第 1 章 Configuring and maintaining a Dovecot IMAP and POP3 server

Procedure

1. Set secure permissions on the private key file:

   # chown root:root /etc/pki/dovecot/private/server.example.com.key
   # chmod 600 /etc/pki/dovecot/private/server.example.com.key

2. Generate a file with Diffie-Hellman parameters:

   # openssl dhparam -out /etc/dovecot/dh.pem 4096

   Depending on the hardware and entropy on the server, generating Diffie-Hellman parameters with 4096 bits can take several minutes.

3. Set the paths to the certificate and private key files in the /etc/dovecot/conf.d/10-ssl.conf file:

   1. Update the ssl_cert and ssl_key parameters, and set them to use the paths of the server’s certificate and private key:

      ssl_cert = </etc/pki/dovecot/certs/server.example.com.crt
      ssl_key = </etc/pki/dovecot/private/server.example.com.key

   2. Uncomment the ssl_ca parameter, and set it to use the path to the CA certificate:

      ssl_ca = </etc/pki/dovecot/certs/ca.crt

   3. Uncomment the ssl_dh parameter, and set it to use the path to the Diffie-Hellman parameters file:

      ssl_dh = </etc/dovecot/dh.pem

   重要

   To ensure that Dovecot reads the value of a parameter from a file, the path must start with a leading < character.

Procedure

1. Create the vmail user:

   # useradd --home-dir /var/mail/ --shell /usr/sbin/nologin vmail

   Dovecot will later use this user to manage the mailboxes. For security reasons, do not use the dovecot or dovenull system users for this purpose.

2. If you use a different path than /var/mail/, set the mail_spool_t SELinux context on it, for example:

   # semanage fcontext -a -t mail_spool_t "<path>(/.)?"*
   # restorecon -Rv <path>

3. Grant write permissions on /var/mail/ only to the vmail user:

   # chown vmail:vmail /var/mail/
   # chmod 700 /var/mail/

4. Uncomment the mail_location parameter in the /etc/dovecot/conf.d/10-mail.conf file, and set it to the mailbox format and location:

   mail_location = sdbox:/var/mail/%n/

   With this setting:

   • Dovecot uses the high-performant dbox mailbox format in single mode. In this mode, the service stores each mail in a separate file, similar to the maildir format.
   • Dovecot resolves the %n variable in the path to the username. This is required to ensure that each user has a separate directory for its mailbox.

Procedure

1. Update the first_valid_uid parameter in the /etc/dovecot/conf.d/10-mail.conf file to define the lowest user ID (UID) that can authenticate to Dovecot:

   first_valid_uid = 1000

   By default, users with a UID greater than or equal to 1000 can authenticate. If required, you can also set the last_valid_uid parameter to define the highest UID that Dovecot allows to log in.

2. In the /etc/dovecot/conf.d/auth-system.conf.ext file, add the override_fields parameter to the userdb section as follows:

   userdb {
     driver = passwd
     override_fields = uid=vmail gid=vmail home=/var/mail/%n/
   }

   Due to the fixed values, Dovecot does not query these settings from the /etc/passwd file. As a result, the home directory defined in /etc/passwd does not need to exist.

Procedure

1. If you want to provide only an IMAP or POP3 service to users, uncomment the protocols parameter in the /etc/dovecot/dovecot.conf file, and set it to the required protocols. For example, if you do not require POP3, set:

   protocols = imap lmtp

   By default, the imap, pop3, and lmtp protocols are enabled.

2. Open the ports in the local firewall. For example, to open the ports for the IMAPS, IMAP, POP3S, and POP3 protocols, enter:

   # firewall-cmd --permanent --add-service=imaps --add-service=imap --add-service=pop3s --add-service=pop3
   # firewall-cmd --reload

3. Enable and start the dovecot service:

   # systemctl enable --now dovecot

Verification

1. Use a mail client, such as Mozilla Thunderbird, to connect to Dovecot and read emails. The settings for the mail client depend on the protocol you want to use:

   Expand

   表 1.1. Connection settings to the Dovecot server

   Protocol	Port	Connection security	Authentication method
   IMAP	143	STARTTLS	PLAIN[a]
   IMAPS	993	SSL/TLS	PLAIN[a]
   POP3	110	STARTTLS	PLAIN[a]
   POP3S	995	SSL/TLS	PLAIN[a]
   [a] The client transmits data encrypted through the TLS connection. Consequently, credentials are not disclosed.

   Show more

   Note that this table does not list settings for unencrypted connections because, by default, Dovecot does not accept plain text authentication on connections without TLS.

2. Display configuration settings with non-default values:

   # doveconf -n