-
Notifications
You must be signed in to change notification settings - Fork 274
/
DOVECOT.txt
279 lines (204 loc) · 8.59 KB
/
DOVECOT.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
#
# Dovecot configuration for Postfix Admin
# Originally written by: Massimo <AndyCapp> Danieli
# Revised by: Sampsa Hario <shario> for Dovecot v1.0
# Revised by: David Goodwin <david@palepurple.co.uk> for Dovecot 2.1.x (2014/01/02)
#
More complete Dovecot documentation:
http://wiki.dovecot.org/Quota
http://wiki.dovecot.org/Quota/Dict
http://www.opensourcehowto.org/how-to/mysql/mysql-users-postfixadmin-postfix-dovecot--squirrelmail-with-userprefs-stored-in-mysql.html
Here are the relevant parts of Dovecot v2.1.x configuration for Postfixadmin setup.
Please refer to Dovecot documentation for complete information.
The setup gets userdb and passdb info from MySQL as well as quotas, and
uses dict backend to store used quotas as key=value pairs so that they can
be viewed real-time in Postfixadmin.
1. Dovecot setup
-----------------
A basic /etc/dovecot/dovecot.conf is as follows, this was generated using 'dovecot -n' on a vanilla install and then
changing to talk to a PostgreSQL or MySQL database.
# BEGIN /etc/dovecot/dovecot.conf:
# Change this to where your mail root is, this needs to match whatever structure postfix expects....
# See also: https://wiki.dovecot.org/MailLocation - %d domain, %u full username, %n user part (%u with no domain)
mail_location = maildir:/var/mail/vmail/%u/
namespace inbox {
inbox = yes
location =
mailbox Drafts {
special_use = \Drafts
}
mailbox Junk {
special_use = \Junk
}
mailbox Sent {
special_use = \Sent
}
mailbox "Sent Messages" {
special_use = \Sent
}
mailbox Trash {
special_use = \Trash
}
prefix =
}
protocols = "imap pop3"
# change to 'no' if you don't have ssl cert/keys, and comment out ssl_cert/ssl_key
ssl = yes
# If you're using LetsEncrypt/certbot see e.g. /etc/letsencrypt/live/MyDomain/fullchain.pem.
#
# cat server.crt server.key > dovecot.pem
#
# Make sure dovecot can read these file(s)
#
# If you use doveadm for your PostfixAdmin hashing, the webserver will also need read access to these files
# See also : https://github.com/postfixadmin/postfixadmin/blob/master/DOCUMENTS/HASHING.md#dovecotmethod
ssl_cert = </etc/dovecot/private/dovecot.pem
ssl_key = </etc/dovecot/private/dovecot.pem
# login is for outlook express smtpd auth
auth_mechanisms = plain login
# If you're having trouble, try uncommenting these:
#auth_debug = yes
#auth_debug_passwords = yes
userdb {
driver = sql
args = /etc/dovecot/dovecot-sql.conf
}
passdb {
driver = sql
args = /etc/dovecot/dovecot-sql.conf
}
# Uncomment this if you want Postfix to be able to do smtpd auth through dovecot
# At a minimum Postfix probably needs smtpd_sasl_type = dovecot
# And additionally: smtpd_sasl_path = private/auth
#service auth {
# unix_listener /var/spool/postfix/private/auth {
# mode = 0660
# user = postfix
# group = postfix
# }
#}
# Needs to match Postfix virtual_uid_maps
first_valid_uid = 1001
# allow plaintext auth (change to 'yes' to block plaintext passwords)
disable_plaintext_auth = no
#END
2. Dovecot *sql setup
----------------------
Below you'll find the relevant part of dovecot-sql.conf file regarding our
setup.
Things you will probably need to change are db connection settings (connect=)
and the default_pass_scheme.
#BEGIN /etc/dovecot/dovecot-sql.conf
connect = host=localhost dbname=postfix user=postfix password=postfix
# Use either
driver = mysql
# Or
# driver = pgsql
# Default password scheme - change to match your Postfixadmin setting.
# depends on your $CONF['encrypt'] setting:
# md5crypt -> MD5-CRYPT
# md5 -> PLAIN-MD5
# cleartext -> PLAIN
default_pass_scheme = MD5-CRYPT
# Query to retrieve password. user can be used to retrieve username in other
# formats also.
password_query = SELECT username AS user,password FROM mailbox WHERE username = '%u' AND active='1'
# Query to retrieve user information, note uid matches dovecot.conf AND Postfix virtual_uid_maps parameter.
# MYSQL:
user_query = SELECT CONCAT('/var/mail/vmail/', maildir) AS home, 1001 AS uid, 1001 AS gid, CONCAT('*:bytes=', quota) AS quota_rule FROM mailbox WHERE username = '%u' AND active='1'
# PostgreSQL:
# user_query = SELECT '/var/mail/vmail/' || maildir AS home, 1001 AS uid, 1001 AS gid,
# '*:bytes=' || quota AS quota_rule FROM mailbox WHERE username = '%u' AND active = '1'
# see: https://doc.dovecot.org/configuration_manual/authentication/sql/#id6
iterate_query = SELECT username as user FROM mailbox WHERE active = '1'
#END /etc/dovecot/dovecot-sql.conf
If you make use of the separate smtp_active flag in the mailbox table of postfixadmin by
enabling the configuration parameter $CONF['smtp_active_flag'] = YES in postfixadmin configuration
and you're using dovecot sasl with postfix, the dovecot queries can be updated to use the different flag for smtp:
password_query = SELECT username AS user,password FROM mailbox WHERE username = '%u' AND (('%s' = 'smtp' AND smtp_active = '1') OR ('%s' <> 'smtp' AND active = '1'))
user_query = SELECT CONCAT('/var/mail/vmail/', maildir) AS home, 1001 AS uid, 1001 AS gid, CONCAT('*:bytes=', quota) AS quota_rule FROM mailbox WHERE username = '%u' AND (('%s' = 'smtp' AND smtp_active = '1') OR ('%s' <> 'smtp' AND active = '1'))
3. Permissions
--------------
Applicable to those older versions of Postfixadmin (before v 3.4) (see also https://github.com/postfixadmin/postfixadmin/pull/491)
With Dovecot 2.3.11 (ish?), if you are using the Postfixadmin dovecot password hashing backend - so your Postfixadmin configuration looks like
`$CONF['encrypt'] = 'dovecot:something';`
then the system user account running the PostfixAdmin code (normally the webserver user
account, like www-data or http or nobody) will need ...
* read access to any SSL certificate files defined in /etc/dovecot/dovecot.conf
(check: ssl_key, ssl_cert)
* read/write access to /run/dovecot/stats-writer
* Fixable with: `usermod -aG dovecot www-data``
Please note, Postfixadmin does not need to run on the same server as the Dovecot server.
See also the following tickets which contain discussions and solutions :
* https://github.com/postfixadmin/postfixadmin/issues/381 (Unable to login after Dovecot upgrade)
* https://github.com/postfixadmin/postfixadmin/issues/398 (Dovecotpw needs to read my TLS cert and private key)
4. Dovecot v1.0 quota support (optional)
----------------------------------------
Please note that you need to use Dovecot's own local delivery agent to
enforce and update quotas. Then you can view real-time used quotas in
Postfixadmin.
Add to dovecot.conf:
## IMAP quota
protocol imap {
mail_plugins = quota
}
## POP quota
protocol pop3 {
mail_plugins = quota
}
## Local Delivery Agent
protocol lda {
mail_plugins = quota
}
## Dictionary DB proxy
dict {
quota = mysql:/etc/dovecot-dict-quota.conf
}
## Default quota values
plugin {
quota = dict:storage=200000 proxy::quota
}
Change dovecot-sql.conf to return quota values:
for MySQL:
user_query = SELECT maildir, 1001 AS uid, 1001 AS gid, CONCAT('dict:storage=',floor(quota/1000),' ::proxy::quota') as quota FROM mailbox WHERE username = '%u' AND active='1'
for PostgreSQL:
user_query = SELECT maildir, 1001 AS uid, 1001 AS gid, 'dict:storage=' || floor(quota/1000) || '::proxy::quota' as quota FROM mailbox WHERE username = '%u' AND active='1'
Create file dovecot-dict-quota.conf.
For dovecot 1.0 & 1.1, use this as a template:
driver = mysql
connect = host=localhost dbname=postfix user=postfix password=postfix
default_pass_scheme = MD5-CRYPT
table = quota
select_field = current
where_field = path
username_field = username
If you use dovecot 1.2 or newer, use this:
connect = host=localhost dbname=postfix user=postfix password=postfix
map {
pattern = priv/quota/storage
table = quota2
username_field = username
value_field = bytes
}
map {
pattern = priv/quota/messages
table = quota2
username_field = username
value_field = messages
}
Create database in Mysql:
(This is automatically done by postfixadmin's setup.php)
Enable quota support in Postfixadmin config.inc.php:
$CONF['used_quotas'] = 'YES';
$CONF['quota'] = 'YES';
Note: The above text describes the configuration for dovecot 1.0 & 1.1 quota table format.
If you use dovecot 1.2 or newer,
- use the 'quota2' table (also created by setup.php)
- set $CONF['new_quota_table'] = 'YES'
5. Dovecot Allowed IPs and App Password support (optional)
----------------------------------------------------------
To enhance end user security, Postfixadmin supports a set of features that
need implementation in the Dovecot login SQL queries.
The following features are available:
* Restrict login to a list of allowed remote IP addresses.
* Allow login with app passwords.