From: Alex Dehnert Date: Sun, 10 Mar 2019 04:42:16 +0000 (+0000) Subject: New dovecot config from Raspbian X-Git-Url: https://dehnerts.com/gitweb/?a=commitdiff_plain;h=47f1fb62315ed26bdfa4559339b0a739e69fc4c8;p=sysconfig%2Fdovecot.git New dovecot config from Raspbian --- diff --git a/conf.d/10-auth.conf b/conf.d/10-auth.conf index 5a69bcc..16a0d75 100644 --- a/conf.d/10-auth.conf +++ b/conf.d/10-auth.conf @@ -6,6 +6,7 @@ # SSL/TLS is used (LOGINDISABLED capability). Note that if the remote IP # matches the local IP (ie. you're connecting from the same computer), the # connection is considered secure and plaintext authentication is allowed. +# See also ssl=required setting. #disable_plaintext_auth = yes # Authentication cache size (e.g. 10M). 0 means it's disabled. Note that @@ -47,7 +48,7 @@ # the standard variables here, eg. %Lu would lowercase the username, %n would # drop away the domain if it was given, or "%n-AT-%d" would change the '@' into # "-AT-". This translation is done after auth_username_translation changes. -#auth_username_format = +#auth_username_format = %Lu # If you want to allow master users to log in by specifying the master # username within the normal username string (ie. not using SASL mechanism's diff --git a/conf.d/10-director.conf b/conf.d/10-director.conf index d2d7664..31e97e9 100644 --- a/conf.d/10-director.conf +++ b/conf.d/10-director.conf @@ -25,6 +25,11 @@ # If you enable this, you'll also need to add inet_listener for the port. #director_doveadm_port = 0 +# How the username is translated before being hashed. Useful values include +# %Ln if user can log in with or without @domain, %Ld if mailboxes are shared +# within domain. +#director_username_hash = %Lu + # To enable director service, uncomment the modes and assign a port. service director { unix_listener login/director { diff --git a/conf.d/10-logging.conf b/conf.d/10-logging.conf index 7633a67..14798f1 100644 --- a/conf.d/10-logging.conf +++ b/conf.d/10-logging.conf @@ -26,6 +26,7 @@ # In case of password mismatches, log the attempted password. Valid values are # no, plain and sha1. sha1 can be useful for detecting brute force password # attempts vs. user simply trying the same password over and over again. +# You can also truncate the value to n chars by appending ":n" (e.g. sha1:6). #auth_verbose_passwords = no # Even more verbose logging for debugging purposes. Shows for example SQL @@ -59,14 +60,13 @@ plugin { # Prefix for each line written to log file. % codes are in strftime(3) # format. #log_timestamp = "%b %d %H:%M:%S " -log_timestamp = "%Y-%m-%d %H:%M:%S " # Space-separated list of elements we want to log. The elements which have # a non-empty variable value are joined together to form a comma-separated # string. #login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c -# Login log format. %$ contains login_log_format_elements string, %s contains +# Login log format. %s contains login_log_format_elements string, %$ contains # the data we want to log. #login_log_format = %$: %s @@ -74,7 +74,8 @@ log_timestamp = "%Y-%m-%d %H:%M:%S " # possible variables you can use. #mail_log_prefix = "%s(%u): " -# Format to use for logging mail deliveries. You can use variables: +# Format to use for logging mail deliveries. See doc/wiki/Variables.txt for +# list of all variables you can use. Some of the common ones include: # %$ - Delivery status message (e.g. "saved to INBOX") # %m - Message-ID # %s - Subject diff --git a/conf.d/10-mail.conf b/conf.d/10-mail.conf index d32dcd1..c85a187 100644 --- a/conf.d/10-mail.conf +++ b/conf.d/10-mail.conf @@ -81,6 +81,8 @@ mail_location = maildir:~/.maildir # Namespace handles its own subscriptions. If set to "no", the parent # namespace handles them (empty prefix should always have this as "yes") #subscriptions = yes + + # See 15-mailboxes.conf for definitions of special mailboxes. #} # Example shared namespace configuration @@ -103,6 +105,8 @@ mail_location = maildir:~/.maildir # List the shared/ namespace only if there are visible shared mailboxes. #list = children #} +# Should shared INBOX be visible as "shared/user" or "shared/user/INBOX"? +#mail_shared_explicit_inbox = no # System user and group used to access mails. If you use multiple, userdb # can override these by returning uid or gid fields. You can use either numbers @@ -131,6 +135,22 @@ mail_location = maildir:~/.maildir # or ~user/. #mail_full_filesystem_access = no +# Dictionary for key=value mailbox attributes. This is used for example by +# URLAUTH and METADATA extensions. +#mail_attribute_dict = + +# A comment or note that is associated with the server. This value is +# accessible for authenticated users through the IMAP METADATA server +# entry "/shared/comment". +#mail_server_comment = "" + +# Indicates a method for contacting the server administrator. According to +# RFC 5464, this value MUST be a URI (e.g., a mailto: or tel: URL), but that +# is currently not enforced. Use for example mailto:admin@example.com. This +# value is accessible for authenticated users through the IMAP METADATA server +# entry "/shared/admin". +#mail_server_admin = + ## ## Mail processes ## @@ -149,13 +169,6 @@ mail_location = maildir:~/.maildir # never: Never use it (best performance, but crashes can lose data) #mail_fsync = optimized -# Mail storage exists in NFS. Set this to yes to make Dovecot flush NFS caches -# whenever needed. If you're using only a single mail server this isn't needed. -#mail_nfs_storage = no -# Mail index files also exist in NFS. Setting this to yes requires -# mmap_disable=yes and fsync_disable=no. -#mail_nfs_index = no - # Locking method for index files. Alternatives are fcntl, flock and dotlock. # Dotlocking uses some tricks which may create more disk I/O than other locking # methods. NFS users: flock doesn't work, remember to change mmap_disable. @@ -214,6 +227,10 @@ mail_location = maildir:~/.maildir ## Mailbox handling optimizations ## +# Mailbox list indexes can be used to optimize IMAP STATUS commands. They are +# also required for IMAP NOTIFY extension to be enabled. +#mailbox_list_index = no + # The minimum number of mails in a mailbox before updates are done to cache # file. This allows optimizing Dovecot's behavior to do less disk writes at # the cost of more disk reads. @@ -221,7 +238,7 @@ mail_location = maildir:~/.maildir # When IDLE command is running, mailbox is checked once in a while to see if # there are any new mails or other changes. This setting defines the minimum -# time to wait between those checks. Dovecot can also use dnotify, inotify and +# time to wait between those checks. Dovecot can also use inotify and # kqueue to find out immediately when changes occur. #mailbox_idle_check_interval = 30 secs @@ -232,6 +249,14 @@ mail_location = maildir:~/.maildir # the extra CRs wrong and cause problems. #mail_save_crlf = no +# Max number of mails to keep open and prefetch to memory. This only works with +# some mailbox formats and/or operating systems. +#mail_prefetch_count = 0 + +# How often to scan for stale temporary files and delete them (0 = never). +# These should exist only after Dovecot dies in the middle of saving mails. +#mail_temp_scan_interval = 1w + ## ## Maildir-specific settings ## @@ -251,6 +276,16 @@ mail_location = maildir:~/.maildir # when its mtime changes unexpectedly or when we can't find the mail otherwise. #maildir_very_dirty_syncs = no +# If enabled, Dovecot doesn't use the S= in the Maildir filenames for +# getting the mail's physical size, except when recalculating Maildir++ quota. +# This can be useful in systems where a lot of the Maildir filenames have a +# broken size. The performance hit for enabling this is very small. +#maildir_broken_filename_sizes = no + +# Always move mails from new/ directory to cur/, even when the \Recent flags +# aren't being reset. +#maildir_empty_new = no + ## ## mbox-specific settings ## @@ -269,8 +304,14 @@ mail_location = maildir:~/.maildir # in is important to avoid deadlocks if other MTAs/MUAs are using multiple # locking methods as well. Some operating systems don't allow using some of # them simultaneously. +# +# The Debian value for mbox_write_locks differs from upstream Dovecot. It is +# changed to be compliant with Debian Policy (section 11.6) for NFS safety. +# Dovecot: mbox_write_locks = dotlock fcntl +# Debian: mbox_write_locks = fcntl dotlock +# #mbox_read_locks = fcntl -#mbox_write_locks = dotlock fcntl +#mbox_write_locks = fcntl dotlock # Maximum time to wait for lock (all of them) before aborting. #mbox_lock_timeout = 5 mins @@ -304,6 +345,12 @@ mail_location = maildir:~/.maildir # If an index file already exists it's still read, just not updated. #mbox_min_index_size = 0 +# Mail header selection algorithm to use for MD5 POP3 UIDLs when +# pop3_uidl_format=%m. For backwards compatibility we use apop3d inspired +# algorithm, but it fails if the first Received: header isn't unique in all +# mails. An alternative algorithm is "all" that selects all headers. +#mbox_md5 = apop3d + ## ## mdbox-specific settings ## @@ -328,8 +375,6 @@ mail_location = maildir:~/.maildir # also allows single instance storage for them. Other backends don't support # this for now. -# WARNING: This feature hasn't been tested much yet. Use at your own risk. - # Directory root where to store mail attachments. Disabled, if empty. #mail_attachment_dir = diff --git a/conf.d/10-master.conf b/conf.d/10-master.conf index 019c1fd..5068100 100644 --- a/conf.d/10-master.conf +++ b/conf.d/10-master.conf @@ -32,7 +32,7 @@ service imap-login { #process_min_avail = 0 # If you set service_count=0, you probably need to grow this. - #vsz_limit = 64M + #vsz_limit = $default_vsz_limit } service pop3-login { @@ -61,7 +61,7 @@ service lmtp { service imap { # Most of the memory goes to mmap()ing files. You may need to increase this # limit if you have huge mailboxes. - #vsz_limit = 256M + #vsz_limit = $default_vsz_limit # Max. number of IMAP processes (connections) #process_limit = 1024 @@ -74,12 +74,20 @@ service pop3 { service auth { # auth_socket_path points to this userdb socket by default. It's typically - # used by dovecot-lda, doveadm, possibly imap process, etc. Its default - # permissions make it readable only by root, but you may need to relax these - # permissions. Users that have access to this socket are able to get a list - # of all usernames and get results of everyone's userdb lookups. + # used by dovecot-lda, doveadm, possibly imap process, etc. Users that have + # full permissions to this socket are able to get a list of all usernames and + # get the results of everyone's userdb lookups. + # + # The default 0666 mode allows anyone to connect to the socket, but the + # userdb lookups will succeed only if the userdb returns an "uid" field that + # matches the caller process's UID. Also if caller's uid or gid matches the + # socket's uid or gid the lookup succeeds. Anything else causes a failure. + # + # To give the caller full permissions to lookup all users, set the mode to + # something else than 0666 and Dovecot lets the kernel enforce the + # permissions (e.g. 0777 allows everyone full permissions). unix_listener auth-userdb { - #mode = 0600 + #mode = 0666 #user = #group = } diff --git a/conf.d/10-tcpwrapper.conf b/conf.d/10-tcpwrapper.conf new file mode 100644 index 0000000..b237d96 --- /dev/null +++ b/conf.d/10-tcpwrapper.conf @@ -0,0 +1,14 @@ +# 10-tcpwrapper.conf +# +# service name for hosts.{allow|deny} are those defined as +# inet_listener in master.conf +# +#login_access_sockets = tcpwrap +# +#service tcpwrap { +# unix_listener login/tcpwrap { +# group = $default_login_user +# mode = 0600 +# user = $default_login_user +# } +#} diff --git a/conf.d/15-lda.conf b/conf.d/15-lda.conf index 42318a8..6eadbf4 100644 --- a/conf.d/15-lda.conf +++ b/conf.d/15-lda.conf @@ -3,11 +3,11 @@ ## # Address to use when sending rejection mails. -# Default is postmaster@. +# Default is postmaster@. %d expands to recipient domain. #postmaster_address = -# Hostname to use in various parts of sent mails, eg. in Message-Id. -# Default is the system's real hostname. +# Hostname to use in various parts of sent mails (e.g. in Message-Id) and +# in LMTP replies. Default is the system's real hostname@domain. #hostname = # If user is over quota, return with temporary failure instead of diff --git a/conf.d/15-mailboxes.conf b/conf.d/15-mailboxes.conf new file mode 100644 index 0000000..cd5b21b --- /dev/null +++ b/conf.d/15-mailboxes.conf @@ -0,0 +1,78 @@ +## +## Mailbox definitions +## + +# Each mailbox is specified in a separate mailbox section. The section name +# specifies the mailbox name. If it has spaces, you can put the name +# "in quotes". These sections can contain the following mailbox settings: +# +# auto: +# Indicates whether the mailbox with this name is automatically created +# implicitly when it is first accessed. The user can also be automatically +# subscribed to the mailbox after creation. The following values are +# defined for this setting: +# +# no - Never created automatically. +# create - Automatically created, but no automatic subscription. +# subscribe - Automatically created and subscribed. +# +# special_use: +# A space-separated list of SPECIAL-USE flags (RFC 6154) to use for the +# mailbox. There are no validity checks, so you could specify anything +# you want in here, but it's not a good idea to use flags other than the +# standard ones specified in the RFC: +# +# \All - This (virtual) mailbox presents all messages in the +# user's message store. +# \Archive - This mailbox is used to archive messages. +# \Drafts - This mailbox is used to hold draft messages. +# \Flagged - This (virtual) mailbox presents all messages in the +# user's message store marked with the IMAP \Flagged flag. +# \Junk - This mailbox is where messages deemed to be junk mail +# are held. +# \Sent - This mailbox is used to hold copies of messages that +# have been sent. +# \Trash - This mailbox is used to hold messages that have been +# deleted. +# +# comment: +# Defines a default comment or note associated with the mailbox. This +# value is accessible through the IMAP METADATA mailbox entries +# "/shared/comment" and "/private/comment". Users with sufficient +# privileges can override the default value for entries with a custom +# value. + +# NOTE: Assumes "namespace inbox" has been defined in 10-mail.conf. +namespace inbox { + # These mailboxes are widely used and could perhaps be created automatically: + mailbox Drafts { + special_use = \Drafts + } + mailbox Junk { + special_use = \Junk + } + mailbox Trash { + special_use = \Trash + } + + # For \Sent mailboxes there are two widely used names. We'll mark both of + # them as \Sent. User typically deletes one of them if duplicates are created. + mailbox Sent { + special_use = \Sent + } + mailbox "Sent Messages" { + special_use = \Sent + } + + # If you have a virtual "All messages" mailbox: + #mailbox virtual/All { + # special_use = \All + # comment = All my messages + #} + + # If you have a virtual "Flagged" mailbox: + #mailbox virtual/Flagged { + # special_use = \Flagged + # comment = All my flagged messages + #} +} diff --git a/conf.d/20-imap.conf b/conf.d/20-imap.conf index 99f7833..b7dd95d 100644 --- a/conf.d/20-imap.conf +++ b/conf.d/20-imap.conf @@ -2,57 +2,74 @@ ## IMAP specific settings ## -protocol imap { - # Maximum IMAP command line length. Some clients generate very long command - # lines with huge mailboxes, so you may need to raise this if you get - # "Too long argument" or "IMAP command line too large" errors often. - #imap_max_line_length = 64k +# If nothing happens for this long while client is IDLEing, move the connection +# to imap-hibernate process and close the old imap process. This saves memory, +# because connections use very little memory in imap-hibernate process. The +# downside is that recreating the imap process back uses some resources. +#imap_hibernate_timeout = 0 - # Maximum number of IMAP connections allowed for a user from each IP address. - # NOTE: The username is compared case-sensitively. - #mail_max_userip_connections = 10 +# Maximum IMAP command line length. Some clients generate very long command +# lines with huge mailboxes, so you may need to raise this if you get +# "Too long argument" or "IMAP command line too large" errors often. +#imap_max_line_length = 64k + +# IMAP logout format string: +# %i - total number of bytes read from client +# %o - total number of bytes sent to client +# %{fetch_hdr_count} - Number of mails with mail header data sent to client +# %{fetch_hdr_bytes} - Number of bytes with mail header data sent to client +# %{fetch_body_count} - Number of mails with mail body data sent to client +# %{fetch_body_bytes} - Number of bytes with mail body data sent to client +# %{deleted} - Number of mails where client added \Deleted flag +# %{expunged} - Number of mails that client expunged +# %{trashed} - Number of mails that client copied/moved to the +# special_use=\Trash mailbox. +#imap_logout_format = in=%i out=%o + +# Override the IMAP CAPABILITY response. If the value begins with '+', +# add the given capabilities on top of the defaults (e.g. +XFOO XBAR). +#imap_capability = + +# How long to wait between "OK Still here" notifications when client is +# IDLEing. +#imap_idle_notify_interval = 2 mins + +# ID field names and values to send to clients. Using * as the value makes +# Dovecot use the default value. The following fields have default values +# currently: name, version, os, os-version, support-url, support-email. +#imap_id_send = +# ID fields sent by client to log. * means everything. +#imap_id_log = + +# Workarounds for various client bugs: +# delay-newmail: +# Send EXISTS/RECENT new mail notifications only when replying to NOOP +# and CHECK commands. Some clients ignore them otherwise, for example OSX +# Mail (:]path[;