Cyrus IMAP

[ ] AUTOCREATE    Enable autocreate support
[ ] CLAMAV        Use ClamAV
[x] CLD2          Use CLD2
[x] HTTP          Enable HTTP support
[x] IDLED         Enable IMAP idled support
[x] JMAP          Enable JMAP support
[x] LDAP          Enable LDAP support (experimental)
[ ] MURDER        Enable IMAP Murder support
[x] MYSQL         MySQL database support
[ ] NNTP          Enable NNTP support
[x] PCRE2         Use PCRE2 rather than PCRE
[ ] PGSQL         PostgreSQL database support
[ ] REPLICATION   Enable replication
[x] SQLITE        SQLite database support
[x] SQUAT         Enable Squat support
[x] SRS           Enable Sender Rewriting Scheme support
[x] XAPIAN        Enable Xapian support
[x] DOCS          Build and/or install documentation
(*) GSSAPI_BASE   GSSAPI support via base system (needs Kerberos)
(*) READLINE_GNU  Use Term::Readline::GNU for cyradm

Installation

File system

Four file systems are created to manage the processes, mailboxes, metadata and filters.

The separation of metadata and mailboxes (ie: emails), allows the introduction of compression, for mail, at the file system without impacting performance for metadata access.

Compilation

cd /usr/ports/mail/cyrus-imapd312/ && make install

Configuration

cyrus.conf

It is responsible for managing the various processes needed for the operation of the imap service:

ctl_cyrusdb

Maintenance operations on the database used by cyrus-imap. In particular it handles recovering the data after a crash (option -r) and creating checkpoints (option -c).

imapd

Handles the IMAP protocol. The -s option specifies that SSL is to be used for connections; without it connections are not encrypted, unless the client decides to initiate a switch to TLS.

idled

Handles IDLE mode in IMAP. This allows the client to be told of new messages almost in real time.

sieve

Handles mail filtering. It allows user scripts to be run directly on the server to filter e-mail (choice of folder, deletion, redirection, …).

lmtpunix / lmtp

Message reception. This is the process that handles messages passed on by the mail server, either from a unix socket or from a TCP connection on a dedicated port.

squatter

Indexes mail (headers and bodies) so that IMAP SEARCH commands run faster. Note that indexing can be expensive in time when many mailboxes and messages are present, and that its absence does not stop the system working.

The following configuration is done in the cyrus.conf file and allows the use of IMAP with TLS or SSL connections, to deal with the IDLE mode, to manage sieve scripts, to automatically suppress duplicated messages at reception time, to periodically index messages. Messages being delivered from a unix socket.

START {
  recover	cmd="ctl_cyrusdb -r"
  idled		cmd="idled"
}

SERVICES {
  imap		cmd="imapd"     listen="imap"                  prefork=0
  imaps		cmd="imapd -s"  listen="imaps"                 prefork=0
  sieve		cmd="timsieved" listen="sieve"                 prefork=0
  lmtpunix	cmd="lmtpd"     listen="/var/imap/socket/lmtp" prefork=0
}

EVENTS {
  checkpoint	cmd="ctl_cyrusdb -c"  period=30
  delprune	cmd="cyr_expire -E 3" at=0400
  tlsprune	cmd="tls_prune"       at=0400
  squat         cmd="squatter -i"     at=0100
}

imapd.conf

The configuration file is imapd.conf, despite its name, it manages the configuration for all the different processes involved in cyrus.conf.

Authentication

The authentication mechanism relies on saslauthd, which can query an LDAP directory without requiring the passwords to be stored in clear text in the directory (unlike a configuration using the ldap_* directives). In exchange, the passwords have to be transmitted in clear text (plain or login) between client and server; to avoid the risk of interception, sending them over a network connection that is not encrypted is forbidden (allowplaintext set to no).

# Authentication
#  ! Password verification with SASL pwcheck/saslauthd services
#  ! only support clear text mechanism such as PLAIN or LOGIN.
sasl_pwcheck_method: saslauthd
sasl_mech_list: plain

# Disallow sending password on a connection which is not secured
allowplaintext:      no

Certificates

To allow encryption, the list of certificates to use is specified by the following directives:

# Certificates
#  If a non-global certificate is required, the directive must be prefixed
#  with the service name: imap, pop3, lmtp ...
tls_cert_file:    /etc/cert/wildcard.example.com.crtServer certificate
tls_key_file:     /etc/cert/wildcard.example.com.keyCertificate key
tls_ca_file:      /etc/cert/cachain.pemChain of certificate authorities

And so as not to require the client to use a certificate (to authenticate itself):

tls_require_cert: 0

Server and virtual domains

If the server has several names, it is preferable to use servername to specify the one to use rather than relying on the value returned by gethostname(2):

# Name to use in the welcome message
servername: mail.example.comServer name

Virtual domains allow several different domains to be managed, the userid value indicating that the domain is to be determined from the mail address, using the ‘@’ separator. If that separator is not present, the defaultdomain domain is used.

# Virtual domains
defaultdomain: mail.example.comDefault mail domain
virtdomains: userid

Sieve

Sieve allows to filter email directly at the server level and to put in place redirection or vacation messages, it needs to use sendmail.

# Sieve
sievedir:          /var/spool/sieve
sendmail:          /usr/local/sbin/sendmailMailer command

Working directory

Hold the data and locks necessary for the good operations of the process.

# Working directory
configdirectory:   /var/imap
mboxname_lockpath: /var/imap/lock

Email reception

No size limit is enforced at reception of the email, and deletion of identical messages is performed to only keep one copy.

Size limitation for email reception is performed upstream by the SMTP server.

# Message reception
maxmessagesize:       0
duplicatesuppression: yes

Mailboxes

To store mailboxes, several partitions (directories on different disks) can be used, but it’s decided here to only create one called main, and to force its used as a default. Furthermore for a good management of the disk space, hard links will be created (singleinstancestore directive) so to only keep one copy of identical messages among the partition mailboxes. Finally, as it’s a Unix system, it will be possible to use ‘/’ as a hierarchy separator (unixhierarchysep directive), allowing the ‘.’ character to be present in mailbox names. When storing on disk, email and metadata are split (partition-main and metapartition-main) allowing to setup compression for the email at the file system level (zfs set compression=on).

# Storing mailboxes
metapartition_files:  header index cache expunge squat
defaultpartition:     mainPartition name
partition-mainPartition name:       /var/spool/imap
metapartition-mainPartition name:   /var/spool/imap-meta
singleinstancestore:  yes
unixhierarchysep:     yes

Use an alternative display of the folders, where they are in the same hierarchy level as INBOX.

# Folder display
altnamespace:         yes
userprefix:           OtherUsers
sharedprefix:         SharedFolders

To get an easier folder reading, display order is slightly modified so that characters ‘ ’ and ‘-’ are dealt with the same way.

# Sorting option
improved_mboxlist_sort: yes

# Dumping mailbox
ctl_mboxlist -d > mb.txt

# Setting improved_mboxlist_sort option

# Importing mailbox
rm /var/imap/mailboxes.db 
ctl_mboxlist -u < mb.txt

Access rights

# Security 
#
umask:               077
allowanonymouslogin: no
allowallsubscribe:   no
anyoneuseracl:       no
defaultacl:          anyone lrs
admins:              rootAdministrator root@example.comAdministrator root@sample.comAdministrator

Quota

# Quota
quotawarn: 90

Initialisation

A few steps remain before finishing the installation and configuration:

1. Creating directories, data structures and setting access rights:

   /usr/local/cyrus/bin/mkimap
   

2. Correcting access rights for the lmtp socket, to allow communication from postfix to Cyrus IMAP:

   chown cyrus:mail /var/imap/socket/lmtp
   chmod 660        /var/imap/socket/lmtp
   

Startup

To allow automatic startup, the following lines are added to the /etc/rc.conf file:

cyrus_imapd_enable="YES"
cyrus_imapd_flags="-d"

Tools

The following examples use the cyradm command, it is run connecting as a user with administrative privileges for the selected domain (ie: users present in the admins directive):

cyradm --user rootUser@example.comMail domain imap.example.comImap server

Creating a mailbox

create user/jdoeUser
setquota user/jdoeUser 10000

Deleting a mailbox

setacl user/jdoeUser rootUser@example.comMail domain all
delete user/jdoeUser

Renaming a mailbox

rename --partition partPartition name user/jdoeUser user/totoUser