1.3. Setting up a Dovecot server with MariaDB SQL authentication

Procedure

1. Set secure permissions on the private key file:

   # chown root:root /etc/pki/dovecot/private/server.example.com.key
   # chmod 600 /etc/pki/dovecot/private/server.example.com.key

2. Generate a file with Diffie-Hellman parameters:

   # openssl dhparam -out /etc/dovecot/dh.pem 4096

   Depending on the hardware and entropy on the server, generating Diffie-Hellman parameters with 4096 bits can take several minutes.

3. Set the paths to the certificate and private key files in the /etc/dovecot/conf.d/10-ssl.conf file:

   1. Update the ssl_cert and ssl_key parameters, and set them to use the paths of the server’s certificate and private key:

      ssl_cert = </etc/pki/dovecot/certs/server.example.com.crt
      ssl_key = </etc/pki/dovecot/private/server.example.com.key

   2. Uncomment the ssl_ca parameter, and set it to use the path to the CA certificate:

      ssl_ca = </etc/pki/dovecot/certs/ca.crt

   3. Uncomment the ssl_dh parameter, and set it to use the path to the Diffie-Hellman parameters file:

      ssl_dh = </etc/dovecot/dh.pem

   중요

   To ensure that Dovecot reads the value of a parameter from a file, the path must start with a leading < character.

Procedure

1. Create the vmail user:

   # useradd --home-dir /var/mail/ --shell /usr/sbin/nologin vmail

   Dovecot will later use this user to manage the mailboxes. For security reasons, do not use the dovecot or dovenull system users for this purpose.

2. If you use a different path than /var/mail/, set the mail_spool_t SELinux context on it, for example:

   # semanage fcontext -a -t mail_spool_t "<path>(/.)?"*
   # restorecon -Rv <path>

3. Grant write permissions on /var/mail/ only to the vmail user:

   # chown vmail:vmail /var/mail/
   # chmod 700 /var/mail/

4. Uncomment the mail_location parameter in the /etc/dovecot/conf.d/10-mail.conf file, and set it to the mailbox format and location:

   mail_location = sdbox:/var/mail/%n/

   With this setting:

   • Dovecot uses the high-performant dbox mailbox format in single mode. In this mode, the service stores each mail in a separate file, similar to the maildir format.
   • Dovecot resolves the %n variable in the path to the username. This is required to ensure that each user has a separate directory for its mailbox.

Procedure

1. Install the dovecot-mysql package:

   # dnf install dovecot-mysql

2. Configure the authentication backends in the /etc/dovecot/conf.d/10-auth.conf file:

   1. Comment out include statements for auth-*.conf.ext authentication backend configuration files that you do not require, for example:

      #!include auth-system.conf.ext

   2. Enable SQL authentication by uncommenting the following line:

      !include auth-sql.conf.ext

3. Edit the /etc/dovecot/conf.d/auth-sql.conf.ext file, and add the override_fields parameter to the userdb section as follows:

   userdb {
     driver = sql
     args = /etc/dovecot/dovecot-sql.conf.ext
     override_fields = uid=vmail gid=vmail home=/var/mail/%n/
   }

   Due to the fixed values, Dovecot does not query these settings from the SQL server.

4. Create the /etc/dovecot/dovecot-sql.conf.ext file with the following settings:

   driver = mysql**
   connect = host=mariadb_srv.example.com dbname=dovecotDB user=dovecot password=_<dovecotPW>_ ssl_ca=/etc/pki/tls/certs/ca.crt
   default_pass_scheme = SHA512-CRYPT
   user_query = SELECT username FROM users WHERE username='%u';
   password_query = SELECT username AS user, password FROM users WHERE username='%u';
   iterate_query = SELECT username FROM users;

   To use TLS encryption to the database server, set the ssl_ca option to the path of the certificate of the CA that issued the MariaDB server certificate. For a working certificate validation, the hostname of the MariaDB server must match the hostname used in its TLS certificate.

   If the password values in the database contain a {<pw-storage-scheme>} prefix, you can omit the default_pass_scheme setting.

   The queries in the file must be set as follows:

   • For the user_query parameter, the query must return the username of the Dovecot user. The query must also return only one result.
   • For the password_query parameter, the query must return the username and the password, and Dovecot must use these values in the user and password variables. Therefore, if the database uses different column names, use the AS SQL command to rename a column in the result.
   • For the iterate_query parameter, the query must return a list of all users.

5. Set secure permissions on the /etc/dovecot/dovecot-sql.conf.ext file:

   # chown root:root /etc/dovecot/dovecot-sql.conf.ext
   # chmod 600 /etc/dovecot/dovecot-sql.conf.ext

Procedure

1. If you want to provide only an IMAP or POP3 service to users, uncomment the protocols parameter in the /etc/dovecot/dovecot.conf file, and set it to the required protocols. For example, if you do not require POP3, set:

   protocols = imap lmtp

   By default, the imap, pop3, and lmtp protocols are enabled.

2. Open the ports in the local firewall. For example, to open the ports for the IMAPS, IMAP, POP3S, and POP3 protocols, enter:

   # firewall-cmd --permanent --add-service=imaps --add-service=imap --add-service=pop3s --add-service=pop3
   # firewall-cmd --reload

3. Enable and start the dovecot service:

   # systemctl enable --now dovecot

Verification

1. Use a mail client, such as Mozilla Thunderbird, to connect to Dovecot and read emails. The settings for the mail client depend on the protocol you want to use:

   Expand

   표 1.3. Connection settings to the Dovecot server

   Protocol	Port	Connection security	Authentication method
   IMAP	143	STARTTLS	PLAIN[a]
   IMAPS	993	SSL/TLS	PLAIN[a]
   POP3	110	STARTTLS	PLAIN[a]
   POP3S	995	SSL/TLS	PLAIN[a]
   [a] The client transmits data encrypted through the TLS connection. Consequently, credentials are not disclosed.

   Show more

   Note that this table does not list settings for unencrypted connections because, by default, Dovecot does not accept plain text authentication on connections without TLS.

2. Display configuration settings with non-default values:

   # doveconf -n