This document describes how to set up the “Dovecot” Imap server.

Debian: 8.5 (Jessie)
dovecot-imapd: 1:2.2.13-12~deb8u1

The Internet Message Access Protocol (IMAP) is an Internet standard protocol used by e-mail clients to retrieve e-mail messages from a mail server over a TCP/IP connection. IMAP is defined by RFC 3501. ¹⁾

Dovecot-imapd ²⁾ is a secure IMAP server that supports mbox, maildir, dbox and mdbox mailboxes.

# apt-get install dovecot-imapd

Dovecot allows for unencrypted imap sessions on localhost only. So in most cases we have to setup SSL encryption.

Procedure:

• Generate a Certificate
• Enable SSL
• Restart dovecot

To create a self-signed certificate the Debian dovecot-imapd package is shipped with a shell script “mkcert.sh” and a template configuration file “dovecot-openssl.cnf”.

# cp /usr/share/dovecot/mkcert.sh /etc/dovecot
# cp /usr/share/dovecot/dovecot-openssl.cnf /etc/dovecot

• The CN must match the mailserver domain!

dovecot-openssl.cnf:

..
[ req_distinguished_name ]
organizationName = Dovecot mail server
#
# commonName (CN) must match mailserver domain!
#
organizationalUnitName = your_mail_serverdomain
commonName = your_mail_serverdomain
emailAddress = postmaster@your_mailserver_domain
..

In the “mkcert.sh” script the certificate lifetime is hardcoded as “-days 365”.
Optionally this can be altered in a longer lifetime e.g. 10 years:

/etc/dovecot/mkcert.sh

..
$OPENSSL req -new -x509 -nodes -config $OPENSSLCONFIG -out $CERTFILE -keyout $KEYFILE -days 3650 || exit 2
..

# cd /etc/dovecot

# ./mkcert.sh

Generating a 2048 bit RSA private key
................................+++
................................................+++
writing new private key to '/etc/dovecot/private/dovecot.pem'
-----

subject= /O=Dovecot mail server/OU=your_mail_serverdomain/CN=your_mail_serverdomain/emailAddress=postmaster@your_mail_serverdomain
SHA1 Fingerprint=FA:E0:EC:57:53:29:D0:DF:D5:F1:FB:05:03:B1:13:05:CD:34:6A:C5

Make sure that the key file isn't world readable:

# chmod 600 /etc/dovecot/private/dovecot.pem

# ls -l /etc/dovecot/private/
total 4
-rw------- 1 root root 1704 Jan  6 17:00 dovecot.pem

/etc/dovecot/conf.d/10-ssl.conf:

• ssl = yes
• ssl_cert = </etc/dovecot/dovecot.pem
• ssl_key = </etc/dovecot/private/dovecot.pem

# SSL/TLS support: yes, no, required. <doc/wiki/SSL.txt>
#
# ssl = no
ssl = yes

# PEM encoded X.509 SSL/TLS certificate and private key. They're opened before
# dropping root privileges, so keep the key file unreadable by anyone but
# root. Included doc/mkcert.sh can be used to easily generate self-signed
# certificate, just make sure to update the domains in dovecot-openssl.cnf
#
# Uncomment ssl_cert, ssl_key!!
ssl_cert = </etc/dovecot/dovecot.pem
ssl_key = </etc/dovecot/private/dovecot.pem
..

# /etc/init.d/dovecot restart

Copyright © 2018 Tux4u.be
Author: Marjan Waldorp; dovecot-imapd 2018-01-07