github-com-docker-mailserver/docker-mailserver
1
0
Fork 0
mirror of https://github.com/docker-mailserver/docker-mailserver.git synced 2024-01-19 02:48:50 +00:00
Code Issues Projects Releases Wiki Activity
docker-mailserver/docs/content/config/security/mail_crypt.md
Nathan Pierce 0fb5251c20
docs: add mail_crypt plugin documentation (#1913) 
* mail_crypt plugin + quick improvement to dovecot override defaults doc

* quick change for <your-container-name> to use mailserver

Co-authored-by: Georg Lauterbach <44545919+aendeavor@users.noreply.github.com>
2021-04-18 00:31:09 +02:00

3.1 KiB
Raw Blame History

title
Security | mail_crypt (email/storage encryption)

!!! info

The Mail crypt plugin is used to secure email messages stored in a Dovecot system. Messages are encrypted before written to storage and decrypted after reading. Both operations are transparent to the user.

In case of unauthorized access to the storage backend, the messages will, without access to the decryption keys, be unreadable to the offending party.

There can be a single encryption key for the whole system or each user can have a key of their own. The used cryptographical methods are widely used standards and keys are stored in portable formats, when possible.

Official Dovecot documentation: https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/

Basic Setup

  1. Before you can enable mail_crypt, you'll need to copy out several dovecot/conf.d files to the host (from a running container) and then take the container down: 
    mkdir -p config/dovecot
docker cp mailserver:/etc/dovecot/conf.d/20-lmtp.conf config/dovecot/
docker cp mailserver:/etc/dovecot/conf.d/20-imap.conf config/dovecot/
docker cp mailserver:/etc/dovecot/conf.d/20-pop3.conf config/dovecot/
docker-compose down
  2. You then need to generate your global EC key.
  3. The EC key needs to be available in the container. I prefer to mount a /certs directory into the container: 
    services:
  mailserver:
    image: docker.io/mailserver/docker-mailserver:latest
    volumes:
    . . .
      - ./certs/:/certs
    . . .
  4. While you're editing the docker-compose.yml, add the configuration files you copied out: 
    services:
  mailserver:
    image: docker.io/mailserver/docker-mailserver:latest
    volumes:
    . . .
      - ./config/dovecot/20-lmtp.conf:/etc/dovecot/conf.d/20-lmtp.conf
      - ./config/dovecot/20-imap.conf:/etc/dovecot/conf.d/20-imap.conf
      - ./config/dovecot/20-pop3.conf:/etc/dovecot/conf.d/20-pop3.conf
      - ./certs/:/certs
    . . .
  5. The mail_crypt plugin, unless you're using a non-standard configuration of docker-mailserver, should be enabled on both lmtp and imap. You'll want to edit three different files:
    • ./config/dovecot/20-lmtp.conf 
      protocol lmtp {
  mail_plugins = $mail_plugins sieve mail_crypt
  plugin {
    mail_crypt_global_private_key = </certs/ecprivkey.pem
    mail_crypt_global_public_key = </certs/ecpubkey.pem
    mail_crypt_save_version = 2
  }
}
    • ./config/dovecot/20-imap.conf 
      protocol imap {
  mail_plugins = $mail_plugins imap_quota mail_crypt
  plugin {
    mail_crypt_global_private_key = </certs/ecprivkey.pem
    mail_crypt_global_public_key = </certs/ecpubkey.pem
    mail_crypt_save_version = 2
  }
}
    • If you use pop3, make the same changes in 20-pop3.conf
  6. Start the container and monitor the logs for any errors

This should be the minimum required for encryption of the mail while in storage.