Configure Dovecot

1. Edit the file /etc/dovecot/dovecot.conf using the command

sudo vi /etc/dovecot/dovecot.conf

and update the lines below

mail_location = maildir:~/Maildir
pop3_client_workarounds = outlook-no-nuls oe-ns-eoh

2. Restart dovecot using the command

sudo service dovecot restart

Test Dovecot

Here’s a sample dovecot session. Replace johndoe and password with any valid user name and password.

johndoe@mail:~$ telnet localhost pop3
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
+OK dovecot ready.
user johndoe
+OK
pass password
+OK Logged in.
list
+OK 1 messages:
1 622
.
retr 1
+OK 622 octets
Return-Path: <johndoe@mail.acme.local>
X-Original-To: johndoe
Delivered-To: johndoe@mail.acme.local
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])
        by mail.acme.local (Postfix) with SMTP id 9729067C17
        for <johndoe>; Thu, 22 Feb 2007 09:06:37 -0500 (EST)
Message-Id: <20070222140640.9729067C17@mail.acme.local>
Date: Thu, 22 Feb 2007 09:06:37 -0500 (EST)
From: johndoe@mail.acme.local
To: undisclosed-recipients:;
X-IMAPbase: 1172153557 1
Status: O
X-UID: 1
Content-Length: 5
X-Keywords:


test
.
quit
+OK Logging out.
Connection closed by foreign host.
johndoe@mail:~$

If you encounter any problems, check the log file at /var/log/mail.log.

Configure Postfix and Dovecot

1. Edit the file /etc/dovecot/conf.d/10-master.conf and make sure your service auth section has the lines below.

service auth {	
  unix_listener /var/spool/postfix/private/auth {
	mode = 0666
	user = postfix
	group = postfix
  }	
}

2. Edit the file /etc/dovecot/conf.d/10-auth.conf and update the line below.

auth_mechanisms = plain login

3. Edit /etc/postfix/main.cf, find the keys below and change its values as follows or add it at the bottom of the file if the key (the word before the = sign) cannot be found.

mynetworks = 127.0.0.0/8
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_recipient_restrictions =  permit_mynetworks, 
    permit_sasl_authenticated, 
    reject_unauth_destination
broken_sasl_auth_clients = yes

4. Configure SELinux using the commands below. Here’s the content of postfixdovecotsasl.te

wget linuxmail.info/files/rhel6/postfixdovecotsasl.te
checkmodule -M -m -o postfixdovecotsasl.mod postfixdovecotsasl.te
semodule_package -o postfixdovecotsasl.pp -m postfixdovecotsasl.mod
semodule -i postfixdovecotsasl.pp

5. Restart the Dovecot and Postfix service. But if you installed MailScanner, restart MailScanner instead of Postfix. Learn how to restart services here.

Test Postfix

In a Terminal window, type in the highlighted commands below.

Sample postfix session

[root@mail ~]# telnet mail smtp

Replace mail with the name of your server. We should not use localhost since localhost is a trusted client ip address. And make sure the domain name you specified does not resolve to 127.0.0.1 which is the IP address of localhost.

Trying 192.168.0.1...
Connected to mail.acme.local (192.168.0.1).
Escape character is '^]'.
220 mail.acme.local ESMTP Postfix
ehlo localhost
250-mail.acme.local
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-AUTH LOGIN PLAIN
250-AUTH=LOGIN PLAIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN

Note the new 250-AUTH lines. See the old SMTP Telnet Test.

mail from:<johndoe>
250 2.1.0 Ok
rcpt to:<test@example.com>
554 5.7.1 <test@example.com>: Relay access denied

It works, now to check if we can send it after authenticating.

auth plain AGpvaG5kb2UAcGFzc3dvcmQ=
235 2.0.0 Authentication successful
rcpt to:<test@example.com>
250 2.1.5 Ok
quit
221 2.0.0 Bye
Connection closed by foreign host.
[root@mail ~]#

You can send to email addresses belonging to your domain without authentication. This is normal as it enables you to receive mail from the outside.

The gibberish text after AUTH PLAIN is the base64 encoded value of the user name johndoe and password password. You can generate your own base64 text using the form below.

If you encounter any problems, check the log file at /var/log/maillog.

Configure Dovecot

1. The settings for Dovecot are spread out across several files. Edit the files listed below and update its lines accordingly.

 

/etc/dovecot/dovecot.conf

protocols = pop3 imap lmtp

/etc/dovecot/conf.d/10-mail.conf

mail_location = maildir:~/Maildir

/etc/dovecot/conf.d/20-pop3.conf

pop3_uidl_format = %08Xu%08Xv
pop3_client_workarounds = outlook-no-nuls oe-ns-eoh

2. Start the dovecot service. Learn how to start and stop services here.

Test Dovecot

1. Click Applications, select System Tools, and click Terminal. This will launch the Terminal window.

2. In the Terminal window, type in the highlighted commands below.

Sample dovecot session. Replace johndoe and password with any valid user name and password.

[root@mail ~]# telnet localhost pop3
+OK dovecot ready.
user johndoe
+OK
pass password
+OK Logged in.
list
+OK 1 messages:
1 622
.
retr 1
+OK 622 octets
Return-Path: <johndoe@mail.acme.local>
X-Original-To: johndoe
Delivered-To: johndoe@mail.acme.local
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])
        by mail.acme.local (Postfix) with SMTP id 9729067C17
        for <johndoe>; Thu, 22 Feb 2007 09:06:37 -0500 (EST)
Message-Id: <20070222140640.9729067C17@mail.acme.local>
Date: Thu, 22 Feb 2007 09:06:37 -0500 (EST)
From: johndoe@mail.acme.local
To: undisclosed-recipients:;
X-IMAPbase: 1172153557 1
Status: O
X-UID: 1
Content-Length: 5
X-Keywords:


test
.
quit
+OK Logging out.
Connection closed by foreign host.
[root@mail ~]#

If you encounter any problems, check the log file at /var/log/maillog.

Create the Virtual Mail User Account

1. Create a new user, we will call it vmail. Change the Login Shell to /sbin/nologin, this user account should not be used for logging in. Learn how to use the User Manager application here.

2. Take note of the User ID and Home Directory of vmail.

3. Click the Groups tab and now note down the Group ID of vmail. We’ll be needing all of them later.

Configure Postfix for Virtual User Accounts

1. Edit the postfix configuration file /etc/postfix/main.cf and edit the line below

mydestination = $myhostname, localhost.$mydomain, localhost

and add the lines below

virtual_mailbox_domains = $mydomain
virtual_mailbox_base = /home/vmail/
virtual_mailbox_maps = hash:/etc/postfix/vmailbox
virtual_uid_maps = static:501
virtual_gid_maps = static:501

virtual_mailbox_base, virtual_uid_maps and virtual_gid_maps should contain the home directory, user id and group id of vmail respectively.

2. Create the file /etc/postfix/vmailbox containing the mapping from an email address to a mailbox path relative to virtual_mailbox_base. See the example below.

johndoe@acme.local johndoe/Maildir/
janedoe@acme.local janedoe/Maildir/

3. Type in the command below to generate the static db that will be used for the lookup.

postmap /etc/postfix/vmailbox

4. Restart the Postfix or MailScanner service if you have installed MailScanner. Learn how to start and stop services here.

5. Try sending an email. See Test Postfix using Telnet. New mails should now be stored under the path specified in virtual_mailbox_base.

Configure Dovecot Virtual User Accounts

1. Edit the file /etc/dovecot.conf and change the value of the following keys below

passdb static {
  args = /etc/dovecot-passdb
}

userdb static {
  args = uid=501 gid=501 home=/home/vmail/%u
}

uid, gid and home should contain the user id, group id and home directory respectively of the vmail user account.

Make sure comment out all the other passdb and userdb sections to avoid any conflicts.

2. Create the file /etc/dovecot-passdb containing the password of a user name. See the example below.

johndoe:{PLAIN}secret
janedoe:{HMAC-MD5}dd59f669267e9bb13d42a1ba57c972c5b13a4b2ae457c9ada803dc7d8bae4ab

You can generate a hash password using the dovecotpw command.

3. Restart the dovecot service. Learn how to start and stop services here.

4. Test Dovecot using Telnet. You should be able to read the recently sent mail which was stored in a new location.

Postfix

1. Edit the file /etc/postfix/main.cf and add the lines below.

smtp_tls_security_level = may
smtpd_tls_security_level = may
smtpd_tls_cert_file = /etc/pki/tls/certs/mail.acme.local.cert
smtpd_tls_key_file = /etc/pki/tls/private/mail.acme.local.key
tls_random_source = dev:/dev/urandom

Make sure smtpd_tls_cert_file and smtpd_tls_key_file refers to your own certificate and key file respectively.

2. Restart the Postfix or MailScanner service if you have installed it. Learn how to start and stop services here.

3. Test Postfix using Telnet and check if 250-STARTTLS is present after the ehlo host command.

Dovecot

1. Edit the file /etc/dovecot.conf and add the lines below.

ssl_cert_file = /etc/pki/tls/certs/mail.acme.local.cert
ssl_key_file = /etc/pki/tls/private/mail.acme.local.key

Make sure ssl_cert_file and ssl_key_file refers to your own certificate and key file respectively.

2. Restart the dovecot service. Learn how to start and stop services here.

Thanks to the new SASL support in Dovecot 1.0 and the new Dovecot SASL support in Postfix 2.3, setting up SMTP authentication is now easier. Instead of setting up two separate authentication for Postfix and Dovecot, we can now just setup the authentication in Dovecot and just let Postfix talk to Dovecot.

Configure Postfix and Dovecot

1. Edit the file /etc/dovecot.conf and make sure your auth default section has the lines below.

auth default {	
  socket listen {
    client {
	  path = /var/spool/postfix/private/auth
	  mode = 0660
	  user = postfix
	  group = postfix
    }
  }	
  mechanisms = plain login
}

If you are using Ubuntu, edit /etc/dovecot/dovecot.conf.

2. Edit /etc/postfix/main.cf, find the keys below and change its values as follows or add it at the bottom of the file if the key (the word before the = sign) cannot be found.

mynetworks = 127.0.0.0/8
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_recipient_restrictions =  permit_mynetworks, 
    permit_sasl_authenticated, reject_unauth_destination
broken_sasl_auth_clients = yes

3. Restart the Dovecot and Postfix service. But if you installed MailScanner, restart MailScanner instead of Postfix.

Test Postfix

In a Terminal window, type in the highlighted commands below.

Sample postfix session

[root@mail ~]# telnet mail smtp

Replace mail with the name of your server. We should not use localhost since localhost is a trusted client ip address. And make sure the domain name you specified does not resolve to 127.0.0.1 which is the IP address of localhost.

Trying 192.168.0.1...
Connected to mail.acme.local (192.168.0.1).
Escape character is '^]'.
220 mail.acme.local ESMTP Postfix
ehlo localhost
250-mail.acme.local
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-AUTH LOGIN PLAIN
250-AUTH=LOGIN PLAIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN

Note the new 250-AUTH lines. See the old SMTP Telnet Test.

mail from:<johndoe>
250 2.1.0 Ok
rcpt to:<test@example.com>
554 5.7.1 <test@example.com>: Relay access denied

It works, now to check if we can send it after authenticating.

auth plain AGpvaG5kb2UAcGFzc3dvcmQ=
235 2.0.0 Authentication successful
rcpt to:<test@example.com>
250 2.1.5 Ok
quit
221 2.0.0 Bye
Connection closed by foreign host.
[root@mail ~]#

You can send to email addresses belonging to your domain without authentication. This is normal as it enables you to receive mail from the outside.

The gibberish text after AUTH PLAIN is the base64 encoded value of the user name johndoe and password password. You can generate your own base64 text using the form below.

If you encounter any problems, check the log file at /var/log/maillog (mail.log in Ubuntu).

Setup and Configure Kerberos

The steps below describes how to configure Kerberos using the GUI tool. You can apply the changes manually by editing the file /etc/krb5.conf.

The Kerberos network authentication protocol requires the clocks of the involved machines to be synchronized or at least the difference is less than 5 minutes.

1. Click System, select Administration and click Authentication. This will launch the Authentication Configuration window.

2. Click the Authentication tab and check the Enable Kerberos Support. Next, click the Configure Kerberos button.

3. In the Kerberos Settings window, fill in the Realm, clear out KDC and Admin Servers and check the Use DNS to locate KDCs for realms. Realm is usually your domain name capitalized, capitalization is important. KDC is your Active Directory server. Click Ok when you’re done.

To make sure that your KDC can be automatically located, type in the command host -t any _kerberos._tcp.acme.local in a terminal window. Replace acme.local with your own realm. If it replies “_kerberos._tcp.acme.local has SRV record …” then it works. This is how the Windows workstation is able to find the domain controller during domain logon. If it does not work, something is wrong with your DNS setting. You could either fix your DNS settings or manually fill in the KDC field above. You can specify more than one KDC by separating each server with a comma or space.

4. Uncheck the Enable Kerberos Support and click Ok. We don’t actually want to use Kerberos authentication in Linux, we just want the tool to setup Kerberos for us.

5. Test Kerberos by typing in kinit username in a terminal window. If you need help in making sense of the kinit error messages, check out Test the Kerberos Authentication.

Configuring Dovecot PAM

1. Edit the file /etc/pam.d/dovecot and replace the content with the lines below.

auth        sufficient   pam_krb5.so no_user_check validate
account     sufficient   pam_permit.so

2. Edit the file /etc/dovecot.conf and change the value of the following keys below

passdb pam {
}

userdb static {
  args = uid=501 gid=501 home=/home/vmail/%Lu
}

uid, gid and home should contain the user id, group id and home directory respectively of the vmail user account.

3. Restart the dovecot service. Learn how to start and stop services here.

4. You should now be able to login using the user names found in your Active Directory server. See Test Dovecot using Telnet and try using Active Directory user names instead of the system user names.

If you encounter any problems, check the log file at /var/log/maillog.

This is what a typical Active Directory layout looks like.

And here’s a sample OpenLDAP layout. See OpenLDAP Setup Howto for a guide in setting up OpenLDAP. Or better yet, use the 389 Directory Server.

I used JXplorer to browse the LDAP servers, you’ll need the Java Runtime Environment to use it.

We will be using the following attributes

• samaccountname or uid – User Name for Active Directory or OpenLDAP respectively.
• mail – Email Address. For Active Directory users, you need to fill-up the E-mail field of the User.
• othermailbox – For Active Directory only. We will use this field to store email aliases. Use ADSI Edit to update this field.

Create the Virtual Mail User Account

Since the Active Directory/OpenLDAP user names are not part of the Linux system, we will have to create a user that will be the owner for all the files belonging to the LDAP user names.

1. Create a new user, we will call it vmail. Change the Login Shell to /sbin/nologin, this user account should not be used for logging in. Learn how to use the User Manager application here.

2. Take note of the User ID and Home Directory of vmail.

3. Click the Groups tab and now note down the Group ID of vmail. We’ll be needing all of them later.

Postfix Active Directory/LDAP Integration

1. Create the file /etc/postfix/ldap-users.cf containing the lines below

server_host = your ldap server
search_base = your search base
version = 3
query_filter = (&(objectclass=person)(mail=%s))
result_attribute = samaccountname
result_format = %s/Maildir/

If you are connecting to an Active Directory server and would like to have email alias capability, change the query filter to (&(objectclass=person)(|(mail=%s)(othermailbox=%s))) to include the othermailbox field in the search.

Change samaccountname to uid if you will be connecting to an OpenLDAP server. If your server requires authentication, add the lines below

bind = yes
bind_dn = cn=mailuser,dc=acme,dc=local
bind_pw = password

Replace the value of bind_dn and bind_pw with a valid user account and password respectively. If you will be connecting to an Active Directory server, bind_dn can also be

bind_dn = acme\mailuser

or

bind_dn = mailuser@acme.local

2. Test your postfix configuration file by typing in the command

postmap -q bugsbunny@acme.local ldap:/etc/postfix/ldap-users.cf

in a terminal window. Replace bugsbunny@acme.local with a valid email address from your server. It should return the path to a mailbox file.

If you are querying a Windows 2003 Server and postmap does not seem to work, try enabling the Windows 2003 Active Directory anonymous ldap operations.

3. Edit the postfix configuration file /etc/postfix/main.cf and edit the line below

mydestination = $myhostname, localhost.$mydomain, localhost

and add the lines below

virtual_mailbox_domains = $mydomain
virtual_mailbox_base = /home/vmail/
virtual_mailbox_maps = ldap:/etc/postfix/ldap-users.cf
virtual_uid_maps = static:501
virtual_gid_maps = static:501

virtual_mailbox_base, virtual_uid_maps and virtual_gid_maps should contain the home directory, user id and group id of vmail respectively.

Make sure $mydomain in mydestination has been removed, otherwise the lookup will not work and you will get a “User unknown in local recipient table” error.

4. Restart the Postfix or MailScanner service if you have installed it. Learn how to start and stop services here.

5. You should now be able to send email to addresses found in your LDAP server. See Test Postfix using Telnet and try using LDAP email addresses instead of the system user names.

Dovecot Active Directory/LDAP Integration

If you will be connecting to an Active Directory server, use Active Directory and Dovecot PAM Authentication which uses Kerberos authentication instead. The Kerberos authentication method is more reliable since it doesn’t require a persistent connection and you can gain fail-over capabilities if you have multiple Active Directory servers.

1. Create a file containing the lines below using the filename specified below.

RHEL/CentOS Version	Filename
5	/etc/dovecot-ldap.conf
6	/etc/dovecot/dovecot-ldap.conf

hosts = your ldap server
base = your search base
ldap_version = 3
auth_bind = yes

Depending on the LDAP server and the layout you are going query, you have 3 ways to enable Dovecot to authenticate to your LDAP server.

Option 1: Active Directory
Replace acme with your own domain name. Works only with Microsoft’s Active Directory.

auth_bind_userdn = acme\%u

Option 2: Distinguished Name Template
Change the sample value to one that is appropriate for your layout.

auth_bind_userdn = uid=%u,ou=people,dc=acme,dc=local

Option 3: Search Filter
This should work with any layout but requires an additional search operation to find the correct distinguished name. Change the sample value to one that is appropriate for your layout.

pass_filter = (&(objectclass=person)(uid=%u))

2. For RHEL/CentOS 5, edit the file /etc/dovecot.conf and change the value of the following keys below

auth_username_format = %Lu

passdb ldap {
  args = /etc/dovecot-ldap.conf
}

userdb static {
  args = uid=501 gid=501 home=/home/vmail/%u
}

For RHEL/CentOS 6, edit the file /etc/dovecot/conf.d/10-auth.conf and add the lines below

auth_username_format = %Lu

passdb {
  driver = ldap
  args = /etc/dovecot/dovecot-ldap.conf
}

userdb {
  driver = static
  args = uid=501 gid=501 home=/home/vmail/%u
}

uid, gid and home should contain the user id, group id and home directory respectively of the vmail user account.

Comment out all the other passdb and userdb sections or include lines except for those specified above to ensure that nothing will conflict with our LDAP virtual accounts.

3. Restart the dovecot service. Learn how to start and stop services here.

4. You should now be able to login using the user names found in your LDAP server. See Test Dovecot using Telnet and try using LDAP user names instead of the system user names.

If you encounter any problems, check the log file at /var/log/maillog.

Related Pages

How to use the Active Directory Distribution Group in Postfix.

Install Dovecot

1. If you did not add dovecot during the CentOS installation, you can add it now using Package Manager.

Configure Dovecot

1. Click Applications, select System Tools then click File Browser. This will launch the File Browser window.

2. In the Location field, type in /etc and press Enter. If you don’t see the Location field, click the notepad button to toggle to text-based location bar.

3. Double click on the file dovecot.conf to open it for editing. We need to change a few key items.

protocols = pop3 pop3s imap imaps
mail_location = maildir:~/Maildir/
pop3_uidl_format = %08Xu%08Xv
imap_client_workarounds = delay-newmail outlook-idle netscape-eoh
pop3_client_workarounds = outlook-no-nuls oe-ns-eoh

For 64-bit users: Add the line login_process_size = 64 in the file /etc/dovecot.conf.

Lines starting with # are comments. The last two line enables workarounds for various client bugs. Save the file after completing your changes.

4. Start the dovecot service. Learn how to start and stop services here.

Test Dovecot

1. Click Applications, select Accessories, and click Terminal. This will launch the Terminal window.

2. In the Terminal window, type in the highlighted commands below.

Sample dovecot session. Replace johndoe and password with any valid user name and password.

[root@mail ~]# telnet localhost pop3
+OK dovecot ready.
user johndoe
+OK
pass password
+OK Logged in.
list
+OK 1 messages:
1 622
.
retr 1
+OK 622 octets
Return-Path: <johndoe@mail.acme.local>
X-Original-To: johndoe
Delivered-To: johndoe@mail.acme.local
Received: from localhost.localdomain (localhost.localdomain [127.0.0.1])
        by mail.acme.local (Postfix) with SMTP id 9729067C17
        for <johndoe>; Thu, 22 Feb 2007 09:06:37 -0500 (EST)
Message-Id: <20070222140640.9729067C17@mail.acme.local>
Date: Thu, 22 Feb 2007 09:06:37 -0500 (EST)
From: johndoe@mail.acme.local
To: undisclosed-recipients:;
X-IMAPbase: 1172153557 1
Status: O
X-UID: 1
Content-Length: 5
X-Keywords:


test
.
quit
+OK Logging out.
Connection closed by foreign host.
[root@mail ~]#

If you encounter any problems, check the log file at /var/log/maillog.