1.Установка и натсройка Exim+TLS/SSL

2.Установка и настройка Cyrus-Sasl2

3.Установка и натсройка Clamav

4.Установка и настройка Spamassassin

5.Установка и настройка Dovecot+TLS/SSL

6.Тестирование работоспособности Exim и всей связки в целом.

Используемое ПО:

FreeBSD 8.1 –Release

Exim-4.72

Cyrus-sasl2-saslauthd-2.1.23

Clamav-0.96.5

Spamassassin-3.3.1_2

Dovecot-1.2.14_1

1.Установка и настройка Exim

#cd /usr/ports/mail/exim
#make install clean

#rehash

(Выбранные опции MBX,NIS,OLD Demine,PAM,PASSWD,SASLAUTHD,SUID,TLS)

После установки читаем дальнейшие указания в /usr/local/share/doc/exim/POST-INSTALL-NOTES и выполняем:

а) Останавливаем sendmail(если он запущен)

#/etc/rc.d/sendmail stop

б) В /etc/rc.conf добавляем:

sendmail_enable=»NONE»
exim_enable=»YES»

в) В etc создаем файл periodic.conf с таким содержанием:

daily_clean_hoststat_enable=»NO»

daily_status_include_submit_mailq=»NO»

daily_submit_queuerun=»NO»

 

г) Файл /etc/mail/mailer.conf приводим к виду:

sendmail         /usr/local/sbin/exim

send-mail        /usr/local/sbin/exim

mailq               /usr/local/sbin/exim -bp

newaliases       /usr/local/sbin/exim -bi

hoststat           /usr/local/sbin/exim

purgestat         /usr/local/sbin/exim

д) Прикручиваем шифрование SMTP-трафика

Генерируем ключ и сертификат:

cd /etc/ssl

Openssl req   -new  -outform PEM  -out exim.crt  -newkey rsa:2048  -nodes

-keyout exim.key  -keyform PEM  -days 3650  -x509

(Common Name указать полное доменное имя(у меня guk8.kiev.ua))

  Файл конфигурации Exim /usr/local/etc/exim/configure имет вид:

primary_hostname = guk8.kiev.ua #Это FQDN

domainlist local_domains = @ : kiev.ua #Мой домен

domainlist relay_to_domains =

hostlist   relay_from_hosts = localhost: 127.0.0.1

acl_smtp_rcpt = acl_check_rcpt

#првязка Clamav и Spaassassin к Exim

acl_smtp_data = acl_check_data

av_scanner = clamd:/var/run/clamav/clamd.sock

spamd_address = 127.0.0.1 783

#првязка TLS/SSL к Exim(шифруем SMTP-трафик)

tls_advertise_hosts = *

tls_certificate = /etc/ssl/exim.crt

tls_privatekey = /etc/ssl/exim.pem

daemon_smtp_ports = 25 : 465

tls_on_connect_ports = 465

qualify_domain = kiev.ua # имя домена

qualify_recipient = kiev.ua

# allow_domain_literals

exim_user = mailnull

exim_group = mail

never_users = root

host_lookup = *

rfc1413_hosts = *

rfc1413_query_timeout = 0s

sender_unqualified_hosts = +relay_from_hosts

recipient_unqualified_hosts =+relay_from_hosts

ignore_bounce_errors_after = 2d

timeout_frozen_after = 7d

helo_accept_junk_hosts = 192.168.238.0/24 # локальная сеть

auto_thaw = 1h

smtp_banner = «primary_hostname, ESMTP EXIM $version_number»

smtp_accept_max = 50

smtp_accept_max_per_connection = 25

smtp_connect_backlog = 30

smtp_accept_max_per_host = 20

remote_max_parallel = 15

message_size_limit = 20M

helo_allow_chars = _

smtp_enforce_sync = true

syslog_timestamp = no

split_spool_directory = true

 

 

begin acl

acl_check_rcpt:

 

accept  hosts = :

deny    message       = Restricted characters in address

domains       = +local_domains

local_parts   = ^[.] : ^.*[@%!/|]

 

deny    message       = Restricted characters in address

domains       = !+local_domains

local_parts   = ^[./|] : ^.*[@%!] : ^.*/\\.\\./

 

#accept  local_parts   = postmaster

#      domains       = +local_domains

 

 

 

 

accept

 

 

#првязка Clamav и Spaassassin к Exim

 

acl_check_data:

   deny    malware    = *

           message    = This message contains a virus ($malware_name).

 

   warn    spam       = nobody

           add_header = X-Spam_score: $spam_score\n\

                        X-Spam_score_int: $spam_score_int\n\

                        X-Spam_bar: $spam_bar\n\

                        X-Spam_report: $spam_report

 

accept

 

 

 

 

begin routers

 

# domain_literal:

#   driver = ipliteral

#   domains = ! +local_domains

#   transport = remote_smtp

 

 

dnslookup:

driver = dnslookup

domains = ! +local_domains

transport = remote_smtp

ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8

no_more

 

system_aliases:

driver = redirect

allow_fail

allow_defer

data = ${lookup{$local_part}lsearch{/etc/aliases}}

user = mailnull

group = mail

file_transport = address_file

pipe_transport = address_pipe

userforward:

driver = redirect

check_local_user

# local_part_suffix = +* : -*

# local_part_suffix_optional

file = $home/.forward

# allow_filter

no_verify

no_expn

check_ancestor

file_transport = address_file

pipe_transport = address_pipe

reply_transport = address_reply

condition = ${if exists{$home/.forward} {yes} {no} }

localuser:

driver = accept

check_local_user

# local_part_suffix = +* : -*

# local_part_suffix_optional

transport = local_delivery

cannot_route_message = Unknown user

 

 

 

begin transports

 

remote_smtp:

driver = smtp

 

local_delivery:

driver = appendfile

file = /var/mail/$local_part

delivery_date_add

envelope_to_add

return_path_add

group = mail

user = $local_part

mode = 0660

no_mode_fail_narrower

 

address_pipe:

driver = pipe

return_output

 

address_file:

driver = appendfile

delivery_date_add

envelope_to_add

return_path_add

 

address_reply:

driver = autoreply

 

 

begin retry

 

*                      *           F,2h,15m; G,16h,1h,1.5; F,4d,6h

 

 

begin rewrite

 

 

 

begin authenticators

 

PLAIN:

driver                     = plaintext

server_set_id              = $auth2

server_prompts             = :

server_condition           = ${if saslauthd{{$2}{$3}}{1}{0}} #привязка

#saslauthd демона к EXIM(для SMTP-авторизации при отправке почты )

#  server_advertise_condition = ${if def:tls_cipher }

LOGIN:

driver                     = plaintext

server_set_id              = $auth1

#server_prompts             = <| Username: | Password:

server_prompts                       = «Username:: : Password::»

server_condition           = ${if saslauthd{{$1}{$2}}{1}{0}} #привязка

#saslauthd демона к EXIM(для SMTP- авторизации при отправке почты )

#  server_advertise_condition = ${if def:tls_cipher }

2.Установка и настройка Cyrus-Sasl2

Прикручиваем SMTP-авторизацию при отправке почты.

а)# cd /usr/ports/security/cyrus-sasl2-saslauthd/

(Выбираем опции  AUTHDAEMOND,LOGIN,PLAIN,CRAM,DIGEST,OTP,NTLM)

#make install clean

#rehash

б)В /etc/rc.conf добавляем:

saslauthd_enable=»YES»
saslauthd_flags=»-a getpwent»

 

в)Запускаем сервис

/usr/local/etc/rc.d/saslauthd start

Тестируем его,вводя команду

#testsaslauthd -u user -p pass , где user и pass –имя пользователя и пароль соответственно системной учетной записи  пользователя.

 

Результат успешной работы демона будет следующим:

0: OK «Success.»

 

3.Установка и наcтройка Clamav

Прикручиваем бесплатный антивирус Clamav для проверки почты на вирусыю.

а)#cd /usr/ports/security/clamav

(выбираем опции ARC,ARJ,LHA,UNZOO,UNRAR,LLVM,TESTS)

#make install clean

#rehash

б)В etc/rc.conf добавляем:

clamav_clamd_enable=»YES»
clamav_freshclam_enable=»YES»

Конфигурационный файл Clamav-антивируса /usr/local/etc/clamd.conf имеет вид:

LogFile /var/log/clamav/clamd.log

PidFile /var/run/clamav/clamd.pid

TemporaryDirectory /var/tmp

DatabaseDirectory /var/db/clamav

LocalSocket /var/run/clamav/clamd.sock

FixStaleSocket yes

#VirusEvent /usr/local/bin/send_sms 123456789 «VIRUS ALERT: %v»

User clamav

AllowSupplementaryGroups yes

ScanMail yes

ScanArchive yes

 

Конфигурационыый файл утилиты freshclam /usr/local/etc/freshclam.conf:

DatabaseDirectory /var/db/clamav

PidFile /var/run/clamav/freshclam.pid

DatabaseOwner clamav

AllowSupplementaryGroups yes

# Default: current.cvd.clamav.net

#DNSDatabaseInfo current.cvd.clamav.net

#DatabaseMirror db.XY.clamav.net

DatabaseMirror database.clamav.net

# Default: 3 (per mirror)

#DatabaseCustomURL http://myserver.com/mysigs.ndb

#DatabaseCustomURL file:///mnt/nfs/local.hdb

# Default: 12 (every two hours)

#Checks 24

NotifyClamd /usr/local/etc/clamd.conf

 

Запуск clamd и freshclam:

/usr/local/etc/rc.d/clamav-clamd start

/usr/local/etc/rc.d/clamav-freshclam start

В планировщик cron добавляем строку типа:

30 22 * * * /usr/local/bin/freshclam(для ежедневног обновления антивирусных баз)

4.Установка и настройка Spamassassin

а) #cd /usr/ports/mail/p5-Mail-SpamAssassin/

(Выбираем опции AS_ROOT, SPAMC, DKIM, SSL, GNUPG,RAZOR,)

#make install clean

#rehash

б) В /etc/rc.conf добавляем:

spamd_enable=»YES»

в)Основной конфигурационный фал Spamassassina /usr/local/etc/mail/local.cf имеет вид:

rewrite_header Subject *****SPAM*****

report_safe 1

# trusted_networks 192.168.238.

# lock_method flock

required_score 6.0

use_bayes 1

bayes_auto_learn 1

# bayes_ignore_header X-Bogosity

bayes_ignore_header X-Spam-Flag

bayes_ignore_header X-Spam-Status

ifplugin Mail::SpamAssassin::Plugin::Shortcircuit

#

#   default: strongly-whitelisted mails are *really* whitelisted now, if the

#   shortcircuiting plugin is active, causing early exit to save CPU load.

#   Uncomment to turn this on

#

# shortcircuit USER_IN_WHITELIST       on

# shortcircuit USER_IN_DEF_WHITELIST   on

# shortcircuit USER_IN_ALL_SPAM_TO     on

# shortcircuit SUBJECT_IN_WHITELIST    on

 

#   the opposite; blacklisted mails can also save CPU

#

# shortcircuit USER_IN_BLACKLIST       on

# shortcircuit USER_IN_BLACKLIST_TO    on

# shortcircuit SUBJECT_IN_BLACKLIST    on

 

#   if you have taken the time to correctly specify your «trusted_networks»,

#   this is another good way to save CPU

#

# shortcircuit ALL_TRUSTED             on

 

#   and a well-trained bayes DB can save running rules, too

#

# shortcircuit BAYES_99                spam

# shortcircuit BAYES_00                ham

 

endif # Mail::SpamAssassin::Plugin::Shortcircuit

 

bayes_min_ham_num 1

bayes_min_spam_num           1

bayes_file_mode        0770

bayes_path      /var/spool/spamd/bayes

use_razor2 0

use_pyzor 0

skip_rbl_checks 0

ok_locales ru en

report_charset windows-1251

 

г)Запускаем Spamassassin:

sa-update(я вначале не выполнил эту команду, а сразу запустил spamd(/usr/local/etc/rc.d/sa-spamd start) в результате чего получил ошибку типа

Starting spamd.
child process [34411] exited or timed out without signaling production of a PID file: exit 25 at /usr/local/bin/spamd line 2588.

Погуглив,понял, что вначале нужно  выполнить команду:

#sa-update

А потом уже запустить демон spamd:

#/usr/local/etc/rc.d/spamd start

Командой /usr/local/etc/rc.d/sa-spamd status проверяем,что spamd корректно запустился и работает в фоновом режиме.

spamd is running as pid 1328

5.Установка и настройка Dovecot+TLS/SSL

В качестве MUA(Mail User Agent) используем шифруемый Dovecot:

а) # сd /usr/ports/mail/dovecot:

#make install clean

#rehash

б)В /etc/rc.conf добавляем:

dovecot_enable=»YES»

в)Прикручиваем шифрование POP3- трафика

Сгенерируем сертификат и секретный ключ:

(На вопрос Common Name ответить FQDN(у меня это guk8.kiev.ua))

Openssl req   -new  -outform PEM  -out dovecot.crt  -newkey rsa:2048  -nodes

-keyout dovecot.key  -keyform PEM  -days 3650  -x509

Перемещаем созданные ключи в папку /usr/local/etc/dovecot/ssl и устанавливаем права доступа к ним:

# mkdir /usr/local/etc/dovecot/ssl
# mv dovecot.crt /usr/local/etc/dovecot/ssl/dovecot.crt
# mv dovecot.key /usr/local/etc/dovecot/ssl/dovecot.key
# chown root usr/local/etc/dovecot/ssl/dovecot.*
# chmod 0600 usr/local/etc/dovecot/ssl/dovecot.key

г) Запускаем dovecot и проверяем корректность его запуска и работы

/usr/local/etc/rc.d/dovecot start

Проверка 110 порта:

telnet localhost 110

user bill (имя  пользователя в системе)

pass 123 (пароль пользователя)

list (проверка количества сообщений)

quit

Проверка 995 порта:

Openssl s_client –host localhost –port 995

CONNECTED(00000003)

—

Certificate chain

0 s:/C=UA/ST=Kharkov Region/L=Kharkov/O=Sanran/OU=IT Department/CN=guk8.kiev.ua/emailAddress=test@kiev.ua

i:/C=UA/ST=Kharkov Region/L=Kharkov/O=Sanran/OU=IT Department/CN=guk8.kiev.ua/emailAddress=test@kiev.ua

—

Server certificate

——BEGIN CERTIFICATE——

MIIErzCCA5egAwIBAgIJAOS3NhpGaGBOMA0GCSqGSIb3DQEBBQUAMIGVMQswCQYD

VQQGEwJVQTEXMBUGA1UECBMOS2hhcmtvdiBSZWdpb24xEDAOBgNVBAcTB0toYXJr

b3YxDzANBgNVBAoTBlNhbnJhbjEWMBQGA1UECxMNSVQgRGVwYXJ0bWVudDEVMBMG

A1UEAxMMZ3VrOC5raWV2LnVhMRswGQYJKoZIhvcNAQkBFgx0ZXN0QGtpZXYudWEw

IBcNMTAxMTMwMjAwNDMyWhgPMTkwMjAzMTExMzM2MTZaMIGVMQswCQYDVQQGEwJV

QTEXMBUGA1UECBMOS2hhcmtvdiBSZWdpb24xEDAOBgNVBAcTB0toYXJrb3YxDzAN

BgNVBAoTBlNhbnJhbjEWMBQGA1UECxMNSVQgRGVwYXJ0bWVudDEVMBMGA1UEAxMM

Z3VrOC5raWV2LnVhMRswGQYJKoZIhvcNAQkBFgx0ZXN0QGtpZXYudWEwggEiMA0G

CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDkIkmwxQW/OREIcGJ/cwvuxqGaCpaQ

ih6A1M/iIILTRKRotwBKvKfFbjcG0WO6Lu0uysoggXH+Irm2Or53cfRW1X4++yGp

KCL2hcYmup0BLwuPo5+6iQK3dPhZf1z1w9s/1YLnXBpI/qMNRbonWt0d7nTEIhqV

Z6rQQ+L9e3RxF23+8C/TWbIIrGDHXre6vT/Ncxv0VfYsesmceC5n+OejCzGMLroJ

uBNzefSKSrmzR9Bb+a5Cdq92gU8XusQLw2AGzef7OjG2lc/qmQYParHQ+ja2dBLf

3hXMeQ6BpbK6AJuxJBXoGMpoVl8g/KBtgavCTPHiFVsdgFmbaUveKHWnAgMBAAGj

gf0wgfowHQYDVR0OBBYEFCBH03k+mshFjWJcSNqxNSvDTDsmMIHKBgNVHSMEgcIw

gb+AFCBH03k+mshFjWJcSNqxNSvDTDsmoYGbpIGYMIGVMQswCQYDVQQGEwJVQTEX

MBUGA1UECBMOS2hhcmtvdiBSZWdpb24xEDAOBgNVBAcTB0toYXJrb3YxDzANBgNV

BAoTBlNhbnJhbjEWMBQGA1UECxMNSVQgRGVwYXJ0bWVudDEVMBMGA1UEAxMMZ3Vr

OC5raWV2LnVhMRswGQYJKoZIhvcNAQkBFgx0ZXN0QGtpZXYudWGCCQDktzYaRmhg

TjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQDdbyEBdA9pygCpSXUO

QHwbkbSlvyW7AfJwA/zIB3Quv9THNCZYNYowa05IcNda+w7+F1A8Iua+1UYXrrW3

MPh0+90T1ULgZcp+2pbTfi3JMYS0MNw2jXBsfnyedvpEQ98ZWOuAJTV6e9tu+uYz

zQkgMyAqcxLmEadH/TABhx5GZm8w/tkwyzLPAjuf7a8HB3bxHOxDfq75d5l2MvJJ

YQokaTouryCygq7WZVC2H/+vh8clSnjEKnQs+G7oBkoZ0z/n5o4P3zqy9tdqBbg2

MzSllk43yFLXkoVleMiAxztRIuA5uvfIq9GZ4y6QmHMhYqtGyTRrntDsSnjjmxJk

/FXq

——END CERTIFICATE——

subject=/C=UA/ST=Kharkov Region/L=Kharkov/O=Sanran/OU=IT Department/CN=guk8.kiev.ua/emailAddress=test@kiev.ua

issuer=/C=UA/ST=Kharkov Region/L=Kharkov/O=Sanran/OU=IT Department/CN=guk8.kiev.ua/emailAddress=test@kiev.ua

—

No client certificate CA names sent

—

SSL handshake has read 1902 bytes and written 337 bytes

—

New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA

Server public key is 2048 bit

Secure Renegotiation IS supported

Compression: NONE

Expansion: NONE

SSL-Session:

Protocol  : TLSv1

Cipher    : DHE-RSA-AES256-SHA

Session-ID: 4959913A974074D168D1D57E23D8192BDEC7113957B94D5CE26C2D7A22101116

Session-ID-ctx:

Master-Key: 880055FF851D0E1DEF953A2F7A95A55EDFCC5E7EAAA67316972B00847B55A9991AB6AC8E60270EEB217729C9C8017395

Key-Arg   : None

Start Time: 1291922978

Timeout   : 300 (sec)

Verify return code: 10 (certificate has expired)

—

+OK Dovecot ready.

д)Основной конфигурационный файл Dovecot имеет вид

base_dir = /var/run/dovecot/

protocols = pop3 pop3s

listen = *

disable_plaintext_auth = no

shutdown_clients = yes

log_path = /var/log/dovecot.log

info_log_path = /var/log/dovecot.log

#log_timestamp = «%b %d %H:%M:%S »

#syslog_facility = mail

ssl = yes

ssl_cert_file = /usr/local/etc/dovecot/ssl/dovecot.crt

ssl_key_file = /usr/local/etc/dovecot/ssl/dovecot.key

#ssl_key_password =

#ssl_ca_file =

#ssl_verify_client_cert = no

# ssl_username_from_cert=yes.

#ssl_cert_username_field = commonName

#ssl_parameters_regenerate = 168

#ssl_cipher_list = ALL:!LOW:!SSLv2

verbose_ssl = no

login_dir = /var/run/dovecot/login

login_chroot = yes

login_user = dovecot

login_process_size = 64

login_process_per_connection = yes

login_processes_count = 3

login_max_processes_count = 64

login_max_connections = 128

login_greeting = Dovecot ready.

#login_trusted_networks =

login_log_format_elements = user=<%u> method=%m rip=%r lip=%l %c

login_log_format = %$: %s

mail_location = mbox:~/mail/:INBOX=/var/mail/%u

 

#namespace private {

# Hierarchy separator to use. You should use the same separator for all

# namespaces or some clients get confused. ‘/’ is usually a good one.

# The default however depends on the underlying mail storage format.

#separator =

 

#prefix =

 

#location =

 

#inbox = no

#list = yes

 

#subscriptions = yes

#}

 

# Example shared namespace configuration

#namespace shared {

#separator = /

 

# Mailboxes are visible under «shared/user@domain/»

# %%n, %%d and %%u are expanded to the destination user.

#prefix = shared/%%u/

 

# Mail location for other users’ mailboxes. Note that %variables and ~/

# expands to the logged in user’s data. %%n, %%d, %%u and %%h expand to the

# destination user’s data.

#location = maildir:%%h/Maildir:INDEX=~/Maildir/shared/%%u

 

# Use the default namespace for saving subscriptions.

#subscriptions = no

 

# List the shared/ namespace only if there are visible shared mailboxes.

#list = children

#}

 

# System user and group used to access mails. If you use multiple, userdb

# can override these by returning uid or gid fields. You can use either numbers

# or names. <doc/wiki/UserIds.txt>

#mail_uid =

#mail_gid =

 

# Group to enable temporarily for privileged operations. Currently this is

# used only with INBOX when either its initial creation or dotlocking fails.

# Typically this is set to «mail» to give access to /var/mail.

mail_privileged_group = mail

 

# Grant access to these supplementary groups for mail processes. Typically

# these are used to set up access to shared mailboxes. Note that it may be

# dangerous to set these if users can create symlinks (e.g. if «mail» group is

# set here, ln -s /var/mail ~/mail/var could allow a user to delete others’

# mailboxes, or ln -s /secret/shared/box ~/mail/mybox would allow reading it).

#mail_access_groups =

 

# Allow full filesystem access to clients. There’s no access checks other than

# what the operating system does for the active UID/GID. It works with both

# maildir and mboxes, allowing you to prefix mailboxes names with eg. /path/

# or ~user/.

#mail_full_filesystem_access = no

 

##

## Mail processes

##

 

# Enable mail process debugging. This can help you figure out why Dovecot

# isn’t finding your mails.

#mail_debug = yes

 

# Log prefix for mail processes. See <doc/wiki/Variables.txt> for list of

# possible variables you can use.

#mail_log_prefix = «%Us(%u): »

 

# Max. number of lines a mail process is allowed to log per second before it’s

# throttled. 0 means unlimited. Typically there’s no need to change this

# unless you’re using mail_log plugin, which may log a lot. This setting is

# ignored while mail_debug=yes to avoid pointless throttling.

#mail_log_max_lines_per_sec = 10

 

# Don’t use mmap() at all. This is required if you store indexes to shared

# filesystems (NFS or clustered filesystem).

#mmap_disable = no

 

# Rely on O_EXCL to work when creating dotlock files. NFS supports O_EXCL

# since version 3, so this should be safe to use nowadays by default.

dotlock_use_excl = yes

 

# Don’t use fsync() or fdatasync() calls. This makes the performance better

# at the cost of potential data loss if the server (or the file server)

# goes down.

#fsync_disable = no

 

# Mail storage exists in NFS. Set this to yes to make Dovecot flush NFS caches

# whenever needed. If you’re using only a single mail server this isn’t needed.

#mail_nfs_storage = no

# Mail index files also exist in NFS. Setting this to yes requires

# mmap_disable=yes and fsync_disable=no.

#mail_nfs_index = no

 

# Locking method for index files. Alternatives are fcntl, flock and dotlock.

# Dotlocking uses some tricks which may create more disk I/O than other locking

# methods. NFS users: flock doesn’t work, remember to change mmap_disable.

#lock_method = fcntl

 

# Drop all privileges before exec()ing the mail process. This is mostly

# meant for debugging, otherwise you don’t get core dumps. It could be a small

# security risk if you use single UID for multiple users, as the users could

# ptrace() each others processes then.

#mail_drop_priv_before_exec = no

 

# Show more verbose process titles (in ps). Currently shows user name and

# IP address. Useful for seeing who are actually using the IMAP processes

# (eg. shared mailboxes or if same uid is used for multiple accounts).

verbose_proctitle = yes

 

# Valid UID range for users, defaults to 500 and above. This is mostly

# to make sure that users can’t log in as daemons or other system users.

# Note that denying root logins is hardcoded to dovecot binary and can’t

# be done even if first_valid_uid is set to 0.

first_valid_uid = 1000

#last_valid_uid = 0

 

# Valid GID range for users, defaults to non-root/wheel. Users having

# non-valid GID as primary group ID aren’t allowed to log in. If user

# belongs to supplementary groups with non-valid GIDs, those groups are

# not set.

first_valid_gid = 1000

#last_valid_gid = 0

 

# Maximum number of running mail processes. When this limit is reached,

# new users aren’t allowed to log in.

#max_mail_processes = 512

 

# Set max. process size in megabytes. Most of the memory goes to mmap()ing

# files, so it shouldn’t harm much even if this limit is set pretty high.

#mail_process_size = 256

 

# Maximum allowed length for mail keyword name. It’s only forced when trying

# to create new keywords.

#mail_max_keyword_length = 50

 

# ‘:’ separated list of directories under which chrooting is allowed for mail

# processes (ie. /var/mail will allow chrooting to /var/mail/foo/bar too).

# This setting doesn’t affect login_chroot, mail_chroot or auth chroot

# settings. If this setting is empty, «/./» in home dirs are ignored.

# WARNING: Never add directories here which local users can modify, that

# may lead to root exploit. Usually this should be done only if you don’t

# allow shell access for users. <doc/wiki/Chrooting.txt>

#valid_chroot_dirs =

 

# Default chroot directory for mail processes. This can be overridden for

# specific users in user database by giving /./ in user’s home directory

# (eg. /home/./user chroots into /home). Note that usually there is no real

# need to do chrooting, Dovecot doesn’t allow users to access files outside

# their mail directory anyway. If your home directories are prefixed with

# the chroot directory, append «/.» to mail_chroot. <doc/wiki/Chrooting.txt>

#mail_chroot =

 

##

## Mailbox handling optimizations

##

 

# The minimum number of mails in a mailbox before updates are done to cache

# file. This allows optimizing Dovecot’s behavior to do less disk writes at

# the cost of more disk reads.

#mail_cache_min_mail_count = 0

 

# When IDLE command is running, mailbox is checked once in a while to see if

# there are any new mails or other changes. This setting defines the minimum

# time in seconds to wait between those checks. Dovecot can also use dnotify,

# inotify and kqueue to find out immediately when changes occur.

#mailbox_idle_check_interval = 30

 

# Save mails with CR+LF instead of plain LF. This makes sending those mails

# take less CPU, especially with sendfile() syscall with Linux and FreeBSD.

# But it also creates a bit more disk I/O which may just make it slower.

# Also note that if other software reads the mboxes/maildirs, they may handle

# the extra CRs wrong and cause problems.

#mail_save_crlf = no

 

##

## Maildir-specific settings

##

 

# By default LIST command returns all entries in maildir beginning with a dot.

# Enabling this option makes Dovecot return only entries which are directories.

# This is done by stat()ing each entry, so it causes more disk I/O.

# (For systems setting struct dirent->d_type, this check is free and it’s

# done always regardless of this setting)

#maildir_stat_dirs = no

 

# When copying a message, do it with hard links whenever possible. This makes

# the performance much better, and it’s unlikely to have any side effects.

maildir_copy_with_hardlinks = yes

 

# When copying a message, try to preserve the base filename. Only if the

# destination mailbox already contains the same name (ie. the mail is being

# copied there twice), a new name is given. The destination filename check is

# done only by looking at dovecot-uidlist file, so if something outside

# Dovecot does similar filename preserving copies, you may run into problems.

# NOTE: This setting requires maildir_copy_with_hardlinks = yes to work.

#maildir_copy_preserve_filename = no

 

# Assume Dovecot is the only MUA accessing Maildir: Scan cur/ directory only

# when its mtime changes unexpectedly or when we can’t find the mail otherwise.

#maildir_very_dirty_syncs = no

 

##

## mbox-specific settings

##

 

# Which locking methods to use for locking mbox. There are four available:

#  dotlock: Create <mailbox>.lock file. This is the oldest and most NFS-safe

#           solution. If you want to use /var/mail/ like directory, the users

#           will need write access to that directory.

#  dotlock_try: Same as dotlock, but if it fails because of permissions or

#               because there isn’t enough disk space, just skip it.

#  fcntl  : Use this if possible. Works with NFS too if lockd is used.

#  flock  : May not exist in all systems. Doesn’t work with NFS.

#  lockf  : May not exist in all systems. Doesn’t work with NFS.

#

# You can use multiple locking methods; if you do the order they’re declared

# in is important to avoid deadlocks if other MTAs/MUAs are using multiple

# locking methods as well. Some operating systems don’t allow using some of

# them simultaneously.

#mbox_read_locks = fcntl

#mbox_write_locks = dotlock fcntl

 

# Maximum time in seconds to wait for lock (all of them) before aborting.

#mbox_lock_timeout = 300

 

# If dotlock exists but the mailbox isn’t modified in any way, override the

# lock file after this many seconds.

#mbox_dotlock_change_timeout = 120

 

# When mbox changes unexpectedly we have to fully read it to find out what

# changed. If the mbox is large this can take a long time. Since the change

# is usually just a newly appended mail, it’d be faster to simply read the

# new mails. If this setting is enabled, Dovecot does this but still safely

# fallbacks to re-reading the whole mbox file whenever something in mbox isn’t

# how it’s expected to be. The only real downside to this setting is that if

# some other MUA changes message flags, Dovecot doesn’t notice it immediately.

# Note that a full sync is done with SELECT, EXAMINE, EXPUNGE and CHECK

# commands.

#mbox_dirty_syncs = yes

 

# Like mbox_dirty_syncs, but don’t do full syncs even with SELECT, EXAMINE,

# EXPUNGE or CHECK commands. If this is set, mbox_dirty_syncs is ignored.

#mbox_very_dirty_syncs = no

 

# Delay writing mbox headers until doing a full write sync (EXPUNGE and CHECK

# commands and when closing the mailbox). This is especially useful for POP3

# where clients often delete all mails. The downside is that our changes

# aren’t immediately visible to other MUAs.

#mbox_lazy_writes = yes

 

# If mbox size is smaller than this (in kilobytes), don’t write index files.

# If an index file already exists it’s still read, just not updated.

#mbox_min_index_size = 0

 

##

## dbox-specific settings

##

 

# Maximum dbox file size in kilobytes until it’s rotated.

#dbox_rotate_size = 2048

 

# Minimum dbox file size in kilobytes before it’s rotated

# (overrides dbox_rotate_days)

#dbox_rotate_min_size = 16

 

# Maximum dbox file age in days until it’s rotated. Day always begins from

# midnight, so 1 = today, 2 = yesterday, etc. 0 = check disabled.

#dbox_rotate_days = 0

 

##

## IMAP specific settings

##

 

protocol imap {

# Login executable location.

#login_executable = /usr/local/libexec/dovecot/imap-login

 

# IMAP executable location. Changing this allows you to execute other

# binaries before the imap process is executed.

#

# This would write rawlogs into user’s ~/dovecot.rawlog/, if it exists:

#   mail_executable = /usr/local/libexec/dovecot/rawlog /usr/local/libexec/dovecot/imap

# <doc/wiki/Debugging/Rawlog.txt>

#

# This would attach gdb into the imap process and write backtraces into

# /tmp/gdbhelper.* files:

#   mail_executable = /usr/local/libexec/dovecot/gdbhelper /usr/local/libexec/dovecot/imap

#

#mail_executable = /usr/local/libexec/dovecot/imap

 

# Maximum IMAP command line length in bytes. Some clients generate very long

# command lines with huge mailboxes, so you may need to raise this if you get

# «Too long argument» or «IMAP command line too large» errors often.

#imap_max_line_length = 65536

 

# Maximum number of IMAP connections allowed for a user from each IP address.

# NOTE: The username is compared case-sensitively.

#mail_max_userip_connections = 10

 

# Support for dynamically loadable plugins. mail_plugins is a space separated

# list of plugins to load.

#mail_plugins =

#mail_plugin_dir = /usr/local/lib/dovecot/imap

 

# IMAP logout format string:

#  %i — total number of bytes read from client

#  %o — total number of bytes sent to client

#imap_logout_format = bytes=%i/%o

 

# Override the IMAP CAPABILITY response.

#imap_capability =

 

# How many seconds to wait between «OK Still here» notifications when

# client is IDLEing.

#imap_idle_notify_interval = 120

 

# ID field names and values to send to clients. Using * as the value makes

# Dovecot use the default value. The following fields have default values

# currently: name, version, os, os-version, support-url, support-email.

#imap_id_send =

 

# ID fields sent by client to log. * means everything.

#imap_id_log =

 

# Workarounds for various client bugs:

#   delay-newmail:

#     Send EXISTS/RECENT new mail notifications only when replying to NOOP

#     and CHECK commands. Some clients ignore them otherwise, for example OSX

#     Mail (<v2.1). Outlook Express breaks more badly though, without this it

#     may show user «Message no longer in server» errors. Note that OE6 still

#     breaks even with this workaround if synchronization is set to

#     «Headers Only».

#   netscape-eoh:

#     Netscape 4.x breaks if message headers don’t end with the empty «end of

#     headers» line. Normally all messages have this, but setting this

#     workaround makes sure that Netscape never breaks by adding the line if

#     it doesn’t exist. This is done only for FETCH BODY[HEADER.FIELDS..]

#     commands. Note that RFC says this shouldn’t be done.

#   tb-extra-mailbox-sep:

#     With mbox storage a mailbox can contain either mails or submailboxes,

#     but not both. Thunderbird separates these two by forcing server to

#     accept ‘/’ suffix in mailbox names in subscriptions list.

# The list is space-separated.

imap_client_workarounds = delay-newmail netscape-eoh tb-extra-mailbox-sep

}

 

##

## POP3 specific settings

##

 

protocol pop3 {

# Login executable location.

#login_executable = /usr/local/libexec/dovecot/pop3-login

 

# POP3 executable location. See IMAP’s mail_executable above for examples

# how this could be changed.

#mail_executable = /usr/local/libexec/dovecot/pop3

 

# Don’t try to set mails non-recent or seen with POP3 sessions. This is

# mostly intended to reduce disk I/O. With maildir it doesn’t move files

# from new/ to cur/, with mbox it doesn’t write Status-header.

#pop3_no_flag_updates = no

 

# Support LAST command which exists in old POP3 specs, but has been removed

# from new ones. Some clients still wish to use this though. Enabling this

# makes RSET command clear all \Seen flags from messages.

#pop3_enable_last = no

 

# If mail has X-UIDL header, use it as the mail’s UIDL.

#pop3_reuse_xuidl = no

 

# Keep the mailbox locked for the entire POP3 session.

#pop3_lock_session = no

 

# POP3 UIDL (unique mail identifier) format to use. You can use following

# variables, along with the variable modifiers described in

# <doc/wiki/Variables.txt> (e.g. %Uf for the filename in uppercase)

#

#  %v — Mailbox’s IMAP UIDVALIDITY

#  %u — Mail’s IMAP UID

#  %m — MD5 sum of the mailbox headers in hex (mbox only)

#  %f — filename (maildir only)

#

# If you want UIDL compatibility with other POP3 servers, use:

#  UW’s ipop3d         : %08Xv%08Xu

#  Courier             : %f or %v-%u (both might be used simultaneosly)

#  Cyrus (<= 2.1.3)    : %u

#  Cyrus (>= 2.1.4)    : %v.%u

#  Dovecot v0.99.x     : %v.%u

#  tpop3d              : %Mf

#

# Note that Outlook 2003 seems to have problems with %v.%u format which was

# Dovecot’s default, so if you’re building a new server it would be a good

# idea to change this. %08Xu%08Xv should be pretty fail-safe.

#

pop3_uidl_format = %08Xu%08Xv

 

# Permanently save UIDLs sent to POP3 clients, so pop3_uidl_format changes

# won’t change those UIDLs. Currently this works only with Maildir.

#pop3_save_uidl = no

 

# POP3 logout format string:

#  %i — total number of bytes read from client

#  %o — total number of bytes sent to client

#  %t — number of TOP commands

#  %p — number of bytes sent to client as a result of TOP command

#  %r — number of RETR commands

#  %b — number of bytes sent to client as a result of RETR command

#  %d — number of deleted messages

#  %m — number of messages (before deletion)

#  %s — mailbox size in bytes (before deletion)

#pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s

 

# Maximum number of POP3 connections allowed for a user from each IP address.

# NOTE: The username is compared case-sensitively.

#mail_max_userip_connections = 3

 

# Support for dynamically loadable plugins. mail_plugins is a space separated

# list of plugins to load.

#mail_plugins =

#mail_plugin_dir = /usr/local/lib/dovecot/pop3

 

# Workarounds for various client bugs:

#   outlook-no-nuls:

#     Outlook and Outlook Express hang if mails contain NUL characters.

#     This setting replaces them with 0x80 character.

#   oe-ns-eoh:

#     Outlook Express and Netscape Mail breaks if end of headers-line is

#     missing. This option simply sends it if it’s missing.

# The list is space-separated.

pop3_client_workarounds = outlook-no-nuls oe-ns-eoh

}

 

##

## ManageSieve specific settings

##

 

protocol managesieve {

# Login executable location.

#login_executable = /usr/local/libexec/dovecot/managesieve-login

 

# ManageSieve executable location. See IMAP’s mail_executable above for

# examples how this could be changed.

#mail_executable = /usr/local/libexec/dovecot/managesieve

 

# Maximum ManageSieve command line length in bytes. This setting is

# directly borrowed from IMAP. But, since long command lines are very

# unlikely with ManageSieve, changing this will not be very useful.

#managesieve_max_line_length = 65536

 

# ManageSieve logout format string:

#  %i — total number of bytes read from client

#  %o — total number of bytes sent to client

#managesieve_logout_format = bytes=%i/%o

 

# If, for some inobvious reason, the sieve_storage remains unset, the

# ManageSieve daemon uses the specification of the mail_location to find out

# where to store the sieve files (see explaination in README.managesieve).

# The example below, when uncommented, overrides any global mail_location

# specification and stores all the scripts in ‘~/mail/sieve’ if sieve_storage

# is unset. However, you should always use the sieve_storage setting.

# mail_location = mbox:~/mail

 

# To fool ManageSieve clients that are focused on timesieved you can

# specify the IMPLEMENTATION capability that the dovecot reports to clients

# (default: «dovecot»).

#managesieve_implementation_string = Cyrus timsieved v2.2.13

}

 

##

## LDA specific settings

##

 

protocol lda {

# Address to use when sending rejection mails (e.g. postmaster@example.com).

postmaster_address = postmaster@kiev.ua

 

# Hostname to use in various parts of sent mails, eg. in Message-Id.

# Default is the system’s real hostname.

hostname = guk8.kiev.ua

 

# Support for dynamically loadable plugins. mail_plugins is a space separated

# list of plugins to load.

#mail_plugins =

#mail_plugin_dir = /usr/local/lib/dovecot/lda

 

# If user is over quota, return with temporary failure instead of

# bouncing the mail.

#quota_full_tempfail = no

 

# Format to use for logging mail deliveries. You can use variables:

#  %$ — Delivery status message (e.g. «saved to INBOX»)

#  %m — Message-ID

#  %s — Subject

#  %f — From address

#deliver_log_format = msgid=%m: %$

 

# Binary to use for sending mails.

sendmail_path = /usr/sbin/sendmail

 

# Subject: header to use for rejection mails. You can use the same variables

# as for rejection_reason below.

#rejection_subject = Rejected: %s

 

# Human readable error message for rejection mails. You can use variables:

#  %n = CRLF, %r = reason, %s = original subject, %t = recipient

#rejection_reason = Your message to <%t> was automatically rejected:%n%r

 

# UNIX socket path to master authentication server to find users.

#auth_socket_path = /var/run/dovecot/auth-master

}

 

##

## Authentication processes

##

 

# Executable location

#auth_executable = /usr/local/libexec/dovecot/dovecot-auth

 

# Set max. process size in megabytes.

#auth_process_size = 256

 

# Authentication cache size in kilobytes. 0 means it’s disabled.

# Note that bsdauth, PAM and vpopmail require cache_key to be set for caching

# to be used.

#auth_cache_size = 0

# Time to live in seconds for cached data. After this many seconds the cached

# record is no longer used, *except* if the main database lookup returns

# internal failure. We also try to handle password changes automatically: If

# user’s previous authentication was successful, but this one wasn’t, the

# cache isn’t used. For now this works only with plaintext authentication.

#auth_cache_ttl = 3600

# TTL for negative hits (user not found, password mismatch).

# 0 disables caching them completely.

#auth_cache_negative_ttl = 3600

 

# Space separated list of realms for SASL authentication mechanisms that need

# them. You can leave it empty if you don’t want to support multiple realms.

# Many clients simply use the first one listed here, so keep the default realm

# first.

#auth_realms =

 

# Default realm/domain to use if none was specified. This is used for both

# SASL realms and appending @domain to username in plaintext logins.

#auth_default_realm =

 

# List of allowed characters in username. If the user-given username contains

# a character not listed in here, the login automatically fails. This is just

# an extra check to make sure user can’t exploit any potential quote escaping

# vulnerabilities with SQL/LDAP databases. If you want to allow all characters,

# set this value to empty.

#auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@

 

# Username character translations before it’s looked up from databases. The

# value contains series of from -> to characters. For example «#@/@» means

# that ‘#’ and ‘/’ characters are translated to ‘@’.

#auth_username_translation =

 

# Username formatting before it’s looked up from databases. You can use

# the standard variables here, eg. %Lu would lowercase the username, %n would

# drop away the domain if it was given, or «%n-AT-%d» would change the ‘@’ into

# «-AT-«. This translation is done after auth_username_translation changes.

auth_username_format = %Lu

 

# If you want to allow master users to log in by specifying the master

# username within the normal username string (ie. not using SASL mechanism’s

# support for it), you can specify the separator character here. The format

# is then <username><separator><master username>. UW-IMAP uses «*» as the

# separator, so that could be a good choice.

#auth_master_user_separator =

 

# Username to use for users logging in with ANONYMOUS SASL mechanism

#auth_anonymous_username = anonymous

 

# Log unsuccessful authentication attempts and the reasons why they failed.

#auth_verbose = yes

 

# Even more verbose logging for debugging purposes. Shows for example SQL

# queries.

#auth_debug = yes

 

# In case of password mismatches, log the passwords and used scheme so the

# problem can be debugged. Enabling this also enables auth_debug.

#auth_debug_passwords = yes

 

# Maximum number of dovecot-auth worker processes. They’re used to execute

# blocking passdb and userdb queries (eg. MySQL and PAM). They’re

# automatically created and destroyed as needed.

#auth_worker_max_count = 30

 

# Host name to use in GSSAPI principal names. The default is to use the

# name returned by gethostname(). Use «$ALL» to allow all keytab entries.

#auth_gssapi_hostname =

 

# Kerberos keytab to use for the GSSAPI mechanism. Will use the system

# default (usually /etc/krb5.keytab) if not specified.

#auth_krb5_keytab =

 

# Do NTLM and GSS-SPNEGO authentication using Samba’s winbind daemon and

# ntlm_auth helper. <doc/wiki/Authentication/Mechanisms/Winbind.txt>

#auth_use_winbind = no

 

# Path for Samba’s ntlm_auth helper binary.

#auth_winbind_helper_path = /usr/local/bin/ntlm_auth

 

# Number of seconds to delay before replying to failed authentications.

#auth_failure_delay = 2

 

auth default {

# Space separated list of wanted authentication mechanisms:

#   plain login digest-md5 cram-md5 ntlm rpa apop anonymous gssapi otp skey

#   gss-spnego

# NOTE: See also disable_plaintext_auth setting.

mechanisms = plain login

 

#

# Password database is used to verify user’s password (and nothing more).

# You can have multiple passdbs and userdbs. This is useful if you want to

# allow both system users (/etc/passwd) and virtual users to login without

# duplicating the system users into virtual database.

#

# <doc/wiki/PasswordDatabase.txt>

#

# By adding master=yes setting inside a passdb you make the passdb a list

# of «master users», who can log in as anyone else. Unless you’re using PAM,

# you probably still want the destination user to be looked up from passdb

# that it really exists. This can be done by adding pass=yes setting to the

# master passdb. <doc/wiki/Authentication.MasterUsers.txt>

 

# Users can be temporarily disabled by adding a passdb with deny=yes.

# If the user is found from that database, authentication will fail.

# The deny passdb should always be specified before others, so it gets

# checked first. Here’s an example:

 

#passdb passwd-file {

# File contains a list of usernames, one per line

#args = /usr/local/etc/dovecot.deny

#deny = yes

#}

 

# PAM authentication. Preferred nowadays by most systems.

# Note that PAM can only be used to verify if user’s password is correct,

# so it can’t be used as userdb. If you don’t want to use a separate user

# database (passwd usually), you can use static userdb.

# REMEMBER: You’ll need /etc/pam.d/dovecot file created for PAM

# authentication to actually work. <doc/wiki/PasswordDatabase.PAM.txt>

passdb pam {

# [session=yes] [setcred=yes] [failure_show_msg=yes] [max_requests=<n>]

# [cache_key=<key>] [<service name>]

#

# session=yes makes Dovecot open and immediately close PAM session. Some

# PAM plugins need this to work, such as pam_mkhomedir.

#

# setcred=yes makes Dovecot establish PAM credentials if some PAM plugins

# need that. They aren’t ever deleted though, so this isn’t enabled by

# default.

#

# max_requests specifies how many PAM lookups to do in one process before

# recreating the process. The default is 100, because many PAM plugins

# leak memory.

#

# cache_key can be used to enable authentication caching for PAM

# (auth_cache_size also needs to be set). It isn’t enabled by default

# because PAM modules can do all kinds of checks besides checking password,

# such as checking IP address. Dovecot can’t know about these checks

# without some help. cache_key is simply a list of variables (see

# doc/wiki/Variables.txt) which must match for the cached data to be used.

# Here are some examples:

#   %u — Username must match. Probably sufficient for most uses.

#   %u%r — Username and remote IP address must match.

#   %u%s — Username and service (ie. IMAP, POP3) must match.

#

# The service name can contain variables, for example %Ls expands to

# pop3 or imap.

#

# Some examples:

#   args = session=yes %Ls

#   args = cache_key=%u dovecot

#args = dovecot

args = session=yes dovecot

}

 

# System users (NSS, /etc/passwd, or similiar)

# In many systems nowadays this uses Name Service Switch, which is

# configured in /etc/nsswitch.conf. <doc/wiki/AuthDatabase.Passwd.txt>

#passdb passwd {

# [blocking=yes] — See userdb passwd for explanation

#args =

#}

 

# Shadow passwords for system users (NSS, /etc/shadow or similiar).

# Deprecated by PAM nowadays.

# <doc/wiki/PasswordDatabase.Shadow.txt>

#passdb shadow {

# [blocking=yes] — See userdb passwd for explanation

#args =

#}

 

# PAM-like authentication for OpenBSD.

# <doc/wiki/PasswordDatabase.BSDAuth.txt>

#passdb bsdauth {

# [cache_key=<key>] — See cache_key in PAM for explanation.

#args =

#}

 

# passwd-like file with specified location

# <doc/wiki/AuthDatabase.PasswdFile.txt>

#passdb passwd-file {

# [scheme=<default password scheme>] [username_format=<format>]

# <Path for passwd-file>

#args =

#}

 

# checkpassword executable authentication

# NOTE: You will probably want to use «userdb prefetch» with this.

# <doc/wiki/AuthDatabase.CheckPassword.txt>

#passdb checkpassword {

# Path for checkpassword binary

#args =

#}

 

# SQL database <doc/wiki/AuthDatabase.SQL.txt>

#passdb sql {

# Path for SQL configuration file.

# See /usr/local/share/examples/dovecot/dovecot-sql.conf

#args = /usr/local/etc/dovecot-sql.conf

#}

 

# LDAP database <doc/wiki/AuthDatabase.LDAP.txt>

#passdb ldap {

# Path for LDAP configuration file.

# See /usr/local/share/examples/dovecot/dovecot-ldap.conf

#args = /usr/local/etc/dovecot-ldap.conf

#}

 

# vpopmail authentication <doc/wiki/AuthDatabase.VPopMail.txt>

#passdb vpopmail {

# [cache_key=<key>] — See cache_key in PAM for explanation.

# [quota_template=<template>] — %q expands to Maildir++ quota

#   (eg. quota_template=quota_rule=*:backend=%q)

#args =

#}

 

#

# User database specifies where mails are located and what user/group IDs

# own them. For single-UID configuration use «static».

#

# <doc/wiki/UserDatabase.txt>

#

 

# «prefetch» user database means that the passdb already provided the

# needed information and there’s no need to do a separate userdb lookup.

# This can be made to work with SQL and LDAP databases, see their example

# configuration files for more information how to do it.

# <doc/wiki/UserDatabase.Prefetch.txt>

#userdb prefetch {

#}

 

# System users (NSS, /etc/passwd, or similiar). In many systems nowadays this

# uses Name Service Switch, which is configured in /etc/nsswitch.conf.

# <doc/wiki/AuthDatabase.Passwd.txt>

userdb passwd {

# [blocking=yes] — By default the lookups are done in the main dovecot-auth

# process. This setting causes the lookups to be done in auth worker

# proceses. Useful with remote NSS lookups that may block.

# NOTE: Be sure to use this setting with nss_ldap or users might get

# logged in as each others!

args = blocking=yes

}

 

# passwd-like file with specified location

# <doc/wiki/AuthDatabase.PasswdFile.txt>

#userdb passwd-file {

# [username_format=<format>] <Path for passwd-file>

#args =

#}

 

# checkpassword executable user database lookup

# <doc/wiki/AuthDatabase.CheckPassword.txt>

#userdb checkpassword {

# Path for checkpassword binary

#args =

#}

 

# static settings generated from template <doc/wiki/UserDatabase.Static.txt>

#userdb static {

# Template for the fields. Can return anything a userdb could normally

# return. For example:

#

#  args = uid=500 gid=500 home=/var/mail/%u

#

# If you use deliver, it needs to look up users only from the userdb. This

# of course doesn’t work with static because there is no list of users.

# Normally static userdb handles this by doing a passdb lookup. This works

# with most passdbs, with PAM being the most notable exception. If you do

# the user verification another way, you can add allow_all_users=yes to

# the args in which case the passdb lookup is skipped.

#

#args =

#}

 

# SQL database <doc/wiki/AuthDatabase.SQL.txt>

#userdb sql {

# Path for SQL configuration file.

# See /usr/local/share/examples/dovecot/dovecot-sql.conf

#args = /usr/local/etc/dovecot-sql.conf

#}

 

# LDAP database <doc/wiki/AuthDatabase.LDAP.txt>

#userdb ldap {

# Path for LDAP configuration file.

# See /usr/local/share/examples/dovecot/dovecot-ldap.conf

#args = /usr/local/etc/dovecot-ldap.conf

#}

 

# vpopmail <doc/wiki/AuthDatabase.VPopMail.txt>

#userdb vpopmail {

#}

 

# User to use for the process. This user needs access to only user and

# password databases, nothing else. Only shadow and pam authentication

# requires roots, so use something else if possible. Note that passwd

# authentication with BSDs internally accesses shadow files, which also

# requires roots. Note that this user is NOT used to access mails.

# That user is specified by userdb above.

user = root

 

# Directory where to chroot the process. Most authentication backends don’t

# work if this is set, and there’s no point chrooting if auth_user is root.

# Note that valid_chroot_dirs isn’t needed to use this setting.

#chroot =

 

# Number of authentication processes to create

#count = 1

 

# Require a valid SSL client certificate or the authentication fails.

#ssl_require_client_cert = no

 

# Take the username from client’s SSL certificate, using

# X509_NAME_get_text_by_NID() which returns the subject’s DN’s

# CommonName.

#ssl_username_from_cert = no

 

# It’s possible to export the authentication interface to other programs:

socket listen {

master {

# Master socket provides access to userdb information. It’s typically

# used to give Dovecot’s local delivery agent access to userdb so it

# can find mailbox locations.

path = /var/run/dovecot/auth-master

mode = 0600

# Default user/group is the one who started dovecot-auth (root)

#user =

#group =

}

client {

# The client socket is generally safe to export to everyone. Typical use

# is to export it to your SMTP server so it can do SMTP AUTH lookups

# using it.

path = /var/run/dovecot/auth-client

mode = 0660

}

}

}

 

# If you wish to use another authentication server than dovecot-auth, you can

# use connect sockets. They are assumed to be already running, Dovecot’s master

# process only tries to connect to them. They don’t need any other settings

# than the path for the master socket, as the configuration is done elsewhere.

# Note that the client sockets must exist in the login_dir.

#auth external {

#  socket connect {

#    master {

#      path = /var/run/dovecot/auth-master

#    }

#  }

#}

 

##

## Dictionary server settings

##

 

# Dictionary can be used by some plugins to store key=value lists, such as

# quota, expire and acl plugins. The dictionary can be used either directly or

# though a dictionary server. The following dict block maps dictionary names to

# URIs when the server is used. These can then be referenced using URIs in

# format «proxy::<name>».

 

dict {

#quota = mysql:/usr/local/etc/dovecot-dict-quota.conf

#expire = db:/var/db/dovecot/expire.db

}

 

# Path to Berkeley DB’s configuration file.

# See /usr/local/share/examples/dovecot/dovecot-db.conf

#dict_db_config = /usr/local/etc/dovecot-db.conf

 

##

## Plugin settings

##

 

plugin {

# Here you can give some extra environment variables to mail processes.

# This is mostly meant for passing parameters to plugins. %variable

# expansion is done for all values.

 

# Quota plugin. Multiple backends are supported:

#   dirsize: Find and sum all the files found from mail directory.

#            Extremely SLOW with Maildir. It’ll eat your CPU and disk I/O.

#   dict: Keep quota stored in dictionary (eg. SQL)

#   maildir: Maildir++ quota

#   fs: Read-only support for filesystem quota

#

# Quota limits are set using «quota_rule» parameters, either in here or in

# userdb. It’s also possible to give mailbox-specific limits, for example:

#   quota_rule = *:storage=1048576

#   quota_rule2 = Trash:storage=102400

# User has now 1GB quota, but when saving to Trash mailbox the user gets

# additional 100MB.

#

# Multiple quota roots are also possible, for example:

#   quota = dict:user::proxy::quota

#   quota2 = dict:domain:%d:proxy::quota_domain

#   quota_rule = *:storage=102400

#   quota2_rule = *:storage=1048576

# Gives each user their own 100MB quota and one shared 1GB quota within

# the domain.

#

# You can execute a given command when user exceeds a specified quota limit.

# Each quota root has separate limits. Only the command for the first

# exceeded limit is excecuted, so put the highest limit first.

# Note that % needs to be escaped as %%, otherwise «% » expands to empty.

#   quota_warning = storage=95%% /usr/local/bin/quota-warning.sh 95

#   quota_warning2 = storage=80%% /usr/local/bin/quota-warning.sh 80

#quota = maildir

 

# ACL plugin. vfile backend reads ACLs from «dovecot-acl» file from maildir

# directory. You can also optionally give a global ACL directory path where

# ACLs are applied to all users’ mailboxes. The global ACL directory contains

# one file for each mailbox, eg. INBOX or sub.mailbox. cache_secs parameter

# specifies how many seconds to wait between stat()ing dovecot-acl file

# to see if it changed.

#acl = vfile:/usr/local/etc/dovecot-acls:cache_secs=300

 

# To let users LIST mailboxes shared by other users, Dovecot needs a

# shared mailbox dictionary. For example:

#acl_shared_dict = file:/var/lib/dovecot/shared-mailboxes

 

# Convert plugin. If set, specifies the source storage path which is

# converted to destination storage (mail_location) when the user logs in.

# The existing mail directory is renamed to <dir>-converted.

#convert_mail = mbox:%h/mail

# Skip mailboxes which we can’t open successfully instead of aborting.

#convert_skip_broken_mailboxes = no

# Skip directories beginning with ‘.’

#convert_skip_dotdirs = no

# If source storage has mailbox names with destination storage’s hierarchy

# separators, replace them with this character.

#convert_alt_hierarchy_char = _

 

# Trash plugin. When saving a message would make user go over quota, this

# plugin automatically deletes the oldest mails from configured mailboxes

# until the message can be saved within quota limits. The configuration file

# is a text file where each line is in format: <priority> <mailbox name>

# Mails are first deleted in lowest -> highest priority number order

#trash = /usr/local/etc/dovecot-trash.conf

 

# Expire plugin. Mails are expunged from mailboxes after being there the

# configurable time. The first expiration date for each mailbox is stored in

# a dictionary so it can be quickly determined which mailboxes contain

# expired mails. The actual expunging is done in a nightly cronjob, which

# you must set up:

#   dovecot —exec-mail ext /usr/local/libexec/dovecot/expire-tool

#expire = Trash 7 Spam 30

#expire_dict = proxy::expire

 

# Lazy expunge plugin. Currently works only with maildirs. When a user

# expunges mails, the mails are moved to a mailbox in another namespace

# (1st). When a mailbox is deleted, the mailbox is moved to another namespace

# (2nd) as well. Also if the deleted mailbox had any expunged messages,

# they’re moved to a 3rd namespace. The mails won’t be counted in quota,

# and they’re not deleted automatically (use a cronjob or something).

#lazy_expunge = .EXPUNGED/ .DELETED/ .DELETED/.EXPUNGED/

 

# Events to log. Also available: flag_change append

#mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename

# Group events within a transaction to one line.

#mail_log_group_events = no

# Available fields: uid, box, msgid, from, subject, size, vsize, flags

# size and vsize are available only for expunge and copy events.

#mail_log_fields = uid box msgid size

 

# Sieve plugin (http://wiki.dovecot.org/LDA/Sieve) and ManageSieve service

#

# Location of the active script. When ManageSieve is used this is actually

# a symlink pointing to the active script in the sieve storage directory.

#sieve=~/.dovecot.sieve

#

# The path to the directory where the personal Sieve scripts are stored. For

# ManageSieve this is where the uploaded scripts are stored.

#sieve_dir=~/sieve

}

 

# Config files can also be included. deliver doesn’t support them currently.

#!include /usr/local/etc/dovecot/conf.d/*.conf

# Optional configurations, don’t give an error if it’s not found:

#!include_try /usr/local/etc/dovecot/extra.conf

Тестирование Exim

Запускаем  Exim

/usr/local/etc/rc.d exim start

Логи смотрим в /var/log/exim/mainlog и в /var/log/exim/paniclog

После этого требуется проверить правильность синтаксиса файла конфигурации /usr/local/exim/configure. Выполним:

Exim version 4.72 #0 (FreeBSD 8.1) built 05-Dec-2010 15:12:56

Copyright (c) University of Cambridge, 1995 — 2007

Probably Berkeley DB version 1.8x (native mode)

Support for: crypteq iconv() use_setclassresources PAM Perl Expand_dlfunc OpenSSL Content_Scanning DKIM Old_Demime

Lookups: lsearch wildlsearch nwildlsearch iplsearch cdb dbm dbmnz dnsdb dsearch nis nis0 passwd

Authenticators: cram_md5 dovecot plaintext spa

Routers: accept dnslookup ipliteral manualroute queryprogram redirect

Transports: appendfile/maildir/mailstore/mbx autoreply lmtp pipe smtp

Fixed never_users: 0

Size of off_t: 8

OpenSSL compile-time version: OpenSSL 0.9.8n 24 Mar 2010

OpenSSL runtime version: OpenSSL 0.9.8n 24 Mar 2010

Configuration file is /usr/local/etc/exim/configure

Если ошибок не обнаружено, идем дальше… Теперь требуется проверить, будет ли осуществляться распознавание сообщений для локальных пользователей, для этого выполним:(у меня в /etc/mail/aliases стоит перенапрвление рутовой почты на  test@kiev.ua

root: test@kiev.ua)

test@kiev.ua

<— root@kiev.ua

<— postmaster@kiev.ua

router = localuser, transport = local_delivery

 

Если ошибок не обнаружено, идем дальше… Теперь требуется проверить, будет ли осуществляться распознавание сообщений для внешних пользователей, для этого выполним:

someuser@msn.com

router = dnslookup, transport = remote_smtp

host mx3.hotmail.com [65.55.92.152]  MX=5

host mx3.hotmail.com [65.54.188.72]  MX=5

host mx3.hotmail.com [65.55.37.88]   MX=5

host mx3.hotmail.com [65.55.37.104]  MX=5

host mx3.hotmail.com [65.55.37.120]  MX=5

host mx3.hotmail.com [65.54.188.126] MX=5

host mx3.hotmail.com [65.54.188.110] MX=5

host mx4.hotmail.com [65.55.92.168]  MX=5

host mx4.hotmail.com [65.54.188.94]  MX=5

host mx1.hotmail.com [65.55.37.72]   MX=5

 

Если ошибок не обнаружено, идем дальше… Теперь требуется проверить, будет ли осуществляться доставка сообщений локальным пользователям, для этого выполним:

.

LOG: MAIN

<= root@kiev.ua U=root P=local S=325

delivering 1DOs2P-000HAY-0E

LOG: MAIN

=> test <postmaster.kiev.ua>  R=localuser T=local_delivery

LOG: MAIN

Completed

Если ошибок не обнаружено, идем дальше… Теперь требуется проверить, будет ли осуществляться доставка сообщений внешним пользователям, для этого выполним:

LOG: MAIN

<= test@kiev.ua U=root P=local S=305

LOG: MAIN

=> someuser R=dnslookupT=remote_smtp

LOG: MAIN

Completed

Проверим защищенное соединение TLS/SSL Exima:

Openssl s_client  -host localhost  -port 465

CONNECTED(00000003)

—

Certificate chain

0 s:/C=UA/ST=Kharkov region/L=Kharkov/O=Santan/OU=IT Department/CN=guk8.kiev.ua/emailAddress=test@kiev.ua

i:/C=UA/ST=Kharkov region/L=Kharkov/O=Santan/OU=IT Department/CN=guk8.kiev.ua/emailAddress=test@kiev.ua

—

Server certificate

——BEGIN CERTIFICATE——

MIIDqDCCAxGgAwIBAgIJAOo5q+xFejApMA0GCSqGSIb3DQEBBQUAMIGVMQswCQYD

VQQGEwJVQTEXMBUGA1UECBMOS2hhcmtvdiByZWdpb24xEDAOBgNVBAcTB0toYXJr

b3YxDzANBgNVBAoTBlNhbnRhbjEWMBQGA1UECxMNSVQgRGVwYXJ0bWVudDEVMBMG

A1UEAxMMZ3VrOC5raWV2LnVhMRswGQYJKoZIhvcNAQkBFgx0ZXN0QGtpZXYudWEw

HhcNMTAxMjA1MTkwNzUyWhcNMjAxMjAyMTkwNzUyWjCBlTELMAkGA1UEBhMCVUEx

FzAVBgNVBAgTDktoYXJrb3YgcmVnaW9uMRAwDgYDVQQHEwdLaGFya292MQ8wDQYD

VQQKEwZTYW50YW4xFjAUBgNVBAsTDUlUIERlcGFydG1lbnQxFTATBgNVBAMTDGd1

azgua2lldi51YTEbMBkGCSqGSIb3DQEJARYMdGVzdEBraWV2LnVhMIGfMA0GCSqG

SIb3DQEBAQUAA4GNADCBiQKBgQC19ewDm1uUBS3vnE3mzI5hTul/owbk5Vf0hPZ1

AkeW3VdvzQysDTtnqy54d3bgaVA40Lb3ZQKQLmqXS5Ww22Kl65sQLMZnVYaJI4JN

ZQ+OqzxAFUthdlfZYc53DPd8Iy8PSZgvG0RF7CtBrmSmeCwfoKBj8Uah6s5MZUIE

pNZHGwIDAQABo4H9MIH6MB0GA1UdDgQWBBQZg/lHEOZHrviRO7PBHXHXr2jJ6TCB

ygYDVR0jBIHCMIG/gBQZg/lHEOZHrviRO7PBHXHXr2jJ6aGBm6SBmDCBlTELMAkG

A1UEBhMCVUExFzAVBgNVBAgTDktoYXJrb3YgcmVnaW9uMRAwDgYDVQQHEwdLaGFy

a292MQ8wDQYDVQQKEwZTYW50YW4xFjAUBgNVBAsTDUlUIERlcGFydG1lbnQxFTAT

BgNVBAMTDGd1azgua2lldi51YTEbMBkGCSqGSIb3DQEJARYMdGVzdEBraWV2LnVh

ggkA6jmr7EV6MCkwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOBgQCDELZz

FB61Mmc5QHdTD052TwA8NJo8/6BHu+uzadvA3ozmzXrYS0eXE/QLuywPwYuMur/H

duJDDN5ySCJXRUSCEFzu/HosCzEBWnw1LIw5IVgM+iEK4f52dWYyL9zeR6WEcK2Z

O6j+FPRxVduUZ07M53wfi55Ro2X0WtdgDCaS9A==

——END CERTIFICATE——

subject=/C=UA/ST=Kharkov region/L=Kharkov/O=Santan/OU=IT Department/CN=guk8.kiev.ua/emailAddress=test@kiev.ua

issuer=/C=UA/ST=Kharkov region/L=Kharkov/O=Santan/OU=IT Department/CN=guk8.kiev.ua/emailAddress=test@kiev.ua

—

No client certificate CA names sent

—

SSL handshake has read 1109 bytes and written 337 bytes

—

New, TLSv1/SSLv3, Cipher is AES256-SHA

Server public key is 1024 bit

Secure Renegotiation IS supported

Compression: NONE

Expansion: NONE

SSL-Session:

Protocol  : TLSv1

Cipher    : AES256-SHA

Session-ID: 622217B4251FFFECE1815CAA3D16B87A8F2295FACB595B5F3EC5E485033D7264

Session-ID-ctx:

Master-Key: B579A1D31070FEA20AB459E53D63CDF60D7219A2D34C82CF4E651E96180C96DF26E4EA96614E292509F8CF54E7660A62

Key-Arg   : None

Start Time: 1291928100

Timeout   : 300 (sec)

Verify return code: 18 (self signed certificate)

—

220 primary_hostname, ESMTP EXIM 4.72

 

Источники

http://freebsd.munk.me.uk/archives/212-Installing-Exim,-SASLAuthd,-ClamAV-and-SpamAssassin-on-FreeBSD-6.2.html

http://www.lissyara.su/articles/freebsd/mail/exim+dovecot+postfixadmin/

http://www.lissyara.su/articles/freebsd/mail/exim+dovecot+postfixadmin+roundcube+fetchmail+smtp_relay/

http://www.propheta.ru/2008/10/dovecot-imap-pop3.html