mail server postfix dovecot sasl dovecot.conf PART II

## POP3 specific settings

##



protocol pop3 {

# Login executable location.

#login_executable = /usr/lib/dovecot/pop3-login



# POP3 executable location. See IMAP's mail_executable above for examples

# how this could be changed.

#mail_executable = /usr/lib/dovecot/pop3



# Don't try to set mails non-recent or seen with POP3 sessions. This is

# mostly intended to reduce disk I/O. With maildir it doesn't move files

# from new/ to cur/, with mbox it doesn't write Status-header.

#pop3_no_flag_updates = no



# Support LAST command which exists in old POP3 specs, but has been removed

# from new ones. Some clients still wish to use this though. Enabling this

# makes RSET command clear all \Seen flags from messages.

#pop3_enable_last = no



# If mail has X-UIDL header, use it as the mail's UIDL.

#pop3_reuse_xuidl = no



# Keep the mailbox locked for the entire POP3 session.

#pop3_lock_session = no



# POP3 UIDL (unique mail identifier) format to use. You can use following

# variables:

#

# %v - Mailbox's IMAP UIDVALIDITY

# %u - Mail's IMAP UID

# %m - MD5 sum of the mailbox headers in hex (mbox only)

# %f - filename (maildir only)

#

# If you want UIDL compatibility with other POP3 servers, use:

# UW's ipop3d : %08Xv%08Xu

# Courier version 0 : %f

# Courier version 1 : %u

# Courier version 2 : %v-%u

# Cyrus (<= 2.1.3) : %u

# Cyrus (>= 2.1.4) : %v.%u

# Older Dovecots : %v.%u

# tpop3d : %Mf

#

# Note that Outlook 2003 seems to have problems with %v.%u format which was

# Dovecot's default, so if you're building a new server it would be a good

# idea to change this. %08Xu%08Xv should be pretty fail-safe.

#

# NOTE: Nowadays this is required to be set explicitly, since the old

# default was bad but it couldn't be changed without breaking existing

# installations. %08Xu%08Xv will be the new default, so use it for new

# installations.

#

pop3_uidl_format = %08Xu%08Xv



# POP3 logout format string:

# %t - number of TOP commands

# %p - number of bytes sent to client as a result of TOP command

# %r - number of RETR commands

# %b - number of bytes sent to client as a result of RETR command

# %d - number of deleted messages

# %m - number of messages (before deletion)

# %s - mailbox size in bytes (before deletion)

#pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s



# Support for dynamically loadable plugins. mail_plugins is a space separated

# list of plugins to load.

#mail_plugins =

#mail_plugin_dir = /usr/lib/dovecot/modules/pop3



# Workarounds for various client bugs:

# outlook-no-nuls:

# Outlook and Outlook Express hang if mails contain NUL characters.

# This setting replaces them with 0x80 character.

# oe-ns-eoh:

# Outlook Express and Netscape Mail breaks if end of headers-line is

# missing. This option simply sends it if it's missing.

# The list is space-separated.

#pop3_client_workarounds =

}



##

## MANAGESIEVE specific settings

##

protocol managesieve {

# Login executable location.

#login_executable = /usr/libexec/dovecot/managesieve-login



# MANAGESIEVE executable location. See IMAP's mail_executable above for

# examples how this could be changed.

#mail_executable = /usr/libexec/dovecot/managesieve



# Maximum MANAGESIEVE command line length in bytes. This setting is

# directly borrowed from IMAP. But, since long command lines are very

# unlikely with MANAGESIEVE, changing this will not be very useful.

#managesieve_max_line_length = 65536



# Specifies the location of the symlink pointing to the active script in

# the sieve storage directory. This must match the SIEVE setting used by

# deliver (refer to http://wiki.dovecot.org/LDA/Sieve#location for more

# info). Variable substitution with % is recognized.

#sieve=~/.dovecot.sieve



# This specifies the path to the directory where the uploaded scripts must

# be stored. In terms of '%' variable substitution it is identical to

# dovecot's mail_location setting used by the mail protocol daemons.

#sieve_storage=~/sieve



# If, for some inobvious reason, the sieve_storage remains unset, the

# managesieve daemon uses the specification of the mail_location to find out

# where to store the sieve files (see explaination in README.managesieve).

# The example below, when uncommented, overrides any global mail_location

# specification and stores all the scripts in '~/mail/sieve' if sieve_storage

# is unset. However, you should always use the sieve_storage setting.

# mail_location = mbox:~/mail



# To fool managesieve clients that are focused on timesieved you can

# specify the IMPLEMENTATION capability that the dovecot reports to clients

# (default: dovecot).

#managesieve_implementation_string = Cyrus timsieved v2.2.13

}



##

## LDA specific settings

##



# protocol lda {

# Address to use when sending rejection mails.

# postmaster_address = postmaster@example.com



# Hostname to use in various parts of sent mails, eg. in Message-Id.

# Default is the system's real hostname.

#hostname =



# Support for dynamically loadable plugins. mail_plugins is a space separated

# list of plugins to load.

#mail_plugins =

#mail_plugin_dir = /usr/lib/dovecot/modules/lda



# Binary to use for sending mails.

#sendmail_path = /usr/lib/sendmail



# UNIX socket path to master authentication server to find users.

#auth_socket_path = /var/run/dovecot/auth-master



# Enabling Sieve plugin for server-side mail filtering

# mail_plugins = cmusieve

# }



##

## Authentication processes

##



# Executable location

#auth_executable = /usr/lib/dovecot/dovecot-auth



# Set max. process size in megabytes.

#auth_process_size = 256



# Authentication cache size in kilobytes. 0 means it's disabled.

# Note that bsdauth, PAM and vpopmail require cache_key to be set for caching

# to be used.

#auth_cache_size = 0

# Time to live in seconds for cached data. After this many seconds the cached

# record is no longer used, *except* if the main database lookup returns

# internal failure. We also try to handle password changes automatically: If

# user's previous authentication was successful, but this one wasn't, the

# cache isn't used. For now this works only with plaintext authentication.

#auth_cache_ttl = 3600



# Space separated list of realms for SASL authentication mechanisms that need

# them. You can leave it empty if you don't want to support multiple realms.

# Many clients simply use the first one listed here, so keep the default realm

# first.

#auth_realms =



# Default realm/domain to use if none was specified. This is used for both

# SASL realms and appending @domain to username in plaintext logins.

#auth_default_realm =



# List of allowed characters in username. If the user-given username contains

# a character not listed in here, the login automatically fails. This is just

# an extra check to make sure user can't exploit any potential quote escaping

# vulnerabilities with SQL/LDAP databases. If you want to allow all characters,

# set this value to empty.

#auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@



# Username character translations before it's looked up from databases. The

# value contains series of from -> to characters. For example "#@/@" means

# that '#' and '/' characters are translated to '@'.

#auth_username_translation =



# Username formatting before it's looked up from databases. You can use

# the standard variables here, eg. %Lu would lowercase the username, %n would

# drop away the domain if it was given, or "%n-AT-%d" would change the '@' into

# "-AT-". This translation is done after auth_username_translation changes.

#auth_username_format =



# If you want to allow master users to log in by specifying the master

# username within the normal username string (ie. not using SASL mechanism's

# support for it), you can specify the separator character here. The format

# is then . UW-IMAP uses "*" as the

# separator, so that could be a good choice.

#auth_master_user_separator =



# Username to use for users logging in with ANONYMOUS SASL mechanism

#auth_anonymous_username = anonymous



# More verbose logging. Useful for figuring out why authentication isn't

# working.

#auth_verbose = no



# Even more verbose logging for debugging purposes. Shows for example SQL

# queries.

#auth_debug = no



# In case of password mismatches, log the passwords and used scheme so the

# problem can be debugged. Requires auth_debug=yes to be set.

#auth_debug_passwords = no



# Maximum number of dovecot-auth worker processes. They're used to execute

# blocking passdb and userdb queries (eg. MySQL and PAM). They're

# automatically created and destroyed as needed.

#auth_worker_max_count = 30



# Host name to use in GSSAPI principal names. The default is to use the

# name returned by gethostname().

#auth_gssapi_hostname =



# Kerberos keytab to use for the GSSAPI mechanism. Will use the system

# default (usually /etc/krb5.keytab) if not specified.

#auth_krb5_keytab =



auth default {

# Space separated list of wanted authentication mechanisms:

# plain login digest-md5 cram-md5 ntlm rpa apop anonymous gssapi

# NOTE: See also disable_plaintext_auth setting.

mechanisms = plain login



#

# Password database is used to verify user's password (and nothing more).

# You can have multiple passdbs and userdbs. This is useful if you want to

# allow both system users (/etc/passwd) and virtual users to login without

# duplicating the system users into virtual database.

#

#

#

# By adding master=yes setting inside a passdb you make the passdb a list

# of "master users", who can log in as anyone else. Unless you're using PAM,

# you probably still want the destination user to be looked up from passdb

# that it really exists. This can be done by adding pass=yes setting to the

# master passdb.



# Users can be temporarily disabled by adding a passdb with deny=yes.

# If the user is found from that database, authentication will fail.

# The deny passdb should always be specified before others, so it gets

# checked first. Here's an example:



#passdb passwd-file {

# File contains a list of usernames, one per line

#args = /etc/dovecot.deny

#deny = yes

#}



# PAM authentication. Preferred nowadays by most systems.

# Note that PAM can only be used to verify if user's password is correct,

# so it can't be used as userdb. If you don't want to use a separate user

# database (passwd usually), you can use static userdb.

# REMEMBER: You'll need /etc/pam.d/dovecot file created for PAM

# authentication to actually work.

passdb pam {

# [blocking=yes] [session=yes] [setcred=yes]

# [cache_key=] []

#

# By default a new process is forked from dovecot-auth for each PAM lookup.

# Setting blocking=yes uses the alternative way: dovecot-auth worker

# processes do the PAM lookups.

#

# session=yes makes Dovecot open and immediately close PAM session. Some

# PAM plugins need this to work, such as pam_mkhomedir.

#

# setcred=yes makes Dovecot establish PAM credentials if some PAM plugins

# need that. They aren't ever deleted though, so this isn't enabled by

# default.

#

# cache_key can be used to enable authentication caching for PAM

# (auth_cache_size also needs to be set). It isn't enabled by default

# because PAM modules can do all kinds of checks besides checking password,

# such as checking IP address. Dovecot can't know about these checks

# without some help. cache_key is simply a list of variables (see

# /usr/share/doc/dovecot-common/wiki/Variables.txt) which must match for

# the cached data to be used. Here are some examples:

# %u - Username must match. Probably sufficient for most uses.

# %u%r - Username and remote IP address must match.

# %u%s - Username and service (ie. IMAP, POP3) must match.

#

# If service name is "*", it means the authenticating service name

# is used, eg. pop3 or imap (/etc/pam.d/pop3, /etc/pam.d/imap).

#

# Some examples:

# args = session=yes *

# args = cache_key=%u dovecot

#args = dovecot

}



# System users (NSS, /etc/passwd, or similiar)

# In many systems nowadays this uses Name Service Switch, which is

# configured in /etc/nsswitch.conf.

#passdb passwd {

# [blocking=yes] - See userdb passwd for explanation

#args =

#}



# Shadow passwords for system users (NSS, /etc/shadow or similiar).

# Deprecated by PAM nowadays.

#

#passdb shadow {

# [blocking=yes] - See userdb passwd for explanation

#args =

#}



# PAM-like authentication for OpenBSD.

#

#passdb bsdauth {

# [cache_key=] - See cache_key in PAM for explanation.

#args =

#}



# passwd-like file with specified location

#

#passdb passwd-file {

# Path for passwd-file

#args =

#}



# checkpassword executable authentication

# NOTE: You will probably want to use "userdb prefetch" with this.

#

#passdb checkpassword {

# Path for checkpassword binary

#args =

#}



# SQL database

#passdb sql {

# Path for SQL configuration file

#args = /etc/dovecot/dovecot-sql.conf

#}



# LDAP database

#passdb ldap {

# Path for LDAP configuration file

#args = /etc/dovecot/dovecot-ldap.conf

#}



# vpopmail authentication

#passdb vpopmail {

# [cache_key=] - See cache_key in PAM for explanation.

#args =

#}



#

# User database specifies where mails are located and what user/group IDs

# own them. For single-UID configuration use "static".

#

#

#



# System users (NSS, /etc/passwd, or similiar). In many systems nowadays this

# uses Name Service Switch, which is configured in /etc/nsswitch.conf.

#

userdb passwd {

# [blocking=yes] - By default the lookups are done in the main dovecot-auth

# process. This setting causes the lookups to be done in auth worker

# proceses. Useful with remote NSS lookups that may block.

# NOTE: Be sure to use this setting with nss_ldap or users might get

# logged in as each others!

#args =

}



# passwd-like file with specified location

#

#userdb passwd-file {

# Path for passwd-file

#args =

#}



# static settings generated from template

#userdb static {

# Template for the fields. Can return anything a userdb could normally

# return. For example:

#

# args = uid=500 gid=500 home=/var/mail/%u

#

# If you use deliver, it needs to look up users only from the userdb. This

# of course doesn't work with static because there is no list of users.

# Normally static userdb handles this by doing a passdb lookup. This works

# with most passdbs, with PAM being the most notable exception. If you do

# the user verification another way, you can add allow_all_users=yes to

# the args in which case the passdb lookup is skipped.

#

#args =

#}



# SQL database

#userdb sql {

# Path for SQL configuration file

#args = /etc/dovecot/dovecot-sql.conf

#}



# LDAP database

#userdb ldap {

# Path for LDAP configuration file

#args = /etc/dovecot/dovecot-ldap.conf

#}



# vpopmail

#userdb vpopmail {

#}



# "prefetch" user database means that the passdb already provided the

# needed information and there's no need to do a separate userdb lookup.

# This can be made to work with SQL and LDAP databases, see their example

# configuration files for more information how to do it.

#

#userdb prefetch {

#}



# User to use for the process. This user needs access to only user and

# password databases, nothing else. Only shadow and pam authentication

# requires roots, so use something else if possible. Note that passwd

# authentication with BSDs internally accesses shadow files, which also

# requires roots. Note that this user is NOT used to access mails.

# That user is specified by userdb above.

#user = root



# Directory where to chroot the process. Most authentication backends don't

# work if this is set, and there's no point chrooting if auth_user is root.

# Note that valid_chroot_dirs isn't needed to use this setting.

#chroot =



# Number of authentication processes to create

#count = 1



# Require a valid SSL client certificate or the authentication fails.

#ssl_require_client_cert = no



# Take the username from client's SSL certificate, using

# X509_NAME_get_text_by_NID() which returns the subject's DN's

# CommonName.

#ssl_username_from_cert = no



# It's possible to export the authentication interface to other programs:

socket listen {

#master {

# Master socket provides access to userdb information. It's typically

# used to give Dovecot's local delivery agent access to userdb so it

# can find mailbox locations.

#path = /var/run/dovecot/auth-master

#mode = 0600

# Default user/group is the one who started dovecot-auth (root)

#user = postfix

#group = postfix

#}

client {

# The client socket is generally safe to export to everyone. Typical use

# is to export it to your SMTP server so it can do SMTP AUTH lookups

# using it.

#path = /var/run/dovecot/auth-client

path = /var/spool/postfix/private/auth

user = postfix

group = postfix

mode = 0660

}

}



## dovecot-lda specific settings

##

# socket listen {

# master {

# path = /var/run/dovecot/auth-master

# mode = 0600

# user = mail # User running Dovecot LDA

# #group = mail # Or alternatively mode 0660 + LDA user in this group

# }

# }



}



# If you wish to use another authentication server than dovecot-auth, you can

# use connect sockets. They are assumed to be already running, Dovecot's master

# process only tries to connect to them. They don't need any other settings

# than the path for the master socket, as the configuration is done elsewhere.

# Note that the client sockets must exist in the login_dir.

#auth external {

# socket connect {

# master {

# path = /var/run/dovecot/auth-master

# }

# }

#}



##

## Dictionary server settings

##



# Dictionary can be used by some plugins to store key=value lists.

# Currently this is only used by dict quota backend. The dictionary can be

# used either directly or though a dictionary server. The following dict block

# maps dictionary names to URIs when the server is used. These can then be

# referenced using URIs in format "proxy:".



dict {

#quota = mysql:/etc/dovecot-dict-quota.conf

}



##

## Plugin settings

##



plugin {

# Here you can give some extra environment variables to mail processes.

# This is mostly meant for passing parameters to plugins. %variable

# expansion is done for all values.



# Quota plugin. Multiple backends are supported:

# dirsize: Find and sum all the files found from mail directory.

# Extremely SLOW with Maildir. It'll eat your CPU and disk I/O.

# dict: Keep quota stored in dictionary (eg. SQL)

# maildir: Maildir++ quota

# fs: Read-only support for filesystem quota

#quota = maildir



# ACL plugin. vfile backend reads ACLs from "dovecot-acl" file from maildir

# directory. You can also optionally give a global ACL directory path where

# ACLs are applied to all users' mailboxes. The global ACL directory contains

# one file for each mailbox, eg. INBOX or sub.mailbox.

#acl = vfile:/etc/dovecot-acls



# Convert plugin. If set, specifies the source storage path which is

# converted to destination storage (mail_location) when the user logs in.

# The existing mail directory is renamed to -converted.

#convert_mail = mbox:%h/mail

# Skip mailboxes which we can't open successfully instead of aborting.

#convert_skip_broken_mailboxes = no



# Trash plugin. When saving a message would make user go over quota, this

# plugin automatically deletes the oldest mails from configured mailboxes

# until the message can be saved within quota limits. The configuration file

# is a text file where each line is in format:

# Mails are first deleted in lowest -> highest priority number order

#trash = /etc/dovecot-trash.conf



# Lazy expunge plugin. Currently works only with maildirs. When a user

# expunges mails, the mails are moved to a mailbox in another namespace

# (1st). When a mailbox is deleted, the mailbox is moved to another namespace

# (2nd) as well. Also if the deleted mailbox had any expunged messages,

# they're moved to a 3rd namespace. The mails won't be counted in quota,

# and they're not deleted automatically (use a cronjob or something).

#lazy_expunge = .EXPUNGED/ .DELETED/ .DELETED/.EXPUNGED/

}

#