Red Hat Training
A Red Hat training course is available for RHEL 8
Chapter 11. Configuring and maintaining a Dovecot IMAP and POP3 server
Dovecot is a high-performance mail delivery agent (MDA) with a focus on security. You can use IMAP or POP3-compatible email clients to connect to a Dovecot server and read or download emails.
Key features of Dovecot:
- The design and implementation focuses on security
- Two-way replication support for high availability to improve the performance in large environments
-
Supports the high-performance
dboxmailbox format, but alsomboxandMaildirfor compatibility reasons - Self-healing features, such as fixing broken index files
- Compliance with the IMAP standards
- Workaround support to bypass bugs in IMAP and POP3 clients
11.1. Setting up a Dovecot server with PAM authentication
Dovecot supports the Name Service Switch (NSS) interface as a user database and the Pluggable Authentication Modules (PAM) framework as an authentication backend. With this configuration, Dovecot can provide services to users who are available locally on the server through NSS.
Use PAM authentication if accounts:
-
Are defined locally in the
/etc/passwdfile - Are stored in a remote database but they are available locally through the System Security Services Daemon (SSSD) or other NSS plugins.
11.1.1. Installing Dovecot
The dovecot package provides:
-
The
dovecotservice and the utilities to maintain it - Services that Dovecot starts on demand, such as for authentication
- Plugins, such as server-side mail filtering
-
Configuration files in the
/etc/dovecot/directory -
Documentation in the
/usr/share/doc/dovecot/directory
Procedure
Install the
dovecotpackage:# yum install dovecotNoteIf Dovecot is already installed and you require clean configuration files, rename or remove the
/etc/dovecot/directory. Afterwards, reinstall the package. Without removing the configuration files, theyum reinstall dovecotcommand does not reset the configuration files in/etc/dovecot/.
11.1.2. Configuring TLS encryption on a Dovecot server
Dovecot provides a secure default configuration. For example, TLS is enabled by default to transmit credentials and data encrypted over networks. To configure TLS on a Dovecot server, you only need to set the paths to the certificate and private key files. Additionally, you can increase the security of TLS connections by generating and using Diffie-Hellman parameters to provide perfect forward secrecy (PFS).
Prerequisites
- Dovecot is installed.
The following files have been copied to the listed locations on the server:
-
The server certificate:
/etc/pki/dovecot/certs/server.example.com.crt -
The private key:
/etc/pki/dovecot/private/server.example.com.key -
The Certificate Authority (CA) certificate:
/etc/pki/dovecot/certs/ca.crt
-
The server certificate:
-
The hostname in the
Subject DNfield of the server certificate matches the server’s Fully-qualified Domain Name (FQDN).
Procedure
Set secure permissions on the private key file:
# chown root:root /etc/pki/dovecot/private/server.example.com.key # chmod 600 /etc/pki/dovecot/private/server.example.com.key
Generate a file with Diffie-Hellman parameters:
# openssl dhparam -out /etc/dovecot/dh.pem 4096Depending on the hardware and entropy on the server, generating Diffie-Hellman parameters with 4096 bits can take several minutes.
Set the paths to the certificate and private key files in the
/etc/dovecot/conf.d/10-ssl.conffile:Update the
ssl_certandssl_keyparameters, and set them to use the paths of the server’s certificate and private key:ssl_cert = </etc/pki/dovecot/certs/server.example.com.crt ssl_key = </etc/pki/dovecot/private/server.example.com.key
Uncomment the
ssl_caparameter, and set it to use the path to the CA certificate:ssl_ca = </etc/pki/dovecot/certs/ca.crtUncomment the
ssl_dhparameter, and set it to use the path to the Diffie-Hellman parameters file:ssl_dh = </etc/dovecot/dh.pem
ImportantTo ensure that Dovecot reads the value of a parameter from a file, the path must start with a leading
<character.
Next step
Additional resources
-
/usr/share/doc/dovecot/wiki/SSL.DovecotConfiguration.txt
11.1.3. Preparing Dovecot to use virtual users
By default, Dovecot performs many actions on the file system as the user who uses the service. However, configuring the Dovecot back end to use one local user to perform these actions has several benefits:
- Dovecot performs file system actions as a specific local user instead of using the user’s ID (UID).
- Users do not need to be available locally on the server.
- You can store all mailboxes and user-specific files in one root directory.
- Users do not require a UID and group ID (GID), which reduces administration efforts.
- Users who have access to the file system on the server cannot compromise their mailboxes or indexes because they cannot access these files.
- Setting up replication is easier.
Prerequisites
- Dovecot is installed.
Procedure
Create the
vmailuser:# useradd --home-dir /var/mail/ --shell /usr/sbin/nologin vmailDovecot will later use this user to manage the mailboxes. For security reasons, do not use the
dovecotordovenullsystem users for this purpose.If you use a different path than
/var/mail/, set themail_spool_tSELinux context on it, for example:# semanage fcontext -a -t mail_spool_t "<path>(/.*)?" # restorecon -Rv <path>
Grant write permissions on
/var/mail/only to thevmailuser:# chown vmail:vmail /var/mail/ # chmod 700 /var/mail/
Uncomment the
mail_locationparameter in the/etc/dovecot/conf.d/10-mail.conffile, and set it to the mailbox format and location:mail_location = sdbox:/var/mail/%n/With this setting:
-
Dovecot uses the high-performant
dboxmailbox format insinglemode. In this mode, the service stores each mail in a separate file, similar to themaildirformat. -
Dovecot resolves the
%nvariable in the path to the username. This is required to ensure that each user has a separate directory for its mailbox.
-
Dovecot uses the high-performant
Additional resources
-
/usr/share/doc/dovecot/wiki/VirtualUsers.txt -
/usr/share/doc/dovecot/wiki/MailLocation.txt -
/usr/share/doc/dovecot/wiki/MailboxFormat.dbox.txt -
/usr/share/doc/dovecot/wiki/Variables.txt
11.1.4. Using PAM as the Dovecot authentication backend
By default, Dovecot uses the Name Service Switch (NSS) interface as the user database and the Pluggable Authentication Modules (PAM) framework as the authentication backend.
Customize the settings to adapt Dovecot to your environment and to simplify administration by using the virtual users feature.
Prerequisites
- Dovecot is installed.
- The virtual users feature is configured.
Procedure
Update the
first_valid_uidparameter in the/etc/dovecot/conf.d/10-mail.conffile to define the lowest user ID (UID) that can authenticate to Dovecot:first_valid_uid = 1000By default, users with a UID greater than or equal to
1000can authenticate. If required, you can also set thelast_valid_uidparameter to define the highest UID that Dovecot allows to log in.In the
/etc/dovecot/conf.d/auth-system.conf.extfile, add theoverride_fieldsparameter to theuserdbsection as follows:userdb { driver = passwd override_fields = uid=vmail gid=vmail home=/var/mail/%n/ }Due to the fixed values, Dovecot does not query these settings from the
/etc/passwdfile. As a result, the home directory defined in/etc/passwddoes not need to exist.
Next step
Additional resources
-
/usr/share/doc/dovecot/wiki/PasswordDatabase.PAM.txt -
/usr/share/doc/dovecot/wiki/VirtualUsers.Home.txt
11.1.5. Completing the Dovecot configuration
Once you have installed and configured Dovecot, open the required ports in the firewalld service, and enable and start the service. Afterwards, you can test the server.
Prerequisites
The following has been configured in Dovecot:
- TLS encryption
- An authentication backend
- Clients trust the Certificate Authority (CA) certificate.
Procedure
If you want to provide only an IMAP or POP3 service to users, uncomment the
protocolsparameter in the/etc/dovecot/dovecot.conffile, and set it to the required protocols. For example, if you do not require POP3, set:protocols = imap lmtpBy default, the
imap,pop3, andlmtpprotocols are enabled.Open the ports in the local firewall. For example, to open the ports for the IMAPS, IMAP, POP3S, and POP3 protocols, enter:
# firewall-cmd --permanent --add-service=imaps --add-service=imap --add-service=pop3s --add-service=pop3 # firewall-cmd --reload
Enable and start the
dovecotservice:# systemctl enable --now dovecot
Verification
Use a mail client, such as Mozilla Thunderbird, to connect to Dovecot and read emails. The settings for the mail client depend on the protocol you want to use:
Table 11.1. Connection settings to the Dovecot server
Note that this table does not list settings for unencrypted connections because, by default, Dovecot does not accept plain text authentication on connections without TLS.
Display configuration settings with non-default values:
# doveconf -n
Additional resources
-
firewall-cmd(1)man page
11.2. Setting up a Dovecot server with LDAP authentication
If your infrastructure uses an LDAP server to store accounts, you can authenticate Dovecot users against it. In this case, you manage accounts centrally in the directory and, users do not required local access to the file system on the Dovecot server.
Centrally-managed accounts are also a benefit if you plan to set up multiple Dovecot servers with replication to make your mailboxes high available.
11.2.1. Installing Dovecot
The dovecot package provides:
-
The
dovecotservice and the utilities to maintain it - Services that Dovecot starts on demand, such as for authentication
- Plugins, such as server-side mail filtering
-
Configuration files in the
/etc/dovecot/directory -
Documentation in the
/usr/share/doc/dovecot/directory
Procedure
Install the
dovecotpackage:# yum install dovecotNoteIf Dovecot is already installed and you require clean configuration files, rename or remove the
/etc/dovecot/directory. Afterwards, reinstall the package. Without removing the configuration files, theyum reinstall dovecotcommand does not reset the configuration files in/etc/dovecot/.
11.2.2. Configuring TLS encryption on a Dovecot server
Dovecot provides a secure default configuration. For example, TLS is enabled by default to transmit credentials and data encrypted over networks. To configure TLS on a Dovecot server, you only need to set the paths to the certificate and private key files. Additionally, you can increase the security of TLS connections by generating and using Diffie-Hellman parameters to provide perfect forward secrecy (PFS).
Prerequisites
- Dovecot is installed.
The following files have been copied to the listed locations on the server:
-
The server certificate:
/etc/pki/dovecot/certs/server.example.com.crt -
The private key:
/etc/pki/dovecot/private/server.example.com.key -
The Certificate Authority (CA) certificate:
/etc/pki/dovecot/certs/ca.crt
-
The server certificate:
-
The hostname in the
Subject DNfield of the server certificate matches the server’s Fully-qualified Domain Name (FQDN).
Procedure
Set secure permissions on the private key file:
# chown root:root /etc/pki/dovecot/private/server.example.com.key # chmod 600 /etc/pki/dovecot/private/server.example.com.key
Generate a file with Diffie-Hellman parameters:
# openssl dhparam -out /etc/dovecot/dh.pem 4096Depending on the hardware and entropy on the server, generating Diffie-Hellman parameters with 4096 bits can take several minutes.
Set the paths to the certificate and private key files in the
/etc/dovecot/conf.d/10-ssl.conffile:Update the
ssl_certandssl_keyparameters, and set them to use the paths of the server’s certificate and private key:ssl_cert = </etc/pki/dovecot/certs/server.example.com.crt ssl_key = </etc/pki/dovecot/private/server.example.com.key
Uncomment the
ssl_caparameter, and set it to use the path to the CA certificate:ssl_ca = </etc/pki/dovecot/certs/ca.crtUncomment the
ssl_dhparameter, and set it to use the path to the Diffie-Hellman parameters file:ssl_dh = </etc/dovecot/dh.pem
ImportantTo ensure that Dovecot reads the value of a parameter from a file, the path must start with a leading
<character.
Next step
Additional resources
-
/usr/share/doc/dovecot/wiki/SSL.DovecotConfiguration.txt
11.2.3. Preparing Dovecot to use virtual users
By default, Dovecot performs many actions on the file system as the user who uses the service. However, configuring the Dovecot back end to use one local user to perform these actions has several benefits:
- Dovecot performs file system actions as a specific local user instead of using the user’s ID (UID).
- Users do not need to be available locally on the server.
- You can store all mailboxes and user-specific files in one root directory.
- Users do not require a UID and group ID (GID), which reduces administration efforts.
- Users who have access to the file system on the server cannot compromise their mailboxes or indexes because they cannot access these files.
- Setting up replication is easier.
Prerequisites
- Dovecot is installed.
Procedure
Create the
vmailuser:# useradd --home-dir /var/mail/ --shell /usr/sbin/nologin vmailDovecot will later use this user to manage the mailboxes. For security reasons, do not use the
dovecotordovenullsystem users for this purpose.If you use a different path than
/var/mail/, set themail_spool_tSELinux context on it, for example:# semanage fcontext -a -t mail_spool_t "<path>(/.*)?" # restorecon -Rv <path>
Grant write permissions on
/var/mail/only to thevmailuser:# chown vmail:vmail /var/mail/ # chmod 700 /var/mail/
Uncomment the
mail_locationparameter in the/etc/dovecot/conf.d/10-mail.conffile, and set it to the mailbox format and location:mail_location = sdbox:/var/mail/%n/With this setting:
-
Dovecot uses the high-performant
dboxmailbox format insinglemode. In this mode, the service stores each mail in a separate file, similar to themaildirformat. -
Dovecot resolves the
%nvariable in the path to the username. This is required to ensure that each user has a separate directory for its mailbox.
-
Dovecot uses the high-performant
Additional resources
-
/usr/share/doc/dovecot/wiki/VirtualUsers.txt -
/usr/share/doc/dovecot/wiki/MailLocation.txt -
/usr/share/doc/dovecot/wiki/MailboxFormat.dbox.txt -
/usr/share/doc/dovecot/wiki/Variables.txt
11.2.4. Using LDAP as the Dovecot authentication backend
Users in an LDAP directory can usually authenticate themselves to the directory service. Dovecot can use this to authenticate users when they log in to the IMAP and POP3 services. This authentication method has a number of benefits, such as:
- Administrators can manage users centrally in the directory.
- The LDAP accounts do not require any special attributes. They only need to be able to authenticate to the LDAP server. Consequently, this method is independent from the password storage scheme used on the LDAP server.
- Users do not need to be available locally on the server through the Name Service Switch (NSS) interface and the Pluggable Authentication Modules (PAM) framework.
Prerequisites
- Dovecot is installed.
- The virtual users feature is configured.
- Connections to the LDAP server support TLS encryption.
- RHEL on the Dovecot server trusts the Certificate Authority (CA) certificate of the LDAP server.
- If users are stored in different trees in the LDAP directory, a dedicated LDAP account for Dovecot exists to search the directory. This account requires permissions to search for Distinguished Names (DNs) of other users.
Procedure
Configure the authentication backends in the
/etc/dovecot/conf.d/10-auth.conffile:Comment out
includestatements forauth-*.conf.extauthentication backend configuration files that you do not require, for example:#!include auth-system.conf.extEnable LDAP authentication by uncommenting the following line:
!include auth-ldap.conf.ext
Edit the
/etc/dovecot/conf.d/auth-ldap.conf.extfile, and add theoverride_fieldsparameter as follows to theuserdbsection:userdb { driver = ldap args = /etc/dovecot/dovecot-ldap.conf.ext override_fields = uid=vmail gid=vmail home=/var/mail/%n/ }Due to the fixed values, Dovecot does not query these settings from the LDAP server. Consequently, these attributes also do not have to be present.
Create the
/etc/dovecot/dovecot-ldap.conf.extfile with the following settings:Depending on the LDAP structure, configure one of the following:
If users are stored in different trees in the LDAP directory, configure dynamic DN lookups:
dn = cn=dovecot_LDAP,dc=example,dc=com dnpass = password pass_filter = (&(objectClass=posixAccount)(uid=%n))
Dovecot uses the specified DN, password, and filter to search the DN of the authenticating user in the directory. In this search, Dovecot replaces
%nin the filter with the username. Note that the LDAP search must return only one result.If all users are stored under a specific entry, configure a DN template:
auth_bind_userdn = cn=%n,ou=People,dc=example,dc=com
Enable authentication binds to the LDAP server to verify Dovecot users:
auth_bind = yesSet the URL to the LDAP server:
uris = ldaps://LDAP-srv.example.comFor security reasons, only use encrypted connections using LDAPS or the
STARTTLScommand over the LDAP protocol. For the latter, additionally addtls = yesto the settings.For a working certificate validation, the hostname of the LDAP server must match the hostname used in its TLS certificate.
Enable the verification of the LDAP server’s TLS certificate:
tls_require_cert = hardSet the base DN to the DN where to start searching for users:
base = ou=People,dc=example,dc=comSet the search scope:
scope = onelevelDovecot searches with the
onelevelscope only in the specified base DN and with thesubtreescope also in subtrees.
Set secure permissions on the
/etc/dovecot/dovecot-ldap.conf.extfile:# chown root:root /etc/dovecot/dovecot-ldap.conf.ext # chmod 600 /etc/dovecot/dovecot-ldap.conf.ext
Next step
Additional resources
-
/usr/share/doc/dovecot/example-config/dovecot-ldap.conf.ext -
/usr/share/doc/dovecot/wiki/UserDatabase.Static.txt -
/usr/share/doc/dovecot/wiki/AuthDatabase.LDAP.txt -
/usr/share/doc/dovecot/wiki/AuthDatabase.LDAP.AuthBinds.txt -
/usr/share/doc/dovecot/wiki/AuthDatabase.LDAP.PasswordLookups.txt
11.2.5. Completing the Dovecot configuration
Once you have installed and configured Dovecot, open the required ports in the firewalld service, and enable and start the service. Afterwards, you can test the server.
Prerequisites
The following has been configured in Dovecot:
- TLS encryption
- An authentication backend
- Clients trust the Certificate Authority (CA) certificate.
Procedure
If you want to provide only an IMAP or POP3 service to users, uncomment the
protocolsparameter in the/etc/dovecot/dovecot.conffile, and set it to the required protocols. For example, if you do not require POP3, set:protocols = imap lmtpBy default, the
imap,pop3, andlmtpprotocols are enabled.Open the ports in the local firewall. For example, to open the ports for the IMAPS, IMAP, POP3S, and POP3 protocols, enter:
# firewall-cmd --permanent --add-service=imaps --add-service=imap --add-service=pop3s --add-service=pop3 # firewall-cmd --reload
Enable and start the
dovecotservice:# systemctl enable --now dovecot
Verification
Use a mail client, such as Mozilla Thunderbird, to connect to Dovecot and read emails. The settings for the mail client depend on the protocol you want to use:
Table 11.2. Connection settings to the Dovecot server
Note that this table does not list settings for unencrypted connections because, by default, Dovecot does not accept plain text authentication on connections without TLS.
Display configuration settings with non-default values:
# doveconf -n
Additional resources
-
firewall-cmd(1)man page
11.3. Setting up a Dovecot server with MariaDB SQL authentication
If you store users and passwords in a MariaDB SQL server, you can configure Dovecot to use it as the user database and authentication backend. With this configuration, you manage accounts centrally in a database, and users have no local access to the file system on the Dovecot server.
Centrally managed accounts are also a benefit if you plan to set up multiple Dovecot servers with replication to make your mailboxes highly available.
11.3.1. Installing Dovecot
The dovecot package provides:
-
The
dovecotservice and the utilities to maintain it - Services that Dovecot starts on demand, such as for authentication
- Plugins, such as server-side mail filtering
-
Configuration files in the
/etc/dovecot/directory -
Documentation in the
/usr/share/doc/dovecot/directory
Procedure
Install the
dovecotpackage:# yum install dovecotNoteIf Dovecot is already installed and you require clean configuration files, rename or remove the
/etc/dovecot/directory. Afterwards, reinstall the package. Without removing the configuration files, theyum reinstall dovecotcommand does not reset the configuration files in/etc/dovecot/.
11.3.2. Configuring TLS encryption on a Dovecot server
Dovecot provides a secure default configuration. For example, TLS is enabled by default to transmit credentials and data encrypted over networks. To configure TLS on a Dovecot server, you only need to set the paths to the certificate and private key files. Additionally, you can increase the security of TLS connections by generating and using Diffie-Hellman parameters to provide perfect forward secrecy (PFS).
Prerequisites
- Dovecot is installed.
The following files have been copied to the listed locations on the server:
-
The server certificate:
/etc/pki/dovecot/certs/server.example.com.crt -
The private key:
/etc/pki/dovecot/private/server.example.com.key -
The Certificate Authority (CA) certificate:
/etc/pki/dovecot/certs/ca.crt
-
The server certificate:
-
The hostname in the
Subject DNfield of the server certificate matches the server’s Fully-qualified Domain Name (FQDN).
Procedure
Set secure permissions on the private key file:
# chown root:root /etc/pki/dovecot/private/server.example.com.key # chmod 600 /etc/pki/dovecot/private/server.example.com.key
Generate a file with Diffie-Hellman parameters:
# openssl dhparam -out /etc/dovecot/dh.pem 4096Depending on the hardware and entropy on the server, generating Diffie-Hellman parameters with 4096 bits can take several minutes.
Set the paths to the certificate and private key files in the
/etc/dovecot/conf.d/10-ssl.conffile:Update the
ssl_certandssl_keyparameters, and set them to use the paths of the server’s certificate and private key:ssl_cert = </etc/pki/dovecot/certs/server.example.com.crt ssl_key = </etc/pki/dovecot/private/server.example.com.key
Uncomment the
ssl_caparameter, and set it to use the path to the CA certificate:ssl_ca = </etc/pki/dovecot/certs/ca.crtUncomment the
ssl_dhparameter, and set it to use the path to the Diffie-Hellman parameters file:ssl_dh = </etc/dovecot/dh.pem
ImportantTo ensure that Dovecot reads the value of a parameter from a file, the path must start with a leading
<character.
Next step
Additional resources
-
/usr/share/doc/dovecot/wiki/SSL.DovecotConfiguration.txt
11.3.3. Preparing Dovecot to use virtual users
By default, Dovecot performs many actions on the file system as the user who uses the service. However, configuring the Dovecot back end to use one local user to perform these actions has several benefits:
- Dovecot performs file system actions as a specific local user instead of using the user’s ID (UID).
- Users do not need to be available locally on the server.
- You can store all mailboxes and user-specific files in one root directory.
- Users do not require a UID and group ID (GID), which reduces administration efforts.
- Users who have access to the file system on the server cannot compromise their mailboxes or indexes because they cannot access these files.
- Setting up replication is easier.
Prerequisites
- Dovecot is installed.
Procedure
Create the
vmailuser:# useradd --home-dir /var/mail/ --shell /usr/sbin/nologin vmailDovecot will later use this user to manage the mailboxes. For security reasons, do not use the
dovecotordovenullsystem users for this purpose.If you use a different path than
/var/mail/, set themail_spool_tSELinux context on it, for example:# semanage fcontext -a -t mail_spool_t "<path>(/.*)?" # restorecon -Rv <path>
Grant write permissions on
/var/mail/only to thevmailuser:# chown vmail:vmail /var/mail/ # chmod 700 /var/mail/
Uncomment the
mail_locationparameter in the/etc/dovecot/conf.d/10-mail.conffile, and set it to the mailbox format and location:mail_location = sdbox:/var/mail/%n/With this setting:
-
Dovecot uses the high-performant
dboxmailbox format insinglemode. In this mode, the service stores each mail in a separate file, similar to themaildirformat. -
Dovecot resolves the
%nvariable in the path to the username. This is required to ensure that each user has a separate directory for its mailbox.
-
Dovecot uses the high-performant
Additional resources
-
/usr/share/doc/dovecot/wiki/VirtualUsers.txt -
/usr/share/doc/dovecot/wiki/MailLocation.txt -
/usr/share/doc/dovecot/wiki/MailboxFormat.dbox.txt -
/usr/share/doc/dovecot/wiki/Variables.txt
11.3.4. Using a MariaDB SQL database as the Dovecot authentication backend
Dovecot can read accounts and passwords from a MariaDB database and use it to authenticate users when they log in to the IMAP or POP3 service. The benefits of this authentication method include:
- Administrators can manage users centrally in a database.
- Users have no access locally on the server.
Prerequisites
- Dovecot is installed.
- The virtual users feature is configured.
- Connections to the MariaDB server support TLS encryption.
-
The
dovecotDBdatabase exists in MariaDB, and theuserstable contains at least ausernameandpasswordcolumn. -
The
passwordcolumn contains passwords encrypted with a scheme that Dovecot supports. -
The passwords either use the same scheme or have a
{pw-storage-scheme}prefix. -
The
dovecotMariaDB user has read permission on theuserstable in thedovecotDBdatabase. -
The certificate of the Certificate Authority (CA) that issued the MariaDB server’s TLS certificate is stored on the Dovecot server in the
/etc/pki/tls/certs/ca.crtfile.
Procedure
Install the
dovecot-mysqlpackage:# yum install dovecot-mysqlConfigure the authentication backends in the
/etc/dovecot/conf.d/10-auth.conffile:Comment out
includestatements forauth-*.conf.extauthentication backend configuration files that you do not require, for example:#!include auth-system.conf.extEnable SQL authentication by uncommenting the following line:
!include auth-sql.conf.ext
Edit the
/etc/dovecot/conf.d/auth-sql.conf.extfile, and add theoverride_fieldsparameter to theuserdbsection as follows:userdb { driver = sql args = /etc/dovecot/dovecot-sql.conf.ext override_fields = uid=vmail gid=vmail home=/var/mail/%n/ }Due to the fixed values, Dovecot does not query these settings from the SQL server.
Create the
/etc/dovecot/dovecot-sql.conf.extfile with the following settings:driver = mysql connect = host=mariadb_srv.example.com dbname=dovecotDB user=dovecot password=dovecotPW ssl_ca=/etc/pki/tls/certs/ca.crt default_pass_scheme = SHA512-CRYPT user_query = SELECT username FROM users WHERE username='%u'; password_query = SELECT username AS user, password FROM users WHERE username='%u'; iterate_query = SELECT username FROM users;
To use TLS encryption to the database server, set the
ssl_caoption to the path of the certificate of the CA that issued the MariaDB server certificate. For a working certificate validation, the hostname of the MariaDB server must match the hostname used in its TLS certificate.If the password values in the database contain a
{pw-storage-scheme}prefix, you can omit thedefault_pass_schemesetting.The queries in the file must be set as follows:
-
For the
user_queryparameter, the query must return the username of the Dovecot user. The query must also return only one result. -
For the
password_queryparameter, the query must return the username and the password, and Dovecot must use these values in theuserandpasswordvariables. Therefore, if the database uses different column names, use theASSQL command to rename a column in the result. -
For the
iterate_queryparameter, the query must return a list of all users.
-
For the
Set secure permissions on the
/etc/dovecot/dovecot-sql.conf.extfile:# chown root:root /etc/dovecot/dovecot-sql.conf.ext # chmod 600 /etc/dovecot/dovecot-sql.conf.ext
Next step
Additional resources
-
/usr/share/doc/dovecot/example-config/dovecot-sql.conf.ext -
/usr/share/doc/dovecot/wiki/Authentication.PasswordSchemes.txt
11.3.5. Completing the Dovecot configuration
Once you have installed and configured Dovecot, open the required ports in the firewalld service, and enable and start the service. Afterwards, you can test the server.
Prerequisites
The following has been configured in Dovecot:
- TLS encryption
- An authentication backend
- Clients trust the Certificate Authority (CA) certificate.
Procedure
If you want to provide only an IMAP or POP3 service to users, uncomment the
protocolsparameter in the/etc/dovecot/dovecot.conffile, and set it to the required protocols. For example, if you do not require POP3, set:protocols = imap lmtpBy default, the
imap,pop3, andlmtpprotocols are enabled.Open the ports in the local firewall. For example, to open the ports for the IMAPS, IMAP, POP3S, and POP3 protocols, enter:
# firewall-cmd --permanent --add-service=imaps --add-service=imap --add-service=pop3s --add-service=pop3 # firewall-cmd --reload
Enable and start the
dovecotservice:# systemctl enable --now dovecot
Verification
Use a mail client, such as Mozilla Thunderbird, to connect to Dovecot and read emails. The settings for the mail client depend on the protocol you want to use:
Table 11.3. Connection settings to the Dovecot server
Note that this table does not list settings for unencrypted connections because, by default, Dovecot does not accept plain text authentication on connections without TLS.
Display configuration settings with non-default values:
# doveconf -n
Additional resources
-
firewall-cmd(1)man page
11.4. Configuring replication between two Dovecot servers
With two-way replication, you can make your Dovecot server high-available, and IMAP and POP3 clients can access a mailbox on both servers. Dovecot keeps track of changes in the index logs of each mailbox and solves conflicts in a safe way.
Perform this procedure on both replication partners.
Replication works only between server pairs. Consequently, in a large cluster, you need multiple independent backend pairs.
Prerequisites
- Both servers use the same authentication backend. Preferably, use LDAP or SQL to maintain accounts centrally.
-
The Dovecot user database configuration supports user listing. Use the
doveadm user '*'command to verify this. -
Dovecot accesses mailboxes on the file system as the
vmailuser instead of the user’s ID (UID).
Procedure
Create the
/etc/dovecot/conf.d/10-replication.conffile and perform the following steps in it:Enable the
notifyandreplicationplug-ins:mail_plugins = $mail_plugins notify replicationAdd a
service replicatorsection:service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 user = vmail } }
With these settings, Dovecot starts at least one replicator process when the
dovecotservice starts. Additionally, this section defines the settings on thereplicator-doveadmsocket.Add a
service aggregatorsection to configure thereplication-notify-fifopipe andreplication-notifysocket:service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } }
Add a
service doveadmsection to define the port of the replication service:service doveadm { inet_listener { port = 12345 } }
Set the password of the
doveadmreplication service:doveadm_password = replication_passwordThe password must be the same on both servers.
Configure the replication partner:
plugin { mail_replica = tcp:server2.example.com:12345 }
Optional: Define the maximum number of parallel
dsyncprocesses:replication_max_conns = 20The default value of
replication_max_connsis10.
Set secure permissions on the
/etc/dovecot/conf.d/10-replication.conffile:# chown root:root /etc/dovecot/conf.d/10-replication.conf # chmod 600 /etc/dovecot/conf.d/10-replication.conf
Enable the
nis_enabledSELinux Boolean to allow Dovecot to open thedoveadmreplication port:setsebool -P nis_enabled onConfigure
firewalldrules to allow only the replication partner to access the replication port, for example:# firewall-cmd --permanent --zone=public --add-rich-rule="rule family="ipv4" source address="192.0.2.1/32" port protocol="tcp" port="12345" accept" # firewall-cmd --permanent --zone=public --add-rich-rule="rule family="ipv6" source address="2001:db8:2::1/128" port protocol="tcp" port="12345" accept" # firewall-cmd --reload
The subnet masks
/32for the IPv4 and/128for the IPv6 address limit the access to the specified addresses.- Perform this procedure also on the other replication partner.
Reload Dovecot:
# systemctl reload dovecot
Verification
- Perform an action in a mailbox on one server and then verify if Dovecot has replicated the change to the other server.
Display the replicator status:
# doveadm replicator status Queued 'sync' requests 0 Queued 'high' requests 0 Queued 'low' requests 0 Queued 'failed' requests 0 Queued 'full resync' requests 30 Waiting 'failed' requests 0 Total number of known users 75Display the replicator status of a specific user:
# doveadm replicator status example_user username priority fast sync full sync success sync failed example_user none 02:05:28 04:19:07 02:05:28 -
Additional resources
-
dsync(1)man page -
/usr/share/doc/dovecot/wiki/Replication.txt
11.5. Automatically subscribing users to IMAP mailboxes
Typically, IMAP server administrators want Dovecot to automatically create certain mailboxes, such as Sent and Trash, and subscribe the users to them. You can set this in the configuration files.
Additionally, you can define special-use mailboxes. IMAP clients often support defining mailboxes for special purposes, such as for sent emails. To avoid that the user has to manually select and set the correct mailboxes, IMAP servers can send a special-use attribute in the IMAP LIST command. Clients can then use this attribute to identify and set, for example, the mailbox for sent emails.
Prerequisites
- Dovecot is configured.
Procedure
Update the
inboxnamespace section in the/etc/dovecot/conf.d/15-mailboxes.conffile:Add the
auto = subscribesetting to each special-use mailbox that should be available to users, for example:namespace inbox { ... mailbox Drafts { special_use = \Drafts auto = subscribe } mailbox Junk { special_use = \Junk auto = subscribe } mailbox Trash { special_use = \Trash auto = subscribe } mailbox Sent { special_use = \Sent auto = subscribe } ... }If your mail clients support more special-use mailboxes, you can add similar entries. The
special_useparameter defines the value that Dovecot sends in thespecial-useattribute to the clients.Optional: If you want to define other mailboxes that have no special purpose, add
mailboxsections for them in the user’s inbox, for example:namespace inbox { ... mailbox "Important Emails" { auto = <value> } ... }You can set the
autoparameter to one of the following values:-
subscribe: Automatically creates the mailbox and subscribes the user to it. -
create: Automatically creates the mailbox without subscribing the user to it. -
no(default): Dovecot neither creates the mailbox nor does it subscribe the user to it.
-
Reload Dovecot:
# systemctl reload dovecot
Verification
Use an IMAP client and access your mailbox.
Mailboxes with the setting
auto = subscribeare automatically visible. If the client supports special-use mailboxes and the defined purposes, the client automatically uses them.
Additional resources
- RFC 6154: IMAP LIST Extension for Special-Use Mailboxes
-
/usr/share/doc/dovecot/wiki/MailboxSettings.txt
11.6. Configuring an LMTP socket and LMTPS listener
SMTP servers, such as Postfix, use the Local Mail Transfer Protocol (LMTP) to deliver emails to Dovecot. If the SMTP server runs:
- On the same host as Dovecot, use an LMTP socket
On a different host, use an LMTP service
By default, the LMTP protocol is not encrypted. However, if you configured TLS encryption, Dovecot uses the same settings automatically for the LMTP service. SMTP servers can then connect to it using the LMTPS protocol or the
STARTTLScommand over LMTP.
Prerequisites
- Dovecot is installed.
- If you want to configure an LMTP service, TLS encryption is configured in Dovecot.
Procedure
Verify that the LMTP protocol is enabled:
# doveconf -a | egrep "^protocols" protocols = imap pop3 lmtpThe protocol is enabled, if the output contains
lmtp.If the
lmtpprotocol is disabled, edit the/etc/dovecot/dovecot.conffile, and appendlmtpto the values in theprotocolsparameter:protocols = ... lmtpDepending on whether you need an LMTP socket or service, make the following changes in the
service lmtpsection in the/etc/dovecot/conf.d/10-master.conffile:LMTP socket: By default, Dovecot automatically creates the
/var/run/dovecot/lmtpsocket.Optional: Customize the ownership and permissions:
service lmtp { ... unix_listener lmtp { mode = 0600 user = postfix group = postfix } ... }LMTP service: Add a
inet_listenersub-section:service lmtp { ... inet_listener lmtp { port = 24 } ... }
Configure
firewalldrules to allow only the SMTP server to access the LMTP port, for example:# firewall-cmd --permanent --zone=public --add-rich-rule="rule family="ipv4" source address="192.0.2.1/32" port protocol="tcp" port="24" accept" # firewall-cmd --permanent --zone=public --add-rich-rule="rule family="ipv6" source address="2001:db8:2::1/128" port protocol="tcp" port="24" accept" # firewall-cmd --reload
The subnet masks
/32for the IPv4 and/128for the IPv6 address limit the access to the specified addresses.Reload Dovecot:
# systemctl reload dovecot
Verification
If you configured the LMTP socket, verify that Dovecot has created the socket and that the permissions are correct:
# ls -l /var/run/dovecot/lmtp srw-------. 1 postfix postfix 0 Nov 22 17:17 /var/run/dovecot/lmtp
Configure the SMTP server to submit emails to Dovecot using the LMTP socket or service.
When you use the LMTP service, ensure that the SMTP server uses the LMTPS protocol or sends the
STARTTLScommand to use an encrypted connection.
Additional resources
-
/usr/share/doc/dovecot/wiki/LMTP.txt
11.7. Disabling the IMAP or POP3 service in Dovecot
By default, Dovecot provides IMAP and POP3 services. If you require only one of them, you can disable the other to reduce the surface for attack.
Prerequisites
- Dovecot is installed.
Procedure
Uncomment the
protocolsparameter in the/etc/dovecot/dovecot.conffile, and set it to use the required protocols. For example, if you do not require POP3, set:protocols = imap lmtpBy default, the
imap,pop3, andlmtpprotocols are enabled.Reload Dovecot:
# systemctl reload dovecotClose the ports that are no longer required in the local firewall. For example, to close the ports for the POP3S and POP3 protocols, enter:
# firewall-cmd --remove-service=pop3s --remove-service=pop3 # firewall-cmd --reload
Verification
Display all ports in
LISTENmode opened by thedovecotprocess:# ss -tulp | grep dovecot tcp LISTEN 0 100 0.0.0.0:993 0.0.0.0:* users:(("dovecot",pid=1405,fd=44)) tcp LISTEN 0 100 0.0.0.0:143 0.0.0.0:* users:(("dovecot",pid=1405,fd=42)) tcp LISTEN 0 100 [::]:993 [::]:* users:(("dovecot",pid=1405,fd=45)) tcp LISTEN 0 100 [::]:143 [::]:* users:(("dovecot",pid=1405,fd=43))
In this example, Dovecot listens only on the TCP ports
993(IMAPS) and143(IMAP).Note that Dovecot only opens a port for the LMTP protocol if you configure the service to listen on a port instead of using a socket.
Additional resources
-
firewall-cmd(1)man page
11.8. Enabling server-side email filtering using Sieve on a Dovecot IMAP server
You can upload Sieve scripts to a server using the ManageSieve protocol. Sieve scripts define rules and actions that a server should validate and perform on incoming emails. For example, users can use Sieve to forward emails from a specific sender, and administrators can create a global filter to move mails flagged by a spam filter into a separate IMAP folder.
The ManageSieve plugin adds support for Sieve scripts and the ManageSieve protocol to a Dovecot IMAP server.
Use only clients that support using the ManageSieve protocol over TLS connections. Disabling TLS for this protocol causes clients to send credentials in plain text over the network.
Prerequisites
- Dovecot is configured and provides IMAP mailboxes.
- TLS encryption is configured in Dovecot.
- The mail clients support the ManageSieve protocol over TLS connections.
Procedure
Install the
dovecot-pigeonholepackage:# yum install dovecot-pigeonholeUncomment the following line in
/etc/dovecot/conf.d/20-managesieve.confto enable thesieveprotocol:protocols = $protocols sieveThis setting activates Sieve in addition to the other protocols that are already enabled.
Open the ManageSieve port in
firewalld:# firewall-cmd --permanent --add-service=managesieve # firewall-cmd --reload
Reload Dovecot:
# systemctl reload dovecot
Verification
Use a client and upload a Sieve script. Use the following connection settings:
- Port: 4190
- Connection security: SSL/TLS
- Authentication method: PLAIN
- Send an email to the user who has the Sieve script uploaded. If the email matches the rules in the script, verify that the server performs the defined actions.
Additional resources
-
/usr/share/doc/dovecot/wiki/Pigeonhole.Sieve.Plugins.IMAPSieve.txt -
/usr/share/doc/dovecot/wiki/Pigeonhole.Sieve.Troubleshooting.txt -
firewall-cmd(1)man page
11.9. How Dovecot processes configuration files
The dovecot package provides the main configuration file /etc/dovecot/dovecot.conf and multiple configuration files in the /etc/dovecot/conf.d/ directory. Dovecot combines the files to build the configuration when you start the service.
The main benefit of multiple config files is to group settings and increase readability. If you prefer a single configuration file, you can instead maintain all settings in /etc/dovecot/dovecot.conf and remove all include and include_try statements from that file.
Additional resources
-
/usr/share/doc/dovecot/wiki/ConfigFile.txt -
/usr/share/doc/dovecot/wiki/Variables.txt