Deploying mail servers

Procedure

1. Set secure permissions on the private key file:

   # chown root:root /etc/pki/dovecot/private/server.example.com.key
   # chmod 600 /etc/pki/dovecot/private/server.example.com.key

   Copy to Clipboard

2. Generate a file with Diffie-Hellman parameters:

   # openssl dhparam -out /etc/dovecot/dh.pem 4096

   Copy to Clipboard

   Depending on the hardware and entropy on the server, generating Diffie-Hellman parameters with 4096 bits can take several minutes.

3. Set the paths to the certificate and private key files in the /etc/dovecot/conf.d/10-ssl.conf file:

   1. Update the ssl_cert and ssl_key parameters, and set them to use the paths of the server’s certificate and private key:

      ssl_cert = </etc/pki/dovecot/certs/server.example.com.crt
      ssl_key = </etc/pki/dovecot/private/server.example.com.key

      Copy to Clipboard

   2. Uncomment the ssl_ca parameter, and set it to use the path to the CA certificate:

      ssl_ca = </etc/pki/dovecot/certs/ca.crt

      Copy to Clipboard

   3. Uncomment the ssl_dh parameter, and set it to use the path to the Diffie-Hellman parameters file:

      ssl_dh = </etc/dovecot/dh.pem

      Copy to Clipboard
   Important

   To ensure that Dovecot reads the value of a parameter from a file, the path must start with a leading < character.

Procedure

1. Create the vmail user:

   # useradd --home-dir /var/mail/ --shell /usr/sbin/nologin vmail

   Copy to Clipboard

   Dovecot will later use this user to manage the mailboxes. For security reasons, do not use the dovecot or dovenull system users for this purpose.

2. If you use a different path than /var/mail/, set the mail_spool_t SELinux context on it, for example:

   # semanage fcontext -a -t mail_spool_t "<path>(/.)?"*
   # restorecon -Rv <path>

   Copy to Clipboard

3. Grant write permissions on /var/mail/ only to the vmail user:

   # chown vmail:vmail /var/mail/
   # chmod 700 /var/mail/

   Copy to Clipboard

4. Uncomment the mail_location parameter in the /etc/dovecot/conf.d/10-mail.conf file, and set it to the mailbox format and location:

   mail_location = sdbox:/var/mail/%n/

   Copy to Clipboard

   With this setting:

   • Dovecot uses the high-performant dbox mailbox format in single mode. In this mode, the service stores each mail in a separate file, similar to the maildir format.
   • Dovecot resolves the %n variable in the path to the username. This is required to ensure that each user has a separate directory for its mailbox.

Procedure

1. Update the first_valid_uid parameter in the /etc/dovecot/conf.d/10-mail.conf file to define the lowest user ID (UID) that can authenticate to Dovecot:

   first_valid_uid = 1000

   Copy to Clipboard

   By default, users with a UID greater than or equal to 1000 can authenticate. If required, you can also set the last_valid_uid parameter to define the highest UID that Dovecot allows to log in.

2. In the /etc/dovecot/conf.d/auth-system.conf.ext file, add the override_fields parameter to the userdb section as follows:

   userdb {
     driver = passwd
     override_fields = uid=vmail gid=vmail home=/var/mail/%n/
   }

   Copy to Clipboard

   Due to the fixed values, Dovecot does not query these settings from the /etc/passwd file. As a result, the home directory defined in /etc/passwd does not need to exist.

Procedure

1. If you want to provide only an IMAP or POP3 service to users, uncomment the protocols parameter in the /etc/dovecot/dovecot.conf file, and set it to the required protocols. For example, if you do not require POP3, set:

   protocols = imap lmtp

   Copy to Clipboard

   By default, the imap, pop3, and lmtp protocols are enabled.

2. Open the ports in the local firewall. For example, to open the ports for the IMAPS, IMAP, POP3S, and POP3 protocols, enter:

   # firewall-cmd --permanent --add-service=imaps --add-service=imap --add-service=pop3s --add-service=pop3
   # firewall-cmd --reload

   Copy to Clipboard

3. Enable and start the dovecot service:

   # systemctl enable --now dovecot

   Copy to Clipboard

Verification

1. Use a mail client, such as Mozilla Thunderbird, to connect to Dovecot and read emails. The settings for the mail client depend on the protocol you want to use:

   Table 1.1. Connection settings to the Dovecot server

   Protocol	Port	Connection security	Authentication method
   IMAP	143	STARTTLS	PLAIN[a]
   IMAPS	993	SSL/TLS	PLAIN[a]
   POP3	110	STARTTLS	PLAIN[a]
   POP3S	995	SSL/TLS	PLAIN[a]
   [a] The client transmits data encrypted through the TLS connection. Consequently, credentials are not disclosed.

   Note that this table does not list settings for unencrypted connections because, by default, Dovecot does not accept plain text authentication on connections without TLS.

2. Display configuration settings with non-default values:

   # doveconf -n

   Copy to Clipboard

Procedure

1. Set secure permissions on the private key file:

   # chown root:root /etc/pki/dovecot/private/server.example.com.key
   # chmod 600 /etc/pki/dovecot/private/server.example.com.key

   Copy to Clipboard

2. Generate a file with Diffie-Hellman parameters:

   # openssl dhparam -out /etc/dovecot/dh.pem 4096

   Copy to Clipboard

   Depending on the hardware and entropy on the server, generating Diffie-Hellman parameters with 4096 bits can take several minutes.

3. Set the paths to the certificate and private key files in the /etc/dovecot/conf.d/10-ssl.conf file:

   1. Update the ssl_cert and ssl_key parameters, and set them to use the paths of the server’s certificate and private key:

      ssl_cert = </etc/pki/dovecot/certs/server.example.com.crt
      ssl_key = </etc/pki/dovecot/private/server.example.com.key

      Copy to Clipboard

   2. Uncomment the ssl_ca parameter, and set it to use the path to the CA certificate:

      ssl_ca = </etc/pki/dovecot/certs/ca.crt

      Copy to Clipboard

   3. Uncomment the ssl_dh parameter, and set it to use the path to the Diffie-Hellman parameters file:

      ssl_dh = </etc/dovecot/dh.pem

      Copy to Clipboard
   Important

   To ensure that Dovecot reads the value of a parameter from a file, the path must start with a leading < character.

Procedure

1. Create the vmail user:

   # useradd --home-dir /var/mail/ --shell /usr/sbin/nologin vmail

   Copy to Clipboard

   Dovecot will later use this user to manage the mailboxes. For security reasons, do not use the dovecot or dovenull system users for this purpose.

2. If you use a different path than /var/mail/, set the mail_spool_t SELinux context on it, for example:

   # semanage fcontext -a -t mail_spool_t "<path>(/.)?"*
   # restorecon -Rv <path>

   Copy to Clipboard

3. Grant write permissions on /var/mail/ only to the vmail user:

   # chown vmail:vmail /var/mail/
   # chmod 700 /var/mail/

   Copy to Clipboard

4. Uncomment the mail_location parameter in the /etc/dovecot/conf.d/10-mail.conf file, and set it to the mailbox format and location:

   mail_location = sdbox:/var/mail/%n/

   Copy to Clipboard

   With this setting:

   • Dovecot uses the high-performant dbox mailbox format in single mode. In this mode, the service stores each mail in a separate file, similar to the maildir format.
   • Dovecot resolves the %n variable in the path to the username. This is required to ensure that each user has a separate directory for its mailbox.

Procedure

1. Configure the authentication backends in the /etc/dovecot/conf.d/10-auth.conf file:

   1. Comment out include statements for auth-*.conf.ext authentication backend configuration files that you do not require, for example:

      #!include auth-system.conf.ext

      Copy to Clipboard

   2. Enable LDAP authentication by uncommenting the following line:

      !include auth-ldap.conf.ext

      Copy to Clipboard

2. Edit the /etc/dovecot/conf.d/auth-ldap.conf.ext file, and add the override_fields parameter as follows to the userdb section:

   userdb {
     driver = ldap
     args = /etc/dovecot/dovecot-ldap.conf.ext
     override_fields = uid=vmail gid=vmail home=/var/mail/%n/
   }

   Copy to Clipboard

   Due to the fixed values, Dovecot does not query these settings from the LDAP server. Consequently, these attributes also do not have to be present.

3. Create the /etc/dovecot/dovecot-ldap.conf.ext file with the following settings:

   1. Depending on the LDAP structure, configure one of the following:

      • If users are stored in different trees in the LDAP directory, configure dynamic DN lookups:

        dn = cn=dovecot_LDAP,dc=example,dc=com
        dnpass = <password>
        pass_filter = (&(objectClass=posixAccount)(uid=%n))

        Copy to Clipboard

        Dovecot uses the specified DN, password, and filter to search the DN of the authenticating user in the directory. In this search, Dovecot replaces %n in the filter with the username. Note that the LDAP search must return only one result.

      • If all users are stored under a specific entry, configure a DN template:

        auth_bind_userdn = cn=%n,ou=People,dc=example,dc=com

        Copy to Clipboard

   2. Enable authentication binds to the LDAP server to verify Dovecot users:

      auth_bind = yes

      Copy to Clipboard

   3. Set the URL to the LDAP server:

      uris = ldaps://LDAP-srv.example.com

      Copy to Clipboard

      For security reasons, only use encrypted connections by using LDAPS or the STARTTLS command over the LDAP protocol. For the latter, additionally add tls = yes to the settings.

      For a working certificate validation, the hostname of the LDAP server must match the hostname used in its TLS certificate.

   4. Enable the verification of the LDAP server’s TLS certificate:

      tls_require_cert = hard

      Copy to Clipboard

   5. Set the base DN to the DN where to start searching for users:

      base = ou=People,dc=example,dc=com

      Copy to Clipboard

   6. Set the search scope:

      scope = onelevel

      Copy to Clipboard

      Dovecot searches with the onelevel scope only in the specified base DN and with the subtree scope also in subtrees.

4. Set secure permissions on the /etc/dovecot/dovecot-ldap.conf.ext file:

   # chown root:root /etc/dovecot/dovecot-ldap.conf.ext
   # chmod 600 /etc/dovecot/dovecot-ldap.conf.ext

   Copy to Clipboard

Procedure

1. If you want to provide only an IMAP or POP3 service to users, uncomment the protocols parameter in the /etc/dovecot/dovecot.conf file, and set it to the required protocols. For example, if you do not require POP3, set:

   protocols = imap lmtp

   Copy to Clipboard

   By default, the imap, pop3, and lmtp protocols are enabled.

2. Open the ports in the local firewall. For example, to open the ports for the IMAPS, IMAP, POP3S, and POP3 protocols, enter:

   # firewall-cmd --permanent --add-service=imaps --add-service=imap --add-service=pop3s --add-service=pop3
   # firewall-cmd --reload

   Copy to Clipboard

3. Enable and start the dovecot service:

   # systemctl enable --now dovecot

   Copy to Clipboard

Verification

1. Use a mail client, such as Mozilla Thunderbird, to connect to Dovecot and read emails. The settings for the mail client depend on the protocol you want to use:

   Table 1.2. Connection settings to the Dovecot server

   Protocol	Port	Connection security	Authentication method
   IMAP	143	STARTTLS	PLAIN[a]
   IMAPS	993	SSL/TLS	PLAIN[a]
   POP3	110	STARTTLS	PLAIN[a]
   POP3S	995	SSL/TLS	PLAIN[a]
   [a] The client transmits data encrypted through the TLS connection. Consequently, credentials are not disclosed.

   Note that this table does not list settings for unencrypted connections because, by default, Dovecot does not accept plain text authentication on connections without TLS.

2. Display configuration settings with non-default values:

   # doveconf -n

   Copy to Clipboard

Procedure

1. Set secure permissions on the private key file:

   # chown root:root /etc/pki/dovecot/private/server.example.com.key
   # chmod 600 /etc/pki/dovecot/private/server.example.com.key

   Copy to Clipboard

2. Generate a file with Diffie-Hellman parameters:

   # openssl dhparam -out /etc/dovecot/dh.pem 4096

   Copy to Clipboard

   Depending on the hardware and entropy on the server, generating Diffie-Hellman parameters with 4096 bits can take several minutes.

3. Set the paths to the certificate and private key files in the /etc/dovecot/conf.d/10-ssl.conf file:

   1. Update the ssl_cert and ssl_key parameters, and set them to use the paths of the server’s certificate and private key:

      ssl_cert = </etc/pki/dovecot/certs/server.example.com.crt
      ssl_key = </etc/pki/dovecot/private/server.example.com.key

      Copy to Clipboard

   2. Uncomment the ssl_ca parameter, and set it to use the path to the CA certificate:

      ssl_ca = </etc/pki/dovecot/certs/ca.crt

      Copy to Clipboard

   3. Uncomment the ssl_dh parameter, and set it to use the path to the Diffie-Hellman parameters file:

      ssl_dh = </etc/dovecot/dh.pem

      Copy to Clipboard
   Important

   To ensure that Dovecot reads the value of a parameter from a file, the path must start with a leading < character.

Procedure

1. Create the vmail user:

   # useradd --home-dir /var/mail/ --shell /usr/sbin/nologin vmail

   Copy to Clipboard

   Dovecot will later use this user to manage the mailboxes. For security reasons, do not use the dovecot or dovenull system users for this purpose.

2. If you use a different path than /var/mail/, set the mail_spool_t SELinux context on it, for example:

   # semanage fcontext -a -t mail_spool_t "<path>(/.)?"*
   # restorecon -Rv <path>

   Copy to Clipboard

3. Grant write permissions on /var/mail/ only to the vmail user:

   # chown vmail:vmail /var/mail/
   # chmod 700 /var/mail/

   Copy to Clipboard

4. Uncomment the mail_location parameter in the /etc/dovecot/conf.d/10-mail.conf file, and set it to the mailbox format and location:

   mail_location = sdbox:/var/mail/%n/

   Copy to Clipboard

   With this setting:

   • Dovecot uses the high-performant dbox mailbox format in single mode. In this mode, the service stores each mail in a separate file, similar to the maildir format.
   • Dovecot resolves the %n variable in the path to the username. This is required to ensure that each user has a separate directory for its mailbox.

Procedure

1. Install the dovecot-mysql package:

   # dnf install dovecot-mysql

   Copy to Clipboard

2. Configure the authentication backends in the /etc/dovecot/conf.d/10-auth.conf file:

   1. Comment out include statements for auth-*.conf.ext authentication backend configuration files that you do not require, for example:

      #!include auth-system.conf.ext

      Copy to Clipboard

   2. Enable SQL authentication by uncommenting the following line:

      !include auth-sql.conf.ext

      Copy to Clipboard

3. Edit the /etc/dovecot/conf.d/auth-sql.conf.ext file, and add the override_fields parameter to the userdb section as follows:

   userdb {
     driver = sql
     args = /etc/dovecot/dovecot-sql.conf.ext
     override_fields = uid=vmail gid=vmail home=/var/mail/%n/
   }

   Copy to Clipboard

   Due to the fixed values, Dovecot does not query these settings from the SQL server.

4. Create the /etc/dovecot/dovecot-sql.conf.ext file with the following settings:

   driver = mysql**
   connect = host=mariadb_srv.example.com dbname=dovecotDB user=dovecot password=_<dovecotPW>_ ssl_ca=/etc/pki/tls/certs/ca.crt
   default_pass_scheme = SHA512-CRYPT
   user_query = SELECT username FROM users WHERE username='%u';
   password_query = SELECT username AS user, password FROM users WHERE username='%u';
   iterate_query = SELECT username FROM users;

   Copy to Clipboard

   To use TLS encryption to the database server, set the ssl_ca option to the path of the certificate of the CA that issued the MariaDB server certificate. For a working certificate validation, the hostname of the MariaDB server must match the hostname used in its TLS certificate.

   If the password values in the database contain a {<pw-storage-scheme>} prefix, you can omit the default_pass_scheme setting.

   The queries in the file must be set as follows:

   • For the user_query parameter, the query must return the username of the Dovecot user. The query must also return only one result.
   • For the password_query parameter, the query must return the username and the password, and Dovecot must use these values in the user and password variables. Therefore, if the database uses different column names, use the AS SQL command to rename a column in the result.
   • For the iterate_query parameter, the query must return a list of all users.

5. Set secure permissions on the /etc/dovecot/dovecot-sql.conf.ext file:

   # chown root:root /etc/dovecot/dovecot-sql.conf.ext
   # chmod 600 /etc/dovecot/dovecot-sql.conf.ext

   Copy to Clipboard

Procedure

1. If you want to provide only an IMAP or POP3 service to users, uncomment the protocols parameter in the /etc/dovecot/dovecot.conf file, and set it to the required protocols. For example, if you do not require POP3, set:

   protocols = imap lmtp

   Copy to Clipboard

   By default, the imap, pop3, and lmtp protocols are enabled.

2. Open the ports in the local firewall. For example, to open the ports for the IMAPS, IMAP, POP3S, and POP3 protocols, enter:

   # firewall-cmd --permanent --add-service=imaps --add-service=imap --add-service=pop3s --add-service=pop3
   # firewall-cmd --reload

   Copy to Clipboard

3. Enable and start the dovecot service:

   # systemctl enable --now dovecot

   Copy to Clipboard

Verification

1. Use a mail client, such as Mozilla Thunderbird, to connect to Dovecot and read emails. The settings for the mail client depend on the protocol you want to use:

   Table 1.3. Connection settings to the Dovecot server

   Protocol	Port	Connection security	Authentication method
   IMAP	143	STARTTLS	PLAIN[a]
   IMAPS	993	SSL/TLS	PLAIN[a]
   POP3	110	STARTTLS	PLAIN[a]
   POP3S	995	SSL/TLS	PLAIN[a]
   [a] The client transmits data encrypted through the TLS connection. Consequently, credentials are not disclosed.

   Note that this table does not list settings for unencrypted connections because, by default, Dovecot does not accept plain text authentication on connections without TLS.

2. Display configuration settings with non-default values:

   # doveconf -n

   Copy to Clipboard

Procedure

1. Set up Dovecot:

   1. Include the following lines in the /etc/dovecot/conf.d/10-master.conf file:

      service auth {
        unix_listener /var/spool/postfix/private/auth {
          mode = 0660
          user = postfix
          group = postfix
        }
      }

      Copy to Clipboard

      The previous example uses UNIX-domain sockets for communication between Postfix and Dovecot. The example also assumes default Postfix SMTP server settings, which include the mail queue located in the /var/spool/postfix/ directory, and the application running under the postfix user and group.

   2. Optional: Set up Dovecot to listen for Postfix authentication requests through TCP:

      service auth {
        inet_listener {
            port = <port_number>
        }
      }

      Copy to Clipboard

   3. Specify the method that the email client uses to authenticate with Dovecot by editing the auth_mechanisms parameter in /etc/dovecot/conf.d/10-auth.conf file:

      auth_mechanisms = plain login

      Copy to Clipboard

      The auth_mechanisms parameter supports different plain text and non-plain text authentication methods.

2. Set up Postfix by modifying the /etc/postfix/main.cf file:

   1. Enable SMTP Authentication on the Postfix SMTP server:

      smtpd_sasl_auth_enable = yes

      Copy to Clipboard

   2. Enable the use of Dovecot SASL implementation for SMTP Authentication:

      smtpd_sasl_type = dovecot

      Copy to Clipboard

   3. Provide the authentication path relative to the Postfix queue directory. Note that the use of a relative path ensures that the configuration works regardless of whether the Postfix server runs in chroot or not:

      smtpd_sasl_path = private/auth

      Copy to Clipboard

      This step uses UNIX-domain sockets for communication between Postfix and Dovecot.

      To configure Postfix to look for Dovecot on a different machine in case you use TCP sockets for communication, use configuration values similar to the following:

      smtpd_sasl_path = inet: <IP_address> : <port_number>

      Copy to Clipboard

      In the previous example, replace the <IP_address> with the IP address of the Dovecot machine and <port_number> with the port number specified in Dovecot’s /etc/dovecot/conf.d/10-master.conf file.

   4. Specify SASL mechanisms that the Postfix SMTP server makes available to clients. Note that you can specify different mechanisms for encrypted and unencrypted sessions.

      smtpd_sasl_security_options = noanonymous, noplaintext
      smtpd_sasl_tls_security_options = noanonymous

      Copy to Clipboard

      The previous directives specify that during unencrypted sessions, no anonymous authentication is allowed and no mechanisms that transmit unencrypted user names or passwords are allowed. For encrypted sessions that use TLS, only non-anonymous authentication mechanisms are allowed.