Login

オンライン中

We have 6 guests and no members online

eagle1jp

POP,IMAPサーバ(dovecot)の構築

POP・IMAPサーバ(dovecot)の構築

1.dovecotの特徴

Postfixやqmailといった比較的新しいMailサーバでは、メールの保存形式としてMaildirという方式で保存できるようになっています。 Maildir形式はそれまでのmbox形式に比べ

  • 届いたメールをユーザのホームディレクトリに保存させる
  • メールは1件毎に1つのファイルで管理される。
  • ファイルの保存時にロックの必要が無い

といった特徴があります。 特にメール1件に対しファイルが1つ、かつロックが不要という特性から、ユーザのホームディレクトリがNFSなどでマウントされたネットワード上のドライブに対してマウントされているような場合であっても、不整合を起こすことなくメールの保存が可能になっています。
また、mbox形式ではすべてのメールデータがただ1つのファイルに保存されるため、保存データが肥大するとメールの読み取りが遅くなったり、何らかの不整合が発生するとすべてのメールが読めなくなるという危険性がありますが、Maildirではそういう心配は不要になります。 反面、mboxにしか対応できないsendmailは古くから利用されてきたこともあり、sendmailの動作を期待するようなプログラムも多く存在するので悩むところですが、POPやIMAPといったMRA(Mail Retrieval Agent)に関しては「courier-imap、courier-pop」やここで紹介する「dovecot」を利用することで簡単にサービスの提供が可能になっています。
dovecot は比較的新しいMRAで最近になって多くのLinuxディスリビューションでも標準で組み込まれるようになってきており、特徴として

  • 高速
  • IMAPの標準互換テストにパス
  • 高いセキュリティ
  • mbox、Maildirのどちらの形式でもOK

といった事が挙げられます。

2.dovecotのインストール

 (Debian(Ubuntu)でのパッケージのインストール方法)

 次のコマンドを実行します。

$ sudo apt-get install dovecot-common dovecot-imapd dovecot-pop3d

 

 (Redhat(CentOS)でのパッケージのインストール方法)

 次のコマンドを実行します。(スーパーユーザ権限で実行します)

# yum install dovecot

3.dovecotの設定

インストールができたなら、利用する環境に合わせた設定を行います。
以下では次のようなシナリオで設定を行うこととします。

設定内容
パラメータ
提供するサーバサービスをPOPとIMAPにするprotocols = imap pop3
プレーンテキストでのパスワードを許可するdisable_plaintext_auth =no
ログファイルを記録する
log_path = /var/log/dovecot.log
ログのタイムスタンプ形式をyy-mm-dd HH:MM:SS形式にする
log_timestamp = "%Y-%m-%d %H:%M:%S "
メールデータの保存形式をMaildirとする。
mail_location = maildir:~/Maildir

 

dovecotのメインの設定ファイルは /etc/dovecot/dovecot.conf になりますので、このファイルを編集していきます。

/etc/dovecot/dovecot.conf

protocols = imap pop3
disable_plaintext_auth = no
log_path = /var/log/dovecot.log
log_timestamp = "%Y-%m-%d %H:%M:%S "
mail_location = maildir:~/Maildir
mail_privileged_group = mail

##
## IMAP specific settings
##
protocol imap {
    #login_executable = /usr/lib/dovecot/imap-login
    #mail_executable = /usr/lib/dovecot/imap
    #imap_max_line_length = 65536
    #mail_max_userip_connections = 10
    #mail_plugins =
    #mail_plugin_dir = /usr/lib/dovecot/modules/imap
    #login_greeting_capability = no
    #imap_logout_format = bytes=%i/%o
    #imap_capability =
    #imap_client_workarounds =
}

##
## POP3 specific settings
##
protocol pop3 {
    #login_executable = /usr/lib/dovecot/pop3-login
    #mail_executable = /usr/lib/dovecot/pop3
    #pop3_no_flag_updates = no
    #pop3_enable_last = no
    #pop3_reuse_xuidl = no
    #pop3_lock_session = no
    pop3_uidl_format = %08Xu%08Xv
    #pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s
    #mail_max_userip_connections = 3
    #mail_plugins =
    #mail_plugin_dir = /usr/lib/dovecot/modules/pop3
    #pop3_client_workarounds =
}

protocol managesieve {
  #login_executable = /usr/libexec/dovecot/managesieve-login
  #mail_executable = /usr/libexec/dovecot/managesieve
  #managesieve_max_line_length = 65536
  sieve=~/.dovecot.sieve
  sieve_storage=~/sieve
  # mail_location = mbox:~/mail
  #managesieve_implementation_string = Cyrus timsieved v2.2.13

}
#protocol lda {
  #postmaster_address = This e-mail address is being protected from spambots. You need JavaScript enabled to view it.
  #hostname =
  #mail_plugins =
  #mail_plugin_dir = /usr/lib/dovecot/modules/lda
  #quota_full_tempfail = no
  #deliver_log_format = msgid=%m: %$
  #sendmail_path = /usr/lib/sendmail
  #rejection_reason = Your message to was automatically rejected:%n%r
  #auth_socket_path = /var/run/dovecot/auth-master
#}

# Executable location
#auth_executable = /usr/lib/dovecot/dovecot-auth

# Set max. process size in megabytes.
#auth_process_size = 256
#auth_cache_size = 0
#auth_cache_ttl = 3600
#auth_cache_negative_ttl = 3600

#auth_realms =
#auth_default_realm =
#auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@
#auth_username_translation =

#auth_username_format =

#auth_master_user_separator =
#auth_anonymous_username = anonymous
#auth_verbose = no
#auth_debug = no

#auth_debug_passwords = no

#auth_worker_max_count = 30
#auth_worker_max_request_count = 0
#auth_gssapi_hostname =
#auth_krb5_keytab =
#auth_ntlm_use_winbind = no
#auth_winbind_helper_path = /usr/bin/ntlm_auth

#auth_failure_delay = 2

auth default {
  mechanisms = login plain
  #passdb passwd-file {
    # File contains a list of usernames, one per line
    #args = /etc/dovecot.deny
    #deny = yes
  #}

  passdb pam {
    # Some examples:
    #   args = session=yes %Ls
    #   args = cache_key=%u dovecot
    #args = dovecot
  }

  # System users (NSS, /etc/passwd, or similiar)
  # In many systems nowadays this uses Name Service Switch, which is
  # configured in /etc/nsswitch.conf.
  #passdb passwd {
    # [blocking=yes] - See userdb passwd for explanation
    #args =
  #}
  # Shadow passwords for system users (NSS, /etc/shadow or similiar).
  # Deprecated by PAM nowadays.
  #
  #passdb shadow {
    # [blocking=yes] - See userdb passwd for explanation
    #args =
  #}

  # PAM-like authentication for OpenBSD.
  #
  #passdb bsdauth {
    # [cache_key=] - See cache_key in PAM for explanation.
    #args =
  #}

  # passwd-like file with specified location
  #
  #passdb passwd-file {
    # [scheme=] [username_format=]
    #
    #args =
  #}
  # checkpassword executable authentication
  # NOTE: You will probably want to use "userdb prefetch" with this.
  #
  #passdb checkpassword {
    # Path for checkpassword binary
    #args =
  #}

  # SQL database
  #passdb sql {
    # Path for SQL configuration file
    #args = /etc/dovecot/dovecot-sql.conf
  #}

  # LDAP database
  #passdb ldap {
    # Path for LDAP configuration file
    #args = /etc/dovecot/dovecot-ldap.conf
  #}

  # vpopmail authentication
  #passdb vpopmail {
    # [cache_key=] - See cache_key in PAM for explanation.
    # [quota_template=] - %q expands to Maildir++ quota
    #   (eg. quota_template=quota_rule=*:backend=%q)
    #args =
  #}

  #
  # User database specifies where mails are located and what user/group IDs
  # own them. For single-UID configuration use "static".
  #
  #
  #

  # System users (NSS, /etc/passwd, or similiar). In many systems nowadays this
  # uses Name Service Switch, which is configured in /etc/nsswitch.conf.
  #
  userdb passwd {
    # [blocking=yes] - By default the lookups are done in the main dovecot-auth
    # process. This setting causes the lookups to be done in auth worker
    # proceses. Useful with remote NSS lookups that may block.
    # NOTE: Be sure to use this setting with nss_ldap or users might get
    # logged in as each others!
    #args =
  }

  # passwd-like file with specified location
  #
  #userdb passwd-file {
    # [username_format=]
    #args =
  #}
  # static settings generated from template
  #userdb static {
    # Template for the fields. Can return anything a userdb could normally
    # return. For example:
    #
    #  args = uid=500 gid=500 home=/var/mail/%u
    #
    # If you use deliver, it needs to look up users only from the userdb. This
    # of course doesn't work with static because there is no list of users.
    # Normally static userdb handles this by doing a passdb lookup. This works
    # with most passdbs, with PAM being the most notable exception. If you do
    # the user verification another way, you can add allow_all_users=yes to
    # the args in which case the passdb lookup is skipped.
    #
    #args =
  #}
  # SQL database
  #userdb sql {
    # Path for SQL configuration file
    #args = /etc/dovecot/dovecot-sql.conf
  #}

  # LDAP database
  #userdb ldap {
    # Path for LDAP configuration file
    #args = /etc/dovecot/dovecot-ldap.conf
  #}

  # vpopmail
  #userdb vpopmail {
  #}

  # "prefetch" user database means that the passdb already provided the
  # needed information and there's no need to do a separate userdb lookup.
  # This can be made to work with SQL and LDAP databases, see their example
  # configuration files for more information how to do it.
  #
  #userdb prefetch {
  #}
  # User to use for the process. This user needs access to only user and
  # password databases, nothing else. Only shadow and pam authentication
  # requires roots, so use something else if possible. Note that passwd
  # authentication with BSDs internally accesses shadow files, which also
  # requires roots. Note that this user is NOT used to access mails.
  # That user is specified by userdb above.
  user = root

  # Directory where to chroot the process. Most authentication backends don't
  # work if this is set, and there's no point chrooting if auth_user is root.
  # Note that valid_chroot_dirs isn't needed to use this setting.
  #chroot =

  # Number of authentication processes to create
  #count = 1

  # Require a valid SSL client certificate or the authentication fails.
  #ssl_require_client_cert = no

  # Take the username from client's SSL certificate, using
  # X509_NAME_get_text_by_NID() which returns the subject's DN's
  # CommonName.
  #ssl_username_from_cert = no

  # It's possible to export the authentication interface to other programs:
  #socket listen {
    #master {
      # Master socket provides access to userdb information. It's typically
      # used to give Dovecot's local delivery agent access to userdb so it
      # can find mailbox locations.
      #path = /var/run/dovecot/auth-master
      #mode = 0600
      # Default user/group is the one who started dovecot-auth (root)
      #user =
      #group =
    #}
    #client {
      # The client socket is generally safe to export to everyone. Typical use
      # is to export it to your SMTP server so it can do SMTP AUTH lookups
      # using it.
      #path = /var/run/dovecot/auth-client
      #mode = 0660
    #}
  #}
}
#auth external {
#  socket connect {
#    master {
#      path = /var/run/dovecot/auth-master
#    }
#  }
#}
dict {
  #quota = mysql:/etc/dovecot-dict-quota.conf
}

# Path to Berkeley DB's configuration file. See doc/dovecot-db-example.conf
#dict_db_config =

plugin {
  # Quota limits are set using "quota_rule" parameters, either in here or in
  # userdb. It's also possible to give mailbox-specific limits, for example:
  #   quota_rule = *:storage=1048576
  #   quota_rule2 = Trash:storage=102400
  # User has now 1GB quota, but when saving to Trash mailbox the user gets
  # additional 100MB.
  #
  # Multiple quota roots are also possible, for example:
  #   quota = dict:user::proxy::quota
  #   quota2 = dict:domain:%d:proxy::quota_domain
  #   quota_rule = *:storage=102400
  #   quota2_rule = *:storage=1048576
  # Gives each user their own 100MB quota and one shared 1GB quota within
  # the domain.
  #
  # You can execute a given command when user exceeds a specified quota limit.
  # Each quota root has separate limits. Only the command for the first
  # exceeded limit is excecuted, so put the highest limit first.
  # Note that % needs to be escaped as %%, otherwise "% " expands to empty.
  #   quota_warning = storage=95%% /usr/local/bin/quota-warning.sh 95
  #   quota_warning2 = storage=80%% /usr/local/bin/quota-warning.sh 80
  #quota = maildir

  # ACL plugin. vfile backend reads ACLs from "dovecot-acl" file from maildir
  # directory. You can also optionally give a global ACL directory path where
  # ACLs are applied to all users' mailboxes. The global ACL directory contains
  # one file for each mailbox, eg. INBOX or sub.mailbox. cache_secs parameter
  # specifies how many seconds to wait between stat()ing dovecot-acl file
  # to see if it changed.
  #acl = vfile:/etc/dovecot-acls:cache_secs=300

  # Convert plugin. If set, specifies the source storage path which is
  # converted to destination storage (mail_location) when the user logs in.
  # The existing mail directory is renamed to

-converted.
  #convert_mail = mbox:%h/mail
  # Skip mailboxes which we can't open successfully instead of aborting.
  #convert_skip_broken_mailboxes = no
  # Skip directories beginning with '.'
  #convert_skip_dotdirs = no
  # If source storage has mailbox names with destination storage's hierarchy
  # separators, replace them with this character.
  #convert_alt_hierarchy_char = _

  # Trash plugin. When saving a message would make user go over quota, this
  # plugin automatically deletes the oldest mails from configured mailboxes
  # until the message can be saved within quota limits. The configuration file
  # is a text file where each line is in format:
  # Mails are first deleted in lowest -> highest priority number order
  #trash = /etc/dovecot-trash.conf

  # Expire plugin. Mails are expunged from mailboxes after being there the
  # configurable time. The first expiration date for each mailbox is stored in
  # a dictionary so it can be quickly determined which mailboxes contain
  # expired mails. The actual expunging is done in a nightly cronjob, which
  # you must set up:
  #   dovecot --exec-mail ext /usr/lib/dovecot/expire-tool
  #expire = Trash 7 Spam 30
  #expire_dict = db:/var/lib/dovecot/expire.db

  # Lazy expunge plugin. Currently works only with maildirs. When a user
  # expunges mails, the mails are moved to a mailbox in another namespace
  # (1st). When a mailbox is deleted, the mailbox is moved to another namespace
  # (2nd) as well. Also if the deleted mailbox had any expunged messages,
  # they're moved to a 3rd namespace. The mails won't be counted in quota,
  # and they're not deleted automatically (use a cronjob or something).
  #lazy_expunge = .EXPUNGED/ .DELETED/ .DELETED/.EXPUNGED/

  # Events to log. Default is all.
  #mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename
  # Group events within a transaction to one line.
  #mail_log_group_events =
  # Available fields: uid, box, msgid, size, vsize
  # size and vsize are available only for expunge and copy events.
  #mail_log_fields = uid box msgid size
}

 

 

dovecot は最低限上記の項目を設定すれば利用できる筈です。

 

4.システム起動時にdevcotを自動起動させる

 (Debian(Ubuntu)での場合)

 debianでは、パッケージでインストールした段階で自動起動する設定になっているので、特になにもする必要はありません。

 

 (Redhat(CentOS)での場合)

 次のコマンドを実行します。(スーパーユーザ権限で実行します)

# chkconfig dovecot on 

 

dovecotのTLS(SSL)化】に続く

 

 

セキュリティ情報

JVN サイト新着ならびに更新情報

広告