-# Valid UID range for users, defaults to 500 and above. This is mostly
-# to make sure that users can't log in as daemons or other system users.
-# Note that denying root logins is hardcoded to dovecot binary and can't
-# be done even if first_valid_uid is set to 0.
-#first_valid_uid = 500
-#last_valid_uid = 0
-
-# Valid GID range for users, defaults to non-root/wheel. Users having
-# non-valid GID as primary group ID aren't allowed to log in. If user
-# belongs to supplementary groups with non-valid GIDs, those groups are
-# not set.
-#first_valid_gid = 1
-#last_valid_gid = 0
-
-# Maximum number of running mail processes. When this limit is reached,
-# new users aren't allowed to log in.
-#max_mail_processes = 512
-
-# Set max. process size in megabytes. Most of the memory goes to mmap()ing
-# files, so it shouldn't harm much even if this limit is set pretty high.
-#mail_process_size = 256
-
-# Maximum allowed length for mail keyword name. It's only forced when trying
-# to create new keywords.
-#mail_max_keyword_length = 50
-
-# ':' separated list of directories under which chrooting is allowed for mail
-# processes (ie. /var/mail will allow chrooting to /var/mail/foo/bar too).
-# This setting doesn't affect login_chroot, mail_chroot or auth chroot
-# settings. If this setting is empty, "/./" in home dirs are ignored.
-# WARNING: Never add directories here which local users can modify, that
-# may lead to root exploit. Usually this should be done only if you don't
-# allow shell access for users. </usr/share/doc/dovecot-common/wiki/Chrooting.txt>
-#valid_chroot_dirs =
-
-# Default chroot directory for mail processes. This can be overridden for
-# specific users in user database by giving /./ in user's home directory
-# (eg. /home/./user chroots into /home). Note that usually there is no real
-# need to do chrooting, Dovecot doesn't allow users to access files outside
-# their mail directory anyway. If your home directories are prefixed with
-# the chroot directory, append "/." to mail_chroot. </usr/share/doc/dovecot-common/wiki/Chrooting.txt>
-#mail_chroot =
-
-##
-## Mailbox handling optimizations
-##
-
-# The minimum number of mails in a mailbox before updates are done to cache
-# file. This allows optimizing Dovecot's behavior to do less disk writes at
-# the cost of more disk reads.
-#mail_cache_min_mail_count = 0
-
-# When IDLE command is running, mailbox is checked once in a while to see if
-# there are any new mails or other changes. This setting defines the minimum
-# time in seconds to wait between those checks. Dovecot can also use dnotify,
-# inotify and kqueue to find out immediately when changes occur.
-#mailbox_idle_check_interval = 30
-
-# Save mails with CR+LF instead of plain LF. This makes sending those mails
-# take less CPU, especially with sendfile() syscall with Linux and FreeBSD.
-# But it also creates a bit more disk I/O which may just make it slower.
-# Also note that if other software reads the mboxes/maildirs, they may handle
-# the extra CRs wrong and cause problems.
-#mail_save_crlf = no
-
-##
-## Maildir-specific settings
-##
-
-# By default LIST command returns all entries in maildir beginning with a dot.
-# Enabling this option makes Dovecot return only entries which are directories.
-# This is done by stat()ing each entry, so it causes more disk I/O.
-# (For systems setting struct dirent->d_type, this check is free and it's
-# done always regardless of this setting)
-#maildir_stat_dirs = no
-
-# When copying a message, do it with hard links whenever possible. This makes
-# the performance much better, and it's unlikely to have any side effects.
-#maildir_copy_with_hardlinks = yes
-
-# When copying a message, try to preserve the base filename. Only if the
-# destination mailbox already contains the same name (ie. the mail is being
-# copied there twice), a new name is given. The destination filename check is
-# done only by looking at dovecot-uidlist file, so if something outside
-# Dovecot does similar filename preserving copies, you may run into problems.
-# NOTE: This setting requires maildir_copy_with_hardlinks = yes to work.
-#maildir_copy_preserve_filename = no
-
-# Assume Dovecot is the only MUA accessing Maildir: Scan cur/ directory only
-# when its mtime changes unexpectedly or when we can't find the mail otherwise.
-#maildir_very_dirty_syncs = no
-
-##
-## mbox-specific settings
-##
-
-# Which locking methods to use for locking mbox. There are four available:
-# dotlock: Create <mailbox>.lock file. This is the oldest and most NFS-safe
-# solution. If you want to use /var/mail/ like directory, the users
-# will need write access to that directory.
-# dotlock_try: Same as dotlock, but if it fails because of permissions or
-# because there isn't enough disk space, just skip it.
-# fcntl : Use this if possible. Works with NFS too if lockd is used.
-# flock : May not exist in all systems. Doesn't work with NFS.
-# lockf : May not exist in all systems. Doesn't work with NFS.
-#
-# You can use multiple locking methods; if you do the order they're declared
-# in is important to avoid deadlocks if other MTAs/MUAs are using multiple
-# locking methods as well. Some operating systems don't allow using some of
-# them simultaneously.
-#
-# The Debian value for mbox_write_locks differs from upstream Dovecot. It is
-# changed to be compliant with Debian Policy (section 11.6) for NFS safety.
-# Dovecot: mbox_write_locks = dotlock fcntl
-# Debian: mbox_write_locks = fcntl dotlock
-#
-#mbox_read_locks = fcntl
-#mbox_write_locks = fcntl dotlock
-
-# Maximum time in seconds to wait for lock (all of them) before aborting.
-#mbox_lock_timeout = 300
-
-# If dotlock exists but the mailbox isn't modified in any way, override the
-# lock file after this many seconds.
-#mbox_dotlock_change_timeout = 120
-
-# When mbox changes unexpectedly we have to fully read it to find out what
-# changed. If the mbox is large this can take a long time. Since the change
-# is usually just a newly appended mail, it'd be faster to simply read the
-# new mails. If this setting is enabled, Dovecot does this but still safely
-# fallbacks to re-reading the whole mbox file whenever something in mbox isn't
-# how it's expected to be. The only real downside to this setting is that if
-# some other MUA changes message flags, Dovecot doesn't notice it immediately.
-# Note that a full sync is done with SELECT, EXAMINE, EXPUNGE and CHECK
-# commands.
-#mbox_dirty_syncs = yes
-
-# Like mbox_dirty_syncs, but don't do full syncs even with SELECT, EXAMINE,
-# EXPUNGE or CHECK commands. If this is set, mbox_dirty_syncs is ignored.
-#mbox_very_dirty_syncs = no
-
-# Delay writing mbox headers until doing a full write sync (EXPUNGE and CHECK
-# commands and when closing the mailbox). This is especially useful for POP3
-# where clients often delete all mails. The downside is that our changes
-# aren't immediately visible to other MUAs.
-#mbox_lazy_writes = yes
-
-# If mbox size is smaller than this (in kilobytes), don't write index files.
-# If an index file already exists it's still read, just not updated.
-#mbox_min_index_size = 0
-
-##
-## dbox-specific settings
-##
-
-# Maximum dbox file size in kilobytes until it's rotated.
-#dbox_rotate_size = 2048
-
-# Minimum dbox file size in kilobytes before it's rotated
-# (overrides dbox_rotate_days)
-#dbox_rotate_min_size = 16
-
-# Maximum dbox file age in days until it's rotated. Day always begins from
-# midnight, so 1 = today, 2 = yesterday, etc. 0 = check disabled.
-#dbox_rotate_days = 0
-
-##
-## IMAP specific settings
-##
-
-protocol imap {
- # Login executable location.
- #login_executable = /usr/lib/dovecot/imap-login
-
- # IMAP executable location. Changing this allows you to execute other
- # binaries before the imap process is executed.
- #
- # This would write rawlogs into user's ~/dovecot.rawlog/, if it exists:
- # mail_executable = /usr/lib/dovecot/rawlog /usr/lib/dovecot/imap
- # </usr/doc/dovecot-common/wiki/Debugging.Rawlog.txt>
- #
- # This would attach gdb into the imap process and write backtraces into
- # /tmp/gdbhelper.* files:
- # mail_executable = /usr/lib/dovecot/gdbhelper /usr/lib/dovecot/imap
- #
- #mail_executable = /usr/lib/dovecot/imap
-
- # Maximum IMAP command line length in bytes. Some clients generate very long
- # command lines with huge mailboxes, so you may need to raise this if you get
- # "Too long argument" or "IMAP command line too large" errors often.
- #imap_max_line_length = 65536
-
- # Maximum number of IMAP connections allowed for a user from each IP address.
- # NOTE: The username is compared case-sensitively.
- #mail_max_userip_connections = 10
-
- # Support for dynamically loadable plugins. mail_plugins is a space separated
- # list of plugins to load.
- #mail_plugins =
- #mail_plugin_dir = /usr/lib/dovecot/modules/imap
-
- # IMAP logout format string:
- # %i - total number of bytes read from client
- # %o - total number of bytes sent to client
- #imap_logout_format = bytes=%i/%o
-
- # Override the IMAP CAPABILITY response.
- #imap_capability =
-
- # How many seconds to wait between "OK Still here" notifications when
- # client is IDLEing.
- #imap_idle_notify_interval = 120
-
- # ID field names and values to send to clients. Using * as the value makes
- # Dovecot use the default value. The following fields have default values
- # currently: name, version, os, os-version, support-url, support-email.
- #imap_id_send =
-
- # ID fields sent by client to log. * means everything.
- #imap_id_log =
-
- # Workarounds for various client bugs:
- # delay-newmail:
- # Send EXISTS/RECENT new mail notifications only when replying to NOOP
- # and CHECK commands. Some clients ignore them otherwise, for example OSX
- # Mail (<v2.1). Outlook Express breaks more badly though, without this it
- # may show user "Message no longer in server" errors. Note that OE6 still
- # breaks even with this workaround if synchronization is set to
- # "Headers Only".
- # netscape-eoh:
- # Netscape 4.x breaks if message headers don't end with the empty "end of
- # headers" line. Normally all messages have this, but setting this
- # workaround makes sure that Netscape never breaks by adding the line if
- # it doesn't exist. This is done only for FETCH BODY[HEADER.FIELDS..]
- # commands. Note that RFC says this shouldn't be done.
- # tb-extra-mailbox-sep:
- # With mbox storage a mailbox can contain either mails or submailboxes,
- # but not both. Thunderbird separates these two by forcing server to
- # accept '/' suffix in mailbox names in subscriptions list.
- # The list is space-separated.
- #imap_client_workarounds =
-}
-
-##
-## POP3 specific settings
-##
-
-protocol pop3 {
- # Login executable location.
- #login_executable = /usr/lib/dovecot/pop3-login
-
- # POP3 executable location. See IMAP's mail_executable above for examples
- # how this could be changed.
- #mail_executable = /usr/lib/dovecot/pop3
-
- # Don't try to set mails non-recent or seen with POP3 sessions. This is
- # mostly intended to reduce disk I/O. With maildir it doesn't move files
- # from new/ to cur/, with mbox it doesn't write Status-header.
- #pop3_no_flag_updates = no
-
- # Support LAST command which exists in old POP3 specs, but has been removed
- # from new ones. Some clients still wish to use this though. Enabling this
- # makes RSET command clear all \Seen flags from messages.
- #pop3_enable_last = no
-
- # If mail has X-UIDL header, use it as the mail's UIDL.
- #pop3_reuse_xuidl = no
-
- # Keep the mailbox locked for the entire POP3 session.
- #pop3_lock_session = no
-
- # POP3 UIDL (unique mail identifier) format to use. You can use following
- # variables, along with the variable modifiers described in
- # </usr/share/doc/dovecot-common/wiki/Variables.txt> (e.g. %Uf for the
- # filename in uppercase)
- #
- # %v - Mailbox's IMAP UIDVALIDITY
- # %u - Mail's IMAP UID
- # %m - MD5 sum of the mailbox headers in hex (mbox only)
- # %f - filename (maildir only)
- #
- # If you want UIDL compatibility with other POP3 servers, use:
- # UW's ipop3d : %08Xv%08Xu
- # Courier : %f or %v-%u (both might be used simultaneosly)
- # Cyrus (<= 2.1.3) : %u
- # Cyrus (>= 2.1.4) : %v.%u
- # Dovecot v0.99.x : %v.%u
- # tpop3d : %Mf
- #
- # Note that Outlook 2003 seems to have problems with %v.%u format which was
- # Dovecot's default, so if you're building a new server it would be a good
- # idea to change this. %08Xu%08Xv should be pretty fail-safe.
- #
- pop3_uidl_format = %08Xu%08Xv
-
- # Permanently save UIDLs sent to POP3 clients, so pop3_uidl_format changes
- # won't change those UIDLs. Currently this works only with Maildir.
- #pop3_save_uidl = no
-
- # POP3 logout format string:
- # %i - total number of bytes read from client
- # %o - total number of bytes sent to client
- # %t - number of TOP commands
- # %p - number of bytes sent to client as a result of TOP command
- # %r - number of RETR commands
- # %b - number of bytes sent to client as a result of RETR command
- # %d - number of deleted messages
- # %m - number of messages (before deletion)
- # %s - mailbox size in bytes (before deletion)
- #pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s
-
- # Maximum number of POP3 connections allowed for a user from each IP address.
- # NOTE: The username is compared case-sensitively.
- #mail_max_userip_connections = 3
-
- # Support for dynamically loadable plugins. mail_plugins is a space separated
- # list of plugins to load.
- #mail_plugins =
- #mail_plugin_dir = /usr/lib/dovecot/modules/pop3
-
- # Workarounds for various client bugs:
- # outlook-no-nuls:
- # Outlook and Outlook Express hang if mails contain NUL characters.
- # This setting replaces them with 0x80 character.
- # oe-ns-eoh:
- # Outlook Express and Netscape Mail breaks if end of headers-line is
- # missing. This option simply sends it if it's missing.
- # The list is space-separated.
- #pop3_client_workarounds =
-}
-
-##
-## ManageSieve specific settings
-##
-
-protocol managesieve {
- # Login executable location.
- #login_executable = /usr/lib/dovecot/managesieve-login
-
- # ManageSieve executable location. See IMAP's mail_executable above for
- # examples how this could be changed.
- #mail_executable = /usr/lib/dovecot/managesieve
-
- # Maximum ManageSieve command line length in bytes. This setting is
- # directly borrowed from IMAP. But, since long command lines are very
- # unlikely with ManageSieve, changing this will not be very useful.
- #managesieve_max_line_length = 65536
-
- # ManageSieve logout format string:
- # %i - total number of bytes read from client
- # %o - total number of bytes sent to client
- #managesieve_logout_format = bytes=%i/%o
-
- # To fool ManageSieve clients that are focused on timesieved you can
- # specify the IMPLEMENTATION capability that the dovecot reports to clients
- # (default: "dovecot").
- #managesieve_implementation_string = Cyrus timsieved v2.2.13
-
- # The ManageSieve service also uses the sieve and sieve_dir settings
- # of the Sieve plugin. These are configured in the plugin {} section of
- # this config file.
-}
-
-##
-## LDA specific settings
-##
-
-protocol lda {
- # Address to use when sending rejection mails.
- postmaster_address = postmaster@dehnerts.com
-
- # Hostname to use in various parts of sent mails, eg. in Message-Id.
- # Default is the system's real hostname.
- #hostname =
-
- # Support for dynamically loadable plugins. mail_plugins is a space separated
- # list of plugins to load.
- mail_plugins = sieve
- #mail_plugin_dir = /usr/lib/dovecot/modules/lda
-
- # If user is over quota, return with temporary failure instead of
- # bouncing the mail.
- #quota_full_tempfail = no
-
- # Format to use for logging mail deliveries. You can use variables:
- # %$ - Delivery status message (e.g. "saved to INBOX")
- # %m - Message-ID
- # %s - Subject
- # %f - From address
- #deliver_log_format = msgid=%m: %$
- deliver_log_format = msgid=%m, subj=%s: %$
- log_path = /var/log/mail/dovecot-deliver.log
- info_log_path = /var/log/mail/dovecot-deliver.info.log
-
- # Binary to use for sending mails.
- #sendmail_path = /usr/lib/sendmail
-
- # Subject: header to use for rejection mails. You can use the same variables
- # as for rejection_reason below.
- #rejection_subject = Rejected: %s
-
- # Human readable error message for rejection mails. You can use variables:
- # %n = CRLF, %r = reason, %s = original subject, %t = recipient
- #rejection_reason = Your message to <%t> was automatically rejected:%n%r
-
- # UNIX socket path to master authentication server to find users.
- auth_socket_path = /var/run/dovecot/auth-master
-}
-
-##
-## Authentication processes
-##
-
-# Executable location
-#auth_executable = /usr/lib/dovecot/dovecot-auth
-
-# Set max. process size in megabytes.
-#auth_process_size = 256
-
-# Authentication cache size in kilobytes. 0 means it's disabled.
-# Note that bsdauth, PAM and vpopmail require cache_key to be set for caching
-# to be used.
-#auth_cache_size = 0
-# Time to live in seconds for cached data. After this many seconds the cached
-# record is no longer used, *except* if the main database lookup returns
-# internal failure. We also try to handle password changes automatically: If
-# user's previous authentication was successful, but this one wasn't, the
-# cache isn't used. For now this works only with plaintext authentication.
-#auth_cache_ttl = 3600
-# TTL for negative hits (user not found, password mismatch).
-# 0 disables caching them completely.
-#auth_cache_negative_ttl = 3600
-
-# Space separated list of realms for SASL authentication mechanisms that need
-# them. You can leave it empty if you don't want to support multiple realms.
-# Many clients simply use the first one listed here, so keep the default realm
-# first.
-#auth_realms =
-
-# Default realm/domain to use if none was specified. This is used for both
-# SASL realms and appending @domain to username in plaintext logins.
-#auth_default_realm =
-
-# List of allowed characters in username. If the user-given username contains
-# a character not listed in here, the login automatically fails. This is just
-# an extra check to make sure user can't exploit any potential quote escaping
-# vulnerabilities with SQL/LDAP databases. If you want to allow all characters,
-# set this value to empty.
-#auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@
-
-# Username character translations before it's looked up from databases. The
-# value contains series of from -> to characters. For example "#@/@" means
-# that '#' and '/' characters are translated to '@'.
-#auth_username_translation =
-
-# Username formatting before it's looked up from databases. You can use
-# the standard variables here, eg. %Lu would lowercase the username, %n would
-# drop away the domain if it was given, or "%n-AT-%d" would change the '@' into
-# "-AT-". This translation is done after auth_username_translation changes.
-#auth_username_format =
-
-# If you want to allow master users to log in by specifying the master
-# username within the normal username string (ie. not using SASL mechanism's
-# support for it), you can specify the separator character here. The format
-# is then <username><separator><master username>. UW-IMAP uses "*" as the
-# separator, so that could be a good choice.
-#auth_master_user_separator =
-
-# Username to use for users logging in with ANONYMOUS SASL mechanism
-#auth_anonymous_username = anonymous
-
-# Log unsuccessful authentication attempts and the reasons why they failed.
-#auth_verbose = no
-
-# Even more verbose logging for debugging purposes. Shows for example SQL
-# queries.
-#auth_debug = no
-
-# In case of password mismatches, log the passwords and used scheme so the
-# problem can be debugged. Enabling this also enables auth_debug.
-#auth_debug_passwords = no
-
-# Maximum number of dovecot-auth worker processes. They're used to execute
-# blocking passdb and userdb queries (eg. MySQL and PAM). They're
-# automatically created and destroyed as needed.
-#auth_worker_max_count = 30
-
-# Host name to use in GSSAPI principal names. The default is to use the
-# name returned by gethostname(). Use "$ALL" to allow all keytab entries.
-#auth_gssapi_hostname =
-
-# Kerberos keytab to use for the GSSAPI mechanism. Will use the system
-# default (usually /etc/krb5.keytab) if not specified.
-#auth_krb5_keytab =
-
-# Do NTLM and GSS-SPNEGO authentication using Samba's winbind daemon and
-# ntlm_auth helper.
-# </usr/share/doc/dovecot-common/wiki/Authentication.Mechanisms.Winbind.txt>
-#auth_use_winbind = no
-
-# Path for Samba's ntlm_auth helper binary.
-#auth_winbind_helper_path = /usr/bin/ntlm_auth
-
-# Number of seconds to delay before replying to failed authentications.
-#auth_failure_delay = 2
-
-auth default {
- # Space separated list of wanted authentication mechanisms:
- # plain login digest-md5 cram-md5 ntlm rpa apop anonymous gssapi otp skey
- # gss-spnego
- # NOTE: See also disable_plaintext_auth setting.
- mechanisms = plain
-
- #
- # Password database is used to verify user's password (and nothing more).
- # You can have multiple passdbs and userdbs. This is useful if you want to
- # allow both system users (/etc/passwd) and virtual users to login without
- # duplicating the system users into virtual database.
- #
- # </usr/share/doc/dovecot-common/wiki/PasswordDatabase.txt>
- #
- # By adding master=yes setting inside a passdb you make the passdb a list
- # of "master users", who can log in as anyone else. Unless you're using PAM,
- # you probably still want the destination user to be looked up from passdb
- # that it really exists. This can be done by adding pass=yes setting to the
- # master passdb. </usr/share/doc/dovecot-common/wiki/Authentication.MasterUsers.txt>
-
- # Users can be temporarily disabled by adding a passdb with deny=yes.
- # If the user is found from that database, authentication will fail.
- # The deny passdb should always be specified before others, so it gets
- # checked first. Here's an example:
-
- #passdb passwd-file {
- # File contains a list of usernames, one per line
- #args = /etc/dovecot/dovecot.deny
- #deny = yes
- #}
-
- # PAM authentication. Preferred nowadays by most systems.
- # Note that PAM can only be used to verify if user's password is correct,
- # so it can't be used as userdb. If you don't want to use a separate user
- # database (passwd usually), you can use static userdb.
- # REMEMBER: You'll need /etc/pam.d/dovecot file created for PAM
- # authentication to actually work. </usr/share/doc/dovecot-common/wiki/PasswordDatabase.PAM.txt>
- passdb pam {
- # [session=yes] [setcred=yes] [failure_show_msg=yes] [max_requests=<n>]
- # [cache_key=<key>] [<service name>]
- #
- # session=yes makes Dovecot open and immediately close PAM session. Some
- # PAM plugins need this to work, such as pam_mkhomedir.
- #
- # setcred=yes makes Dovecot establish PAM credentials if some PAM plugins
- # need that. They aren't ever deleted though, so this isn't enabled by
- # default.
- #
- # max_requests specifies how many PAM lookups to do in one process before
- # recreating the process. The default is 100, because many PAM plugins
- # leak memory.
- #
- # cache_key can be used to enable authentication caching for PAM
- # (auth_cache_size also needs to be set). It isn't enabled by default
- # because PAM modules can do all kinds of checks besides checking password,
- # such as checking IP address. Dovecot can't know about these checks
- # without some help. cache_key is simply a list of variables (see
- # /usr/share/doc/dovecot-common/wiki/Variables.txt) which must match
- # for the cached data to be used.
- # Here are some examples:
- # %u - Username must match. Probably sufficient for most uses.
- # %u%r - Username and remote IP address must match.
- # %u%s - Username and service (ie. IMAP, POP3) must match.
- #
- # The service name can contain variables, for example %Ls expands to
- # pop3 or imap.
- #
- # Some examples:
- # args = session=yes %Ls
- # args = cache_key=%u dovecot
- #args = dovecot
- }
-
- # System users (NSS, /etc/passwd, or similiar)
- # In many systems nowadays this uses Name Service Switch, which is
- # configured in /etc/nsswitch.conf. </usr/share/doc/dovecot-common/wiki/AuthDatabase.Passwd.txt>
- #passdb passwd {
- # [blocking=yes] - See userdb passwd for explanation
- #args =
- #}
-
- # Shadow passwords for system users (NSS, /etc/shadow or similiar).
- # Deprecated by PAM nowadays.
- # </usr/share/doc/dovecot-common/wiki/PasswordDatabase.Shadow.txt>
- #passdb shadow {
- # [blocking=yes] - See userdb passwd for explanation
- #args =
- #}
-
- # PAM-like authentication for OpenBSD.
- # </usr/share/doc/dovecot-common/wiki/PasswordDatabase.BSDAuth.txt>
- #passdb bsdauth {
- # [cache_key=<key>] - See cache_key in PAM for explanation.
- #args =
- #}
-
- # passwd-like file with specified location
- # </usr/share/doc/dovecot-common/wiki/AuthDatabase.PasswdFile.txt>
- #passdb passwd-file {
- # [scheme=<default password scheme>] [username_format=<format>]
- # <Path for passwd-file>
- #args =
- #}
-
- # checkpassword executable authentication
- # NOTE: You will probably want to use "userdb prefetch" with this.
- # </usr/share/doc/dovecot-common/wiki/AuthDatabase.CheckPassword.txt>
- #passdb checkpassword {
- # Path for checkpassword binary
- #args =
- #}
-
- # SQL database </usr/share/doc/dovecot-common/wiki/AuthDatabase.SQL.txt>
- #passdb sql {
- # Path for SQL configuration file
- #args = /etc/dovecot/dovecot-sql.conf
- #}
-
- # LDAP database </usr/share/doc/dovecot-common/wiki/AuthDatabase.LDAP.txt>
- #passdb ldap {
- # Path for LDAP configuration file
- #args = /etc/dovecot/dovecot-ldap.conf
- #}
-
- # vpopmail authentication </usr/share/doc/dovecot-common/wiki/AuthDatabase.VPopMail.txt>
- #passdb vpopmail {
- # [cache_key=<key>] - See cache_key in PAM for explanation.
- # [quota_template=<template>] - %q expands to Maildir++ quota
- # (eg. quota_template=quota_rule=*:backend=%q)
- #args =
- #}
-
- #
- # User database specifies where mails are located and what user/group IDs
- # own them. For single-UID configuration use "static".
- #
- # </usr/share/doc/dovecot-common/wiki/UserDatabase.txt>
- #
-
- # "prefetch" user database means that the passdb already provided the
- # needed information and there's no need to do a separate userdb lookup.
- # This can be made to work with SQL and LDAP databases, see their example
- # configuration files for more information how to do it.
- # </usr/share/doc/dovecot-common/wiki/UserDatabase.Prefetch.txt>
- #userdb prefetch {
- #}
-
- # System users (NSS, /etc/passwd, or similiar). In many systems nowadays this
- # uses Name Service Switch, which is configured in /etc/nsswitch.conf.
- # </usr/share/doc/dovecot-common/wiki/AuthDatabase.Passwd.txt>
- userdb passwd {
- # [blocking=yes] - By default the lookups are done in the main dovecot-auth
- # process. This setting causes the lookups to be done in auth worker
- # proceses. Useful with remote NSS lookups that may block.
- # NOTE: Be sure to use this setting with nss_ldap or users might get
- # logged in as each others!
- #args =
- }
-
- passdb passwd-file {
- args = /etc/dovecot/extra-users.passwd
- }
-
- # passwd-like file with specified location
- # </usr/share/doc/dovecot-common/wiki/AuthDatabase.PasswdFile.txt>
- #userdb passwd-file {
- # [username_format=<format>] <Path for passwd-file>
- #args =
- #}
-
- # checkpassword executable user database lookup
- # </usr/share/doc/dovecot-common/wiki/AuthDatabase.CheckPassword.txt>
- #userdb checkpassword {
- # Path for checkpassword binary
- #args =
- #}
-
- # static settings generated from template </usr/share/doc/dovecot-common/wiki/UserDatabase.Static.txt>
- #userdb static {
- # Template for the fields. Can return anything a userdb could normally
- # return. For example:
- #
- # args = uid=500 gid=500 home=/var/mail/%u
- #
- # If you use deliver, it needs to look up users only from the userdb. This
- # of course doesn't work with static because there is no list of users.
- # Normally static userdb handles this by doing a passdb lookup. This works
- # with most passdbs, with PAM being the most notable exception. If you do
- # the user verification another way, you can add allow_all_users=yes to
- # the args in which case the passdb lookup is skipped.
- #
- #args =
- #}
-
- # SQL database </usr/share/doc/dovecot-common/wiki/AuthDatabase.SQL.txt>
- #userdb sql {
- # Path for SQL configuration file
- #args = /etc/dovecot/dovecot-sql.conf
- #}
-
- # LDAP database </usr/share/doc/dovecot-common/wiki/AuthDatabase.LDAP.txt>
- #userdb ldap {
- # Path for LDAP configuration file
- #args = /etc/dovecot/dovecot-ldap.conf
- #}
-
- # vpopmail </usr/share/doc/dovecot-common/wiki/AuthDatabase.VPopMail.txt>
- #userdb vpopmail {
- #}
-
- # User to use for the process. This user needs access to only user and
- # password databases, nothing else. Only shadow and pam authentication
- # requires roots, so use something else if possible. Note that passwd
- # authentication with BSDs internally accesses shadow files, which also
- # requires roots. Note that this user is NOT used to access mails.
- # That user is specified by userdb above.
- user = root
-
- # Directory where to chroot the process. Most authentication backends don't
- # work if this is set, and there's no point chrooting if auth_user is root.
- # Note that valid_chroot_dirs isn't needed to use this setting.
- #chroot =
-
- # Number of authentication processes to create
- #count = 1
-
- # Require a valid SSL client certificate or the authentication fails.
- #ssl_require_client_cert = no
-
- # Take the username from client's SSL certificate, using
- # X509_NAME_get_text_by_NID() which returns the subject's DN's
- # CommonName.
- #ssl_username_from_cert = no