Difference between revisions of "Dovecot"

From ArchWiki
Jump to navigation Jump to search
(PAM Authentication: rm section, it should have always been and now is part of the package: https://bugs.archlinux.org/task/61852)
 
(38 intermediate revisions by 22 users not shown)
Line 6: Line 6:
 
{{Related|OpenSMTPD}}
 
{{Related|OpenSMTPD}}
 
{{Related|Fail2ban}}
 
{{Related|Fail2ban}}
{{Related|Virtual_user_mail_system}}
+
{{Related|SOGo}}
 +
{{Related|Virtual user mail system}}
 
{{Related articles end}}
 
{{Related articles end}}
This article describes how to set up a mail server suitable for personal or small office use.
 
  
[http://www.dovecot.org/ Dovecot] is an open source [[Wikipedia:IMAP|IMAP]] and [[Wikipedia:POP3|POP3]] server for Linux/UNIX-like systems, written primarily with security in mind. Developed by Timo Sirainen, Dovecot was first released in July 2002. Dovecot primarily aims to be a lightweight, fast and easy to set up open source mailserver.  For more detailed information, please see the official [http://wiki2.dovecot.org/ Dovecot Wiki].
+
[http://www.dovecot.org/ Dovecot] is an open source [[Wikipedia:IMAP|IMAP]] and [[Wikipedia:POP3|POP3]] server for Linux/UNIX-like systems, written primarily with security in mind. Dovecot primarily aims to be a lightweight, fast and easy to set up open source mailserver.  For more detailed information, please see the official [http://wiki2.dovecot.org/ Dovecot Wiki].
 +
 
 +
This article describes how to set up Dovecot for personal or small office use.
  
 
==Installation==
 
==Installation==
  
[[Install]] the packages {{Pkg|dovecot}} and {{Pkg|pam}}.
+
[[Install]] the {{Pkg|dovecot}} package.
  
 
==Configuration==
 
==Configuration==
  
 
===Assumptions===
 
===Assumptions===
 +
 +
{{Style|Don't make arbitrary assumptions.}}
  
 
* Each mail account served by Dovecot, has a local user account defined on the server.
 
* Each mail account served by Dovecot, has a local user account defined on the server.
* The server uses [[Wikipedia:Pluggable authentication module|PAM]] to authenticate the user against the local user database (/etc/passwd).
+
* The server uses [[PAM]] to authenticate the user against the local user database (/etc/passwd).
* [[Wikipedia:Transport_Layer_Security|SSL]] is used to encrypt the authentication password.
+
* [[Wikipedia:Transport_Layer_Security|TLS]] is used to encrypt the authentication password.
 
* The common [[Wikipedia:Maildir|Maildir]] format is used to store the mail in the user's home directory.
 
* The common [[Wikipedia:Maildir|Maildir]] format is used to store the mail in the user's home directory.
* A [[Wikipedia:Mail delivery agent|MDA]] has already been set up to deliver mail to the local users.
+
* A [[Wikipedia:Mail delivery agent|MDA]] has already been set up to deliver mail to the local users.
  
===Create the SSL certificate===
+
=== Create the TLS certificate ===
  
The {{Pkg|dovecot}} package contains a script to generate the server SSL certificate.
+
{{Warning|If you deploy [[Wikipedia:TLS|TLS]], be sure to follow [https://weakdh.org/sysadmin.html weakdh.org's guide] to prevent vulnerabilities. {{ic|ssl_min_protocol}} defaults to TLSv1. For more information see [[Server-side TLS]].}}
  
* Copy the configuration file from the sample file: {{ic|# cp /etc/ssl/dovecot-openssl.cnf{.sample,} }}.
+
To obtain a certificate, see [[OpenSSL#Usage]].
* Edit {{ic|/etc/ssl/dovecot-openssl.cnf}} to configure the certificate.
 
  
* Execute {{ic|# /usr/lib/dovecot/mkcert.sh}} to generate the certificate.
+
Alternatively you can generate the certificate using a script that comes with the {{Pkg|dovecot}} package:
 +
 
 +
# Copy the example configuration: {{ic|# cp /usr/share/doc/dovecot/dovecot-openssl.cnf /etc/ssl/dovecot-openssl.cnf}}.
 +
# Edit {{ic|/etc/ssl/dovecot-openssl.cnf}} to configure the certificate.
 +
# Execute {{ic|# /usr/lib/dovecot/mkcert.sh}} to generate the certificate.
  
 
The certificate/key pair is created as {{ic|/etc/ssl/certs/dovecot.pem}} and {{ic|/etc/ssl/private/dovecot.pem}}.
 
The certificate/key pair is created as {{ic|/etc/ssl/certs/dovecot.pem}} and {{ic|/etc/ssl/private/dovecot.pem}}.
Line 39: Line 46:
 
Run {{ic|cp /etc/ssl/certs/dovecot.pem /etc/ca-certificates/trust-source/anchors/dovecot.crt}} and then {{ic|# trust extract-compat}} whenever you have
 
Run {{ic|cp /etc/ssl/certs/dovecot.pem /etc/ca-certificates/trust-source/anchors/dovecot.crt}} and then {{ic|# trust extract-compat}} whenever you have
 
changed your certificate.
 
changed your certificate.
 
{{Warning|If you plan on implementing SSL/TLS, please respond safely to [http://disablessl3.com/ POODLE] and [https://weakdh.org/sysadmin.html FREAK/Logjam] by adding the following to your configuration:
 
{{bc|1=
 
ssl_protocols = !SSLv2 !SSLv3
 
ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
 
ssl_prefer_server_ciphers = yes
 
ssl_dh_parameters_length = 2048
 
}}}}
 
  
 
===Dovecot configuration===
 
===Dovecot configuration===
  
* Copy the dovecot.conf and conf.d/* configuration files from {{ic|/usr/share/doc/dovecot/example-config}} to {{ic|/etc/dovecot}}:
+
* Copy the {{ic|dovecot.conf}} and {{ic|conf.d/*}} configuration files from {{ic|/usr/share/doc/dovecot/example-config}} to {{ic|/etc/dovecot}}:
 
{{bc|
 
{{bc|
 
# cp /usr/share/doc/dovecot/example-config/dovecot.conf /etc/dovecot
 
# cp /usr/share/doc/dovecot/example-config/dovecot.conf /etc/dovecot
Line 60: Line 59:
 
By default dovecot will try to detect what mail storage system is in use on the system. To use the Maildir format edit {{ic|/etc/dovecot/conf.d/10-mail.conf}} to set {{ic|1=mail_location = maildir:~/Maildir}}.
 
By default dovecot will try to detect what mail storage system is in use on the system. To use the Maildir format edit {{ic|/etc/dovecot/conf.d/10-mail.conf}} to set {{ic|1=mail_location = maildir:~/Maildir}}.
  
===PAM Authentication===
+
===Generate DH parameters===
 +
 
 +
To generate a new DH parameters file (this will take very long):
 +
 
 +
# openssl dhparam -out /etc/dovecot/dh.pem 4096
  
* To configure PAM for dovecot, create {{ic|/etc/pam.d/dovecot}} with the following content:
+
then add the file to {{ic|/etc/dovecot/conf.d/10-ssl.conf}}
{{hc|/etc/pam.d/dovecot|
+
 
auth    required        pam_unix.so nullok
+
ssl_dh = </etc/dovecot/dh.pem
account required        pam_unix.so
 
}}
 
  
 
===PAM Authentication with LDAP===
 
===PAM Authentication with LDAP===
Line 82: Line 83:
 
In this way both LDAP and system users have their mailbox.  
 
In this way both LDAP and system users have their mailbox.  
  
* Change the name of the following file so it can be read by dovecot:
 
{{bc|
 
# mv /etc/dovecot/conf.d/auth-system.conf{.ext,}
 
}}
 
 
* Edit {{ic|/etc/dovecot/conf.d/auth-system.conf}} by changing the {{ic|passdb}} directive, like this:
 
* Edit {{ic|/etc/dovecot/conf.d/auth-system.conf}} by changing the {{ic|passdb}} directive, like this:
 
<pre>
 
<pre>
Line 96: Line 93:
  
 
===Sieve===
 
===Sieve===
 +
[[wikipedia:Sieve (mail filtering language)|Sieve]] is a programming language that can be used to create filters for email on mail server.
 +
{{Note| You must be using Dovecot as a local delivery agent (through LMTP or LDA) for plugins like Sieve to work. If you are following the [[Virtual user mail system]] guide, this is most likely not the case and you will need to modify your Postfix configuration. A guide can be found in the [https://wiki2.dovecot.org/HowTo/PostfixDovecotLMTP Dovecot Wiki].}}
  
[http://en.wikipedia.org/wiki/Sieve_%28mail_filtering_language%29 Sieve] is a programming language that can be used to create filters for email on mail server.
+
====Sieve Interpreter Plugin====
 +
This facilitates the actual Sieve filtering upon delivery.  
  
 
* Install {{Pkg|pigeonhole}}.
 
* Install {{Pkg|pigeonhole}}.
* Add "sieve" to "protocols" in dovecot.conf (and the lines from the next points)
+
* Depending on your usage, add {{ic|sieve}} to {{ic|mail_plugins}} in
<pre>
+
** {{ic|<nowiki>/etc/dovecot/conf.d/15-lda.conf</nowiki>}}{{bc|<nowiki>
 +
protocol lda {
 +
  mail_plugins = $mail_plugins sieve
 +
}
 +
</nowiki>}}
 +
** and/or {{ic|/etc/dovecot/conf.d/20-lmtp.conf}}{{bc|<nowiki>
 +
protocol lmtp {
 +
  mail_plugins = $mail_plugins sieve
 +
}
 +
</nowiki>}}
 +
{{Note| Nowadays it is recommended to use LMTP instead of LDA. Nevertheless the Dovecot LDA can still be used for small mailservers. More information can be found in the [http://wiki2.dovecot.org/LMTP Dovecot Wiki].}}
 +
 
 +
* Optionally, add configuration in {{ic|plugin}} section. See [http://wiki2.dovecot.org/Pigeonhole/Sieve/Configuration Sieve Interpreter Documentation] for configuration options and default values.<br> Example: run {{ic|cp /usr/share/doc/dovecot/example-config/conf.d/90-sieve.conf /etc/dovecot/conf.d/90-sieve.conf}} and verify in {{ic|/etc/dovecot/conf.d/90-sieve.conf}}: {{bc|<nowiki>
 +
plugin {
 +
  sieve = file:~/sieve;active=~/.dovecot.sieve
 +
}
 +
</nowiki>}}
 +
{{Note| Configuration files in {{ic|/etc/dovecot/conf.d/}} will not be read without a line in {{ic|/etc/dovecot/dovecot.conf}} like {{ic|!include /etc/dovecot/conf.d/*.conf}}. If you are following the [[Virtual user mail system]] guide, you may need to add this line.}}
 +
 
 +
======Example: SpamAssassin - move spam to "Junk" folder======
 +
* Add spamtest configuration
 +
{{hc|/etc/dovecot/conf.d/90-sieve.conf|<nowiki>
 +
plugin {
 +
  sieve_extensions = +spamtest +spamtestplus
 +
 
 +
  sieve_spamtest_status_type = score
 +
  sieve_spamtest_status_header = \
 +
    X-Spam_score: (-?[[:digit:]]+\.[[:digit:]]).*
 +
  sieve_spamtest_max_value = 5.0
 +
 
 +
  sieve_before = /var/lib/dovecot/sieve/global_sieves/move_to_spam_folder.sieve
 +
}
 +
</nowiki>}} '''Note:''' This tests for "X-Spam_score" (which is the spam header format in default Exim configuration). Your header might look different, ie "X-Spam-Score".
 +
* Create sieve script: {{ic|mkdir -p /var/lib/dovecot/sieve/global_sieves}}
 +
{{hc|/var/lib/dovecot/sieve/global_sieves/move_to_spam_folder.sieve|<nowiki>
 +
require "spamtestplus";
 +
require "fileinto";
 +
require "relational";
 +
require "comparator-i;ascii-numeric";
 +
 
 +
if spamtest :value "ge" :comparator "i;ascii-numeric" "5" {
 +
  fileinto "Junk";
 +
}
 +
</nowiki>}}
 +
 
 +
* To compile sieve, execute in shell {{bc|<nowiki>
 +
sievec /var/lib/dovecot/sieve/global_sieves
 +
</nowiki>}} and make sure the {{ic|move_to_spam_folder.sieve}} and the resulting {{ic|move_to_spam_folder.svbin}} files are world readable.
 +
 
 +
====ManageSieve Server====
 +
This implements the ManageSieve protocol through which users can remotely manage Sieve scripts on the server.
 +
 
 +
* Follow the steps in '''Sieve Interpreter Plugin''' above.
 +
* Add {{ic|sieve}} to {{ic|protocols}} in {{ic|dovecot.conf}} {{bc|<nowiki>
 
protocols = imap pop3 sieve
 
protocols = imap pop3 sieve
</pre>
+
</nowiki>}}
* Add minimal 80-sieve.conf in {{ic|/etc/dovecot/conf.d/}}
+
* Add minimal {{ic|/etc/dovecot/conf.d/20-managesieve.conf}} {{bc|<nowiki>
<pre>
 
 
service managesieve-login {
 
service managesieve-login {
  inet_listener sieve {
 
    port = 4190
 
  }
 
 
}
 
}
  
Line 117: Line 166:
 
protocol sieve {
 
protocol sieve {
 
}
 
}
</pre>
+
</nowiki>}}  
* Add "sieve" as "mail_plugins" in "protocol lda" section of {{ic|/etc/dovecot/conf.d/15-lda.conf}}
+
* Restart {{ic|dovecot}}. The managesieve daemon will listen on port 4190 by default.
<pre>
 
protocol lda {
 
  mail_plugins = sieve
 
}
 
</pre>
 
* Specify sieve storage location in "plugin" section of {{ic|/etc/dovecot/conf.d/90-plugin.conf}}:
 
<pre>
 
plugin {
 
  sieve=/var/mail/%u/dovecot.sieve
 
  sieve_dir=/var/mail/%u/sieve
 
}
 
</pre>
 
 
 
{{Note| Nowadays it is recommended to use LMTP instead of LDA. Nevertheless the Dovecot LDA can still be used for small mailservers. More information can be found in the [http://wiki2.dovecot.org/LMTP Dovecot Wiki]}}
 
 
 
* Ensure that your MTA uses dovecot for delivery. For example: postfix's main.cf and dovecot-lda:
 
  mailbox_command = /usr/lib/dovecot/dovecot-lda -f "$SENDER" -a "$RECIPIENT"
 
  
 
==Starting the server==
 
==Starting the server==

Latest revision as of 17:00, 26 February 2019

Dovecot is an open source IMAP and POP3 server for Linux/UNIX-like systems, written primarily with security in mind. Dovecot primarily aims to be a lightweight, fast and easy to set up open source mailserver. For more detailed information, please see the official Dovecot Wiki.

This article describes how to set up Dovecot for personal or small office use.

Installation

Install the dovecot package.

Configuration

Assumptions

Tango-edit-clear.pngThis article or section needs language, wiki syntax or style improvements. See Help:Style for reference.Tango-edit-clear.png

Reason: Don't make arbitrary assumptions. (Discuss in Talk:Dovecot#)
  • Each mail account served by Dovecot, has a local user account defined on the server.
  • The server uses PAM to authenticate the user against the local user database (/etc/passwd).
  • TLS is used to encrypt the authentication password.
  • The common Maildir format is used to store the mail in the user's home directory.
  • A MDA has already been set up to deliver mail to the local users.

Create the TLS certificate

Warning: If you deploy TLS, be sure to follow weakdh.org's guide to prevent vulnerabilities. ssl_min_protocol defaults to TLSv1. For more information see Server-side TLS.

To obtain a certificate, see OpenSSL#Usage.

Alternatively you can generate the certificate using a script that comes with the dovecot package:

  1. Copy the example configuration: # cp /usr/share/doc/dovecot/dovecot-openssl.cnf /etc/ssl/dovecot-openssl.cnf.
  2. Edit /etc/ssl/dovecot-openssl.cnf to configure the certificate.
  3. Execute # /usr/lib/dovecot/mkcert.sh to generate the certificate.

The certificate/key pair is created as /etc/ssl/certs/dovecot.pem and /etc/ssl/private/dovecot.pem.

Run cp /etc/ssl/certs/dovecot.pem /etc/ca-certificates/trust-source/anchors/dovecot.crt and then # trust extract-compat whenever you have changed your certificate.

Dovecot configuration

  • Copy the dovecot.conf and conf.d/* configuration files from /usr/share/doc/dovecot/example-config to /etc/dovecot:
# cp /usr/share/doc/dovecot/example-config/dovecot.conf /etc/dovecot
# cp -r /usr/share/doc/dovecot/example-config/conf.d /etc/dovecot

The default configuration is ok for most systems, but make sure to read through the configuration files to see what options are available. See the quick configuration guide and dovecot configuration for more instructions.

By default dovecot will try to detect what mail storage system is in use on the system. To use the Maildir format edit /etc/dovecot/conf.d/10-mail.conf to set mail_location = maildir:~/Maildir.

Generate DH parameters

To generate a new DH parameters file (this will take very long):

# openssl dhparam -out /etc/dovecot/dh.pem 4096

then add the file to /etc/dovecot/conf.d/10-ssl.conf

ssl_dh = </etc/dovecot/dh.pem

PAM Authentication with LDAP

  • If you are using an OpenLDAP server for authentication instead, be sure to be able to login with your LDAP users first, as described in LDAP authentication.

You can then write the following in /etc/pam.d/dovecot remembering that the entries order is very important:

/etc/pam.d/dovecot
auth    sufficient      pam_ldap.so
auth    required        pam_unix.so     nullok
account sufficient      pam_ldap.so
account required        pam_unix.so
session required        pam_mkhomedir.so skel=/etc/skel umask=0022
session sufficient      pam_ldap.so

In this way both LDAP and system users have their mailbox.

  • Edit /etc/dovecot/conf.d/auth-system.conf by changing the passdb directive, like this:
passdb {
  driver = pam
  args = session=yes dovecot
}

By using the pam_mkhomedir.so module and by adding the session part in the passdb directive, if an LDAP user logs in for the first time the corresponding home directory will be automatically created.

Sieve

Sieve is a programming language that can be used to create filters for email on mail server.

Note: You must be using Dovecot as a local delivery agent (through LMTP or LDA) for plugins like Sieve to work. If you are following the Virtual user mail system guide, this is most likely not the case and you will need to modify your Postfix configuration. A guide can be found in the Dovecot Wiki.

Sieve Interpreter Plugin

This facilitates the actual Sieve filtering upon delivery.

  • Install pigeonhole.
  • Depending on your usage, add sieve to mail_plugins in
    • /etc/dovecot/conf.d/15-lda.conf
      protocol lda {
        mail_plugins = $mail_plugins sieve
      }
      
    • and/or /etc/dovecot/conf.d/20-lmtp.conf
      protocol lmtp {
        mail_plugins = $mail_plugins sieve
      }
      
Note: Nowadays it is recommended to use LMTP instead of LDA. Nevertheless the Dovecot LDA can still be used for small mailservers. More information can be found in the Dovecot Wiki.
  • Optionally, add configuration in plugin section. See Sieve Interpreter Documentation for configuration options and default values.
    Example: run cp /usr/share/doc/dovecot/example-config/conf.d/90-sieve.conf /etc/dovecot/conf.d/90-sieve.conf and verify in /etc/dovecot/conf.d/90-sieve.conf:
    plugin {
      sieve = file:~/sieve;active=~/.dovecot.sieve 
    }
    
Note: Configuration files in /etc/dovecot/conf.d/ will not be read without a line in /etc/dovecot/dovecot.conf like !include /etc/dovecot/conf.d/*.conf. If you are following the Virtual user mail system guide, you may need to add this line.
Example: SpamAssassin - move spam to "Junk" folder
  • Add spamtest configuration
/etc/dovecot/conf.d/90-sieve.conf
plugin {
  sieve_extensions = +spamtest +spamtestplus

  sieve_spamtest_status_type = score
  sieve_spamtest_status_header = \ 
    X-Spam_score: (-?[[:digit:]]+\.[[:digit:]]).* 
  sieve_spamtest_max_value = 5.0 

  sieve_before = /var/lib/dovecot/sieve/global_sieves/move_to_spam_folder.sieve
}

Note: This tests for "X-Spam_score" (which is the spam header format in default Exim configuration). Your header might look different, ie "X-Spam-Score".

  • Create sieve script: mkdir -p /var/lib/dovecot/sieve/global_sieves
/var/lib/dovecot/sieve/global_sieves/move_to_spam_folder.sieve
require "spamtestplus";
require "fileinto";
require "relational";
require "comparator-i;ascii-numeric";

if spamtest :value "ge" :comparator "i;ascii-numeric" "5" {
  fileinto "Junk";
}
  • To compile sieve, execute in shell
    sievec /var/lib/dovecot/sieve/global_sieves
    
    and make sure the move_to_spam_folder.sieve and the resulting move_to_spam_folder.svbin files are world readable.

ManageSieve Server

This implements the ManageSieve protocol through which users can remotely manage Sieve scripts on the server.

  • Follow the steps in Sieve Interpreter Plugin above.
  • Add sieve to protocols in dovecot.conf
    protocols = imap pop3 sieve
    
  • Add minimal /etc/dovecot/conf.d/20-managesieve.conf
    service managesieve-login {
    }
    
    service managesieve {
    }
    
    protocol sieve {
    }
    
  • Restart dovecot. The managesieve daemon will listen on port 4190 by default.

Starting the server

Use the standard systemd syntax to control the dovecot.service daemon.

Tricks

Generate hashes with non-default hash functions.

doveadm pw -s SHA512-CRYPT -p "superpassword"

Remember to make sure that the column in the database is large enough(you might not get a warning..)

Remember to set the password scheme in your dovecot-sql.conf file

default_pass_scheme = SHA512-CRYPT