Notes on my Dovecot 2.3 to 2.4 Upgrade

I last wrote about my mail system two years ago, in which I coaxed Dovecot 2.3 into accepting my authentication philosophy.  In those days, user@domain would be looked up through /local/auth/domain/passwd containing only user as its first column.  I ended up abandoning this approach for Dovecot 2.4.

An aside: it was initially very helpful in this conversion process to use doveconf -n to get configuration error messages, instead of asking systemd to start the service and then having to look at the (truncated by default) journal for the error message.

I have decided to store the full user@domain in the file now, even if the domain part is redundant, because it makes life a lot easier.  There’s no need to modify the user on a lookup result this way.  This simplifies the configuration in 2.4:

passdb auth_passwd_file {
    passwd_file_path = /local/auth/%{user | domain | lower}/passwd
    driver = passwd-file
}
userdb auth_passwd_file {
    passwd_file_path = /local/auth/%{user | domain | lower}/passwd
    driver = passwd-file
}

Most other problems were caused by Debian’s updated defaults conflicting with my environment.

Their 10-auth.conf file sets “system users through PAM” as the first option for authentication, before my local.conf was included, so I would get a “pam_unix: unknown user” message on every login attempt.  Worse, this would permit someone to authenticate as system users that should not have email service.  I ended up commenting out the include line for auth-system.conf.ext directly.

The other major problem was that they set mail_inbox_path in their 10-mail.conf file.  Instead, I want my local configuration to take effect:

mail_driver = maildir
mail_path = ~/.maildir

I don’t set mail_inbox_path, and mail_home ends up coming from the passwd file itself.  Previously, that file had /home/user/.maildir as a home directory, and these settings created /home/user/.maildir/.maildir as an empty folder structure.  I decided to take the trailing /.maildir out of my passwd file, rather than unsetting the path.  This keeps non-mailbox stuff, like sieve scripts, out of the mailbox.