# Maximum time to wait for lock (all of them) before aborting.
mbox_lock_timeout = 5 mins

# If dotlock exists but the mailbox isn't modified in any way, override the
# lock file after this much time.
mbox_dotlock_change_timeout = 2 mins

# Greeting message for clients.
login_greeting = Dovecot ready.

protocol imap {
[...]
  # Support for dynamically loadable plugins. mail_plugins is a space separated
  # list of plugins to load.
  #mail_plugins =
  mail_plugins = autocreate
  #mail_plugin_dir = /usr/lib/dovecot/imap
[...]
}
[...]
plugin {
[...] # at the end plugin section
  # mail_plugins autocreate (auto create imap folders for new users)
  autocreate = Sent
  autocreate2 = Trash
  autocreate3 = Drafts
  autocreate4 = Templates
  autocreate5 = Trash
  autocreate6 = SPAM
  autosubscribe = Sent
  autosubscribe2 = Trash
  autosubscribe3 = Drafts
  autosubscribe4 = Templates
  autosubscribe5 = Trash
  autosubscribe6 = SPAM
}

protocol imap {
[...]
  #mail_plugins = $mail_plugins
  mail_plugins = autocreate
[...]
}

[...]
plugin {
[...] # at the end plugin section
  # mail_plugins autocreate (auto create imap folders for new users)
  autocreate = Sent
  autocreate2 = Trash
  autocreate3 = Drafts
  autocreate4 = Templates
  autocreate5 = Trash
  autocreate6 = SPAM
  autosubscribe = Sent
  autosubscribe2 = Trash
  autosubscribe3 = Drafts
  autosubscribe4 = Templates
  autosubscribe5 = Trash
  autosubscribe6 = SPAM
}

service lmtp {
  #inet_listener /var/spool/postfix/private/dovecot-lmtp {
  #  address = 0.0.0.0 ::
  #  port = 24
  #}
  unix_listener /var/spool/postfix/private/dovecot-lmtp {
    mode = 0660
    user = postfix
    group = postfix
  }
[...]
}

protocol lmtp {
  # Space separated list of plugins to load (default is global mail_plugins).
  #mail_plugins = $mail_plugins
  #mail_plugins = sieve
  mail_plugins = sieve
}

# for unix users
mailbox_transport = lmtp:unix:private/dovecot-lmtp
# for vmail users
virtual_transport = lmtp:unix:private/dovecot-lmtp

protocol imap {
[...]
  mail_plugins = zlib
[...]
}
[...]
protocol lda {
[...]
  mail_plugins = zlib
[...]
}
[...]
plugin {
[...]
  # Enable these only if you want compression while saving:
  zlib_save_level = 9 # 1..9; default is 6
  zlib_save = bz2 # or bz2, xz or lz4
}

protocol lda {
[...]
  # Space separated list of plugins to load (default is global mail_plugins).
  #mail_plugins = $mail_plugins
  mail_plugins = $mail_plugins sieve zlib
}

protocol imap {
[...]
  # Space separated list of plugins to load (default is global mail_plugins).
  #mail_plugins = $mail_plugins
  mail_plugins = $mail_plugins autocreate zlib
[...]
}

plugin {
  #setting_name = value
  # Enable these only if you want compression while saving:
  zlib_save_level = 9 # 1..9; default is 6
  zlib_save = bz2 # gz or bz2, xz or lz4
}

# Mail location for both system and virtual users:
mail_location = maildir:~/Maildir

auth default {
  mechanisms = plain

  # try to authenticate using SQL database first
  passdb sql {
    args = /etc/dovecot-sql.conf
  }
  # fallback to PAM
  passdb pam {
  }

  # look up users from SQL first (even if authentication was done using PAM!)
  userdb sql {
    args = /etc/dovecot-sql.conf
  }
  # if not found, fallback to /etc/passwd
  userdb passwd {
  }
}

#!include auth-deny.conf.ext
#!include auth-master.conf.ext

#!include auth-system.conf.ext
#!include auth-sql.conf.ext
#!include auth-ldap.conf.ext
#!include auth-passwdfile.conf.ext
#!include auth-checkpassword.conf.ext
#!include auth-vpopmail.conf.ext
#!include auth-static.conf.ext

!include auth-sql.conf.ext
!include auth-system.conf.ext

# Authentication for SQL users. Included from auth.conf.
#
# <doc/wiki/AuthDatabase.SQL.txt>

passdb {
  driver = sql

  # Path for SQL configuration file, see example-config/dovecot-sql.conf.ext
  args = /etc/dovecot/dovecot-sql.conf.ext
}

# "prefetch" user database means that the passdb already provided the
# needed information and there's no need to do a separate userdb lookup.
# <doc/wiki/UserDatabase.Prefetch.txt>
#userdb {
#  driver = prefetch
#}

userdb {
  driver = sql
  args = /etc/dovecot/dovecot-sql.conf.ext
}

# If you don't have any user-specific settings, you can avoid the user_query
# by using userdb static instead of userdb sql, for example:
# <doc/wiki/UserDatabase.Static.txt>
#userdb {
  #driver = static
  #args = uid=vmail gid=vmail home=/var/vmail/%u
#}

# Authentication for system users. Included from auth.conf.
#
# <doc/wiki/PasswordDatabase.txt>
# <doc/wiki/UserDatabase.txt>

# PAM authentication. Preferred nowadays by most systems.
# PAM is typically used with either userdb passwd or userdb static.
# REMEMBER: You'll need /etc/pam.d/dovecot file created for PAM
# authentication to actually work. <doc/wiki/PasswordDatabase.PAM.txt>
passdb {
  driver = pam
  # [session=yes] [setcred=yes] [failure_show_msg=yes] [max_requests=<n>]
  # [cache_key=<key>] [<service name>]
  #args = dovecot
}

# System users (NSS, /etc/passwd, or similiar).
# In many systems nowadays this uses Name Service Switch, which is
# configured in /etc/nsswitch.conf. <doc/wiki/AuthDatabase.Passwd.txt>
#passdb {
  #driver = passwd
  # [blocking=no]
  #args =
#}

# Shadow passwords for system users (NSS, /etc/shadow or similiar).
# Deprecated by PAM nowadays.
# <doc/wiki/PasswordDatabase.Shadow.txt>
#passdb {
  #driver = shadow
  # [blocking=no]
  #args =
#}

# PAM-like authentication for OpenBSD.
# <doc/wiki/PasswordDatabase.BSDAuth.txt>
#passdb {
  #driver = bsdauth
  # [blocking=no] [cache_key=<key>]
  #args =
#}

##
## User databases
##

# System users (NSS, /etc/passwd, or similiar). In many systems nowadays this
# uses Name Service Switch, which is configured in /etc/nsswitch.conf.
userdb {
  # <doc/wiki/AuthDatabase.Passwd.txt>
  driver = passwd
  # [blocking=no]
  #args =
}

# Static settings generated from template <doc/wiki/UserDatabase.Static.txt>
#userdb {
  #driver = static
  # Can return anything a userdb could normally return. For example:
  #
  #  args = uid=500 gid=500 home=/var/mail/%u
  #
  # LDA and LMTP needs to look up users only from the userdb. This of course
  # doesn't work with static userdb because there is no list of users.
  # Normally static userdb handles this by doing a passdb lookup. This works
  # with most passdbs, with PAM being the most notable exception. If you do
  # the user verification another way, you can add allow_all_users=yes to
  # the args in which case the passdb lookup is skipped.
  #
  #args =
#}

protocol lda {
[...]
  postmaster_address = postmaster@cen05.xen.wbcd.pl
[...]
  # Support for dynamically loadable plugins. mail_plugins is a space separated
  # list of plugins to load.
  #mail_plugins =
  mail_plugins = sieve
[...]
}

[...]

plugin {
[...]
  # Sieve plugin (http://wiki.dovecot.org/LDA/Sieve) and ManageSieve service
  #
  # Location of the active script. When ManageSieve is used this is actually
  # a symlink pointing to the active script in the sieve storage directory.
  #sieve=~/.dovecot.sieve
  sieve=/home/vmail/%d/%n/.dovecot.sieve
  #
  # The path to the directory where the personal Sieve scripts are stored. For
  # ManageSieve this is where the uploaded scripts are stored.
  #sieve_dir=~/sieve
  sieve_dir=/home/vmail/%d/%n/sieve
}

protocol lda {
  # Space separated list of plugins to load (default is global mail_plugins).
  mail_plugins = sieve
}

protocol lmtp {
  # Space separated list of plugins to load (default is global mail_plugins).
  mail_plugins = sieve
}

##
## SIEVE specific settings
##
plugin {
  # The path to the user's main active script.
  # usually this means $HOME/.dovecot.sieve (/home/user/.dovecot.sieve)
  #sieve = ~/.dovecot.sieve
  sieve=/home/vmail/%d/%n/.dovecot.sieve

  # A path to a global sieve script file, which gets executed ONLY
  # if user's private Sieve script doesn't exist. Be sure to
  # pre-compile this script manually using the sievec command line
  # tool.
  #sieve_global_path = /var/lib/dovecot/sieve/default.sieve
  # optionally - but not needed
  # mkdir -p /var/lib/dovecot/sieve
  # touch /var/lib/dovecot/sieve/default.sieve
  #sieve_global_path = /var/lib/dovecot/sieve/default.sieve

  # Directory for :personal include scripts for the include extension.
  #sieve_dir = ~/sieve
  sieve_dir=/home/vmail/%d/%n/sieve

  # Directory for :global include scripts for the include extension.
  #sieve_global_dir =
  # optionally - but not needed
  # mkdir -p /var/lib/dovecot/sieve/default.sieve
  #sieve_global_dir = /var/lib/dovecot/sieve/global/
}

protocol managesieve {
  listen = *:4190, [::]:4190
}
[...]
protocol managesieve {
  [...]
  # If, for some inobvious reason, the sieve_storage remains unset, the
  # ManageSieve daemon uses the specification of the mail_location to find out
  # where to store the sieve files (see explaination in README.managesieve).
  # The example below, when uncommented, overrides any global mail_location
  # specification and stores all the scripts in '~/mail/sieve' if sieve_storage
  # is unset. However, you should always use the sieve_storage setting.
  # mail_location = mbox:~/mail
  mail_location = maildir:/home/vmail/%d/%n/Maildir
}

service managesieve-login {
  inet_listener sieve {
    port = 4190
  }

  #inet_listener sieve_deprecated {
  #  port = 2000
  #}
[...]
}

password_query = SELECT SUBSTRING_INDEX(email,'@',1) AS username, SUBSTRING_INDEX(email,'@',-1) AS domain, password, NULL AS nopassword, NULL AS host, NULL AS destuser, NULL AS proxy, NULL AS starttls FROM wbcd_users WHERE email = '%n@%d'     UNION ALL     SELECT '%n' AS username, '%d' AS domain, NULL AS password, 'Y' AS nopassword, 'cen05.xen.wbcd.pl'    AS host, '%n@%d' AS destuser, 'Y' AS proxy, 'any-cert' AS starttls FROM wbcd_users WHERE '%d'='cen05.xen.wbcd.pl'        UNION ALL     SELECT '%n' AS username, '%d' AS domain, NULL AS password, 'Y' AS nopassword, 'cen06-1.xen.wbcd.pl'  AS host, '%n@%d' AS destuser, 'Y' AS proxy, 'any-cert' AS starttls FROM wbcd_users WHERE '%d'='cen06-1.xen.wbcd.pl'      UNION ALL     SELECT '%n' AS username, '%d' AS domain, NULL AS password, 'Y' AS nopassword, 'cen06-2.xen.wbcd.pl'  AS host, '%n@%d' AS destuser, 'Y' AS proxy, 'any-cert' AS starttls FROM wbcd_users WHERE '%d'='cen06-2.xen.wbcd.pl'      UNION ALL     SELECT '%n' AS username, '%d' AS domain, NULL AS password, 'Y' AS nopassword, 'cen05dev.xen.wbcd.pl' AS host, '%n@%d' AS destuser, 'Y' AS proxy, 'any-cert' AS starttls FROM wbcd_users WHERE '%d'='cen05dev.xen.wbcd.pl'     UNION ALL     SELECT '%n' AS username, '%d' AS domain, NULL AS password, 'Y' AS nopassword, 'cen06dev.xen.wbcd.pl' AS host, '%n@%d' AS destuser, 'Y' AS proxy, 'any-cert' AS starttls FROM wbcd_users WHERE '%d'='cen06dev.xen.wbcd.pl'     UNION ALL     SELECT '%n' AS username, '%d' AS domain, NULL AS password, 'Y' AS nopassword, 'cen06x64.xen.wbcd.pl' AS host, '%n@%d' AS destuser, 'Y' AS proxy, 'any-cert' AS starttls FROM wbcd_users WHERE '%d'='cen06x64.xen.wbcd.pl'     UNION ALL     SELECT '%n' AS username, '%d' AS domain, NULL AS password, 'Y' AS nopassword, 'cen07x64.xen.wbcd.pl' AS host, '%n@%d' AS destuser, 'Y' AS proxy, 'any-cert' AS starttls FROM wbcd_users WHERE '%d'='cen07x64.xen.wbcd.pl'     LIMIT 1

password_query = SELECT SUBSTRING_INDEX(email,'@',1) AS username, SUBSTRING_INDEX(email,'@',-1) AS domain, password, NULL AS nopassword, NULL AS host, NULL AS destuser, NULL AS proxy, NULL AS starttls FROM wbcd_users WHERE email = '%n@%d'     UNION ALL     SELECT '%n' AS username, '%d' AS domain, NULL AS password, 'Y' AS nopassword, 'cen05.xen.wbcd.pl'    AS host, '%n@%d' AS destuser, 'Y' AS proxy, 'any-cert' AS starttls FROM wbcd_users WHERE '%d'='cen05.xen.wbcd.pl'        UNION ALL     SELECT '%n' AS username, '%d' AS domain, NULL AS password, 'Y' AS nopassword, 'cen06-1.xen.wbcd.pl'  AS host, '%n@%d' AS destuser, 'Y' AS proxy, 'any-cert' AS starttls FROM wbcd_users WHERE '%d'='cen06-1.xen.wbcd.pl'      UNION ALL     SELECT '%n' AS username, '%d' AS domain, NULL AS password, 'Y' AS nopassword, 'cen06-2.xen.wbcd.pl'  AS host, '%n@%d' AS destuser, 'Y' AS proxy, 'any-cert' AS starttls FROM wbcd_users WHERE '%d'='cen06-2.xen.wbcd.pl'      UNION ALL     SELECT '%n' AS username, '%d' AS domain, NULL AS password, 'Y' AS nopassword, 'cen05dev.xen.wbcd.pl' AS host, '%n@%d' AS destuser, 'Y' AS proxy, 'any-cert' AS starttls FROM wbcd_users WHERE '%d'='cen05dev.xen.wbcd.pl'     UNION ALL     SELECT '%n' AS username, '%d' AS domain, NULL AS password, 'Y' AS nopassword, 'cen06dev.xen.wbcd.pl' AS host, '%n@%d' AS destuser, 'Y' AS proxy, 'any-cert' AS starttls FROM wbcd_users WHERE '%d'='cen06dev.xen.wbcd.pl'     UNION ALL     SELECT '%n' AS username, '%d' AS domain, NULL AS password, 'Y' AS nopassword, 'cen06x64.xen.wbcd.pl' AS host, '%n@%d' AS destuser, 'Y' AS proxy, 'any-cert' AS starttls FROM wbcd_users WHERE '%d'='cen06x64.xen.wbcd.pl'     UNION ALL     SELECT '%n' AS username, '%d' AS domain, NULL AS password, 'Y' AS nopassword, 'cen07x64.xen.wbcd.pl' AS host, '%n@%d' AS destuser, 'Y' AS proxy, 'any-cert' AS starttls FROM wbcd_users WHERE '%d'='cen07x64.xen.wbcd.pl'     LIMIT 1

# SSL/TLS support: yes, no, required. <doc/wiki/SSL.txt>
ssl = yes

# PEM encoded X.509 SSL/TLS certificate and private key. They're opened before
# dropping root privileges, so keep the key file unreadable by anyone but
# root. Included doc/mkcert.sh can be used to easily generate self-signed
# certificate, just make sure to update the domains in dovecot-openssl.cnf
ssl_cert = </etc/pki/dovecot/certs/dovecot.pem
ssl_key = </etc/pki/dovecot/private/dovecot.pem

# PEM encoded trusted certificate authority. Set this only if you intend to use
# ssl_verify_client_cert=yes. The file should contain the CA certificate(s)
# followed by the matching CRL(s). (e.g. ssl_ca = </etc/pki/dovecot/certs/ca.pem)
#ssl_ca =

# SSL ciphers to use
# ssl_cipher_list = ALL:!LOW:!SSLv2
ssl_cipher_list = ALL:!LOW:!SSLv2

# SSL ciphers to use
# ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL
ssl_cipher_list = ALL:!LOW:!SSLv2:!SSLv3:!EXP:!aNULL

# SSL protocols to use
#ssl_protocols = !SSLv2
ssl_protocols = !SSLv2 !SSLv3
# SSL ciphers to use
# ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL
ssl_cipher_list = ALL:!LOW:!SSLv2:!SSLv3:!EXP:!aNULL

# default value
# ssl_cipher_list = ALL:!LOW:!SSLv2
ssl_cipher_list = ALL:!LOW:!SSLv2:!RC4

# default value
# ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL
ssl_cipher_list = ALL:!LOW:!SSLv2:!RC4:!EXP:!aNULL

#
#

##
## SSL settings
##
[...]
# Request client to send a certificate. If you also want to require it, set
# ssl_require_client_cert=yes in auth section.
#ssl_verify_client_cert = no
[...]
# Show protocol level SSL errors.
#verbose_ssl = no

# Show protocol level SSL errors.
#verbose_ssl = no

# Request client to send a certificate. If you also want to require it, set
# auth_ssl_require_client_cert=yes in auth section.
#ssl_verify_client_cert = no

# Prefer the server's order of ciphers over client's.
#ssl_prefer_server_ciphers = no
ssl_prefer_server_ciphers = yes