imap.8gx

.\" SPDX-License-Identifier: CC-BY-SA-4.0 or-later
.\" SPDX-FileCopyrightText: 2020-2022 grommunio GmbH
.TH imap 8gx "" "Gromox" "Gromox admin reference"
.SH Name
imap \(em Gromox IMAP server
.SH Authentication
The IMAP server supports impersonation. The username given to the IMAP login
normally specifies both the mailbox and the user performing the access. To use
a different identity for authentication, prefix the mailbox name by the user
identity and separate it with an exclamation mark, e.g.
"myaccount@domain.example!sharedmbox@domain.example". Accessing a store in such
manner is only possible when the authenticating user has store ownership over
the mailbox.
.SH Synopsis
\fBimap\fP [\fB\-c\fP \fIconfig\fP]
.SH Options
.TP
\fB\-c\fP \fIconfig\fP
Read configuration directives from the given file. If this option is not
specified, /etc/gromox/imap.cfg will be read if it exists.
.TP
\fB\-\-version\fP
Output version information and exit.
.TP
\fB\-?\fP
Display option summary.
.PP
All time-based command-line options and configuration file directives are
subject to the syntax described in gromox(7), section "Duration
specifications".
.SH Configuration directives (gromox.cfg)
.PP
The following directives are recognized when reading from
/etc/gromox/gromox.cfg, or when the \fB\-c\fP option is used to specify a
custom file:
.TP
\fBdaemons_fd_limit\fP
In gromox-imap, this is treated as an alias for imap_fd_limit.
.TP
\fBimap_fd_limit\fP
Request that the file descriptor table be at least this large. The magic value
0 indicates that the system default hard limit (rlim_max, cf. setrlimit(2))
should be used.
.br
Default: \fI0\fP
.TP
\fBimap_accept_haproxy\fP
This directive sets the expectation for incoming connections to carry haproxy's
"PROXY" protocol extension version 2 (2), or no such header (0). When a
(reverse) proxy is placed in front of gromox\-imap, the address that gximap
normally sees is the proxy address (e.g. ::1). A proxy can use this protocol
extension to convey the actual client address, and gximap can pick this up for
its own reporting, which in turn is useful for e.g. fail2ban setups.
.br
Default: \fI0\fP
.SH Configuration directives (imap.cfg)
The following directives are recognized when reading from /etc/gromox/imap.cfg,
or when the \fB\-c\fP option is used to specify a custom file:
.TP
\fBblock_interval_auths\fP
The amount of time a user is blocked from connecting to the service after too
many failed logins.
.br
Default: \fI1 minute\fP
.TP
\fBconfig_file_path\fP
Colon-separated list of directories in which further configuration files,
especially those used by plugin instances, will be searched.
.br
Default: \fI/etc/gromox/imap:/etc/gromox\fP
.TP
\fBcontext_average_mem\fP
Default: \fI128K\fP
.TP
\fBcontext_average_mitem\fP
The expected average upper bound of number of mails for a folder. Together with
context_num, this directive controls the size of the memory pool for listings.
.br
Default: \fI64K\fP
.TP
\fBcontext_num\fP
Maximum number of concurrently active sessions.
.br
Default: \fI200\fP
.TP
\fBdata_file_path\fP
Colon-separated list of directories in which static data files will be
searched.
.br
Default: \fI/usr/share/gromox/imap\fP
.TP
\fBdefault_lang\fP
Default: \fIen\fP
.TP
\fBenable_rfc2971_commands\fP
RFC 2971 specifies the "ID" command with which a client can inquire the program
name and version of the server. This is disabled by default, as it can
facilitate potential attackers' information gathering.
.br
Default: \fIno\fP
.TP
\fBhost_id\fP
A unique identifier for this system. It is used in the IMAP protocol greeting
lines (positive as well as negative). It is furthermore used as a unique
identifier among the set of all midb(8gx) clients to construct filenames for
the MIDB database/EML cache. The identifier should only use characters allowed
for hostnames.
.br
Default: (system hostname)
.TP
\fBimap_auth_times\fP
The number of login tries a user is allowed before the account is blocked.
.br
Default: \fI10\fP
.TP
\fBimap_autologout_time\fP
If an authenticated IMAP connection is idle for the given period, the
connection is terminated. RFC 2060 §5.4 recommends 30 minutes minimum.
(Connections that have not authenticated are subject to the regular
imap_conn_timeout.)
.br
Default: \fI30 minutes\fP
.TP
\fBimap_certificate_passwd\fP
The password to unlock TLS certificates.
.br
Default: (unset)
.TP
\fBimap_certificate_path\fP
A colon-separated list of TLS certificate files. The complete certificate chain
should be present (as there is no other config directive to pull CA certs in,
and implicit loading from system directories is not guaranteed by Gromox).
.br
Default: (unset)
.TP
\fBimap_cmd_debug\fP
Log every incoming IMAP command and the return code of the operation in a
minimal fashion to stderr. Level 1 emits commands that have failed execution,
level 2 emits all commands. (The response text is \fBnot\fP sent to the log,
because of size. Deep analysis can be done with socat/telnet/tcpdump; shallow
analysis for end-users is possible with the protocol-compliant error-reporting
MUA "Alpine" <https://alpineapp.email/>.)
.br
Default: \fI0\fP
.TP
\fBimap_conn_timeout\fP
If an IMAP connection stalls (writing responses to client) for the given
period, the connection is terminated. If unauthenticated IMAP connections do
not have any activity (requests from clients) for the given period, the
connection is terminated.
.br
Default: \fI3 minutes\fP
.TP
\fBimap_force_tls\fP
This flag controls whether clients must utilize TLS, either by way of implicit
TLS (cf. \fBimap_listen_tls_port\fP), or through the STARTTLS command.
.br
Default: \fIfalse\fP
.TP
\fBimap_listen_addr\fP
AF_INET6 socket address to bind the IMAP service to.
.br
Default: \fI::\fP
.TP
\fBimap_listen_port\fP
The TCP port to expose the IMAP protocol service on. (The IP address is fixed
to the wildcard address.)
.br
Default: \fI143\fP
.TP
\fBimap_listen_tls_port\fP
The TCP port to expose implicit-TLS IMAP protocol service (IMAPS) on. (The IP
address is fixed to the wildcard address.)
.br
Default: (unset)
.TP
\fBimap_log_file\fP
Target for log messages here. Special values: "\fI-\fP" (stderr/syslog
depending on parent PID) or "\fIsyslog\fP" are recognized.
.br
Default: \fI-\fP (auto)
.TP
\fBimap_log_level\fP
Maximum verbosity of logging. 1=crit, 2=error, 3=warn, 4=notice, 5=info, 6=debug.
.br
Default: \fI4\fP (notice)
.TP
\fBimap_private_key_path\fP
A colon-separated list of TLS certificate private key files.
.br
Default: (unset)
.TP
\fBimap_rfc9051\fP
Enable RFC 9051 (IMAP 4.2) related logic and protocol elements.
.br
Default: \fIyes\fP
.TP
\fBimap_support_tls\fP
This flag controls the offering of TLS modes. This affects both the implicit TLS
port as well as the advertisement of the STARTTLS extension and availability of
the STARTTLS command (RFC 2595) to clients.
.br
Default: \fIfalse\fP
.TP
\fBimap_thread_charge_num\fP
Connection load factor (oversubscription ratio) for a processing thread.
.br
Default: \fI40\fP
.TP
\fBimap_thread_init_num\fP
The initial and also minimum number of client processing threads to keep
around. This is similar to php-fpm's start_servers/min_spare_servere. (The
maximum number of threads, i.e. what would be max_spare_servers, is determined
by: context_num divided by imap_thread_charge_num)
.br
Default: \fI5\fP
.TP
\fBrunning_identity\fP
An unprivileged user account to switch the process to after startup.
.br
Default: \fIgromox\fP
.TP
\fBtls_min_proto\fP
The lowest TLS version to offer. Possible values are: \fBtls1.0\fP,
\fBtls1.1\fP, \fBtls1.2\fP, and, if supported by the system, \fBtls1.3\fP.
.br
Default: \fItls1.2\fP
.SH Files
.IP \(bu 4
\fIdata_file_path\fP/folder_lang.txt: Translations for IMAP folder names.
.IP \(bu 4
\fIdata_file_path\fP/imap_code.txt: Mapping from internal IMAP error codes to
textual descriptions.
.IP \(bu 4
/usr/lib/gromox/libgxs_*.so: service plugins
.SH See also
\fBgromox\fP(7), \fBmidb_agent\fP(4gx)