|
1 ================== |
|
2 System Preparation |
|
3 ================== |
|
4 .. _doveauth: |
|
5 |
|
6 We have to create a system user, named `doveauth`. |
|
7 The `doveauth` user will execute Dovecot's authentication processes. |
|
8 |
|
9 We will also create an additional system group, named `dovemail`. |
|
10 The GID of the group `dovemail` will be the supplementary GID for all |
|
11 mail related Dovecot processes, e.g. the `dict` service for quota limits. |
|
12 |
|
13 And finally we will create the ``base_directory``, with it's subdirectories. |
|
14 It is the location for all domain directories and the virtual user's home |
|
15 directories. |
|
16 |
|
17 The example below shows the steps executed on a Debian GNU/Linux system. |
|
18 |
|
19 .. code-block:: console |
|
20 |
|
21 root@host:~# adduser --system --home /nonexistent --no-create-home --group \ |
|
22 > --disabled-login --gecos "Dovecot IMAP/POP3 authentication user" doveauth |
|
23 root@host:~# addgroup --system dovemail |
|
24 root@host:~# mkdir /srv/mail |
|
25 root@host:~# cd /srv/mail |
|
26 root@host:/srv/mail# mkdir 0 1 2 3 4 5 6 7 8 9 a b c d e f g h i j k l m n o p q r s t u v w x y z |
|
27 root@host:/srv/mail# chmod 771 /srv/mail |
|
28 root@host:/srv/mail# chmod 751 /srv/mail/* |
|
29 |
|
30 .. _root-setuid-copy-of-deliver: |
|
31 |
|
32 root SETUID copy of deliver |
|
33 --------------------------- |
|
34 .. note:: This step is only necessary if you are still using Dovecot v\ **1**.x |
|
35 |
|
36 For security reasons the permissions in the domain/user directories will |
|
37 be very restricted. |
|
38 Each user will get its own unique UID_ and the GID_ from the domain. |
|
39 So it will be only possible for a user of the domain to access the domain |
|
40 directory (read only) and the user will get granted read write access only |
|
41 for its home directory. |
|
42 |
|
43 For this reason it is necessary to provide a setuid_-root copy of Dovecot's |
|
44 LDA_ (:command:`deliver`) for Postfix. |
|
45 Because Postfix will refuse to execute commands with root privileges, or |
|
46 with the privileges of the mail system owner (normally `postfix`) you should |
|
47 `nobody` let do the job. |
|
48 Therefore the permissions will be set very restrictive again. |
|
49 Only `nobody` will be able to execute the setuid-root copy of |
|
50 :command:`deliver`. |
|
51 |
|
52 .. code-block:: console |
|
53 |
|
54 root@host:~# mkdir -p /usr/local/lib/dovecot |
|
55 root@host:~# chmod 700 /usr/local/lib/dovecot |
|
56 root@host:~# chown nobody /usr/local/lib/dovecot |
|
57 root@host:~# cp /usr/lib/dovecot/deliver /usr/local/lib/dovecot/ |
|
58 root@host:~# chown root:`id -g nobody` /usr/local/lib/dovecot/deliver |
|
59 root@host:~# chmod u+s,o-rwx /usr/local/lib/dovecot/deliver |
|
60 |
|
61 .. include:: ../ext_references.rst |