openship 0.4.4 → 0.4.6

package/dist/server/engine/samples/dovecot/dovecot-2.4-openldap.conf

@@ -0,0 +1,767 @@
+dovecot_config_version = 2.4.0
+dovecot_storage_version = 2.4.0
+
+#
+# Default limits
+#
+default_client_limit = 4096
+default_process_limit = 500
+
+# Limit the process's address space. When the space is reached, some memory
+# allocations may start failing with "Out of memory", or the kernel may kill
+# the process with signal 9. This setting is mainly intended to prevent memory
+# leaks from eating up all of the memory, but there can be also legitimate
+# reasons why the process reaches this limit. For example a huge mailbox may
+# not be accessed if this limit is too low.
+# The default value (18446744073709551615 = 2^64-1) sets the limit to
+# `default_vsz_limit`, while 0 disables the limit entirely.
+default_vsz_limit = unlimited
+
+# Listen addresses.
+#   - '*' means all available IPv4 addresses.
+#   - '[::]' means all available IPv6 addresses.
+# Listen on all available addresses by default
+listen = * [::]
+
+# Enabled mail protocols.
+protocols = pop3 imap sieve lmtp
+
+# Plugins
+mail_plugins {
+    acl = yes
+    mail_log = yes
+    notify = yes
+    quota = yes
+    quota_clone = yes
+}
+
+# Required by OpenBSD
+#base_dir = PH_BASE_DIR
+
+# User/group who owns the message files:
+mail_uid = PH_MAIL_UID
+mail_gid = PH_MAIL_GID
+
+# Assign uid to virtual users.
+first_valid_uid = PH_FIRST_VALID_UID
+last_valid_uid = PH_LAST_VALID_UID
+
+# Debug
+# Enables logging all failed authentication attempts.
+#auth_verbose = yes
+
+# Enables all authentication debug logging. Passwords are logged as `<hidden>`.
+#log_debug = category=auth
+
+# Removes password hiding.
+#auth_debug_passwords = yes
+
+# If authentication fails, this setting logs the used password.
+# If you don't really need to know what the password itself was, but are more
+# interested in knowing if the user is simply trying to use the wrong password
+# every single time or if it's a brute force attack, you can set this to sha1
+# and only the SHA1 of the password is logged. That's enough to know if the
+# password is same or different between login attempts.
+#auth_verbose_passwords = no
+#auth_verbose_passwords = plain
+#auth_verbose_passwords = sha1
+
+# Enables all kinds of mail related debug logging, such as showing where
+# Dovecot is looking for mails.
+#log_debug = category=mail
+
+# Enables logging SSL errors and warnings.
+# Even without this setting if connection is closed because of an SSL error,
+# the error is logged as the disconnection reason.
+#verbose_ssl = category=ssl
+
+#log_debug = category=fts
+#log_debug = category=ldap
+
+# logging
+log_path = syslog
+syslog_facility = PH_IREDMAIL_SYSLOG_FACILITY
+
+# Login log elements.
+# Add '%k' for detailed SSL protocol and cipher information.
+# e.g. "TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)"
+#login_log_format_elements = user=<%{user}> method=%m rip=%r lip=%l %c %k
+
+# Mail delivery log format
+#deliver_log_format = from=%{from}, envelope_sender=%{from_envelope}, subject=%{subject}, msgid=%m, size=%{size}, delivery_time=%{delivery_time}ms, %$
+
+# Authentication mechanisms.
+auth_mechanisms = PLAIN LOGIN
+
+# Authentication related settings.
+# Append this domain name if client gives empty realm.
+#auth_default_domain = PH_AUTH_DEFAULT_REALM
+
+auth_allow_cleartext = no
+
+# IP addresses/ranges specified by login_trusted_networks setting are assumed
+# to be secure.
+login_trusted_networks =
+
+# Mailbox format and path.
+mail_driver = %{userdb:mail_driver | default("maildir") | lower}
+mail_path = %{userdb:mail_path | default("~/Maildir")}
+
+# The maximum number of IMAP connections allowed for a user from each IP address.
+# Maximum number of IMAP connections allowed for a user from each IP address.
+# NOTE: The username is compared case-sensitively.
+# Default is 10.
+mail_max_userip_connections = 30
+
+
+# SSL: Global settings.
+# Refer to wiki site for per protocol, ip, server name SSL settings:
+# http://wiki2.dovecot.org/SSL/DovecotConfiguration
+ssl = required
+
+ssl_min_protocol = TLSv1.2
+# log_debug = category=ssl
+
+ssl_server_cert_file = PH_SSL_CERT
+ssl_server_key_file = PH_SSL_KEY
+ssl_server_dh_file = PH_SSL_DH1024_PARAM_FILE
+ssl_server_prefer_ciphers = server
+ssl_cipher_list = PH_SSL_CIPHERS
+
+# Master user.
+# Master users are able to log in as other users. It's also possible to
+# directly log in as any user using a master password, although this isn't
+# recommended.
+# Reference: http://wiki2.dovecot.org/Authentication/MasterUsers
+auth_master_user_separator = *
+
+passdb passwd-file {
+    master = yes
+    passwd_file_path = /etc/dovecot/dovecot-master-users
+    result_success = continue
+}
+
+# `mailbox_list_index = yes` can help a lot by replying to IMAP STATUS (and
+# similar) lookups from a single index without having to open each mailbox
+# index separately.
+# This is the default in v2.3+.
+mailbox_list_index = yes
+
+# Assume that the list index is up-to-date.
+mailbox_list_index_very_dirty_syncs = yes
+
+# Maximum IMAP command line length. Some clients generate very long command
+# lines with huge mailboxes, so you may need to raise this if you get
+# "Too long argument" or "IMAP command line too large" errors often.
+# Defaults to 64k.
+imap_max_line_length = 2m
+
+sql_driver = mysql
+
+mysql PH_SQL_SERVER_ADDRESS {
+    port = PH_SQL_SERVER_PORT
+    dbname = PH_IREDADMIN_DB_NAME
+    user = PH_IREDADMIN_DB_USER
+    password = PH_IREDADMIN_DB_PASSWD
+}
+
+
+dict_server {
+    dict quota_clone {
+        driver = sql
+
+        dict_map priv/quota/messages {
+            sql_table = used_quota
+            username_field = username
+            value_field messages {
+            }
+        }
+
+        dict_map priv/quota/storage {
+            sql_table = used_quota
+            username_field = username
+            value_field bytes {
+            }
+        }
+    }
+
+    dict acl {
+        driver = sql
+
+        dict_map shared/shared-boxes/user/$to/$from {
+            sql_table = share_folder
+            value_field dummy {
+            }
+
+            key_field from_user {
+                value = $from
+            }
+            key_field to_user {
+                value = $to
+            }
+        }
+
+        dict_map shared/shared-boxes/anyone/$from {
+            sql_table = anyone_shares
+            value_field dummy {
+            }
+
+            key_field from_user {
+                value = $from
+            }
+        }
+    }
+
+    dict lastlogin {
+        driver = sql
+
+        dict_map shared/last-login/imap/$user/$domain {
+            sql_table = last_login
+            value_field imap {
+                type = uint
+            }
+
+            key_field username {
+                value = $user
+            }
+
+            key_field domain {
+                value = $domain
+            }
+        }
+
+        dict_map shared/last-login/pop3/$user/$domain {
+            sql_table = last_login
+            value_field pop3 {
+                type = uint
+            }
+
+            key_field username {
+                value = $user
+            }
+
+            key_field domain {
+                value = $domain
+            }
+        }
+
+        dict_map shared/last-login/lda/$user/$domain {
+            sql_table = last_login
+            value_field lda {
+                type = uint
+            }
+
+            key_field username {
+                value = $user
+            }
+
+            key_field domain {
+                value = $domain
+            }
+        }
+
+        # Treat lmtp as lda
+        dict_map shared/last-login/lmtp/$user/$domain {
+            sql_table = last_login
+            value_field lda {
+                type = uint
+            }
+
+            key_field username {
+                value = $user
+            }
+
+            key_field domain {
+                value = $domain
+            }
+        }
+    }
+    
+}
+
+#
+# Virtual mail accounts.
+#
+
+ldap_uris = ldap://PH_LDAP_SERVER_HOST:PH_LDAP_SERVER_PORT
+ldap_version = 3
+ldap_debug_level = 0
+ldap_deref = never
+ldap_base = PH_LDAP_BASEDN
+ldap_scope = subtree
+ldap_starttls = no
+ldap_auth_dn = PH_LDAP_BINDDN
+ldap_auth_dn_password = PH_LDAP_BINDPW
+
+userdb ldap {
+    iterate_filter = (&(objectClass=mailUser)(accountStatus=active)(!(domainStatus=disabled))(enabledService=mail))
+    iterate_fields {
+        user = %{ldap:mail | lower}
+    }
+
+    filter = (&(objectClass=mailUser)(accountStatus=active)(!(domainStatus=disabled))(enabledService=mail)(enabledService=%{protocol}%{secured | lower})(|(mail=%{user})(&(enabledService=shadowaddress)(shadowAddress=%{user}))))
+    fields {
+        master_user=%{ldap:mail | lower}
+        user=%{ldap:mail | lower }
+        home=%{ldap:homeDirectory | lower }
+        mail_driver=%{ldap:mailboxFormat | default('maildir') | lower}
+        mail_path=~/%{ldap:mailboxFolder | default('Maildir')}
+        quota_storage_size = %{ldap:mailQuota | default(0) }B
+    }
+}
+
+passdb ldap {
+    filter = (&(objectClass=mailUser)(accountStatus=active)(!(domainStatus=disabled))(enabledService=mail)(enabledService=%{protocol}%{secured | lower})(|(mail=%{user})(&(enabledService=shadowaddress)(shadowAddress=%{user}))))
+    fields {
+        user=%{ldap:mail | lower}
+        password=%{ldap:userPassword | default('') }
+        # Allow login from all IP addresses by default.
+        allow_nets=%{ldap:allowNets | default('0.0.0.0/0,::/0')}
+    }
+}
+
+#
+# Namespaces
+#
+namespace inbox {
+    type = private
+    separator = /
+    prefix =
+    inbox = yes
+
+    # Sent
+    mailbox Sent {
+        auto = subscribe
+        special_use = \Sent
+    }
+    mailbox "Sent Messages" {
+        auto = no
+        special_use = \Sent
+    }
+    mailbox "Sent Items" {
+        auto = no
+        special_use = \Sent
+    }
+
+    mailbox Drafts {
+        auto = subscribe
+        special_use = \Drafts
+    }
+
+    # Trash
+    mailbox Trash {
+        auto = subscribe
+        special_use = \Trash
+    }
+
+    mailbox "Deleted Messages" {
+        auto = no
+        special_use = \Trash
+    }
+
+    # Junk
+    mailbox Junk {
+        auto = subscribe
+        special_use = \Junk
+        fts_autoindex = no
+    }
+
+    mailbox Spam {
+        auto = no
+        special_use = \Junk
+        fts_autoindex = no
+    }
+
+    mailbox "Junk E-mail" {
+        auto = no
+        special_use = \Junk
+        fts_autoindex = no
+    }
+}
+
+namespace shared {
+    type = shared
+    separator = /
+    prefix = Shared/$user/
+    mail_driver = maildir
+    mail_path = %{owner_home}/Maildir
+    mail_index_private_path = ~/Maildir/shared/%{owner_user}
+    # not share the index files between users
+    mail_index_path = ~/Maildir/shared/%{owner_user}
+
+    # this namespace should handle its own subscriptions or not.
+    subscriptions = yes
+    list = children
+}
+
+# Public mailboxes.
+# https://doc.dovecot.org/2.4.1/core/config/shared_mailboxes.html#public-shared-mailboxes
+#namespace {
+#    type = public
+#    separator = /
+#    prefix = Public/
+#    mail_driver = maildir
+#    mail_path = /var/vmail/public
+#    subscriptions = no
+#
+#    # Per-user \Seen Flag
+#    mail_index_private_path = ~/Maildir/public
+#}
+
+#
+# Protocols
+#
+# Store METADATA information within user's Maildir directory
+mail_attribute {
+    dict file {
+        path = ~/dovecot-attributes
+    }
+}
+
+# Avoid spending excessive time waiting for the quota calculation to finish
+# when mails' vsizes aren't already cached. If this many mails are opened,
+# finish the quota calculation on background in indexer-worker process. Mail
+# deliveries will be assumed to succeed, and explicit quota lookups will
+# return internal error.
+protocol !indexer-worker {
+    mail_vsize_bg_after_count = 100
+}
+
+protocol imap {
+    mail_plugins {
+        imap_quota = yes
+        imap_acl = yes
+
+        # This will only enable support for administrator scripts.
+        imap_sieve = yes
+        last_login = yes
+    }
+
+    imap_client_workarounds = tb-extra-mailbox-sep
+    imap_metadata = yes
+}
+
+protocol pop3 {
+    mail_plugins {
+        last_login = yes
+    }
+    
+    pop3_client_workarounds = outlook-no-nuls oe-ns-eoh
+    pop3_uidl_format = %{uid | hex(8)}%{uidvalidity | hex(8)}
+
+    # POP3 logout format string:
+    #  %i - total number of bytes read from client
+    #  %o - total number of bytes sent to client
+    #  %t - number of TOP commands
+    #  %p - number of bytes sent to client as a result of TOP command
+    #  %r - number of RETR commands
+    #  %b - number of bytes sent to client as a result of RETR command
+    #  %d - number of deleted messages
+    #  %m - number of messages (before deletion)
+    #  %s - mailbox size in bytes (before deletion)
+    # Default format doesn't have 'in=%i, out=%o'.
+    #pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s, in=%i, out=%o
+}
+
+protocol lda {
+    mail_plugins {
+        sieve = yes
+        last_login = yes
+    }
+
+    lda_mailbox_autocreate = yes
+    lda_mailbox_autosubscribe = yes
+}
+
+protocol lmtp {
+    mail_plugins {
+        sieve = yes
+        last_login = yes
+    }
+
+    # Address extension delivery
+    lmtp_save_to_detail_mailbox = yes
+    recipient_delimiter = +
+}
+
+#
+# Services
+#
+# FYI: https://wiki2.dovecot.org/Authentication/Penalty
+# Dovecot anvil process tracks authentication penalties for different IPs to
+# slow down brute force login attempts.
+service anvil {
+    # there can be only one master process.
+    #process_limit = 1
+
+    unix_listener anvil-auth-penalty {
+        user = PH_SYS_USER_VMAIL
+        group = PH_SYS_GROUP_VMAIL
+        # Set mode to 0 to completely disable penalty.
+        mode = 0660
+    }
+}
+
+service auth {
+    # should be large enough to handle all the simultaneous connections.
+    # Typically only login processes use long lasting auth connections, while
+    # other processes do only quick lookups and disconnect afterwards.
+    #client_limit = 4096
+
+    # there can be only one auth master process
+    #process_limit = 1
+
+    # Auth socket
+    unix_listener PH_POSTFIX_CHROOT_DIR/private/dovecot-auth {
+        user = PH_SYS_USER_VMAIL
+        group = PH_SYS_GROUP_VMAIL
+        mode = 0666
+    }
+
+    unix_listener auth-master {
+        user = PH_SYS_USER_VMAIL
+        group = PH_SYS_GROUP_VMAIL
+        mode = 0666
+    }
+
+    unix_listener auth-userdb {
+        user = PH_SYS_USER_VMAIL
+        group = PH_SYS_GROUP_VMAIL
+        mode = 0660
+    }
+}
+
+service dict {
+    unix_listener dict {
+        user = PH_SYS_USER_VMAIL
+        group = PH_SYS_GROUP_VMAIL
+        mode = 0660
+    }
+}
+
+# Login processes. Refer to Dovecot wiki for more details:
+# http://wiki2.dovecot.org/LoginProcess
+service imap-login {
+    # Maximum number of simultaneous client connections per process. Once this
+    # number of connections is received, the next incoming connection will
+    # prompt Dovecot to spawn another process.
+    # If set to 0, default_client_limit is used instead.
+    #client_limit = 0
+
+    # vsz_limit should be fine at its default 64MB value
+    #vsz_limit = 64M
+    inet_listener imap {
+        name = imap
+        port = 143
+    }
+
+    inet_listener imaps {
+        name = imaps
+        port = 993
+        ssl = yes
+    }
+}
+
+service imap {
+    #process_limit = 4096
+
+    # required by imap-hibernate
+    unix_listener imap-master {
+        user = PH_SYS_USER_VMAIL
+        group = PH_SYS_GROUP_VMAIL
+        mode = 0666
+    }
+}
+
+service pop3 {
+    #process_limit = 4096
+}
+
+# LMTP server (Local Mail Transfer Protocol).
+# Reference: http://wiki2.dovecot.org/LMTP
+service lmtp {
+    user = PH_SYS_USER_VMAIL
+
+    # For higher volume sites, it may be desirable to increase the number of
+    # active listener processes. A range of 5 to 20 is probably good for most
+    # sites.
+    process_min_avail = 5
+
+    # Logging.
+    # Require 'log_path =' in 'protocol lmtp {}' block.
+    executable = lmtp -L
+
+    # Listening on socket file and TCP
+    unix_listener PH_POSTFIX_CHROOT_DIR/private/dovecot-lmtp {
+        user = PH_SYS_USER_VMAIL
+        group = PH_SYS_GROUP_VMAIL
+        mode = 0666
+    }
+
+    inet_listener lmtp {
+        listen = PH_LMTP_BIND_ADDRESS
+        port = PH_LMTP_BIND_PORT
+    }
+}
+
+service managesieve-login {
+    inet_listener sieve {
+        listen = 127.0.0.1
+        port = 4190
+    }
+}
+
+service pop3-login {
+    #client_limit = 0
+    #process_limit = 0
+    #process_min_avail =
+
+    inet_listener pop3 {
+        name = pop3
+        port = 110
+    }
+
+    inet_listener pop3s {
+        name = pop3s
+        port = 995
+        ssl = yes
+    }
+}
+
+service quota-warning {
+    executable = script /usr/local/bin/dovecot-quota-warning.sh
+    user = PH_SYS_USER_VMAIL
+
+    unix_listener quota-warning {
+        user = PH_SYS_USER_VMAIL
+        group = PH_SYS_GROUP_VMAIL
+        mode = 0660
+    }
+}
+
+quota_status_success = DUNNO
+quota_status_nouser = DUNNO
+quota_status_overquota = "552 5.2.2 Mailbox is full"
+service quota-status {
+    executable = quota-status -p postfix
+    inet_listener quota-status {
+        listen = 127.0.0.1
+        port = 12340
+    }
+    client_limit = 1
+}
+
+# quota plugin: count
+# `count` driver doesn't have any additional parameters.
+quota "User quota" {
+}
+# Allows message deliveries to exceed quota once by this amount.
+# After the quota is already over the limit, the grace no longer applies.
+quota_storage_grace = 30M
+
+# Quota warning.
+# Configure the highest limits first.
+quota user {
+  warning warn-95 {
+    quota_storage_percentage = 95
+    execute quota-warning {
+      args = 95 %{user}
+    }
+  }
+  warning warn-90 {
+    quota_storage_percentage = 90
+    execute quota-warning {
+      args = 90 %{user}
+    }
+  }
+  warning warn-85 {
+    quota_storage_percentage = 85
+    execute quota-warning {
+      args = 85 %{user}
+    }
+  }
+  warning warn-under {
+    quota_storage_percentage = 100
+    # user is no longer over quota
+    threshold = under
+    execute quota-warning {
+      args = below %{user}
+    }
+  }
+}
+
+# plugin: quota_clone.
+quota_clone {
+    dict proxy {
+        name = quota_clone
+    }
+}
+
+# The maximum number of redirect actions that can be performed during a single
+# script execution.
+sieve_max_redirects = 30
+
+# Use recipient as vacation message sender instead of null sender (<>).
+sieve_vacation_send_from_recipient = yes
+
+# Specifies what envelope sender address is used for redirected messages.
+# Requires pigeonhole v0.4.4+.
+#
+# Normally, the Sieve "redirect" command copies the sender address for the
+# redirected message from the processed message. So, the redirected message
+# appears to originate from the original sender.
+sieve_redirect_envelope_from = recipient
+
+sieve_duplicate_default_period = 1h
+sieve_duplicate_max_period = 1d
+
+sieve_script global {
+    type = global
+    driver = file
+    path = PH_SIEVE_DIR
+}
+
+sieve_script before {
+    type = before
+    driver = file
+    path = PH_GLOBAL_SIEVE_FILE
+}
+
+sieve_script personal {
+    type = personal
+    driver = file
+    path = ~/sieve/dovecot.sieve
+}
+
+
+# plugin: mail_log
+# https://doc.dovecot.org/main/core/plugins/mail_log.html
+mail_log_events = delete undelete expunge copy save mailbox_create mailbox_delete mailbox_rename
+mail_log_fields = uid box msgid size from subject flags
+#mail_log_cached_only = yes
+
+# plugin: acl
+# https://doc.dovecot.org/main/core/plugins/imap_acl.html
+# ACL and share folder
+acl_driver = vfile
+acl_globals_only = no
+
+acl_sharing_map {
+    dict proxy {
+        name = acl
+    }
+}
+
+# By default Dovecot doesn't allow using the IMAP "anyone" or
+# "authenticated" identifier, because it would be an easy way to spam
+# other users in the system. If you wish to allow it,
+#imap_acl_allow_anyone = no
+
+# plugin: last-login.
+# https://doc.dovecot.org/main/core/plugins/last_login.html
+last_login {
+    dict proxy {
+        name = lastlogin
+    }
+    key = last-login/%{service}/%{user}/%{user | domain}
+}