[Dovecot] Shared Mailboxes in a multi domain environment

[Timo Sirainen]

On 17.9.2012, at 10.09, Alessio Cecchi wrote:

> I would like to enable mailbox sharing for my users. I'm using dovecot 2.1.9 with vpopmail authentication. For security reason shared mailboxes should be available only for users of the same domain.
> 
> Dovecot's wiki suggest to enable acl like this:
> 
> plugin {
>  # assumes mailboxes are in /var/mail/%d/%n:
>  acl_shared_dict = file:/var/mail/%d/shared-mailboxes.db
> }
> 
> but in vpopmail, and also in many others configuration, mailboxes are, for example, in /var/mail/nas1/%d, /var/mail/nas2/%d and so on, so it's difficult to restrict shared mailboxes available only for the same domain. A trick could be set acl_shared_dict to /var/mail/%d-shared-mailboxes.db, but I don't know if it's safe on an NFS environment.

As long as all the servers have access to the file it doesn't matter where it is. You could even do something like /var/mail/nas1/shared-dict/%d.db

> So, why don't provide a way to restrict shared mailboxes also for dict in SQL?
> 
> One way could be to add to "user_shares" table a column "domains" which is the same domain of the mailbox'owner and a config option, for acl, like acl_only_for_same_domain =yes/no so dovecot can add a "WHERE %n = domain"  for the SELECT.

If you don't include %d as part of the shared namespace prefix you already restrict the users sharing within same domain, no need for extra SQL WHEREs.