Re: Authenticated Email (TLS?)

[Matthias Scheler <tron%zhadum.org.uk@localhost>]

On Sun, Nov 06, 2011 at 07:26:33AM -0800, Paul Goyette wrote:
> >>  I think that all I need is to get the mail/dovecot package
> >
> >You should really use the "mail/dovecot2" package.
> 
> Yes, I have installed dovecot2.0.13nb2 from pkgsrc

Good.

> >> installed and running (plus some changes to postfix
> >configuration), > but the instructions are rather lengthy and
> >intimidating.
> >
> >Which instructions did you look at? The instructions in the
> >Dovecot Wiki are IMHO quite simple:
> >
> >http://wiki2.dovecot.org/HowTo/PostfixAndDovecotSASL
> 
> I was reading the /usr/share/examples/postfix/SASL_README

That's a bit too generic.

> The above WiKi is certainly helpful for getting postfix set up, but
> I guess I need more help just getting dovecot itself configured and
> running.  I'll see if I can navigate the Dovecot Wiki ...

No, that page explains pretty much everything. Here is the full
"dovecot.conf" that I'm using:

        auth_mechanisms = cram-md5 digest-md5 plain login
        listen = *, [::]
        #mail_debug = yes
        mail_location = mbox:~/Mail:INBOX=/var/mail/%u
        passdb {
          args = /etc/pkg/dovecot/passwd
          driver = passwd-file
        }
        pop3_uidl_format = %08Xv%08Xu
        protocols = imap pop3
        service auth {
          unix_listener /var/spool/postfix/private/auth {
            group = postfix
            mode = 0660
            user = postfix
          }
        }
        ssl = yes
        ssl_cert = </etc/openssl/certs/dovecot.pem
        ssl_key = </etc/openssl/private/dovecot.pem
        userdb {
          driver = passwd
        }

This is good enough to get SMTP auth, POP3(S) and IMAP(S) working.
I use a separate password file which is necessary for challenge
response authentication method like CRAM-MD5. It also has the
advantage that I can have accounts with a valid shell (for pipe
mailer usage) which still cannot login via SSH as the account
is locked in "master.passwd".

        Kind regards

-- 
Matthias Scheler                                  http://zhadum.org.uk/