This documentation is for Dovecot v1.x, see wiki2 for v2.x documentation.

Dovecot LDA

The Dovecot LDA, called deliver, is a local delivery agent which takes mail from an MTA and delivers it to a user's mailbox, while keeping Dovecot index files up to date.

This page describes the common settings required to make deliver work. You should read it first, and then the MTA specific pages:

Main features of Dovecot LDA

Common configuration

The configuration is done in the protocol lda section in dovecot.conf. The important settings are:

Note that dovecot.conf file must be world readable to enable deliver process read it, while running with user privileges.

Parameters

Parameters accepted by deliver:

Return values

deliver will exit with one of the following values:

System users

You can use deliver with a few selected system users (ie. user is found from /etc/passwd / NSS) by calling deliver in the user's ~/.forward file: 

| "/usr/local/libexec/dovecot/deliver"

This should work with any MTA which supports per-user .forward files. For qmail's per-user setup, see LDA/Qmail.

This method doesn't require the authentication socket explained below since it's executed as the user itself.

Virtual users

With a lookup

Give the destination username to deliver with -d parameter, for example: 

deliver -f $FROM_ENVELOPE -d $DEST_USERNAME

You'll need to set up a master authentication socket for deliver so it knows where to find mailboxes for the users: 

protocol lda {
..
  # UNIX socket path to master authentication server to find users.
  #auth_socket_path = /var/run/dovecot/auth-master
}
auth default {
..
  socket listen {
    # Note that we're setting a master socket. SMTP AUTH for Postfix and Exim uses client sockets.
    master {
      # Typically under base_dir/, if not the directory must be created.
      path = /var/run/dovecot/auth-master

      # Auth master socket can be used to look up userdb information for
      # given usernames. This probably isn't very sensitive information
      # for most systems, but still try to restrict the socket access if possible.
      mode = 0600
      user = vmail # User running deliver
      #group = mail # Or alternatively mode 0660 + deliver user in this group
    }
  }
..
}

The master socket can be used to do userdb lookups for given usernames. Typically the result will contain the user's UID, GID and home directory, but depending on your configuration it may return other information as well. So the information is similar to what can be found from eg. /etc/passwd for system users. This means that it's probably not a problem to use mode=0666 for the socket, but you should try to restrict it more just to be safe.

Without a lookup

If you have already looked up the user's home directory and you don't need a userdb lookup for any other reason either (such as overriding settings for specific users), you can run deliver similar to how it's run for system users: 

HOME=/path/to/user/homedir deliver -f $FROM_ENVELOPE

This way you don't need to have a master listener socket. Note that you should verify the user's existence prior to running deliver, otherwise you'll end up having mail delivered to non-existing users as well.

You must have set the proper UID (and GID) before running deliver. It's not possible to run deliver as root without -d parameter.

Multiple UIDs

If you're using more than one UID for users, you're going to have problems running deliver, as most MTAs won't let you run deliver as root. There are two ways to work around this problem:

  1. Make deliver setuid-root.
  2. Use sudo to wrap the invocation of deliver.

Making deliver setuid-root:

Beware: it's insecure to make deliver setuid-root, especially if you have untrusted users in your system. Setuid-root deliver can be used to gain root privileges. You should take extra steps to make sure that untrusted users can't run it and potentially gain root privileges. You can do this by making sure only your MTA has execution access to it. For example: 

# chgrp secmail /usr/local/libexec/dovecot/deliver
# chmod 04750 /usr/local/libexec/dovecot/deliver
# ls -l /usr/local/libexec/dovecot/deliver
-rwsr-x--- 1 root secmail 4023932 2009-01-15 16:23 deliver

Then start deliver as a user that belongs to secmail group. Note that you have to recreate these rights after each update of dovecot.

Using sudo:

Alternatively, you can use sudo to wrap the invocation of deliver. This has the advantage that updates will not clobber the setuid bit, but note that it is just as insecure being able to run deliver via sudo as setuid-root. Make sure you only give your MTA the ability to invoke deliver via sudo.

First configure sudo to allow 'dovelda' user to invoke deliver by adding the following to your /etc/sudoers: 

Defaults:dovelda !syslog
dovelda          ALL=NOPASSWD:/usr/local/libexec/dovecot/deliver

Then configure your MTA to invoke deliver as user 'dovelda' and via sudo: 

/usr/bin/sudo /usr/local/libexec/dovecot/deliver

instead of just plain /usr/local/libexec/dovecot/deliver.

Problems with deliver

Logging

If you want deliver to keep using Dovecot's the default log files:

You can also specify different log files for deliver. This way you don't have to give any extra write permissions to other log files or the syslog socket. You can do this by overriding the log_path and info_log_path settings: 

protocol lda {
 ..
  # remember to give proper permissions for these files as well
  log_path = /var/log/dovecot-deliver-errors.log
  info_log_path = /var/log/dovecot-deliver.log
}

For using syslog with deliver, set the paths empty: 

protocol lda {
 ..
  log_path =
  info_log_path =
  # You can also override the default syslog_facility:
  #syslog_facility = mail
}
Dovecot

Plugins

None: LDA (last edited 2012-10-18 13:45:21 by adsl-bb25-l172)