | |||
joe /lib/systemd/system/dovecot.service | |||
[Unit] | |||
<b><i>Requires=network-online.target</i></b> | |||
<b><i>After=network-online.target</i></b> | |||
=== dann postfix === | |||
joe /lib/systemd/system/postfix.service | |||
[Unit] | |||
<b><i>Requires=dovecot.service</i></b> | |||
<b><i>After=network-online.target nss-lookup.target dovecot.service</i></b> | |||
=== Dienst beim Reboot starten === | |||
systemctl enable dovecot | |||
systemctl enable postfix | |||
[[Datei:Pi-dovecot-postfix.png]] | |||
== postfix == | == postfix == | ||
http://www.postfix.org/features.html | http://www.postfix.org/features.html | ||
=== main.cf === | |||
# See /usr/share/postfix/main.cf.dist for a commented, more complete version | |||
# Debian specific: Specifying a file name will cause the first | |||
# line of that file to be used as the name. The Debian default | |||
# is /etc/mailname. | |||
#myorigin = /etc/mailname | |||
smtpd_banner = $myhostname ESMTP $mail_name (Raspbian) | |||
biff = no | |||
# appending .domain is the MUA's job. | |||
append_dot_mydomain = no | |||
# Uncomment the next line to generate "delayed mail" warnings | |||
#delay_warning_time = 4h | |||
readme_directory = no | |||
# See http://www.postfix.org/COMPATIBILITY_README.html -- default to 2 on | |||
# fresh installs. | |||
compatibility_level = 2 | |||
# TLS parameters | |||
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem | |||
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key | |||
smtpd_use_tls=no | |||
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache | |||
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache | |||
# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for | |||
# information on enabling SSL in the smtp client. | |||
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination | |||
myhostname = mx.orgamon.eu | |||
alias_maps = hash:/etc/aliases | |||
alias_database = hash:/etc/aliases | |||
mydestination = $myhostname, pi3x05, localhost.localdomain, , localhost | |||
relayhost = | |||
mynetworks = 192.168.115.0/24 127.0.0.0/8 | |||
mailbox_size_limit = 99999999 | |||
message_size_limit = 99999999 | |||
recipient_delimiter = + | |||
inet_interfaces = all | |||
inet_protocols = ipv4 | |||
virtual_maps = hash:/etc/postfix/virtual | |||
smtpd_sasl_auth_enable = yes | |||
smtpd_recipient_restrictions = permit_sasl_authenticated, reject_unauth_destination | |||
smtpd_sasl_type = dovecot | |||
smtpd_sasl_path = private/auth | |||
=== virtual === | |||
# | |||
# Rechte sicherstellen, (Verändern vermeiden) | |||
# | |||
chmod 644 virtual | |||
# | |||
# "virtual.db" neu erstellen (Bei jeder Änderung von "virtual") | |||
# | |||
postmap virtual | |||
=== Test === | |||
* https://www.thomas-krenn.com/de/wiki/TCP_Port_25_(smtp)_Zugriff_mit_telnet_%C3%BCberpr%C3%BCfen | |||
* https://www.ndchost.com/wiki/mail/test-smtp-auth-telnet | |||
== dovecot == | == dovecot == | ||
=== Information === | |||
https://dovecot.org/ | https://dovecot.org/ | ||
=== Installation === | |||
apt-get install dovecot-pop3d | |||
=== Konfiguration === | |||
==== /etc/dovecot/conf.d/10-ssl.conf ==== | |||
## | |||
## SSL settings | |||
## | |||
# SSL/TLS support: yes, no, required. <doc/wiki/SSL.txt> | |||
ssl = no | |||
# PEM encoded X.509 SSL/TLS certificate and private key. They're opened before | |||
# dropping root privileges, so keep the key file unreadable by anyone but | |||
# root. Included doc/mkcert.sh can be used to easily generate self-signed | |||
# certificate, just make sure to update the domains in dovecot-openssl.cnf | |||
#ssl_cert = </etc/dovecot/dovecot.pem | |||
#ssl_key = </etc/dovecot/private/dovecot.pem | |||
# If key file is password protected, give the password here. Alternatively | |||
# give it when starting dovecot with -p parameter. Since this file is often | |||
# world-readable, you may want to place this setting instead to a different | |||
# root owned 0600 file by using ssl_key_password = <path. | |||
#ssl_key_password = | |||
# PEM encoded trusted certificate authority. Set this only if you intend to use | |||
# ssl_verify_client_cert=yes. The file should contain the CA certificate(s) | |||
# followed by the matching CRL(s). (e.g. ssl_ca = </etc/ssl/certs/ca.pem) | |||
#ssl_ca = | |||
# Require that CRL check succeeds for client certificates. | |||
#ssl_require_crl = yes | |||
# Directory and/or file for trusted SSL CA certificates. These are used only | |||
# when Dovecot needs to act as an SSL client (e.g. imapc backend). The | |||
# directory is usually /etc/ssl/certs in Debian-based systems and the file is | |||
# /etc/pki/tls/cert.pem in RedHat-based systems. | |||
#ssl_client_ca_dir = | |||
#ssl_client_ca_file = | |||
# Request client to send a certificate. If you also want to require it, set | |||
# auth_ssl_require_client_cert=yes in auth section. | |||
#ssl_verify_client_cert = no | |||
# Which field from certificate to use for username. commonName and | |||
# x500UniqueIdentifier are the usual choices. You'll also need to set | |||
# auth_ssl_username_from_cert=yes. | |||
#ssl_cert_username_field = commonName | |||
# DH parameters length to use. | |||
#ssl_dh_parameters_length = 1024 | |||
# SSL protocols to use | |||
#ssl_protocols = !SSLv3 | |||
# SSL ciphers to use | |||
#ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL | |||
# Prefer the server's order of ciphers over client's. | |||
#ssl_prefer_server_ciphers = no | |||
# SSL crypto device to use, for valid values run "openssl engine" | |||
#ssl_crypto_device = | |||
# SSL extra options. Currently supported options are: | |||
# no_compression - Disable compression. | |||
#ssl_options = | |||
==== /etc/dovecot/conf.d/10-master.conf ==== | |||
#default_process_limit = 100 | |||
#default_client_limit = 1000 | |||
# Default VSZ (virtual memory size) limit for service processes. This is mainly | |||
# intended to catch and kill processes that leak memory before they eat up | |||
# everything. | |||
#default_vsz_limit = 256M | |||
# Login user is internally used by login processes. This is the most untrusted | |||
# user in Dovecot system. It shouldn't have access to anything at all. | |||
#default_login_user = dovenull | |||
# Internal user is used by unprivileged processes. It should be separate from | |||
# login user, so that login processes can't disturb other processes. | |||
#default_internal_user = dovecot | |||
service imap-login { | |||
inet_listener imap { | |||
#port = 143 | |||
} | |||
inet_listener imaps { | |||
#port = 993 | |||
#ssl = yes | |||
} | |||
# Number of connections to handle before starting a new process. Typically | |||
# the only useful values are 0 (unlimited) or 1. 1 is more secure, but 0 | |||
# is faster. <doc/wiki/LoginProcess.txt> | |||
#service_count = 1 | |||
# Number of processes to always keep waiting for more connections. | |||
#process_min_avail = 0 | |||
# If you set service_count=0, you probably need to grow this. | |||
#vsz_limit = $default_vsz_limit | |||
} | |||
service pop3-login { | |||
inet_listener pop3 { | |||
#port = 110 | |||
} | |||
inet_listener pop3s { | |||
#port = 995 | |||
#ssl = yes | |||
} | |||
} | |||
service lmtp { | |||
unix_listener lmtp { | |||
#mode = 0666 | |||
} | |||
# Create inet listener only if you can't use the above UNIX socket | |||
#inet_listener lmtp { | |||
# Avoid making LMTP visible for the entire internet | |||
#address = | |||
#port = | |||
#} | |||
} | |||
service imap { | |||
# Most of the memory goes to mmap()ing files. You may need to increase this | |||
# limit if you have huge mailboxes. | |||
#vsz_limit = $default_vsz_limit | |||
# Max. number of IMAP processes (connections) | |||
#process_limit = 1024 | |||
} | |||
service pop3 { | |||
# Max. number of POP3 processes (connections) | |||
#process_limit = 1024 | |||
} | |||
service auth { | |||
# auth_socket_path points to this userdb socket by default. It's typically | |||
# used by dovecot-lda, doveadm, possibly imap process, etc. Users that have | |||
# full permissions to this socket are able to get a list of all usernames and | |||
# get the results of everyone's userdb lookups. | |||
# | |||
# The default 0666 mode allows anyone to connect to the socket, but the | |||
# userdb lookups will succeed only if the userdb returns an "uid" field that | |||
# matches the caller process's UID. Also if caller's uid or gid matches the | |||
# socket's uid or gid the lookup succeeds. Anything else causes a failure. | |||
# | |||
# To give the caller full permissions to lookup all users, set the mode to | |||
# something else than 0666 and Dovecot lets the kernel enforce the | |||
# permissions (e.g. 0777 allows everyone full permissions). | |||
unix_listener auth-userdb { | |||
#mode = 0666 | |||
#user = | |||
#group = | |||
} | |||
# Postfix smtp-auth | |||
unix_listener /var/spool/postfix/private/auth { | |||
# mode = 0666 | |||
user = postfix | |||
group = postfix | |||
} | |||
# Auth process is run as this user. | |||
#user = $default_internal_user | |||
} | |||
service auth-worker { | |||
# Auth worker process is run as root by default, so that it can access | |||
# /etc/shadow. If this isn't necessary, the user should be changed to | |||
# $default_internal_user. | |||
#user = root | |||
} | |||
service dict { | |||
# If dict proxy is used, mail processes should have access to its socket. | |||
# For example: mode=0660, group=vmail and global mail_access_groups=vmail | |||
unix_listener dict { | |||
#mode = 0600 | |||
#user = | |||
#group = | |||
} | |||
} | |||
==== /etc/dovecot/conf.d/10-logging.conf ==== | |||
## | |||
## Log destination. | |||
## | |||
# Log file to use for error messages. "syslog" logs to syslog, | |||
# /dev/stderr logs to stderr. | |||
#log_path = syslog | |||
# Log file to use for informational messages. Defaults to log_path. | |||
#info_log_path = | |||
# Log file to use for debug messages. Defaults to info_log_path. | |||
#debug_log_path = | |||
# Syslog facility to use if you're logging to syslog. Usually if you don't | |||
# want to use "mail", you'll use local0..local7. Also other standard | |||
# facilities are supported. | |||
#syslog_facility = mail | |||
## | |||
## Logging verbosity and debugging. | |||
## | |||
# Log unsuccessful authentication attempts and the reasons why they failed. | |||
auth_verbose = yes | |||
# In case of password mismatches, log the attempted password. Valid values are | |||
# no, plain and sha1. sha1 can be useful for detecting brute force password | |||
# attempts vs. user simply trying the same password over and over again. | |||
# You can also truncate the value to n chars by appending ":n" (e.g. sha1:6). | |||
#auth_verbose_passwords = no | |||
# Even more verbose logging for debugging purposes. Shows for example SQL | |||
# queries. | |||
#auth_debug = no | |||
# In case of password mismatches, log the passwords and used scheme so the | |||
# problem can be debugged. Enabling this also enables auth_debug. | |||
#auth_debug_passwords = no | |||
# Enable mail process debugging. This can help you figure out why Dovecot | |||
# isn't finding your mails. | |||
mail_debug = yes | |||
# Show protocol level SSL errors. | |||
#verbose_ssl = no | |||
# mail_log plugin provides more event logging for mail processes. | |||
plugin { | |||
# Events to log. Also available: flag_change append | |||
#mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename | |||
# Available fields: uid, box, msgid, from, subject, size, vsize, flags | |||
# size and vsize are available only for expunge and copy events. | |||
#mail_log_fields = uid box msgid size | |||
} | |||
## | |||
## Log formatting. | |||
## | |||
# Prefix for each line written to log file. % codes are in strftime(3) | |||
# format. | |||
#log_timestamp = "%b %d %H:%M:%S " | |||
# Space-separated list of elements we want to log. The elements which have | |||
# a non-empty variable value are joined together to form a comma-separated | |||
# string. | |||
#login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c | |||
# Login log format. %s contains login_log_format_elements string, %$ contains | |||
# the data we want to log. | |||
#login_log_format = %$: %s | |||
# Log prefix for mail processes. See doc/wiki/Variables.txt for list of | |||
# possible variables you can use. | |||
#mail_log_prefix = "%s(%u): " | |||
# Format to use for logging mail deliveries. See doc/wiki/Variables.txt for | |||
# list of all variables you can use. Some of the common ones include: | |||
# %$ - Delivery status message (e.g. "saved to INBOX") | |||
# %m - Message-ID | |||
# %s - Subject | |||
# %f - From address | |||
# %p - Physical size | |||
# %w - Virtual size | |||
#deliver_log_format = msgid=%m: %$ | |||
==== /etc/dovecot/conf.d/auth-passwdfile.conf.ext ==== | |||
# Authentication for passwd-file users. Included from 10-auth.conf. | |||
# | |||
# passwd-like file with specified location. | |||
# <doc/wiki/AuthDatabase.PasswdFile.txt> | |||
#passdb { | |||
#driver = passwd-file | |||
#args = scheme=CRYPT username_format=%u /etc/dovecot/users | |||
#} | |||
#userdb { | |||
#driver = passwd-file | |||
#args = username_format=%u /etc/dovecot/users | |||
# Default fields that can be overridden by passwd-file | |||
#default_fields = quota_rule=*:storage=1G | |||
# Override fields from passwd-file | |||
#override_fields = home=/home/virtual/%u | |||
#} | |||
==== /etc/dovecot/conf.d/auth-system.conf.ext ==== | |||
# Authentication for system users. Included from 10-auth.conf. | |||
# | |||
# <doc/wiki/PasswordDatabase.txt> | |||
# <doc/wiki/UserDatabase.txt> | |||
# PAM authentication. Preferred nowadays by most systems. | |||
# PAM is typically used with either userdb passwd or userdb static. | |||
# REMEMBER: You'll need /etc/pam.d/dovecot file created for PAM | |||
# authentication to actually work. <doc/wiki/PasswordDatabase.PAM.txt> | |||
passdb { | |||
driver = pam | |||
# [session=yes] [setcred=yes] [failure_show_msg=yes] [max_requests=<n>] | |||
# [cache_key=<key>] [<service name>] | |||
args = failure_show_msg=yes | |||
} | |||
# System users (NSS, /etc/passwd, or similiar). | |||
# In many systems nowadays this uses Name Service Switch, which is | |||
# configured in /etc/nsswitch.conf. <doc/wiki/AuthDatabase.Passwd.txt> | |||
#passdb { | |||
#driver = passwd | |||
# [blocking=no] | |||
#args = | |||
#} | |||
# Shadow passwords for system users (NSS, /etc/shadow or similiar). | |||
# Deprecated by PAM nowadays. | |||
# <doc/wiki/PasswordDatabase.Shadow.txt> | |||
#passdb { | |||
#driver = shadow | |||
# [blocking=no] | |||
#args = | |||
#} | |||
# PAM-like authentication for OpenBSD. | |||
# <doc/wiki/PasswordDatabase.BSDAuth.txt> | |||
#passdb { | |||
#driver = bsdauth | |||
# [blocking=no] [cache_key=<key>] | |||
#args = | |||
#} | |||
## | |||
## User databases | |||
## | |||
# System users (NSS, /etc/passwd, or similiar). In many systems nowadays this | |||
# uses Name Service Switch, which is configured in /etc/nsswitch.conf. | |||
#userdb { | |||
# <doc/wiki/AuthDatabase.Passwd.txt> | |||
# driver = passwd | |||
# [blocking=no] | |||
#args = | |||
# Override fields from passwd | |||
#override_fields = home=/home/virtual/%u | |||
#} | |||
# Static settings generated from template <doc/wiki/UserDatabase.Static.txt> | |||
#userdb { | |||
#driver = static | |||
# Can return anything a userdb could normally return. For example: | |||
# | |||
# args = uid=500 gid=500 home=/var/mail/%u | |||
# | |||
# LDA and LMTP needs to look up users only from the userdb. This of course | |||
# doesn't work with static userdb because there is no list of users. | |||
# Normally static userdb handles this by doing a passdb lookup. This works | |||
# with most passdbs, with PAM being the most notable exception. If you do | |||
# the user verification another way, you can add allow_all_users=yes to | |||
# the args in which case the passdb lookup is skipped. | |||
# | |||
#args = | |||
#} | |||
==== /etc/dovecot/conf.d/10-auth.conf ==== | |||
## | |||
## Authentication processes | |||
## | |||
# Disable LOGIN command and all other plaintext authentications unless | |||
# SSL/TLS is used (LOGINDISABLED capability). Note that if the remote IP | |||
# matches the local IP (ie. you're connecting from the same computer), the | |||
# connection is considered secure and plaintext authentication is allowed. | |||
# See also ssl=required setting. | |||
disable_plaintext_auth = no | |||
# Authentication cache size (e.g. 10M). 0 means it's disabled. Note that | |||
# bsdauth, PAM and vpopmail require cache_key to be set for caching to be used. | |||
#auth_cache_size = 0 | |||
# Time to live for cached data. After TTL expires the cached record is no | |||
# longer used, *except* if the main database lookup returns internal failure. | |||
# We also try to handle password changes automatically: If user's previous | |||
# authentication was successful, but this one wasn't, the cache isn't used. | |||
# For now this works only with plaintext authentication. | |||
#auth_cache_ttl = 1 hour | |||
# TTL for negative hits (user not found, password mismatch). | |||
# 0 disables caching them completely. | |||
#auth_cache_negative_ttl = 1 hour | |||
# Space separated list of realms for SASL authentication mechanisms that need | |||
# them. You can leave it empty if you don't want to support multiple realms. | |||
# Many clients simply use the first one listed here, so keep the default realm | |||
# first. | |||
#auth_realms = | |||
# Default realm/domain to use if none was specified. This is used for both | |||
# SASL realms and appending @domain to username in plaintext logins. | |||
#auth_default_realm = | |||
# List of allowed characters in username. If the user-given username contains | |||
# a character not listed in here, the login automatically fails. This is just | |||
# an extra check to make sure user can't exploit any potential quote escaping | |||
# vulnerabilities with SQL/LDAP databases. If you want to allow all characters, | |||
# set this value to empty. | |||
#auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@ | |||
# Username character translations before it's looked up from databases. The | |||
# value contains series of from -> to characters. For example "#@/@" means | |||
# that '#' and '/' characters are translated to '@'. | |||
#auth_username_translation = | |||
# Username formatting before it's looked up from databases. You can use | |||
# the standard variables here, eg. %Lu would lowercase the username, %n would | |||
# drop away the domain if it was given, or "%n-AT-%d" would change the '@' into | |||
# "-AT-". This translation is done after auth_username_translation changes. | |||
#auth_username_format = %Lu | |||
# If you want to allow master users to log in by specifying the master | |||
# username within the normal username string (ie. not using SASL mechanism's | |||
# support for it), you can specify the separator character here. The format | |||
# is then <username><separator><master username>. UW-IMAP uses "*" as the | |||
# separator, so that could be a good choice. | |||
#auth_master_user_separator = | |||
# Username to use for users logging in with ANONYMOUS SASL mechanism | |||
#auth_anonymous_username = anonymous | |||
# Maximum number of dovecot-auth worker processes. They're used to execute | |||
# blocking passdb and userdb queries (eg. MySQL and PAM). They're | |||
# automatically created and destroyed as needed. | |||
#auth_worker_max_count = 30 | |||
# Host name to use in GSSAPI principal names. The default is to use the | |||
# name returned by gethostname(). Use "$ALL" (with quotes) to allow all keytab | |||
# entries. | |||
#auth_gssapi_hostname = | |||
# Kerberos keytab to use for the GSSAPI mechanism. Will use the system | |||
# default (usually /etc/krb5.keytab) if not specified. You may need to change | |||
# the auth service to run as root to be able to read this file. | |||
#auth_krb5_keytab = | |||
# Do NTLM and GSS-SPNEGO authentication using Samba's winbind daemon and | |||
# ntlm_auth helper. <doc/wiki/Authentication/Mechanisms/Winbind.txt> | |||
#auth_use_winbind = no | |||
# Path for Samba's ntlm_auth helper binary. | |||
#auth_winbind_helper_path = /usr/bin/ntlm_auth | |||
# Time to delay before replying to failed authentications. | |||
#auth_failure_delay = 2 secs | |||
# Require a valid SSL client certificate or the authentication fails. | |||
#auth_ssl_require_client_cert = no | |||
# Take the username from client's SSL certificate, using | |||
# X509_NAME_get_text_by_NID() which returns the subject's DN's | |||
# CommonName. | |||
#auth_ssl_username_from_cert = no | |||
# Space separated list of wanted authentication mechanisms: | |||
# plain login digest-md5 cram-md5 ntlm rpa apop anonymous gssapi otp skey | |||
# gss-spnego | |||
# NOTE: See also disable_plaintext_auth setting. | |||
auth_mechanisms = plain login | |||
## | |||
## Password and user databases | |||
## | |||
# | |||
# Password database is used to verify user's password (and nothing more). | |||
# You can have multiple passdbs and userdbs. This is useful if you want to | |||
# allow both system users (/etc/passwd) and virtual users to login without | |||
# duplicating the system users into virtual database. | |||
# | |||
# <doc/wiki/PasswordDatabase.txt> | |||
# | |||
# User database specifies where mails are located and what user/group IDs | |||
# own them. For single-UID configuration use "static" userdb. | |||
# | |||
# <doc/wiki/UserDatabase.txt> | |||
#!include auth-deny.conf.ext | |||
#!include auth-master.conf.ext | |||
!include auth-system.conf.ext | |||
#!include auth-sql.conf.ext | |||
#!include auth-ldap.conf.ext | |||
!include auth-passwdfile.conf.ext | |||
#!include auth-checkpassword.conf.ext | |||
#!include auth-vpopmail.conf.ext | |||
#!include auth-static.conf.ext | |||
==== /etc/dovecot/conf.d/10-mail.conf ==== | |||
## | |||
## Mailbox locations and namespaces | |||
## | |||
# Location for users' mailboxes. The default is empty, which means that Dovecot | |||
# tries to find the mailboxes automatically. This won't work if the user | |||
# doesn't yet have any mail, so you should explicitly tell Dovecot the full | |||
# location. | |||
# | |||
# If you're using mbox, giving a path to the INBOX file (eg. /var/mail/%u) | |||
# isn't enough. You'll also need to tell Dovecot where the other mailboxes are | |||
# kept. This is called the "root mail directory", and it must be the first | |||
# path given in the mail_location setting. | |||
# | |||
# There are a few special variables you can use, eg.: | |||
# | |||
# %u - username | |||
# %n - user part in user@domain, same as %u if there's no domain | |||
# %d - domain part in user@domain, empty if there's no domain | |||
# %h - home directory | |||
# | |||
# See doc/wiki/Variables.txt for full list. Some examples: | |||
# | |||
# mail_location = maildir:~/Maildir | |||
# mail_location = mbox:~/mail:INBOX=/var/mail/%u | |||
# mail_location = mbox:/var/mail/%d/%1n/%n:INDEX=/var/indexes/%d/%1n/%n | |||
# | |||
# <doc/wiki/MailLocation.txt> | |||
# | |||
mail_location = mbox:/home/%u:INBOX=/var/mail/%u | |||
# If you need to set multiple mailbox locations or want to change default | |||
# namespace settings, you can do it by defining namespace sections. | |||
# | |||
# You can have private, shared and public namespaces. Private namespaces | |||
# are for user's personal mails. Shared namespaces are for accessing other | |||
# users' mailboxes that have been shared. Public namespaces are for shared | |||
# mailboxes that are managed by sysadmin. If you create any shared or public | |||
# namespaces you'll typically want to enable ACL plugin also, otherwise all | |||
# users can access all the shared mailboxes, assuming they have permissions | |||
# on filesystem level to do so. | |||
namespace inbox { | |||
# Namespace type: private, shared or public | |||
#type = private | |||
# Hierarchy separator to use. You should use the same separator for all | |||
# namespaces or some clients get confused. '/' is usually a good one. | |||
# The default however depends on the underlying mail storage format. | |||
#separator = | |||
# Prefix required to access this namespace. This needs to be different for | |||
# all namespaces. For example "Public/". | |||
#prefix = | |||
# Physical location of the mailbox. This is in same format as | |||
# mail_location, which is also the default for it. | |||
#location = | |||
# There can be only one INBOX, and this setting defines which namespace | |||
# has it. | |||
inbox = yes | |||
# If namespace is hidden, it's not advertised to clients via NAMESPACE | |||
# extension. You'll most likely also want to set list=no. This is mostly | |||
# useful when converting from another server with different namespaces which | |||
# you want to deprecate but still keep working. For example you can create | |||
# hidden namespaces with prefixes "~/mail/", "~%u/mail/" and "mail/". | |||
#hidden = no | |||
# Show the mailboxes under this namespace with LIST command. This makes the | |||
# namespace visible for clients that don't support NAMESPACE extension. | |||
# "children" value lists child mailboxes, but hides the namespace prefix. | |||
#list = yes | |||
# Namespace handles its own subscriptions. If set to "no", the parent | |||
# namespace handles them (empty prefix should always have this as "yes") | |||
#subscriptions = yes | |||
# See 15-mailboxes.conf for definitions of special mailboxes. | |||
} | |||
# Example shared namespace configuration | |||
#namespace { | |||
#type = shared | |||
#separator = / | |||
# Mailboxes are visible under "shared/user@domain/" | |||
# %%n, %%d and %%u are expanded to the destination user. | |||
#prefix = shared/%%u/ | |||
# Mail location for other users' mailboxes. Note that %variables and ~/ | |||
# expands to the logged in user's data. %%n, %%d, %%u and %%h expand to the | |||
# destination user's data. | |||
#location = maildir:%%h/Maildir:INDEX=~/Maildir/shared/%%u | |||
# Use the default namespace for saving subscriptions. | |||
#subscriptions = no | |||
# List the shared/ namespace only if there are visible shared mailboxes. | |||
#list = children | |||
#} | |||
# Should shared INBOX be visible as "shared/user" or "shared/user/INBOX"? | |||
#mail_shared_explicit_inbox = no | |||
# System user and group used to access mails. If you use multiple, userdb | |||
# can override these by returning uid or gid fields. You can use either numbers | |||
# or names. <doc/wiki/UserIds.txt> | |||
mail_uid = postfix | |||
mail_gid = postfix | |||
# Group to enable temporarily for privileged operations. Currently this is | |||
# used only with INBOX when either its initial creation or dotlocking fails. | |||
# Typically this is set to "mail" to give access to /var/mail. | |||
mail_privileged_group = mail | |||
# Grant access to these supplementary groups for mail processes. Typically | |||
# these are used to set up access to shared mailboxes. Note that it may be | |||
# dangerous to set these if users can create symlinks (e.g. if "mail" group is | |||
# set here, ln -s /var/mail ~/mail/var could allow a user to delete others' | |||
# mailboxes, or ln -s /secret/shared/box ~/mail/mybox would allow reading it). | |||
#mail_access_groups = | |||
# Allow full filesystem access to clients. There's no access checks other than | |||
# what the operating system does for the active UID/GID. It works with both | |||
# maildir and mboxes, allowing you to prefix mailboxes names with eg. /path/ | |||
# or ~user/. | |||
#mail_full_filesystem_access = no | |||
# Dictionary for key=value mailbox attributes. This is used for example by | |||
# URLAUTH and METADATA extensions. | |||
#mail_attribute_dict = | |||
# A comment or note that is associated with the server. This value is | |||
# accessible for authenticated users through the IMAP METADATA server | |||
# entry "/shared/comment". | |||
#mail_server_comment = "" | |||
# Indicates a method for contacting the server administrator. According to | |||
# RFC 5464, this value MUST be a URI (e.g., a mailto: or tel: URL), but that | |||
# is currently not enforced. Use for example mailto:admin@example.com. This | |||
# value is accessible for authenticated users through the IMAP METADATA server | |||
# entry "/shared/admin". | |||
#mail_server_admin = | |||
## | |||
## Mail processes | |||
## | |||
# Don't use mmap() at all. This is required if you store indexes to shared | |||
# filesystems (NFS or clustered filesystem). | |||
#mmap_disable = no | |||
# Rely on O_EXCL to work when creating dotlock files. NFS supports O_EXCL | |||
# since version 3, so this should be safe to use nowadays by default. | |||
#dotlock_use_excl = yes | |||
# When to use fsync() or fdatasync() calls: | |||
# optimized (default): Whenever necessary to avoid losing important data | |||
# always: Useful with e.g. NFS when write()s are delayed | |||
# never: Never use it (best performance, but crashes can lose data) | |||
#mail_fsync = optimized | |||
# Locking method for index files. Alternatives are fcntl, flock and dotlock. | |||
# Dotlocking uses some tricks which may create more disk I/O than other locking | |||
# methods. NFS users: flock doesn't work, remember to change mmap_disable. | |||
#lock_method = fcntl | |||
# Directory in which LDA/LMTP temporarily stores incoming mails >128 kB. | |||
#mail_temp_dir = /tmp | |||
# Valid UID range for users, defaults to 500 and above. This is mostly | |||
# to make sure that users can't log in as daemons or other system users. | |||
# Note that denying root logins is hardcoded to dovecot binary and can't | |||
# be done even if first_valid_uid is set to 0. | |||
first_valid_uid = 0 | |||
#last_valid_uid = 0 | |||
# Valid GID range for users, defaults to non-root/wheel. Users having | |||
# non-valid GID as primary group ID aren't allowed to log in. If user | |||
# belongs to supplementary groups with non-valid GIDs, those groups are | |||
# not set. | |||
#first_valid_gid = 1 | |||
#last_valid_gid = 0 | |||
# Maximum allowed length for mail keyword name. It's only forced when trying | |||
# to create new keywords. | |||
#mail_max_keyword_length = 50 | |||
# ':' separated list of directories under which chrooting is allowed for mail | |||
# processes (ie. /var/mail will allow chrooting to /var/mail/foo/bar too). | |||
# This setting doesn't affect login_chroot, mail_chroot or auth chroot | |||
# settings. If this setting is empty, "/./" in home dirs are ignored. | |||
# WARNING: Never add directories here which local users can modify, that | |||
# may lead to root exploit. Usually this should be done only if you don't | |||
# allow shell access for users. <doc/wiki/Chrooting.txt> | |||
#valid_chroot_dirs = | |||
# Default chroot directory for mail processes. This can be overridden for | |||
# specific users in user database by giving /./ in user's home directory | |||
# (eg. /home/./user chroots into /home). Note that usually there is no real | |||
# need to do chrooting, Dovecot doesn't allow users to access files outside | |||
# their mail directory anyway. If your home directories are prefixed with | |||
# the chroot directory, append "/." to mail_chroot. <doc/wiki/Chrooting.txt> | |||
#mail_chroot = | |||
# UNIX socket path to master authentication server to find users. | |||
# This is used by imap (for shared users) and lda. | |||
#auth_socket_path = /var/run/dovecot/auth-userdb | |||
# Directory where to look up mail plugins. | |||
#mail_plugin_dir = /usr/lib/dovecot/modules | |||
# Space separated list of plugins to load for all services. Plugins specific to | |||
# IMAP, LDA, etc. are added to this list in their own .conf files. | |||
#mail_plugins = | |||
## | |||
## Mailbox handling optimizations | |||
## | |||
# Mailbox list indexes can be used to optimize IMAP STATUS commands. They are | |||
# also required for IMAP NOTIFY extension to be enabled. | |||
#mailbox_list_index = no | |||
# The minimum number of mails in a mailbox before updates are done to cache | |||
# file. This allows optimizing Dovecot's behavior to do less disk writes at | |||
# the cost of more disk reads. | |||
#mail_cache_min_mail_count = 0 | |||
# When IDLE command is running, mailbox is checked once in a while to see if | |||
# there are any new mails or other changes. This setting defines the minimum | |||
# time to wait between those checks. Dovecot can also use inotify and | |||
# kqueue to find out immediately when changes occur. | |||
#mailbox_idle_check_interval = 30 secs | |||
# Save mails with CR+LF instead of plain LF. This makes sending those mails | |||
# take less CPU, especially with sendfile() syscall with Linux and FreeBSD. | |||
# But it also creates a bit more disk I/O which may just make it slower. | |||
# Also note that if other software reads the mboxes/maildirs, they may handle | |||
# the extra CRs wrong and cause problems. | |||
#mail_save_crlf = no | |||
# Max number of mails to keep open and prefetch to memory. This only works with | |||
# some mailbox formats and/or operating systems. | |||
#mail_prefetch_count = 0 | |||
# How often to scan for stale temporary files and delete them (0 = never). | |||
# These should exist only after Dovecot dies in the middle of saving mails. | |||
#mail_temp_scan_interval = 1w | |||
## | |||
## Maildir-specific settings | |||
## | |||
# By default LIST command returns all entries in maildir beginning with a dot. | |||
# Enabling this option makes Dovecot return only entries which are directories. | |||
# This is done by stat()ing each entry, so it causes more disk I/O. | |||
# (For systems setting struct dirent->d_type, this check is free and it's | |||
# done always regardless of this setting) | |||
#maildir_stat_dirs = no | |||
# When copying a message, do it with hard links whenever possible. This makes | |||
# the performance much better, and it's unlikely to have any side effects. | |||
#maildir_copy_with_hardlinks = yes | |||
# Assume Dovecot is the only MUA accessing Maildir: Scan cur/ directory only | |||
# when its mtime changes unexpectedly or when we can't find the mail otherwise. | |||
#maildir_very_dirty_syncs = no | |||
# If enabled, Dovecot doesn't use the S=<size> in the Maildir filenames for | |||
# getting the mail's physical size, except when recalculating Maildir++ quota. | |||
# This can be useful in systems where a lot of the Maildir filenames have a | |||
# broken size. The performance hit for enabling this is very small. | |||
#maildir_broken_filename_sizes = no | |||
# Always move mails from new/ directory to cur/, even when the \Recent flags | |||
# aren't being reset. | |||
#maildir_empty_new = no | |||
## | |||
## mbox-specific settings | |||
## | |||
# Which locking methods to use for locking mbox. There are four available: | |||
# dotlock: Create <mailbox>.lock file. This is the oldest and most NFS-safe | |||
# solution. If you want to use /var/mail/ like directory, the users | |||
# will need write access to that directory. | |||
# dotlock_try: Same as dotlock, but if it fails because of permissions or | |||
# because there isn't enough disk space, just skip it. | |||
# fcntl : Use this if possible. Works with NFS too if lockd is used. | |||
# flock : May not exist in all systems. Doesn't work with NFS. | |||
# lockf : May not exist in all systems. Doesn't work with NFS. | |||
# | |||
# You can use multiple locking methods; if you do the order they're declared | |||
# in is important to avoid deadlocks if other MTAs/MUAs are using multiple | |||
# locking methods as well. Some operating systems don't allow using some of | |||
# them simultaneously. | |||
# | |||
# The Debian value for mbox_write_locks differs from upstream Dovecot. It is | |||
# changed to be compliant with Debian Policy (section 11.6) for NFS safety. | |||
# Dovecot: mbox_write_locks = dotlock fcntl | |||
# Debian: mbox_write_locks = fcntl dotlock | |||
# | |||
#mbox_read_locks = fcntl | |||
#mbox_write_locks = fcntl dotlock | |||
# Maximum time to wait for lock (all of them) before aborting. | |||
#mbox_lock_timeout = 5 mins | |||
# If dotlock exists but the mailbox isn't modified in any way, override the | |||
# lock file after this much time. | |||
#mbox_dotlock_change_timeout = 2 mins | |||
# When mbox changes unexpectedly we have to fully read it to find out what | |||
# changed. If the mbox is large this can take a long time. Since the change | |||
# is usually just a newly appended mail, it'd be faster to simply read the | |||
# new mails. If this setting is enabled, Dovecot does this but still safely | |||
# fallbacks to re-reading the whole mbox file whenever something in mbox isn't | |||
# how it's expected to be. The only real downside to this setting is that if | |||
# some other MUA changes message flags, Dovecot doesn't notice it immediately. | |||
# Note that a full sync is done with SELECT, EXAMINE, EXPUNGE and CHECK | |||
# commands. | |||
#mbox_dirty_syncs = yes | |||
# Like mbox_dirty_syncs, but don't do full syncs even with SELECT, EXAMINE, | |||
# EXPUNGE or CHECK commands. If this is set, mbox_dirty_syncs is ignored. | |||
#mbox_very_dirty_syncs = no | |||
# Delay writing mbox headers until doing a full write sync (EXPUNGE and CHECK | |||
# commands and when closing the mailbox). This is especially useful for POP3 | |||
# where clients often delete all mails. The downside is that our changes | |||
# aren't immediately visible to other MUAs. | |||
#mbox_lazy_writes = yes | |||
# If mbox size is smaller than this (e.g. 100k), don't write index files. | |||
# If an index file already exists it's still read, just not updated. | |||
#mbox_min_index_size = 0 | |||
# Mail header selection algorithm to use for MD5 POP3 UIDLs when | |||
# pop3_uidl_format=%m. For backwards compatibility we use apop3d inspired | |||
# algorithm, but it fails if the first Received: header isn't unique in all | |||
# mails. An alternative algorithm is "all" that selects all headers. | |||
#mbox_md5 = apop3d | |||
## | |||
## mdbox-specific settings | |||
## | |||
# Maximum dbox file size until it's rotated. | |||
#mdbox_rotate_size = 2M | |||
# Maximum dbox file age until it's rotated. Typically in days. Day begins | |||
# from midnight, so 1d = today, 2d = yesterday, etc. 0 = check disabled. | |||
#mdbox_rotate_interval = 0 | |||
# When creating new mdbox files, immediately preallocate their size to | |||
# mdbox_rotate_size. This setting currently works only in Linux with some | |||
# filesystems (ext4, xfs). | |||
#mdbox_preallocate_space = no | |||
## | |||
## Mail attachments | |||
## | |||
# sdbox and mdbox support saving mail attachments to external files, which | |||
# also allows single instance storage for them. Other backends don't support | |||
# this for now. | |||
# Directory root where to store mail attachments. Disabled, if empty. | |||
#mail_attachment_dir = | |||
# Attachments smaller than this aren't saved externally. It's also possible to | |||
# write a plugin to disable saving specific attachments externally. | |||
#mail_attachment_min_size = 128k | |||
# Filesystem backend to use for saving attachments: | |||
# posix : No SiS done by Dovecot (but this might help FS's own deduplication) | |||
# sis posix : SiS with immediate byte-by-byte comparison during saving | |||
# sis-queue posix : SiS with delayed comparison and deduplication | |||
#mail_attachment_fs = sis posix | |||
# Hash format to use in attachment filenames. You can add any text and | |||
# variables: %{md4}, %{md5}, %{sha1}, %{sha256}, %{sha512}, %{size}. | |||
# Variables can be truncated, e.g. %{sha256:80} returns only first 80 bits | |||
#mail_attachment_hash = %{sha1} | |||
==== Löschungen ==== | |||
* Folgende Dateien in /etc/dovecot/conf.d/ werden nicht benötigt ... | |||
rm 20-pop3.conf | |||
rm auth-checkpassword.conf.ext | |||
rm auth-deny.conf.ext | |||
rm auth-dict.conf.ext | |||
rm auth-master.conf.ext | |||
rm auth-sql.conf.ext | |||
rm auth-static.conf.ext | |||
rm auth-vpopmail.conf.ext | |||
=== Test === | |||
* https://blog.yimingliu.com/2009/01/23/testing-a-pop3-server-via-telnet-or-openssl/ | |||
== eMail-Konten anlegen == | |||
=== eMail.sh === | |||
./eMail.sh <i>mail-account</i> <i>password</i> | |||
# | |||
# create a Postfix Mail Account | |||
# | |||
useradd --gid postfix --create-home --shell /bin/false $1 | |||
echo "$1:$2" | chpasswd | |||
chmod 777 /home/$1 | |||
touch /var/mail/$1 | |||
chown $1 /var/mail/$1 | |||
chgrp postfix /var/mail/$1 | |||
chmod 0660 /var/mail/$1 | |||
== Datensicherung == | |||
=== /etc/rsyncd.conf === | |||
gid = users | |||
read only = true | |||
use chroot = true | |||
transfer logging = true | |||
log format = %h %o %f %l %b | |||
log file = /var/log/rsyncd.log | |||
hosts allow = 192.168.115.0/255.255.255.0 | |||
[mail] | |||
path = /var/mail | |||
read only = yes | |||
list = yes | |||
uid = root | |||
gid = root | |||
hosts allow = 192.168.115.2 |
Aktuelle Version vom 14. Juli 2023, 19:02 Uhr
Konzept
Internet | Raspi | :25 (smtp) -> [ Postfix ] -> Filesystem "/var/mail/user" | -> dovecot User API | :110 (pop3) -> [ dovecot ] -> Filesystem "/var/mail/user" | -> Linux User API
- Mein Ziel ist ein ordentlicher eigenständiger Mailserver (er braucht keinen anderen Mailserver zum versenden der Mail)
- Es soll keine Datenbank nötig sein
- Mail-Accounts sind native Linux-
user
, über den Kernel läuft somit auch die Authentifizierung - Ein Mail-Account heisst so wie der
user
- Mail-Speicherung erfolgt im mbox Format in /var/mail so wie das Linux vorsieht
- alle eMail-Adressen/eMail-Domains sind in der Text-Datei "/etc/postfix/virtual" aufgelistet
Vorarbeiten
benötigte Software
apt-get install dovecot-pop3d postfix dnsutils
Ordentlich starten
- postfix ist von dovecot abhängig, deshalb sollte postfix erst starten wenn dovecot schon Aktiv ist, hier definiere ich die Abhängigkeit
erst dovecot
joe /lib/systemd/system/dovecot.service
[Unit] Requires=network-online.target After=network-online.target
dann postfix
joe /lib/systemd/system/postfix.service
[Unit] Requires=dovecot.service After=network-online.target nss-lookup.target dovecot.service
Dienst beim Reboot starten
systemctl enable dovecot systemctl enable postfix
postfix
http://www.postfix.org/features.html
main.cf
# See /usr/share/postfix/main.cf.dist for a commented, more complete version # Debian specific: Specifying a file name will cause the first # line of that file to be used as the name. The Debian default # is /etc/mailname. #myorigin = /etc/mailname smtpd_banner = $myhostname ESMTP $mail_name (Raspbian) biff = no # appending .domain is the MUA's job. append_dot_mydomain = no # Uncomment the next line to generate "delayed mail" warnings #delay_warning_time = 4h readme_directory = no # See http://www.postfix.org/COMPATIBILITY_README.html -- default to 2 on # fresh installs. compatibility_level = 2 # TLS parameters smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key smtpd_use_tls=no smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache # See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for # information on enabling SSL in the smtp client. smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination myhostname = mx.orgamon.eu alias_maps = hash:/etc/aliases alias_database = hash:/etc/aliases mydestination = $myhostname, pi3x05, localhost.localdomain, , localhost relayhost = mynetworks = 192.168.115.0/24 127.0.0.0/8 mailbox_size_limit = 99999999 message_size_limit = 99999999 recipient_delimiter = + inet_interfaces = all inet_protocols = ipv4 virtual_maps = hash:/etc/postfix/virtual smtpd_sasl_auth_enable = yes smtpd_recipient_restrictions = permit_sasl_authenticated, reject_unauth_destination smtpd_sasl_type = dovecot smtpd_sasl_path = private/auth
virtual
# # Rechte sicherstellen, (Verändern vermeiden) # chmod 644 virtual
# # "virtual.db" neu erstellen (Bei jeder Änderung von "virtual") # postmap virtual
Test
- https://www.thomas-krenn.com/de/wiki/TCP_Port_25_(smtp)_Zugriff_mit_telnet_%C3%BCberpr%C3%BCfen
- https://www.ndchost.com/wiki/mail/test-smtp-auth-telnet
dovecot
Information
Installation
apt-get install dovecot-pop3d
Konfiguration
/etc/dovecot/conf.d/10-ssl.conf
## ## SSL settings ## # SSL/TLS support: yes, no, required. <doc/wiki/SSL.txt> ssl = no # PEM encoded X.509 SSL/TLS certificate and private key. They're opened before # dropping root privileges, so keep the key file unreadable by anyone but # root. Included doc/mkcert.sh can be used to easily generate self-signed # certificate, just make sure to update the domains in dovecot-openssl.cnf #ssl_cert = </etc/dovecot/dovecot.pem #ssl_key = </etc/dovecot/private/dovecot.pem # If key file is password protected, give the password here. Alternatively # give it when starting dovecot with -p parameter. Since this file is often # world-readable, you may want to place this setting instead to a different # root owned 0600 file by using ssl_key_password = <path. #ssl_key_password = # PEM encoded trusted certificate authority. Set this only if you intend to use # ssl_verify_client_cert=yes. The file should contain the CA certificate(s) # followed by the matching CRL(s). (e.g. ssl_ca = </etc/ssl/certs/ca.pem) #ssl_ca = # Require that CRL check succeeds for client certificates. #ssl_require_crl = yes # Directory and/or file for trusted SSL CA certificates. These are used only # when Dovecot needs to act as an SSL client (e.g. imapc backend). The # directory is usually /etc/ssl/certs in Debian-based systems and the file is # /etc/pki/tls/cert.pem in RedHat-based systems. #ssl_client_ca_dir = #ssl_client_ca_file = # Request client to send a certificate. If you also want to require it, set # auth_ssl_require_client_cert=yes in auth section. #ssl_verify_client_cert = no # Which field from certificate to use for username. commonName and # x500UniqueIdentifier are the usual choices. You'll also need to set # auth_ssl_username_from_cert=yes. #ssl_cert_username_field = commonName # DH parameters length to use. #ssl_dh_parameters_length = 1024 # SSL protocols to use #ssl_protocols = !SSLv3 # SSL ciphers to use #ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL # Prefer the server's order of ciphers over client's. #ssl_prefer_server_ciphers = no # SSL crypto device to use, for valid values run "openssl engine" #ssl_crypto_device = # SSL extra options. Currently supported options are: # no_compression - Disable compression. #ssl_options =
/etc/dovecot/conf.d/10-master.conf
#default_process_limit = 100 #default_client_limit = 1000 # Default VSZ (virtual memory size) limit for service processes. This is mainly # intended to catch and kill processes that leak memory before they eat up # everything. #default_vsz_limit = 256M # Login user is internally used by login processes. This is the most untrusted # user in Dovecot system. It shouldn't have access to anything at all. #default_login_user = dovenull # Internal user is used by unprivileged processes. It should be separate from # login user, so that login processes can't disturb other processes. #default_internal_user = dovecot service imap-login { inet_listener imap { #port = 143 } inet_listener imaps { #port = 993 #ssl = yes } # Number of connections to handle before starting a new process. Typically # the only useful values are 0 (unlimited) or 1. 1 is more secure, but 0 # is faster. <doc/wiki/LoginProcess.txt> #service_count = 1 # Number of processes to always keep waiting for more connections. #process_min_avail = 0 # If you set service_count=0, you probably need to grow this. #vsz_limit = $default_vsz_limit } service pop3-login { inet_listener pop3 { #port = 110 } inet_listener pop3s { #port = 995 #ssl = yes } } service lmtp { unix_listener lmtp { #mode = 0666 } # Create inet listener only if you can't use the above UNIX socket #inet_listener lmtp { # Avoid making LMTP visible for the entire internet #address = #port = #} } service imap { # Most of the memory goes to mmap()ing files. You may need to increase this # limit if you have huge mailboxes. #vsz_limit = $default_vsz_limit # Max. number of IMAP processes (connections) #process_limit = 1024 } service pop3 { # Max. number of POP3 processes (connections) #process_limit = 1024 } service auth { # auth_socket_path points to this userdb socket by default. It's typically # used by dovecot-lda, doveadm, possibly imap process, etc. Users that have # full permissions to this socket are able to get a list of all usernames and # get the results of everyone's userdb lookups. # # The default 0666 mode allows anyone to connect to the socket, but the # userdb lookups will succeed only if the userdb returns an "uid" field that # matches the caller process's UID. Also if caller's uid or gid matches the # socket's uid or gid the lookup succeeds. Anything else causes a failure. # # To give the caller full permissions to lookup all users, set the mode to # something else than 0666 and Dovecot lets the kernel enforce the # permissions (e.g. 0777 allows everyone full permissions). unix_listener auth-userdb { #mode = 0666 #user = #group = } # Postfix smtp-auth unix_listener /var/spool/postfix/private/auth { # mode = 0666 user = postfix group = postfix } # Auth process is run as this user. #user = $default_internal_user } service auth-worker { # Auth worker process is run as root by default, so that it can access # /etc/shadow. If this isn't necessary, the user should be changed to # $default_internal_user. #user = root } service dict { # If dict proxy is used, mail processes should have access to its socket. # For example: mode=0660, group=vmail and global mail_access_groups=vmail unix_listener dict { #mode = 0600 #user = #group = } }
/etc/dovecot/conf.d/10-logging.conf
## ## Log destination. ## # Log file to use for error messages. "syslog" logs to syslog, # /dev/stderr logs to stderr. #log_path = syslog # Log file to use for informational messages. Defaults to log_path. #info_log_path = # Log file to use for debug messages. Defaults to info_log_path. #debug_log_path = # Syslog facility to use if you're logging to syslog. Usually if you don't # want to use "mail", you'll use local0..local7. Also other standard # facilities are supported. #syslog_facility = mail ## ## Logging verbosity and debugging. ## # Log unsuccessful authentication attempts and the reasons why they failed. auth_verbose = yes # In case of password mismatches, log the attempted password. Valid values are # no, plain and sha1. sha1 can be useful for detecting brute force password # attempts vs. user simply trying the same password over and over again. # You can also truncate the value to n chars by appending ":n" (e.g. sha1:6). #auth_verbose_passwords = no # Even more verbose logging for debugging purposes. Shows for example SQL # queries. #auth_debug = no # In case of password mismatches, log the passwords and used scheme so the # problem can be debugged. Enabling this also enables auth_debug. #auth_debug_passwords = no # Enable mail process debugging. This can help you figure out why Dovecot # isn't finding your mails. mail_debug = yes # Show protocol level SSL errors. #verbose_ssl = no # mail_log plugin provides more event logging for mail processes. plugin { # Events to log. Also available: flag_change append #mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename # Available fields: uid, box, msgid, from, subject, size, vsize, flags # size and vsize are available only for expunge and copy events. #mail_log_fields = uid box msgid size } ## ## Log formatting. ## # Prefix for each line written to log file. % codes are in strftime(3) # format. #log_timestamp = "%b %d %H:%M:%S " # Space-separated list of elements we want to log. The elements which have # a non-empty variable value are joined together to form a comma-separated # string. #login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c # Login log format. %s contains login_log_format_elements string, %$ contains # the data we want to log. #login_log_format = %$: %s # Log prefix for mail processes. See doc/wiki/Variables.txt for list of # possible variables you can use. #mail_log_prefix = "%s(%u): " # Format to use for logging mail deliveries. See doc/wiki/Variables.txt for # list of all variables you can use. Some of the common ones include: # %$ - Delivery status message (e.g. "saved to INBOX") # %m - Message-ID # %s - Subject # %f - From address # %p - Physical size # %w - Virtual size #deliver_log_format = msgid=%m: %$
/etc/dovecot/conf.d/auth-passwdfile.conf.ext
# Authentication for passwd-file users. Included from 10-auth.conf. # # passwd-like file with specified location. # <doc/wiki/AuthDatabase.PasswdFile.txt> #passdb { #driver = passwd-file #args = scheme=CRYPT username_format=%u /etc/dovecot/users #} #userdb { #driver = passwd-file #args = username_format=%u /etc/dovecot/users # Default fields that can be overridden by passwd-file #default_fields = quota_rule=*:storage=1G # Override fields from passwd-file #override_fields = home=/home/virtual/%u #}
/etc/dovecot/conf.d/auth-system.conf.ext
# Authentication for system users. Included from 10-auth.conf. # # <doc/wiki/PasswordDatabase.txt> # <doc/wiki/UserDatabase.txt> # PAM authentication. Preferred nowadays by most systems. # PAM is typically used with either userdb passwd or userdb static. # REMEMBER: You'll need /etc/pam.d/dovecot file created for PAM # authentication to actually work. <doc/wiki/PasswordDatabase.PAM.txt> passdb { driver = pam # [session=yes] [setcred=yes] [failure_show_msg=yes] [max_requests=<n>] # [cache_key=<key>] [<service name>] args = failure_show_msg=yes } # System users (NSS, /etc/passwd, or similiar). # In many systems nowadays this uses Name Service Switch, which is # configured in /etc/nsswitch.conf. <doc/wiki/AuthDatabase.Passwd.txt> #passdb { #driver = passwd # [blocking=no] #args = #} # Shadow passwords for system users (NSS, /etc/shadow or similiar). # Deprecated by PAM nowadays. # <doc/wiki/PasswordDatabase.Shadow.txt> #passdb { #driver = shadow # [blocking=no] #args = #} # PAM-like authentication for OpenBSD. # <doc/wiki/PasswordDatabase.BSDAuth.txt> #passdb { #driver = bsdauth # [blocking=no] [cache_key=<key>] #args = #} ## ## User databases ## # System users (NSS, /etc/passwd, or similiar). In many systems nowadays this # uses Name Service Switch, which is configured in /etc/nsswitch.conf. #userdb { # <doc/wiki/AuthDatabase.Passwd.txt> # driver = passwd # [blocking=no] #args = # Override fields from passwd #override_fields = home=/home/virtual/%u #} # Static settings generated from template <doc/wiki/UserDatabase.Static.txt> #userdb { #driver = static # Can return anything a userdb could normally return. For example: # # args = uid=500 gid=500 home=/var/mail/%u # # LDA and LMTP needs to look up users only from the userdb. This of course # doesn't work with static userdb because there is no list of users. # Normally static userdb handles this by doing a passdb lookup. This works # with most passdbs, with PAM being the most notable exception. If you do # the user verification another way, you can add allow_all_users=yes to # the args in which case the passdb lookup is skipped. # #args = #}
/etc/dovecot/conf.d/10-auth.conf
## ## Authentication processes ## # Disable LOGIN command and all other plaintext authentications unless # SSL/TLS is used (LOGINDISABLED capability). Note that if the remote IP # matches the local IP (ie. you're connecting from the same computer), the # connection is considered secure and plaintext authentication is allowed. # See also ssl=required setting. disable_plaintext_auth = no # Authentication cache size (e.g. 10M). 0 means it's disabled. Note that # bsdauth, PAM and vpopmail require cache_key to be set for caching to be used. #auth_cache_size = 0 # Time to live for cached data. After TTL expires the cached record is no # longer used, *except* if the main database lookup returns internal failure. # We also try to handle password changes automatically: If user's previous # authentication was successful, but this one wasn't, the cache isn't used. # For now this works only with plaintext authentication. #auth_cache_ttl = 1 hour # TTL for negative hits (user not found, password mismatch). # 0 disables caching them completely. #auth_cache_negative_ttl = 1 hour # Space separated list of realms for SASL authentication mechanisms that need # them. You can leave it empty if you don't want to support multiple realms. # Many clients simply use the first one listed here, so keep the default realm # first. #auth_realms = # Default realm/domain to use if none was specified. This is used for both # SASL realms and appending @domain to username in plaintext logins. #auth_default_realm = # List of allowed characters in username. If the user-given username contains # a character not listed in here, the login automatically fails. This is just # an extra check to make sure user can't exploit any potential quote escaping # vulnerabilities with SQL/LDAP databases. If you want to allow all characters, # set this value to empty. #auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@ # Username character translations before it's looked up from databases. The # value contains series of from -> to characters. For example "#@/@" means # that '#' and '/' characters are translated to '@'. #auth_username_translation = # Username formatting before it's looked up from databases. You can use # the standard variables here, eg. %Lu would lowercase the username, %n would # drop away the domain if it was given, or "%n-AT-%d" would change the '@' into # "-AT-". This translation is done after auth_username_translation changes. #auth_username_format = %Lu # If you want to allow master users to log in by specifying the master # username within the normal username string (ie. not using SASL mechanism's # support for it), you can specify the separator character here. The format # is then <username><separator><master username>. UW-IMAP uses "*" as the # separator, so that could be a good choice. #auth_master_user_separator = # Username to use for users logging in with ANONYMOUS SASL mechanism #auth_anonymous_username = anonymous # Maximum number of dovecot-auth worker processes. They're used to execute # blocking passdb and userdb queries (eg. MySQL and PAM). They're # automatically created and destroyed as needed. #auth_worker_max_count = 30 # Host name to use in GSSAPI principal names. The default is to use the # name returned by gethostname(). Use "$ALL" (with quotes) to allow all keytab # entries. #auth_gssapi_hostname = # Kerberos keytab to use for the GSSAPI mechanism. Will use the system # default (usually /etc/krb5.keytab) if not specified. You may need to change # the auth service to run as root to be able to read this file. #auth_krb5_keytab = # Do NTLM and GSS-SPNEGO authentication using Samba's winbind daemon and # ntlm_auth helper. <doc/wiki/Authentication/Mechanisms/Winbind.txt> #auth_use_winbind = no # Path for Samba's ntlm_auth helper binary. #auth_winbind_helper_path = /usr/bin/ntlm_auth # Time to delay before replying to failed authentications. #auth_failure_delay = 2 secs # Require a valid SSL client certificate or the authentication fails. #auth_ssl_require_client_cert = no # Take the username from client's SSL certificate, using # X509_NAME_get_text_by_NID() which returns the subject's DN's # CommonName. #auth_ssl_username_from_cert = no # Space separated list of wanted authentication mechanisms: # plain login digest-md5 cram-md5 ntlm rpa apop anonymous gssapi otp skey # gss-spnego # NOTE: See also disable_plaintext_auth setting. auth_mechanisms = plain login ## ## Password and user databases ## # # Password database is used to verify user's password (and nothing more). # You can have multiple passdbs and userdbs. This is useful if you want to # allow both system users (/etc/passwd) and virtual users to login without # duplicating the system users into virtual database. # # <doc/wiki/PasswordDatabase.txt> # # User database specifies where mails are located and what user/group IDs # own them. For single-UID configuration use "static" userdb. # # <doc/wiki/UserDatabase.txt> #!include auth-deny.conf.ext #!include auth-master.conf.ext !include auth-system.conf.ext #!include auth-sql.conf.ext #!include auth-ldap.conf.ext !include auth-passwdfile.conf.ext #!include auth-checkpassword.conf.ext #!include auth-vpopmail.conf.ext #!include auth-static.conf.ext
/etc/dovecot/conf.d/10-mail.conf
## ## Mailbox locations and namespaces ## # Location for users' mailboxes. The default is empty, which means that Dovecot # tries to find the mailboxes automatically. This won't work if the user # doesn't yet have any mail, so you should explicitly tell Dovecot the full # location. # # If you're using mbox, giving a path to the INBOX file (eg. /var/mail/%u) # isn't enough. You'll also need to tell Dovecot where the other mailboxes are # kept. This is called the "root mail directory", and it must be the first # path given in the mail_location setting. # # There are a few special variables you can use, eg.: # # %u - username # %n - user part in user@domain, same as %u if there's no domain # %d - domain part in user@domain, empty if there's no domain # %h - home directory # # See doc/wiki/Variables.txt for full list. Some examples: # # mail_location = maildir:~/Maildir # mail_location = mbox:~/mail:INBOX=/var/mail/%u # mail_location = mbox:/var/mail/%d/%1n/%n:INDEX=/var/indexes/%d/%1n/%n # # <doc/wiki/MailLocation.txt> # mail_location = mbox:/home/%u:INBOX=/var/mail/%u # If you need to set multiple mailbox locations or want to change default # namespace settings, you can do it by defining namespace sections. # # You can have private, shared and public namespaces. Private namespaces # are for user's personal mails. Shared namespaces are for accessing other # users' mailboxes that have been shared. Public namespaces are for shared # mailboxes that are managed by sysadmin. If you create any shared or public # namespaces you'll typically want to enable ACL plugin also, otherwise all # users can access all the shared mailboxes, assuming they have permissions # on filesystem level to do so. namespace inbox { # Namespace type: private, shared or public #type = private # Hierarchy separator to use. You should use the same separator for all # namespaces or some clients get confused. '/' is usually a good one. # The default however depends on the underlying mail storage format. #separator = # Prefix required to access this namespace. This needs to be different for # all namespaces. For example "Public/". #prefix = # Physical location of the mailbox. This is in same format as # mail_location, which is also the default for it. #location = # There can be only one INBOX, and this setting defines which namespace # has it. inbox = yes # If namespace is hidden, it's not advertised to clients via NAMESPACE # extension. You'll most likely also want to set list=no. This is mostly # useful when converting from another server with different namespaces which # you want to deprecate but still keep working. For example you can create # hidden namespaces with prefixes "~/mail/", "~%u/mail/" and "mail/". #hidden = no # Show the mailboxes under this namespace with LIST command. This makes the # namespace visible for clients that don't support NAMESPACE extension. # "children" value lists child mailboxes, but hides the namespace prefix. #list = yes # Namespace handles its own subscriptions. If set to "no", the parent # namespace handles them (empty prefix should always have this as "yes") #subscriptions = yes # See 15-mailboxes.conf for definitions of special mailboxes. } # Example shared namespace configuration #namespace { #type = shared #separator = / # Mailboxes are visible under "shared/user@domain/" # %%n, %%d and %%u are expanded to the destination user. #prefix = shared/%%u/ # Mail location for other users' mailboxes. Note that %variables and ~/ # expands to the logged in user's data. %%n, %%d, %%u and %%h expand to the # destination user's data. #location = maildir:%%h/Maildir:INDEX=~/Maildir/shared/%%u # Use the default namespace for saving subscriptions. #subscriptions = no # List the shared/ namespace only if there are visible shared mailboxes. #list = children #} # Should shared INBOX be visible as "shared/user" or "shared/user/INBOX"? #mail_shared_explicit_inbox = no # System user and group used to access mails. If you use multiple, userdb # can override these by returning uid or gid fields. You can use either numbers # or names. <doc/wiki/UserIds.txt> mail_uid = postfix mail_gid = postfix # Group to enable temporarily for privileged operations. Currently this is # used only with INBOX when either its initial creation or dotlocking fails. # Typically this is set to "mail" to give access to /var/mail. mail_privileged_group = mail # Grant access to these supplementary groups for mail processes. Typically # these are used to set up access to shared mailboxes. Note that it may be # dangerous to set these if users can create symlinks (e.g. if "mail" group is # set here, ln -s /var/mail ~/mail/var could allow a user to delete others' # mailboxes, or ln -s /secret/shared/box ~/mail/mybox would allow reading it). #mail_access_groups = # Allow full filesystem access to clients. There's no access checks other than # what the operating system does for the active UID/GID. It works with both # maildir and mboxes, allowing you to prefix mailboxes names with eg. /path/ # or ~user/. #mail_full_filesystem_access = no # Dictionary for key=value mailbox attributes. This is used for example by # URLAUTH and METADATA extensions. #mail_attribute_dict = # A comment or note that is associated with the server. This value is # accessible for authenticated users through the IMAP METADATA server # entry "/shared/comment". #mail_server_comment = "" # Indicates a method for contacting the server administrator. According to # RFC 5464, this value MUST be a URI (e.g., a mailto: or tel: URL), but that # is currently not enforced. Use for example mailto:admin@example.com. This # value is accessible for authenticated users through the IMAP METADATA server # entry "/shared/admin". #mail_server_admin = ## ## Mail processes ## # Don't use mmap() at all. This is required if you store indexes to shared # filesystems (NFS or clustered filesystem). #mmap_disable = no # Rely on O_EXCL to work when creating dotlock files. NFS supports O_EXCL # since version 3, so this should be safe to use nowadays by default. #dotlock_use_excl = yes # When to use fsync() or fdatasync() calls: # optimized (default): Whenever necessary to avoid losing important data # always: Useful with e.g. NFS when write()s are delayed # never: Never use it (best performance, but crashes can lose data) #mail_fsync = optimized # Locking method for index files. Alternatives are fcntl, flock and dotlock. # Dotlocking uses some tricks which may create more disk I/O than other locking # methods. NFS users: flock doesn't work, remember to change mmap_disable. #lock_method = fcntl # Directory in which LDA/LMTP temporarily stores incoming mails >128 kB. #mail_temp_dir = /tmp # Valid UID range for users, defaults to 500 and above. This is mostly # to make sure that users can't log in as daemons or other system users. # Note that denying root logins is hardcoded to dovecot binary and can't # be done even if first_valid_uid is set to 0. first_valid_uid = 0 #last_valid_uid = 0 # Valid GID range for users, defaults to non-root/wheel. Users having # non-valid GID as primary group ID aren't allowed to log in. If user # belongs to supplementary groups with non-valid GIDs, those groups are # not set. #first_valid_gid = 1 #last_valid_gid = 0 # Maximum allowed length for mail keyword name. It's only forced when trying # to create new keywords. #mail_max_keyword_length = 50 # ':' separated list of directories under which chrooting is allowed for mail # processes (ie. /var/mail will allow chrooting to /var/mail/foo/bar too). # This setting doesn't affect login_chroot, mail_chroot or auth chroot # settings. If this setting is empty, "/./" in home dirs are ignored. # WARNING: Never add directories here which local users can modify, that # may lead to root exploit. Usually this should be done only if you don't # allow shell access for users. <doc/wiki/Chrooting.txt> #valid_chroot_dirs = # Default chroot directory for mail processes. This can be overridden for # specific users in user database by giving /./ in user's home directory # (eg. /home/./user chroots into /home). Note that usually there is no real # need to do chrooting, Dovecot doesn't allow users to access files outside # their mail directory anyway. If your home directories are prefixed with # the chroot directory, append "/." to mail_chroot. <doc/wiki/Chrooting.txt> #mail_chroot = # UNIX socket path to master authentication server to find users. # This is used by imap (for shared users) and lda. #auth_socket_path = /var/run/dovecot/auth-userdb # Directory where to look up mail plugins. #mail_plugin_dir = /usr/lib/dovecot/modules # Space separated list of plugins to load for all services. Plugins specific to # IMAP, LDA, etc. are added to this list in their own .conf files. #mail_plugins = ## ## Mailbox handling optimizations ## # Mailbox list indexes can be used to optimize IMAP STATUS commands. They are # also required for IMAP NOTIFY extension to be enabled. #mailbox_list_index = no # The minimum number of mails in a mailbox before updates are done to cache # file. This allows optimizing Dovecot's behavior to do less disk writes at # the cost of more disk reads. #mail_cache_min_mail_count = 0 # When IDLE command is running, mailbox is checked once in a while to see if # there are any new mails or other changes. This setting defines the minimum # time to wait between those checks. Dovecot can also use inotify and # kqueue to find out immediately when changes occur. #mailbox_idle_check_interval = 30 secs # Save mails with CR+LF instead of plain LF. This makes sending those mails # take less CPU, especially with sendfile() syscall with Linux and FreeBSD. # But it also creates a bit more disk I/O which may just make it slower. # Also note that if other software reads the mboxes/maildirs, they may handle # the extra CRs wrong and cause problems. #mail_save_crlf = no # Max number of mails to keep open and prefetch to memory. This only works with # some mailbox formats and/or operating systems. #mail_prefetch_count = 0 # How often to scan for stale temporary files and delete them (0 = never). # These should exist only after Dovecot dies in the middle of saving mails. #mail_temp_scan_interval = 1w ## ## Maildir-specific settings ## # By default LIST command returns all entries in maildir beginning with a dot. # Enabling this option makes Dovecot return only entries which are directories. # This is done by stat()ing each entry, so it causes more disk I/O. # (For systems setting struct dirent->d_type, this check is free and it's # done always regardless of this setting) #maildir_stat_dirs = no # When copying a message, do it with hard links whenever possible. This makes # the performance much better, and it's unlikely to have any side effects. #maildir_copy_with_hardlinks = yes # Assume Dovecot is the only MUA accessing Maildir: Scan cur/ directory only # when its mtime changes unexpectedly or when we can't find the mail otherwise. #maildir_very_dirty_syncs = no # If enabled, Dovecot doesn't use the S=<size> in the Maildir filenames for # getting the mail's physical size, except when recalculating Maildir++ quota. # This can be useful in systems where a lot of the Maildir filenames have a # broken size. The performance hit for enabling this is very small. #maildir_broken_filename_sizes = no # Always move mails from new/ directory to cur/, even when the \Recent flags # aren't being reset. #maildir_empty_new = no ## ## mbox-specific settings ## # Which locking methods to use for locking mbox. There are four available: # dotlock: Create <mailbox>.lock file. This is the oldest and most NFS-safe # solution. If you want to use /var/mail/ like directory, the users # will need write access to that directory. # dotlock_try: Same as dotlock, but if it fails because of permissions or # because there isn't enough disk space, just skip it. # fcntl : Use this if possible. Works with NFS too if lockd is used. # flock : May not exist in all systems. Doesn't work with NFS. # lockf : May not exist in all systems. Doesn't work with NFS. # # You can use multiple locking methods; if you do the order they're declared # in is important to avoid deadlocks if other MTAs/MUAs are using multiple # locking methods as well. Some operating systems don't allow using some of # them simultaneously. # # The Debian value for mbox_write_locks differs from upstream Dovecot. It is # changed to be compliant with Debian Policy (section 11.6) for NFS safety. # Dovecot: mbox_write_locks = dotlock fcntl # Debian: mbox_write_locks = fcntl dotlock # #mbox_read_locks = fcntl #mbox_write_locks = fcntl dotlock # Maximum time to wait for lock (all of them) before aborting. #mbox_lock_timeout = 5 mins # If dotlock exists but the mailbox isn't modified in any way, override the # lock file after this much time. #mbox_dotlock_change_timeout = 2 mins # When mbox changes unexpectedly we have to fully read it to find out what # changed. If the mbox is large this can take a long time. Since the change # is usually just a newly appended mail, it'd be faster to simply read the # new mails. If this setting is enabled, Dovecot does this but still safely # fallbacks to re-reading the whole mbox file whenever something in mbox isn't # how it's expected to be. The only real downside to this setting is that if # some other MUA changes message flags, Dovecot doesn't notice it immediately. # Note that a full sync is done with SELECT, EXAMINE, EXPUNGE and CHECK # commands. #mbox_dirty_syncs = yes # Like mbox_dirty_syncs, but don't do full syncs even with SELECT, EXAMINE, # EXPUNGE or CHECK commands. If this is set, mbox_dirty_syncs is ignored. #mbox_very_dirty_syncs = no # Delay writing mbox headers until doing a full write sync (EXPUNGE and CHECK # commands and when closing the mailbox). This is especially useful for POP3 # where clients often delete all mails. The downside is that our changes # aren't immediately visible to other MUAs. #mbox_lazy_writes = yes # If mbox size is smaller than this (e.g. 100k), don't write index files. # If an index file already exists it's still read, just not updated. #mbox_min_index_size = 0 # Mail header selection algorithm to use for MD5 POP3 UIDLs when # pop3_uidl_format=%m. For backwards compatibility we use apop3d inspired # algorithm, but it fails if the first Received: header isn't unique in all # mails. An alternative algorithm is "all" that selects all headers. #mbox_md5 = apop3d ## ## mdbox-specific settings ## # Maximum dbox file size until it's rotated. #mdbox_rotate_size = 2M # Maximum dbox file age until it's rotated. Typically in days. Day begins # from midnight, so 1d = today, 2d = yesterday, etc. 0 = check disabled. #mdbox_rotate_interval = 0 # When creating new mdbox files, immediately preallocate their size to # mdbox_rotate_size. This setting currently works only in Linux with some # filesystems (ext4, xfs). #mdbox_preallocate_space = no ## ## Mail attachments ## # sdbox and mdbox support saving mail attachments to external files, which # also allows single instance storage for them. Other backends don't support # this for now. # Directory root where to store mail attachments. Disabled, if empty. #mail_attachment_dir = # Attachments smaller than this aren't saved externally. It's also possible to # write a plugin to disable saving specific attachments externally. #mail_attachment_min_size = 128k # Filesystem backend to use for saving attachments: # posix : No SiS done by Dovecot (but this might help FS's own deduplication) # sis posix : SiS with immediate byte-by-byte comparison during saving # sis-queue posix : SiS with delayed comparison and deduplication #mail_attachment_fs = sis posix # Hash format to use in attachment filenames. You can add any text and # variables: %{md4}, %{md5}, %{sha1}, %{sha256}, %{sha512}, %{size}. # Variables can be truncated, e.g. %{sha256:80} returns only first 80 bits #mail_attachment_hash = %{sha1}
Löschungen
- Folgende Dateien in /etc/dovecot/conf.d/ werden nicht benötigt ...
rm 20-pop3.conf rm auth-checkpassword.conf.ext rm auth-deny.conf.ext rm auth-dict.conf.ext rm auth-master.conf.ext rm auth-sql.conf.ext rm auth-static.conf.ext rm auth-vpopmail.conf.ext
Test
eMail-Konten anlegen
eMail.sh
./eMail.sh mail-account password
# # create a Postfix Mail Account # useradd --gid postfix --create-home --shell /bin/false $1 echo "$1:$2" | chpasswd chmod 777 /home/$1 touch /var/mail/$1 chown $1 /var/mail/$1 chgrp postfix /var/mail/$1 chmod 0660 /var/mail/$1
Datensicherung
/etc/rsyncd.conf
gid = users read only = true use chroot = true transfer logging = true log format = %h %o %f %l %b log file = /var/log/rsyncd.log hosts allow = 192.168.115.0/255.255.255.0 [mail] path = /var/mail read only = yes list = yes uid = root gid = root hosts allow = 192.168.115.2