[Dovecot] Issues with SIS and Backups - was Re: v2.1.0 status

[Timo Sirainen]

On 12.2.2012, at 15.43, Charles Marcus wrote:

> One thing that concerns me right now about my main clients site that I will soon be migrating from courier-imap to dovecot is the message/thread a while back about the problems with SIS and backups.

I'm planning on creating a new "backup" mail storage backend, where you could basically run:

doveadm backup -u user at domain backup:

And it would output the user's messages to stdout (or to some file). So it would be similar to e.g. PostgreSQL's pg_dump. Then for restoring you can use the same input for "doveadm import". So in the backups there would be no deduplication, unless implemented by the backup software.

> I am trying to decide between using dovecot's SIS, or using mimedefang's ability to replace attachments with hyperlinks to them (storing them on a webserver - still not clear on exactly how it works or the security implications of doing so). It looks like using mimedefang would eliminate the problem with backups, and would provide the added benefit of eliminating large file attachments for external recipients as well, however I'm concerned about security - ie, how do you limit access to these attachments to only the recipients of the message with the hyperlink in it?

As long as the URL is random enough it shouldn't be possible to guess the links. But if they're HTML mails and such then hyperlinks would send the referrer-url to the next site. I guess you could also add HTTP authentication.