Chapter 1. Configuring and maintaining a Dovecot IMAP and POP3 server

Procedure

1. Set secure permissions on the private key file:

   # chown root:root /etc/pki/dovecot/private/server.example.com.key
   # chmod 600 /etc/pki/dovecot/private/server.example.com.key

2. Generate a file with Diffie-Hellman parameters:

   # openssl dhparam -out /etc/dovecot/dh.pem 4096

   Depending on the hardware and entropy on the server, generating Diffie-Hellman parameters with 4096 bits can take several minutes.

3. Set the paths to the certificate and private key files in the /etc/dovecot/conf.d/10-ssl.conf file:

   1. Update the ssl_cert and ssl_key parameters, and set them to use the paths of the server’s certificate and private key:

      ssl_cert = </etc/pki/dovecot/certs/server.example.com.crt
      ssl_key = </etc/pki/dovecot/private/server.example.com.key

   2. Uncomment the ssl_ca parameter, and set it to use the path to the CA certificate:

      ssl_ca = </etc/pki/dovecot/certs/ca.crt

   3. Uncomment the ssl_dh parameter, and set it to use the path to the Diffie-Hellman parameters file:

      ssl_dh = </etc/dovecot/dh.pem

   Important

   To ensure that Dovecot reads the value of a parameter from a file, the path must start with a leading < character.

Procedure

1. Create the vmail user:

   # useradd --home-dir /var/mail/ --shell /usr/sbin/nologin vmail

   Dovecot will later use this user to manage the mailboxes. For security reasons, do not use the dovecot or dovenull system users for this purpose.

2. If you use a different path than /var/mail/, set the mail_spool_t SELinux context on it, for example:

   # semanage fcontext -a -t mail_spool_t "<path>(/.*)?"
   # restorecon -Rv <path>

3. Grant write permissions on /var/mail/ only to the vmail user:

   # chown vmail:vmail /var/mail/
   # chmod 700 /var/mail/

4. Uncomment the mail_location parameter in the /etc/dovecot/conf.d/10-mail.conf file, and set it to the mailbox format and location:

   mail_location = sdbox:/var/mail/%n/

   With this setting:

   • Dovecot uses the high-performant dbox mailbox format in single mode. In this mode, the service stores each mail in a separate file, similar to the maildir format.
   • Dovecot resolves the %n variable in the path to the username. This is required to ensure that each user has a separate directory for its mailbox.

Procedure

1. Update the first_valid_uid parameter in the /etc/dovecot/conf.d/10-mail.conf file to define the lowest user ID (UID) that can authenticate to Dovecot:

   first_valid_uid = 1000

   By default, users with a UID greater than or equal to 1000 can authenticate. If required, you can also set the last_valid_uid parameter to define the highest UID that Dovecot allows to log in.

2. In the /etc/dovecot/conf.d/auth-system.conf.ext file, add the override_fields parameter to the userdb section as follows:

   userdb {
     driver = passwd
     override_fields = uid=vmail gid=vmail home=/var/mail/%n/
   }

   Due to the fixed values, Dovecot does not query these settings from the /etc/passwd file. As a result, the home directory defined in /etc/passwd does not need to exist.

Procedure

1. If you want to provide only an IMAP or POP3 service to users, uncomment the protocols parameter in the /etc/dovecot/dovecot.conf file, and set it to the required protocols. For example, if you do not require POP3, set:

   protocols = imap lmtp

   By default, the imap, pop3, and lmtp protocols are enabled.

2. Open the ports in the local firewall. For example, to open the ports for the IMAPS, IMAP, POP3S, and POP3 protocols, enter:

   # firewall-cmd --permanent --add-service=imaps --add-service=imap --add-service=pop3s --add-service=pop3
   # firewall-cmd --reload

3. Enable and start the dovecot service:

   # systemctl enable --now dovecot

Verification

1. Use a mail client, such as Mozilla Thunderbird, to connect to Dovecot and read emails. The settings for the mail client depend on the protocol you want to use:

   Table 1.1. Connection settings to the Dovecot server

   Protocol	Port	Connection security	Authentication method
   IMAP	143	STARTTLS	PLAIN[a]
   IMAPS	993	SSL/TLS	PLAIN[a]
   POP3	110	STARTTLS	PLAIN[a]
   POP3S	995	SSL/TLS	PLAIN[a]
   [a] The client transmits data encrypted through the TLS connection. Consequently, credentials are not disclosed.

   Note that this table does not list settings for unencrypted connections because, by default, Dovecot does not accept plain text authentication on connections without TLS.

2. Display configuration settings with non-default values:

   # doveconf -n

Procedure

1. Set secure permissions on the private key file:

   # chown root:root /etc/pki/dovecot/private/server.example.com.key
   # chmod 600 /etc/pki/dovecot/private/server.example.com.key

2. Generate a file with Diffie-Hellman parameters:

   # openssl dhparam -out /etc/dovecot/dh.pem 4096

   Depending on the hardware and entropy on the server, generating Diffie-Hellman parameters with 4096 bits can take several minutes.

3. Set the paths to the certificate and private key files in the /etc/dovecot/conf.d/10-ssl.conf file:

   1. Update the ssl_cert and ssl_key parameters, and set them to use the paths of the server’s certificate and private key:

      ssl_cert = </etc/pki/dovecot/certs/server.example.com.crt
      ssl_key = </etc/pki/dovecot/private/server.example.com.key

   2. Uncomment the ssl_ca parameter, and set it to use the path to the CA certificate:

      ssl_ca = </etc/pki/dovecot/certs/ca.crt

   3. Uncomment the ssl_dh parameter, and set it to use the path to the Diffie-Hellman parameters file:

      ssl_dh = </etc/dovecot/dh.pem

   Important

   To ensure that Dovecot reads the value of a parameter from a file, the path must start with a leading < character.

Procedure

1. Create the vmail user:

   # useradd --home-dir /var/mail/ --shell /usr/sbin/nologin vmail

   Dovecot will later use this user to manage the mailboxes. For security reasons, do not use the dovecot or dovenull system users for this purpose.

2. If you use a different path than /var/mail/, set the mail_spool_t SELinux context on it, for example:

   # semanage fcontext -a -t mail_spool_t "<path>(/.*)?"
   # restorecon -Rv <path>

3. Grant write permissions on /var/mail/ only to the vmail user:

   # chown vmail:vmail /var/mail/
   # chmod 700 /var/mail/

4. Uncomment the mail_location parameter in the /etc/dovecot/conf.d/10-mail.conf file, and set it to the mailbox format and location:

   mail_location = sdbox:/var/mail/%n/

   With this setting:

   • Dovecot uses the high-performant dbox mailbox format in single mode. In this mode, the service stores each mail in a separate file, similar to the maildir format.
   • Dovecot resolves the %n variable in the path to the username. This is required to ensure that each user has a separate directory for its mailbox.

Procedure

1. Configure the authentication backends in the /etc/dovecot/conf.d/10-auth.conf file:

   1. Comment out include statements for auth-*.conf.ext authentication backend configuration files that you do not require, for example:

      #!include auth-system.conf.ext

   2. Enable LDAP authentication by uncommenting the following line:

      !include auth-ldap.conf.ext

2. Edit the /etc/dovecot/conf.d/auth-ldap.conf.ext file, and add the override_fields parameter as follows to the userdb section:

   userdb {
     driver = ldap
     args = /etc/dovecot/dovecot-ldap.conf.ext
     override_fields = uid=vmail gid=vmail home=/var/mail/%n/
   }

   Due to the fixed values, Dovecot does not query these settings from the LDAP server. Consequently, these attributes also do not have to be present.

3. Create the /etc/dovecot/dovecot-ldap.conf.ext file with the following settings:

   1. Depending on the LDAP structure, configure one of the following:

      • If users are stored in different trees in the LDAP directory, configure dynamic DN lookups:

        dn = cn=dovecot_LDAP,dc=example,dc=com
        dnpass = password
        pass_filter = (&(objectClass=posixAccount)(uid=%n))

        Dovecot uses the specified DN, password, and filter to search the DN of the authenticating user in the directory. In this search, Dovecot replaces %n in the filter with the username. Note that the LDAP search must return only one result.

      • If all users are stored under a specific entry, configure a DN template:

        auth_bind_userdn = cn=%n,ou=People,dc=example,dc=com

   2. Enable authentication binds to the LDAP server to verify Dovecot users:

      auth_bind = yes

   3. Set the URL to the LDAP server:

      uris = ldaps://LDAP-srv.example.com

      For security reasons, only use encrypted connections using LDAPS or the STARTTLS command over the LDAP protocol. For the latter, additionally add tls = yes to the settings.

      For a working certificate validation, the hostname of the LDAP server must match the hostname used in its TLS certificate.

   4. Enable the verification of the LDAP server’s TLS certificate:

      tls_require_cert = hard

   5. Set the base DN to the DN where to start searching for users:

      base = ou=People,dc=example,dc=com

   6. Set the search scope:

      scope = onelevel

      Dovecot searches with the onelevel scope only in the specified base DN and with the subtree scope also in subtrees.

4. Set secure permissions on the /etc/dovecot/dovecot-ldap.conf.ext file:

   # chown root:root /etc/dovecot/dovecot-ldap.conf.ext
   # chmod 600 /etc/dovecot/dovecot-ldap.conf.ext

Procedure

1. If you want to provide only an IMAP or POP3 service to users, uncomment the protocols parameter in the /etc/dovecot/dovecot.conf file, and set it to the required protocols. For example, if you do not require POP3, set:

   protocols = imap lmtp

   By default, the imap, pop3, and lmtp protocols are enabled.

2. Open the ports in the local firewall. For example, to open the ports for the IMAPS, IMAP, POP3S, and POP3 protocols, enter:

   # firewall-cmd --permanent --add-service=imaps --add-service=imap --add-service=pop3s --add-service=pop3
   # firewall-cmd --reload

3. Enable and start the dovecot service:

   # systemctl enable --now dovecot

Verification

1. Use a mail client, such as Mozilla Thunderbird, to connect to Dovecot and read emails. The settings for the mail client depend on the protocol you want to use:

   Table 1.2. Connection settings to the Dovecot server

   Protocol	Port	Connection security	Authentication method
   IMAP	143	STARTTLS	PLAIN[a]
   IMAPS	993	SSL/TLS	PLAIN[a]
   POP3	110	STARTTLS	PLAIN[a]
   POP3S	995	SSL/TLS	PLAIN[a]
   [a] The client transmits data encrypted through the TLS connection. Consequently, credentials are not disclosed.

   Note that this table does not list settings for unencrypted connections because, by default, Dovecot does not accept plain text authentication on connections without TLS.

2. Display configuration settings with non-default values:

   # doveconf -n

Procedure

1. Set secure permissions on the private key file:

   # chown root:root /etc/pki/dovecot/private/server.example.com.key
   # chmod 600 /etc/pki/dovecot/private/server.example.com.key

2. Generate a file with Diffie-Hellman parameters:

   # openssl dhparam -out /etc/dovecot/dh.pem 4096

   Depending on the hardware and entropy on the server, generating Diffie-Hellman parameters with 4096 bits can take several minutes.

3. Set the paths to the certificate and private key files in the /etc/dovecot/conf.d/10-ssl.conf file:

   1. Update the ssl_cert and ssl_key parameters, and set them to use the paths of the server’s certificate and private key:

      ssl_cert = </etc/pki/dovecot/certs/server.example.com.crt
      ssl_key = </etc/pki/dovecot/private/server.example.com.key

   2. Uncomment the ssl_ca parameter, and set it to use the path to the CA certificate:

      ssl_ca = </etc/pki/dovecot/certs/ca.crt

   3. Uncomment the ssl_dh parameter, and set it to use the path to the Diffie-Hellman parameters file:

      ssl_dh = </etc/dovecot/dh.pem

   Important

   To ensure that Dovecot reads the value of a parameter from a file, the path must start with a leading < character.

Procedure

1. Create the vmail user:

   # useradd --home-dir /var/mail/ --shell /usr/sbin/nologin vmail

   Dovecot will later use this user to manage the mailboxes. For security reasons, do not use the dovecot or dovenull system users for this purpose.

2. If you use a different path than /var/mail/, set the mail_spool_t SELinux context on it, for example:

   # semanage fcontext -a -t mail_spool_t "<path>(/.*)?"
   # restorecon -Rv <path>

3. Grant write permissions on /var/mail/ only to the vmail user:

   # chown vmail:vmail /var/mail/
   # chmod 700 /var/mail/

4. Uncomment the mail_location parameter in the /etc/dovecot/conf.d/10-mail.conf file, and set it to the mailbox format and location:

   mail_location = sdbox:/var/mail/%n/

   With this setting:

   • Dovecot uses the high-performant dbox mailbox format in single mode. In this mode, the service stores each mail in a separate file, similar to the maildir format.
   • Dovecot resolves the %n variable in the path to the username. This is required to ensure that each user has a separate directory for its mailbox.

Procedure

1. Install the dovecot-mysql package:

   # dnf install dovecot-mysql

2. Configure the authentication backends in the /etc/dovecot/conf.d/10-auth.conf file:

   1. Comment out include statements for auth-*.conf.ext authentication backend configuration files that you do not require, for example:

      #!include auth-system.conf.ext

   2. Enable SQL authentication by uncommenting the following line:

      !include auth-sql.conf.ext

3. Edit the /etc/dovecot/conf.d/auth-sql.conf.ext file, and add the override_fields parameter to the userdb section as follows:

   userdb {
     driver = sql
     args = /etc/dovecot/dovecot-sql.conf.ext
     override_fields = uid=vmail gid=vmail home=/var/mail/%n/
   }

   Due to the fixed values, Dovecot does not query these settings from the SQL server.

4. Create the /etc/dovecot/dovecot-sql.conf.ext file with the following settings:

   driver = mysql
   connect = host=mariadb_srv.example.com dbname=dovecotDB user=dovecot password=dovecotPW ssl_ca=/etc/pki/tls/certs/ca.crt
   default_pass_scheme = SHA512-CRYPT
   user_query = SELECT username FROM users WHERE username='%u';
   password_query = SELECT username AS user, password FROM users WHERE username='%u';
   iterate_query = SELECT username FROM users;

   To use TLS encryption to the database server, set the ssl_ca option to the path of the certificate of the CA that issued the MariaDB server certificate. For a working certificate validation, the hostname of the MariaDB server must match the hostname used in its TLS certificate.

   If the password values in the database contain a {pw-storage-scheme} prefix, you can omit the default_pass_scheme setting.

   The queries in the file must be set as follows:

   • For the user_query parameter, the query must return the username of the Dovecot user. The query must also return only one result.
   • For the password_query parameter, the query must return the username and the password, and Dovecot must use these values in the user and password variables. Therefore, if the database uses different column names, use the AS SQL command to rename a column in the result.
   • For the iterate_query parameter, the query must return a list of all users.

5. Set secure permissions on the /etc/dovecot/dovecot-sql.conf.ext file:

   # chown root:root /etc/dovecot/dovecot-sql.conf.ext
   # chmod 600 /etc/dovecot/dovecot-sql.conf.ext

Procedure

1. If you want to provide only an IMAP or POP3 service to users, uncomment the protocols parameter in the /etc/dovecot/dovecot.conf file, and set it to the required protocols. For example, if you do not require POP3, set:

   protocols = imap lmtp

   By default, the imap, pop3, and lmtp protocols are enabled.

2. Open the ports in the local firewall. For example, to open the ports for the IMAPS, IMAP, POP3S, and POP3 protocols, enter:

   # firewall-cmd --permanent --add-service=imaps --add-service=imap --add-service=pop3s --add-service=pop3
   # firewall-cmd --reload

3. Enable and start the dovecot service:

   # systemctl enable --now dovecot

Verification

1. Use a mail client, such as Mozilla Thunderbird, to connect to Dovecot and read emails. The settings for the mail client depend on the protocol you want to use:

   Table 1.3. Connection settings to the Dovecot server

   Protocol	Port	Connection security	Authentication method
   IMAP	143	STARTTLS	PLAIN[a]
   IMAPS	993	SSL/TLS	PLAIN[a]
   POP3	110	STARTTLS	PLAIN[a]
   POP3S	995	SSL/TLS	PLAIN[a]
   [a] The client transmits data encrypted through the TLS connection. Consequently, credentials are not disclosed.

   Note that this table does not list settings for unencrypted connections because, by default, Dovecot does not accept plain text authentication on connections without TLS.

2. Display configuration settings with non-default values:

   # doveconf -n