Dovecot Setup

Introduction

This will setup dovecot as our IMAP/POP3 server.

Basic Configuration

We will setup dovecot for IMAP and POP3 and disable SSL.

protocols = imap pop3
listen = *
ssl_listen = *
ssl_disable = yes

Maildir

We will use the maildir format as opposed to the default mbox format.

mail_location = maildir:~/Maildir

Authentication & SASL

Configure dovecot to use LOGIN and PLAIN as the authentication mechanisims as many MS clients are unable to use encrypted authentication mechanisms. We also setup the SASL socket to enable postfix to authenticate SMTP connections using dovecot.

auth default {
  mechanisms = plain login
  passdb pam {
  }
  userdb passwd {
  }
  socket listen {
    client {
        path = /var/spool/postfix/private/auth
        mode = 0660
        user = postfix
        group = postfix
    }
  }
}

Client Issues

Some MS imap clients in the outlook family have issues with both thier IMAP and POP3 implementations so we need to accommodate them by setting up these work arounds:

protocol imap {
 imap_client_workarounds = outlook-idle delay-newmail
}
protocol pop3 {
 pop3_client_workarounds = outlook-no-nuls oe-ns-eoh
}

Run IMAP Behind Proxy

The imap server is configured to run on port 10143 such that port 143 is handled by the imap proxy server that will improve performance for your webmail by caching connections to the imap server. The listen option under protocol sets this up.

protocol imap {
 imap_client_workarounds = outlook-idle delay-newmail
 listen = 127.0.0.1:10143
}

Sample files

• dovecot.conf

Setup Imap Proxy

Introduction

imapproxy was written to compensate for webmail clients that are unable to maintain persistent connections to an IMAP server. Most webmail clients need to log in to an IMAP server for nearly every single transaction. This behaviour can cause tragic performance problems on the IMAP server. imapproxy tries to deal with this problem by leaving server connections open for a short time after a webmail client logs out. When the webmail client connects again, imapproxy will determine if there's a cached connection available and reuse it if possible. - according to the imapproxy website.

Configuration

Make the following changes in the file /etc/imapproxy.conf:

server_hostname 127.0.0.1
cache_size 3072
listen_port 143
server_port 10143
cache_expiration_time 900
proc_username nobody
proc_groupname nobody
stat_filename /var/run/pimpstats
protocol_log_filename /var/log/imapproxy_protocol.log
syslog_facility LOG_MAIL
send_tcp_keepalives no
enable_select_cache yes
foreground_mode no
force_tls no
enable_admin_commands no

Sample Files

• imapproxy.conf

Bind Setup

Introduction

Bind will be set up chrooted to improve security we will also use views to prevent abuse of the dns server.

Basic Configuration

The basic configuration disables by default, recursive queries and zone transfers. We also obscure the version of BIND we are running such that we are not hit by zero day vulnerabilities from script kiddies.

options {
        directory "/var/named";
        pid-file "/var/run/named/named.pid";
        listen-on {
                127.0.0.1;
                192.168.1.5;
                };
        version "just guess";
        allow-recursion { "localhost"; };
        allow-transfer { "none"; };
};

Logging

The logging is customized to remove the annoying "lame-server" and update errors that appear in the logs:

logging {
        category update { null; };
        category update-security { null;        };
        category lame-servers{ null; };
};

Chroot

Ensure that this is set in the file /etc/sysconfig/named (it's usually set by the bind-chroot package):

ROOTDIR=/var/named/chroot

Point Server

Let the machine use this server for dns resolution edit /etc/resolv.conf and prepend:

nameserver 127.0.0.1

Sample files

• named.conf
• /etc/sysconfig/named

Vsftpd Setup

Introduction

We will use vsftpd as our ftp server. This has a better track record as opposed to the proftpd & wuftpd servers.

Basic Setting

Our basic setup disables anonymous users, and enables local system users to connect to the ftp server.

anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
anon_upload_enable=NO
anon_mkdir_write_enable=NO
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
xferlog_file=/var/log/vsftpd.log
xferlog_std_format=YES
ftpd_banner=Welcome to example.com server
pam_service_name=vsftpd
tcp_wrappers=YES

Chroot

All users will be chrooted to their home directories (except usernames in the /etc/vsftpd/chroot_list file) meaning the cannot break out and see other users files.

chroot_list_enable=YES
chroot_local_user=YES
chroot_list_file=/etc/vsftpd/chroot_list

Banned Users

Users added to the file /etc/vsftpd/user_list will not be allowed to login:

userlist_enable=YES

Sample Files

• vsftpd.conf
• user_list
• chroot_list