1.2. Setting up a Dovecot server with LDAP authentication

Procedure

1. Set secure permissions on the private key file:

   # chown root:root /etc/pki/dovecot/private/server.example.com.key
   # chmod 600 /etc/pki/dovecot/private/server.example.com.key

2. Generate a file with Diffie-Hellman parameters:

   # openssl dhparam -out /etc/dovecot/dh.pem 4096

   Depending on the hardware and entropy on the server, generating Diffie-Hellman parameters with 4096 bits can take several minutes.

3. Set the paths to the certificate and private key files in the /etc/dovecot/conf.d/10-ssl.conf file:

   1. Update the ssl_cert and ssl_key parameters, and set them to use the paths of the server’s certificate and private key:

      ssl_cert = </etc/pki/dovecot/certs/server.example.com.crt
      ssl_key = </etc/pki/dovecot/private/server.example.com.key

   2. Uncomment the ssl_ca parameter, and set it to use the path to the CA certificate:

      ssl_ca = </etc/pki/dovecot/certs/ca.crt

   3. Uncomment the ssl_dh parameter, and set it to use the path to the Diffie-Hellman parameters file:

      ssl_dh = </etc/dovecot/dh.pem

   重要

   To ensure that Dovecot reads the value of a parameter from a file, the path must start with a leading < character.

Procedure

1. Create the vmail user:

   # useradd --home-dir /var/mail/ --shell /usr/sbin/nologin vmail

   Dovecot will later use this user to manage the mailboxes. For security reasons, do not use the dovecot or dovenull system users for this purpose.

2. If you use a different path than /var/mail/, set the mail_spool_t SELinux context on it, for example:

   # semanage fcontext -a -t mail_spool_t "<path>(/.)?"*
   # restorecon -Rv <path>

3. Grant write permissions on /var/mail/ only to the vmail user:

   # chown vmail:vmail /var/mail/
   # chmod 700 /var/mail/

4. Uncomment the mail_location parameter in the /etc/dovecot/conf.d/10-mail.conf file, and set it to the mailbox format and location:

   mail_location = sdbox:/var/mail/%n/

   With this setting:

   • Dovecot uses the high-performant dbox mailbox format in single mode. In this mode, the service stores each mail in a separate file, similar to the maildir format.
   • Dovecot resolves the %n variable in the path to the username. This is required to ensure that each user has a separate directory for its mailbox.

Procedure

1. Configure the authentication backends in the /etc/dovecot/conf.d/10-auth.conf file:

   1. Comment out include statements for auth-*.conf.ext authentication backend configuration files that you do not require, for example:

      #!include auth-system.conf.ext

   2. Enable LDAP authentication by uncommenting the following line:

      !include auth-ldap.conf.ext

2. Edit the /etc/dovecot/conf.d/auth-ldap.conf.ext file, and add the override_fields parameter as follows to the userdb section:

   userdb {
     driver = ldap
     args = /etc/dovecot/dovecot-ldap.conf.ext
     override_fields = uid=vmail gid=vmail home=/var/mail/%n/
   }

   Due to the fixed values, Dovecot does not query these settings from the LDAP server. Consequently, these attributes also do not have to be present.

3. Create the /etc/dovecot/dovecot-ldap.conf.ext file with the following settings:

   1. Depending on the LDAP structure, configure one of the following:

      • If users are stored in different trees in the LDAP directory, configure dynamic DN lookups:

        dn = cn=dovecot_LDAP,dc=example,dc=com
        dnpass = <password>
        pass_filter = (&(objectClass=posixAccount)(uid=%n))

        Dovecot uses the specified DN, password, and filter to search the DN of the authenticating user in the directory. In this search, Dovecot replaces %n in the filter with the username. Note that the LDAP search must return only one result.

      • If all users are stored under a specific entry, configure a DN template:

        auth_bind_userdn = cn=%n,ou=People,dc=example,dc=com

   2. Enable authentication binds to the LDAP server to verify Dovecot users:

      auth_bind = yes

   3. Set the URL to the LDAP server:

      uris = ldaps://LDAP-srv.example.com

      For security reasons, only use encrypted connections by using LDAPS or the STARTTLS command over the LDAP protocol. For the latter, additionally add tls = yes to the settings.

      For a working certificate validation, the hostname of the LDAP server must match the hostname used in its TLS certificate.

   4. Enable the verification of the LDAP server’s TLS certificate:

      tls_require_cert = hard

   5. Set the base DN to the DN where to start searching for users:

      base = ou=People,dc=example,dc=com

   6. Set the search scope:

      scope = onelevel

      Dovecot searches with the onelevel scope only in the specified base DN and with the subtree scope also in subtrees.

4. Set secure permissions on the /etc/dovecot/dovecot-ldap.conf.ext file:

   # chown root:root /etc/dovecot/dovecot-ldap.conf.ext
   # chmod 600 /etc/dovecot/dovecot-ldap.conf.ext

Procedure

1. If you want to provide only an IMAP or POP3 service to users, uncomment the protocols parameter in the /etc/dovecot/dovecot.conf file, and set it to the required protocols. For example, if you do not require POP3, set:

   protocols = imap lmtp

   By default, the imap, pop3, and lmtp protocols are enabled.

2. Open the ports in the local firewall. For example, to open the ports for the IMAPS, IMAP, POP3S, and POP3 protocols, enter:

   # firewall-cmd --permanent --add-service=imaps --add-service=imap --add-service=pop3s --add-service=pop3
   # firewall-cmd --reload

3. Enable and start the dovecot service:

   # systemctl enable --now dovecot

Verification

1. Use a mail client, such as Mozilla Thunderbird, to connect to Dovecot and read emails. The settings for the mail client depend on the protocol you want to use:

   Expand

   表 1.2. Connection settings to the Dovecot server

   Protocol	Port	Connection security	Authentication method
   IMAP	143	STARTTLS	PLAIN[a]
   IMAPS	993	SSL/TLS	PLAIN[a]
   POP3	110	STARTTLS	PLAIN[a]
   POP3S	995	SSL/TLS	PLAIN[a]
   [a] The client transmits data encrypted through the TLS connection. Consequently, credentials are not disclosed.

   Show more

   Note that this table does not list settings for unencrypted connections because, by default, Dovecot does not accept plain text authentication on connections without TLS.

2. Display configuration settings with non-default values:

   # doveconf -n