Servers 101: Emailify your server - Part 3 (Setting up dovecot)
In the previous part of "Emailify your server", we configured our SMTP (aka outgoing) server (postfix)! In this part, we will take care of our POP3/IMAP (aka incoming) server (dovecot)
Other stuff in the Server 101 series:
- Intro and getting into your server - Single Article
- Basic Server Security - 3 Parts
- Setting up a Web Server - 4 Parts
- Managing Your Server - 4 Parts
- caddy - Lightweight Web Server - 1 Part
Now it's time to configure dovecot. Because this post will get extra long, all long code snippets longer will be hosted on pastebin, and the links will redirect you to the raw file. For now, we will skip the SSL configuration. We will do it on the next post, along with Apache & Webmail.
Copy all the configuration files!
As in the previous part, we need root access for all the post commands. sudo su and enter your password!
First, we have to copy all the configuration files, as a backup. It's nice to have the original file, in case something goes wrong!
cp /etc/dovecot/dovecot.conf /etc/dovecot/dovecot.conf.bak
cp /etc/dovecot/conf.d/10-mail.conf /etc/dovecot/conf.d/10-mail.conf.bak
cp /etc/dovecot/conf.d/10-auth.conf /etc/dovecot/conf.d/10-auth.conf.bak
cp /etc/dovecot/dovecot-sql.conf.ext /etc/dovecot/dovecot-sql.conf.ext.bak
cp /etc/dovecot/conf.d/10-master.conf /etc/dovecot/conf.d/10-master.conf.bak
cp /etc/dovecot/conf.d/10-ssl.conf /etc/dovecot/conf.d/10-ssl.conf.bak
Editing the dovecot.conf file.
We have to do a few changes to the main config file. nano /etc/dovecot/dovecot.conf
You have to make dovecot.conf look like this: https://pastebin.com/iirXW2jL
You can either do a comparison by eye and change anything that's not the same with your own file, or you can clear the file and copy/paste the text in the above link inside it
Save and exit!
Editing the 10-mail.conf file
This file tells Dovecot where to search and store email messages. We need to change 2 variables inside it. The file is really long, and you can use nano's search functionality to make it quicker.
This is the first variable we have to change is mail_location. The one you want to change, does not have hashtags (#) in front of it. This is how you want the line to look like:
mail_location = maildir:/var/mail/vhosts/%d/%n
The second is mail_privileged_group. Change it to look like this:
mail_privileged_group = mail
Save and exit!
Create vhosts directory and domain subdirectories!
Now we have to make the directories for all domains we have configured in our database! We will use the "-p" switch of mkdir, which will create every parent directory that doesn't already exist.
mkdir -p /var/mail/vhosts/example.com
mkdir -p /var/mail/vhosts/example.net
mkdir -p /var/mail/vhosts/example.org
These are the domains I used in my example database. Obviously, you'll have to change them to your own. The generic syntax is this: mkdir -p /var/mail/vhosts/DOMAIN.NAME.
All emails will be saved in these directories, each on its subfolder depending on the used domain name.
Virtual Mail user
We need to create a user who will be responsible for reading/writing email files from dovecot to the disk, and this user's group:
groupadd -g 5000 vmail
useradd -g vmail -u 5000 vmail -d /var/mail
Both the user and the group name is "vmail". We have to give the ownership of the folder to vmail:
chown -R vmail:vmail /var/mail
Also, change the permissions to 775. We want everyone to be able to read the email folders and their contents, but only user vmail and group vmail should be able to write.
chmod -R 775 /var/mail/
If you got overwhelmed, take a break and continue after the break. We have a long road ahead!
Editing 10-auth.conf
We will now take some time to edit the authentication methods file!
The final file should look like this (pastebin link), so you can use this directly instead of doing things one by one.
nano /etc/dovecot/conf.d/10-auth.conf
First, we will disable the plaintext authentication. Locate the line starting with disable_plaintext_auth and make it look like this:
disable_plaintext_auth = yes
Next step, locate the line auth_mechanisms and change it to this:
auth_mechanisms = plain login
After that, locate !include auth-system.conf.ext and comment it out. Add a hashtag (#) infront of it. The result should look like #!include auth-system.conf.ext
Now locate #!include auth-sql.conf.ext line and uncomment it. The result should be !include auth-sql.conf.ext.
Save your changes and exit!
Editing auth-sql.conf.ext
nano /etc/dovecot/conf.d/auth-sql.conf.ext
This step is simple. You should make sure that auth-sql.conf.ext includes the following lines, and they are uncommented:
passdb {
driver = sql
# Path for SQL configuration file, see example-config/dovecot-sql.conf.ext
args = /etc/dovecot/dovecot-sql.conf.ext
}
userdb {
driver = sql
args = /etc/dovecot/dovecot-sql.conf.ext
}
Add your MySQL details to dovecot-sql.conf.ext
As always, here is the final file if you don't want to edit it by hand
Open up and edit this file:
nano /etc/dovecot/dovecot-sql.conf.ext
Locate, uncomment and update the driver = line to look like this:
driver = mysql
Then, locate, uncomment and edit the connect = line, with your MySQL details:
connect = host=127.0.0.1 dbname=mailserver user=mailuser password=changeme
Do the same for the default_pass_scheme = line:
default_pass_scheme = SHA512-CRYPT
And finally for the password_query line:
password_query = SELECT email as user, password FROM virtual_users WHERE email='%u';
Save and exit!
Owner and permission fix
We have to give ownership of /etc/dovecot/ to user vmail and group dovecot, as well as change the permissions:
chown -R vmail:dovecot /etc/dovecot
chmod -R o-rwx /etc/dovecot
Editing 10-master.conf (sockets config file)
This file has a lot of changes. It makes sense to copy/paste everything from here, to this file:
nano /etc/dovecot/conf.d/10-master.conf
I will describe what changes are being done, without writing everything.
If you did it by hand, you will have to change IMAP and POP3 ports to 0, to disable unencrypted connections to dovecot. You would also have to make sure the IMAPs and POP3s (secure) entries are uncommented. You would also make dovecot run as vmail, instead of root.
In the next part we will take care of Apache, we will add a webmail app to our server, and install SSL on Dovecot. This part got a little bit out of hand!
Meme file generated by me in imgflip's meme generator
If you need a place to host your servers consider Vultr, Digital Ocean and BuyVM.
These are affiliate links. If you sign up through them, you support me and I will have more free time to write more content like this.
Also If you signup for Digital Ocean through my affiliate link, you will get $10 to try them out. Note: to battle abusers of this offer, you'll have to make a $5 deposit via Paypal or add your credit/debit card, so they can confirm that you are a new user. I did a deposit via Paypal to test them out, and then I added my credit card so I won't have to deposit money manually every now and then.
