==================
System Preparation
==================
.. _doveauth:

We have to create a system user, named `doveauth`.
The `doveauth` user will execute Dovecot's authentication processes.

We will also create an additional system group, named `dovemail`.
The GID of the group `dovemail` will be the supplementary GID for all
mail related Dovecot processes, e.g. the `dict` service for quota limits.

And finally we will create the ``base_directory``, with it's subdirectories.
It is the location for all domain directories and the virtual user's home
directories.

The example below shows the steps executed on a Debian GNU/Linux system.

.. code-block:: console

 root@host:~# adduser --system --home /nonexistent --no-create-home --group \
 > --disabled-login --gecos "Dovecot IMAP/POP3 authentication user" doveauth
 root@host:~# addgroup --system dovemail
 root@host:~# mkdir /srv/mail
 root@host:~# cd /srv/mail
 root@host:/srv/mail# mkdir 0 1 2 3 4 5 6 7 8 9 a b c d e f g h i j k l m n o p q r s t u v w x y z
 root@host:/srv/mail# chmod 771 /srv/mail
 root@host:/srv/mail# chmod 751 /srv/mail/*

.. _root-setuid-copy-of-deliver:

root SETUID copy of deliver
---------------------------
.. note:: This step is only necessary if you are still using Dovecot v\ **1**.x

For security reasons the permissions in the domain/user directories will
be very restricted.
Each user will get its own unique UID_ and the GID_ from the domain.
So it will be only possible for a user of the domain to access the domain
directory (read only) and the user will get granted read write access only
for its home directory.

For this reason it is necessary to provide a setuid_-root copy of Dovecot's
LDA_ (:command:`deliver`) for Postfix.
Because Postfix will refuse to execute commands with root privileges, or
with the privileges of the mail system owner (normally `postfix`) you should
`nobody` let do the job.
Therefore the permissions will be set very restrictive again.
Only `nobody` will be able to execute the setuid-root copy of
:command:`deliver`.

.. code-block:: console

 root@host:~# mkdir -p /usr/local/lib/dovecot
 root@host:~# chmod 700 /usr/local/lib/dovecot
 root@host:~# chown nobody /usr/local/lib/dovecot
 root@host:~# cp /usr/lib/dovecot/deliver /usr/local/lib/dovecot/
 root@host:~# chown root:`id -g nobody` /usr/local/lib/dovecot/deliver
 root@host:~# chmod u+s,o-rwx /usr/local/lib/dovecot/deliver

.. include:: ../ext_references.rst