- dovecot - dovecot.org

[Dovecot] Shared mailbox ACL
by Alex Ferrara 29 Jan '14

29 Jan '14

Hi everyone, I am having some trouble with shared folders in trying to replicate how we use them with a Cyrus backend. The auth database is Samba4 active directory, so I am using an LDAP lookup to authenticate and forcing the UID and GID to be all the same. I have a post-login script that sets the group ACL, and this seems to be working fine. /mnt/mail is an NFS mount to a FreeNAS machine, and there is only one Dovecot server connecting to that NFS share. I have been able to get the inbox of the shared mailbox to appear in Thunderbird, but I would like to allow all subfolders to have the same ACLs. Is there a way to do this without having an ACL entry for each folder in the dovecot-acl file? I also cannot seem to create folders under the shared inbox. Thanks. Below is the output of /mnt/mail/acl/shared-mailboxes shared/shared-boxes/group/accounting/accounting 1 shared/shared-boxes/group/team1/team1 1 shared/shared-boxes/group/team2/team2 1 Below is the output of dovecot -n # 2.1.7: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-22-pve x86_64 Debian 7.3 nfs auth_mechanisms = plain login auth_username_format = %n mail_debug = yes mail_location = maildir:/mnt/mail/mailboxes/%n/Maildir:INDEX=/var/local/dovecot-indexes/%n mail_plugins = acl mail_shared_explicit_inbox = no managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace { list = yes location = maildir:/mnt/mail/mailboxes/%%n/Maildir:INDEX=/var/local/dovecot-shared/%%n prefix = ZGroup/%%n/ separator = / subscriptions = no type = shared } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / type = private } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile acl_defaults_from_inbox = yes acl_shared_dict = file:/mnt/mail/acl/shared-mailboxes sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } protocols = " imap lmtp sieve" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-postlogin { executable = script-login /usr/local/bin/postlogin.py user = vmail } service imap { executable = imap imap-postlogin } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } user = vmail } ssl_cert = </etc/dovecot/dovecot.pem ssl_key = </etc/dovecot/private/dovecot.pem userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocol lmtp { mail_plugins = quota sieve } protocol lda { mail_plugins = quota sieve } protocol imap { mail_plugins = acl imap_acl }

2 4

Re: [Dovecot] Architecture for large Dovecot cluster
by Joseph Tam 29 Jan '14

29 Jan '14

>> Just a guess, but I expect the difference is because NetApp de-dupes >> by checksumming blocks and mark whole blocks as duplicates if they >> have the same checksum. > > True, the start of the message is always at byte 0, but because of > different header length per user for the same message (different mail > address with different lengths) the body will never start at the same > byte. Oh yes, that's right. I confused maildir format with sendmail queue files that separates header and body. There is still some similarlity for mass mailouts to the same mail domain: they will have almost identical headers +/- message IDs and a few bytes here and there, but as you say, SiS is the way to go for deduping bulky message attachments. Joseph Tam <jtam.home(a)gmail.com>

1 0

[Dovecot] recipient_delimiter -- feature request
by Andrew Ray 29 Jan '14

29 Jan '14

Hi, It would be nice if the recipient_delimiter configuration option supported multiple recipient delimiters as Postfix now does. e.g. now if I set: recipient_delimiter = +- in Postfix, then test-extension(a)sample.com and test+extension(a)sample.com are both recognized. But if I set: recipient_delimiter = +- in Dovecot, neither of the above are recognized and instead test+-extension(a)sample.com is valid. Well, presently this feature isn't that important to me, but I imagine it could be a source of confusion for people who are migrating from say qmail to postfix (as I am doing) and notice Postfix's cool ability to support both types of delimiters and assume Dovecot will as well (as I did). Thanks, Andrew Ray -- Andrew Ray +1 404-418-5443 +421 (0) 917 832 253 http://guns.freedomlives.net/

2 2

[Dovecot] post-login scripting failing with "denied access to user" v2.1.7
by Frank 29 Jan '14

29 Jan '14

I am trying to have a default sieve rule for new mailboxes that can be edited by users using the round cube sieve plugin. It would actually be better executed when a new user is created but my postfixadmin runs on a separate machine so that's a bit tricky. The "sieve-default =" setting won't quite achieve what I want as I want users to be able to edit the default rule (to adjust SPAM level) Mail works fine before I add my post-login script to 10-master.conf ---------------------- service imap { # tell imap to do post-login lookup using a socket called "imap-postlogin" executable = imap imap-postlogin } service imap-postlogin { # all post-login scripts are executed via script-login binary executable = script-login /etc/dovecot/custom_sieve/postlogin.sh # the script process runs as the user specified here (v2.0.14+): user = mail # also tried $default_internal_user and root # this UNIX socket listener must use the same name as given to imap executable unix_listener imap-postlogin { } } After adding this setting, login fails and gives the error below. It certainly looks like a permission issue, but I have checked my script is executable and owned by vmail:vmail. The bash script executes fine as the mail user. The other possibility is that dovecot is denying access to the $HOME variable, but that seems unlikely. Nevertheless, I am stuck! Log shows: ------------------ dovecot: master: Dovecot v2.1.7 starting up (core dumps disabled) dovecot: auth-worker(17522): mysql(database1): Connected to database postfixadmin dovecot: imap-login: Login: user=<test2(a)fqdn.net>, method=PLAIN, rip=10.0.3.120, lip=10.0.1.180, mpid=17524, TLS, session=<+blqxxxxxxxxxM> dovecot: imap(test2(a)fqdn.net): Post-login script denied access to user test2(a)fqdn.net BASH script: /etc/dovecot/custom_sieve/postlogin.sh -------------------------------------------------- #!/bin/sh if [ ! -f $HOME/dovecot.sieve ] # if file doesn't exist then mkdir -p $HOME/sieve cp /etc/dovecot/custom_sieve/default.sieve $HOME/sieve/managesieve.sieve ln -s $HOME/sieve/managesieve.sieve $HOME/dovecot.sieve fi DEFAULT SIEVE RULE: /etc/dovecot/custom_sieve/default.sieve ----------------------------------- require ["fileinto"]; # rule:[SPAM] if header :contains "X-Spam-Level" "**********" { fileinto "Junk"; } Config ======= # 2.1.7: /etc/dovecot/dovecot.conf # OS: Linux 3.2.0-4-amd64 x86_64 Debian 7.3 ext4 dict { sqldomainquota = mysql:/etc/dovecot/dovecot-sql-domain.conf sqluserquota = mysql:/etc/dovecot/dovecot-dict-sql-user.conf } mail_location = maildir:/home/vmail/%d/%n/Maildir:INDEX=/home/vmail/%d/%n/Maildir/indexes mail_plugins = " quota" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { quota = dict:User Quota::proxy::sqluserquota quota_rule2 = Trash:storage=+100M sieve = ~/../.dovecot.sieve sieve_dir = ~/../sieve } protocols = " imap sieve pop3" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service dict { unix_listener dict { group = vmail mode = 0600 user = vmail } } service imap-postlogin { executable = script-login /var/spool/mail/postlogin.sh user = vmail } service imap { executable = imap imap-postlogin } ssl_cert = </etc/ssl/mailserver/mailserver.pem ssl_key = </etc/ssl/mailserver/private/mailserver_dcp.pem userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lda { mail_plugins = " quota sieve" postmaster_address = hidden(a)fqdn.net } protocol imap { mail_plugins = " quota imap_quota" }

2 2

Re: [Dovecot] Architecture for large Dovecot cluster
by Joseph Tam 28 Jan '14

28 Jan '14

Sven Hartge <sven(a)svenhartge.de> wrote: > Interesting datapoint: NetApp Deduplication did only recover about 1% of > storage space with mdbox-based mail storage, while on an maildir-based > mail storage, the rate was about 15%. (This was tested with a copy of > real user data, so is accurate for my workload.) Just a guess, but I expect the difference is because NetApp de-dupes by checksumming blocks and mark whole blocks as duplicates if they have the same checksum. The message body has the same block offset in maildir (i.e. the start of a message is at byte 0), whereas mdbox might align message body anywhere in a block, so you might have 512 different block configurations for the same message. I don't know whether message alignment would be a worthwhile optimization for mdbox. Joseph Tam <jtam.home(a)gmail.com>

2 1

Re: [Dovecot] Architecture for large Dovecot cluster
by Stan Hoeppner 28 Jan '14

28 Jan '14

This went to me only so bringing back on list. On 1/24/2014 11:09 AM, Tom Johnson wrote: > Is anybody using the Object Storage plugin for large-scale > installations? I've not used it. > We're considering it, but are thinking of an in-house > S3 storage system (riak, or ceph, or ?) Looking to support perhaps > 300k users. I was thinking that if we use a bank of dovecot servers > (with director) with ssds as cache, we might be able to consolidate > all the storage on something like a riak cluster, which would make > scaling simple and inexpensive - certainly much less than a NetApp > solution. Everything costs less than a NetApp...except an EMC. > If anyone has any first-hand experience (or even > off-the-top-of-their-head thoughts), I'd love to hear them) Distributed filesystems give you the advantage of a single filesystem namespace with massive amounts of storage, fairly easy addition of storage space, and distributed replication to allow failure of a storage node without service interruption. Replication mitigates node failure, but not disk failure, so you still need RAID in each node. So you have RAID6 in a node and filesystem block mirroring amongst nodes. Thus storage utilization is -worse- than direct attach, CFS on SAN, or NFS head attached RAID10 and far worse than RAID6 in these 3 setups. And if using large SSD cache you'd surely use RAID6 with DAS, CFS, or NFS. You'd need half as many disk drives vs DFS. Each DFS expansion, assuming the typical model, entails the cost of a server, RAID HBA (unless using md) and disks, not strictly buying disks as with DAS, CFS/SAN, or NFS filer. Then you also need more switch ports, more power connections, greater UPS capacity due to all the CPUs, RAM, etc in the nodes. And you'll have a higher electric bill. So while a distributed filesystem storage architecture may seem less expensive it may not be. And just as one can build a DIY DFS cluster, one can also build a DIY NFS cluster instead of buying a NetApp, saving significant cash on the front end box and on disks since you'd need half as many vs a distributed filesystem architecture, though failure of one node may not be quite as graceful as with a NetApp losing a controller board. -- Stan

3 4

[Dovecot] Replication - what am I doing wrong?
by IT geek 31 27 Jan '14

27 Jan '14

Hi, I'm having issues getting replication working, and I'm not also not having much luck finding help on it. So I'm wondering... am I not asking the right questions? Or am I not providing enough information... or do we just not know how this aspect of the technology works? If it's the former, then any pointers on what questions to ask or information to provide would be very helpful. If the community genuinely doesn't know how this works then that's okay too - I will look at another solution (if one exists) and try to move on. But if I can get this working then that would be amazing as I really like Dovecot and would be gutted to move away from it. -Mark

2 2

[Dovecot] managesieve - point me in the right direction?
by erik 27 Jan '14

27 Jan '14

Hi, I am using Dovecot 2.1.16. I'm trying to get Roundcube to talk to the managesieve plugin. Postfix/Dovecot/Roundcube all exist on the same server. I'd like to get managesieve working. I've gone through a few guides, such as: https://wiki.archlinux.org/index.php/dovecot#Sieve But so far roundcube won't connect to the managesieve plugin. ("Cant reach server"). I see that port 4190 is listening and I can telnet to that port: Connected to localhost. Escape character is '^]'. "IMPLEMENTATION" "Dovecot Pigeonhole" "SIEVE" "fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave" "NOTIFY" "mailto" "SASL" "PLAIN LOGIN" "STARTTLS" "VERSION" "1.0" OK "Dovecot ready." I'm not sure what else to check. Any help appreciated!

2 1

[Dovecot] Panic: file index-mailbox-check.c: line 75 (index_mailbox_check_add): assertion failed: (box->notify_min_interval > 0)
by Kevin Holly 27 Jan '14

27 Jan '14

Hey guys, i have a weird problem i'm trying to fix since 5 months now, but i really couldn't find any explanation, why this happens and how it can be fixed. My client is Thunderbird, my dovecot version is 2.1.7-7 from the official Debian repo. If you want to see my config i'll grab all the fils together and send it to you. This is the error i'm always getting when my client tries to get new mails, which i want to get rid off: http://sprunge.us/NZhf Jan 25 11:49:30 old dovecot: auth-worker(15979): Debug: sql(root(a)hallowe.lt,81.217.212.85): query: SELECT password FROM mailbox WHERE username = 'root(a)hallowe.lt' Jan 25 11:49:30 old dovecot: auth: Debug: client out: OK#0111#011user=root(a)hallowe.lt Jan 25 11:49:30 old dovecot: auth-worker(15979): Debug: sql(root(a)hallowe.lt,81.217.212.85): SELECT CONCAT('maildir:/var/vmail/',maildir) AS mail, 1000 AS uid, 1000 AS gid FROM mailbox WHERE username = 'root(a)hallowe.lt' Jan 25 11:49:30 old dovecot: auth: Debug: master out: USER#0113983671297#011root@hallowe.lt#011mail=maildir:/var/vmail/hallowe.lt/root/#011uid=1000#011gid=1000 Jan 25 11:49:30 old dovecot: imap-login: Login: user=<root(a)hallowe.lt>, method=PLAIN, rip=81.217.212.85, lip=10.111.56.107, mpid=17606, TLS, session=<rQGqOsnwuABR2dRV> Jan 25 11:49:30 old dovecot: imap(root(a)hallowe.lt): Debug: Effective uid=1000, gid=1000, home= Jan 25 11:49:30 old dovecot: imap(root(a)hallowe.lt): Debug: quota: No quota setting - plugin disabled Jan 25 11:49:30 old dovecot: imap(root(a)hallowe.lt): Debug: maildir++: root=/var/vmail/hallowe.lt/root, index=, control=, inbox=/var/vmail/hallowe.lt/root, alt= Jan 25 11:49:30 old dovecot: imap(root(a)hallowe.lt): Panic: file index-mailbox-check.c: line 75 (index_mailbox_check_add): assertion failed: (box->notify_min_interval > 0) Jan 25 11:49:30 old dovecot: imap(root(a)hallowe.lt): Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0x4414a) [0x7f858118714a] -> /usr/lib/dovecot/libdovecot.so.0(+0x4418e) [0x7f858118718e] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f858115e82a] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0x99027) [0x7f858146b027] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0x4ccc9) [0x7f858141ecc9] -> dovecot/imap(cmd_idle+0x66) [0x7f8581907c96] -> dovecot/imap(command_exec+0x3c) [0x7f858190dedc] -> dovecot/imap(+0x11f2e) [0x7f858190cf2e] -> dovecot/imap(+0x11fda) [0x7f858190cfda] -> dovecot/imap(client_handle_input+0x11d) [0x7f858190d23d] -> dovecot/imap(client_input+0x65) [0x7f858190db35] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x36) [0x7f8581194016] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0xa7) [0x7f8581194cc7] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x28) [0x7f8581193a28] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f8581180483] -> dovecot/imap(main+0x297) [0x7f85819053e7] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xfd) [0x7f8580dd7ead] -> dovecot/imap(+0xa561) [0x7f8581905561] Jan 25 11:49:30 old dovecot: imap(root(a)hallowe.lt): Fatal: master: service(imap): child 17606 killed with signal 6 (core dumps disabled) I asked for this in the irc already but got no answer. I would be really happy if someone can help me with this. Thank you very much! Best regards, Kevin Holly - root(a)hallowe.lt - http://hallowe.lt/

2 3

[Dovecot] outlook will not sync
by Eric Broch 27 Jan '14

27 Jan '14

Dovecot users list, I started having problems with Outlook not syncing with Dovecot a public imap folder upon issuing a send/receive in the client; eventually Outlook timed out, and I received the following error in the Dovecot log. Jan 23 09:20:23 imap(user(a)mydom.com): Error: FETCH [] for mailbox projects.myfolder UID 120 got too little data: 7744 vs 7759 Jan 23 09:20:23 imap(user(a)mydom.com): Error: Maildir filename has wrong W value: /home/vpopmail/domains/mydom.com/shared/projects/.myfolder/cur/1384292337.M440452P9788.mail.mydom.com,S=265901,W=269597:2,Sc Jan 23 09:20:23 imap(user(a)mydom.com): Error: Corrupted index cache file /home/vpopmail/domains/mydom.com/shared/projects/.myfolder/dovecot.index.cache: Broken virtual size for mail UID 120 Jan 23 09:20:23 imap(user@mydom): Info: Disconnected: FETCH failed bytes=175/270387 However, I've since removed the file manually, deleted the old folder and recreated it and Outlook will still not sync even in the absence of the above error. Has anyone seen this issue--slow to no Outlook performance with dovecot--before, and/or does anyone have a solution or point me in the right direction? Thanks! Eric I'm using dovecot 2.0.17 with the following configuration # 2.0.17 (684381041dc4+): /etc/dovecot/dovecot.conf # OS: Linux 2.6.18-371.1.2.el5 x86_64 CentOS release 5.10 (Final) auth_anonymous_username = anonymous auth_cache_negative_ttl = 1 hours auth_cache_size = 32 M auth_cache_ttl = 1 hours auth_debug = no auth_debug_passwords = no auth_default_realm = auth_failure_delay = 2 secs auth_first_valid_uid = 500 auth_gssapi_hostname = auth_krb5_keytab = auth_last_valid_uid = 0 auth_master_user_separator = auth_mechanisms = plain login digest-md5 cram-md5 auth_realms = auth_socket_path = auth-userdb auth_ssl_require_client_cert = no auth_ssl_username_from_cert = no auth_use_winbind = no auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@ auth_username_format = %Lu auth_username_translation = auth_verbose = no auth_verbose_passwords = no auth_winbind_helper_path = /usr/bin/ntlm_auth auth_worker_max_count = 30 base_dir = /var/run/dovecot config_cache_size = 1 M debug_log_path = default_client_limit = 1000 default_idle_kill = 60 default_internal_user = dovecot default_login_user = dovenull default_process_limit = 100 default_vsz_limit = 256 M deliver_log_format = msgid=%m: %$ dict_db_config = director_doveadm_port = 0 director_mail_servers = director_servers = director_user_expire = 15 mins disable_plaintext_auth = yes dotlock_use_excl = yes doveadm_allowed_commands = doveadm_password = doveadm_proxy_port = 0 doveadm_socket_path = doveadm-server doveadm_worker_count = 0 first_valid_gid = 1 first_valid_uid = 89 hostname = imap_capability = imap_client_workarounds = imap_id_log = imap_id_send = imap_idle_notify_interval = 2 mins imap_logout_format = bytes=%i/%o imap_max_line_length = 64 k import_environment = TZ info_log_path = last_valid_gid = 0 last_valid_uid = 0 lda_mailbox_autocreate = no lda_mailbox_autosubscribe = no lda_original_recipient_header = libexec_dir = /usr/libexec/dovecot listen = *, :: lmtp_proxy = no lmtp_save_to_detail_mailbox = no lock_method = fcntl log_path = /var/log/dovecot.log log_timestamp = "%b %d %H:%M:%S " login_access_sockets = login_greeting = Dovecot toaster ready. login_log_format = %$: %s login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c login_trusted_networks = mail_access_groups = mail_attachment_dir = mail_attachment_fs = sis posix mail_attachment_hash = %{sha1} mail_attachment_min_size = 128 k mail_cache_fields = flags mail_cache_min_mail_count = 0 mail_chroot = mail_debug = no mail_fsync = optimized mail_full_filesystem_access = no mail_gid = mail_home = mail_location = mail_log_prefix = "%s(%u): " mail_max_keyword_length = 50 mail_max_lock_timeout = 0 mail_max_userip_connections = 20 mail_never_cache_fields = imap.envelope mail_nfs_index = no mail_nfs_storage = no mail_plugin_dir = /usr/lib64/dovecot mail_plugins = mail_privileged_group = mail_save_crlf = no mail_temp_dir = /tmp mail_uid = mailbox_idle_check_interval = 30 secs mailbox_list_index_disable = no maildir_copy_with_hardlinks = yes maildir_stat_dirs = no maildir_very_dirty_syncs = no master_user_separator = mbox_dirty_syncs = yes mbox_dotlock_change_timeout = 2 mins mbox_lazy_writes = yes mbox_lock_timeout = 5 mins mbox_min_index_size = 0 mbox_read_locks = fcntl mbox_very_dirty_syncs = no mbox_write_locks = dotlock fcntl mdbox_preallocate_space = no mdbox_rotate_interval = 0 mdbox_rotate_size = 2 M mmap_disable = no namespace { hidden = no inbox = yes list = yes location = prefix = INBOX. separator = . subscriptions = yes type = private } namespace { hidden = no inbox = no list = yes location = maildir:/home/vpopmail/domains/acemt.com/shared/projects prefix = projects. separator = . subscriptions = yes type = public } passdb { args = cache_key=%u webmail=127.0.0.1 deny = no driver = vpopmail master = no pass = no } plugin { quota = maildir } pop3_client_workarounds = pop3_enable_last = no pop3_fast_size_lookups = no pop3_lock_session = no pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s pop3_no_flag_updates = no pop3_reuse_xuidl = no pop3_save_uidl = no pop3_uidl_format = %08Xu%08Xv postmaster_address = protocols = imap quota_full_tempfail = no recipient_delimiter = + rejection_reason = Your message to <%t> was automatically rejected:%n%r rejection_subject = Rejected: %s sendmail_path = /usr/sbin/sendmail service anvil { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = anvil extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 1 protocol = service_count = 0 type = anvil unix_listener anvil-auth-penalty { group = mode = 0600 user = } unix_listener anvil { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service auth-worker { chroot = client_limit = 1 drop_priv_before_exec = no executable = auth -w extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 1 type = unix_listener auth-worker { group = mode = 0600 user = $default_internal_user } user = vsz_limit = 18446744073709551615 B } service auth { chroot = client_limit = 4096 drop_priv_before_exec = no executable = auth extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener auth-client { group = mode = 0600 user = } unix_listener auth-login { group = mode = 0600 user = $default_internal_user } unix_listener auth-master { group = mode = 0600 user = } unix_listener auth-userdb { group = mode = 0600 user = } unix_listener login/login { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service config { chroot = client_limit = 0 drop_priv_before_exec = no executable = config extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = config unix_listener config { group = mode = 0600 user = } user = vsz_limit = 18446744073709551615 B } service dict { chroot = client_limit = 1 drop_priv_before_exec = no executable = dict extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener dict { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service director { chroot = client_limit = 0 drop_priv_before_exec = no executable = director extra_groups = fifo_listener login/proxy-notify { group = mode = 00 user = } group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener director-admin { group = mode = 0600 user = } unix_listener login/director { group = mode = 00 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service dns_client { chroot = client_limit = 1 drop_priv_before_exec = no executable = dns-client extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener dns-client { group = mode = 0666 user = } unix_listener login/dns-client { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service doveadm { chroot = client_limit = 1 drop_priv_before_exec = no executable = doveadm-server extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 1 type = unix_listener doveadm-server { group = mode = 0600 user = } user = vsz_limit = 18446744073709551615 B } service imap-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = imap-login extra_groups = group = idle_kill = 0 inet_listener imap { address = port = 143 ssl = no } inet_listener imaps { address = port = 993 ssl = yes } privileged_group = process_limit = 0 process_min_avail = 0 protocol = imap service_count = 1 type = login user = $default_login_user vsz_limit = 18446744073709551615 B } service imap { chroot = client_limit = 1 drop_priv_before_exec = no executable = imap extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1024 process_min_avail = 0 protocol = imap service_count = 1 type = unix_listener login/imap { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service ipc { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = ipc extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener ipc { group = mode = 0600 user = } unix_listener login/ipc-proxy { group = mode = 0600 user = $default_login_user } user = $default_internal_user vsz_limit = 18446744073709551615 B } service lmtp { chroot = client_limit = 1 drop_priv_before_exec = no executable = lmtp extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = lmtp service_count = 0 type = unix_listener lmtp { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service log { chroot = client_limit = 0 drop_priv_before_exec = no executable = log extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = log user = vsz_limit = 18446744073709551615 B } service pop3-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = pop3-login extra_groups = group = idle_kill = 0 inet_listener pop3 { address = port = 110 ssl = no } inet_listener pop3s { address = port = 995 ssl = yes } privileged_group = process_limit = 0 process_min_avail = 0 protocol = pop3 service_count = 1 type = login user = $default_login_user vsz_limit = 18446744073709551615 B } service pop3 { chroot = client_limit = 1 drop_priv_before_exec = no executable = pop3 extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1024 process_min_avail = 0 protocol = pop3 service_count = 1 type = unix_listener login/pop3 { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service ssl-params { chroot = client_limit = 0 drop_priv_before_exec = no executable = ssl-params extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = startup unix_listener login/ssl-params { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } shutdown_clients = yes ssl = yes ssl_ca = ssl_cert = </var/qmail/control/servercert.pem ssl_cert_username_field = commonName ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL ssl_client_cert = ssl_client_key = ssl_key = </var/qmail/control/servercert.pem ssl_key_password = ssl_parameters_regenerate = 168 ssl_verify_client_cert = no submission_host = syslog_facility = mail userdb { args = cache_key=%u quota_template=quota_rule=*:backend=%q driver = vpopmail } valid_chroot_dirs = verbose_auth = no verbose_proctitle = no verbose_ssl = no version_ignore = no protocol imap { imap_client_workarounds = delay-newmail }

3 2