1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
|
<!DOCTYPE html>
<html class="writer-html5" lang="en" >
<head>
<meta charset="utf-8" /><meta name="generator" content="Docutils 0.19: https://docutils.sourceforge.io/" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>Concepts — Cyrus IMAP 3.12.1 documentation</title>
<link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
<link rel="stylesheet" href="../../_static/css/theme.css" type="text/css" />
<link rel="stylesheet" href="../../_static/graphviz.css" type="text/css" />
<link rel="stylesheet" href="../../_static/cyrus.css" type="text/css" />
<script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>
<script src="../../_static/jquery.js"></script>
<script src="../../_static/underscore.js"></script>
<script src="../../_static/_sphinx_javascript_frameworks_compat.js"></script>
<script src="../../_static/doctools.js"></script>
<script src="../../_static/sphinx_highlight.js"></script>
<script src="../../_static/js/theme.js"></script>
<link rel="index" title="Index" href="../../genindex.html" />
<link rel="search" title="Search" href="../../search.html" />
<link rel="next" title="Setup" href="../../setup.html" />
<link rel="prev" title="Cyrus IMAP Murder (Server Aggregation)" href="features/server-aggregation.html" />
</head>
<body class="wy-body-for-nav">
<div class="wy-grid-for-nav">
<nav data-toggle="wy-nav-shift" class="wy-nav-side">
<div class="wy-side-scroll">
<div class="wy-side-nav-search" >
<a href="../../index.html" class="icon icon-home">
Cyrus IMAP
</a>
<div class="version">
3.12.1
</div>
<div role="search">
<form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
<input type="text" name="q" placeholder="Search docs" aria-label="Search docs" />
<input type="hidden" name="check_keywords" value="yes" />
<input type="hidden" name="area" value="default" />
</form>
</div>
</div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
<p class="caption" role="heading"><span class="caption-text">Cyrus IMAP</span></p>
<ul class="current">
<li class="toctree-l1"><a class="reference internal" href="../../download.html">Download</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../quickstart.html">Quickstart Guide</a></li>
<li class="toctree-l1 current"><a class="reference internal" href="../../overview.html">Overview</a><ul class="current">
<li class="toctree-l2"><a class="reference internal" href="features.html">Features</a></li>
<li class="toctree-l2 current"><a class="current reference internal" href="#">Concepts</a><ul>
<li class="toctree-l3"><a class="reference internal" href="#access-control-lists">Access Control Lists</a><ul>
<li class="toctree-l4"><a class="reference internal" href="#working-with-acls">Working with ACLs</a></li>
<li class="toctree-l4"><a class="reference internal" href="#sample-acl">Sample ACL</a></li>
<li class="toctree-l4"><a class="reference internal" href="#access-rights">Access Rights</a></li>
<li class="toctree-l4"><a class="reference internal" href="#access-control-defaults">Access Control Defaults</a></li>
<li class="toctree-l4"><a class="reference internal" href="#access-control-identifier-aci">Access Control Identifier (ACI)</a></li>
<li class="toctree-l4"><a class="reference internal" href="#negative-rights">Negative Rights</a></li>
<li class="toctree-l4"><a class="reference internal" href="#calculating-a-users-rights">Calculating a Users' Rights</a></li>
</ul>
</li>
<li class="toctree-l3"><a class="reference internal" href="#login-authentication">Login Authentication</a><ul>
<li class="toctree-l4"><a class="reference internal" href="#anonymous-login">Anonymous Login</a></li>
<li class="toctree-l4"><a class="reference internal" href="#plaintext-authentication">Plaintext Authentication</a></li>
<li class="toctree-l4"><a class="reference internal" href="#kerberos-logins">Kerberos Logins</a></li>
<li class="toctree-l4"><a class="reference internal" href="#shared-secrets-logins">Shared Secrets Logins</a></li>
</ul>
</li>
<li class="toctree-l3"><a class="reference internal" href="#quotas">Quotas</a><ul>
<li class="toctree-l4"><a class="reference internal" href="#working-with-quotas">Working with Quotas</a></li>
<li class="toctree-l4"><a class="reference internal" href="#monitor-and-repair">Monitor and Repair</a></li>
<li class="toctree-l4"><a class="reference internal" href="#supported-quota-types">Supported Quota Types</a></li>
<li class="toctree-l4"><a class="reference internal" href="#quota-roots">Quota Roots</a></li>
<li class="toctree-l4"><a class="reference internal" href="#controlling-quota-behavior">Controlling Quota Behavior</a></li>
<li class="toctree-l4"><a class="reference internal" href="#mail-delivery-behavior">Mail Delivery Behavior</a></li>
<li class="toctree-l4"><a class="reference internal" href="#quota-warnings-upon-select-when-user-has-d-rights">Quota Warnings Upon Select When User Has <code class="docutils literal notranslate"><span class="pre">d</span></code> Rights</a></li>
<li class="toctree-l4"><a class="reference internal" href="#quotas-and-partitions">Quotas and Partitions</a></li>
</ul>
</li>
<li class="toctree-l3"><a class="reference internal" href="#new-mail-notification">New Mail Notification</a></li>
<li class="toctree-l3"><a class="reference internal" href="#partitions">Partitions</a><ul>
<li class="toctree-l4"><a class="reference internal" href="#specifying-partitions-with-create">Specifying Partitions with "create"</a></li>
<li class="toctree-l4"><a class="reference internal" href="#changing-partitions-with-rename">Changing Partitions with "rename"</a></li>
</ul>
</li>
<li class="toctree-l3"><a class="reference internal" href="#news">News</a></li>
<li class="toctree-l3"><a class="reference internal" href="#pop3-server">POP3 Server</a></li>
<li class="toctree-l3"><a class="reference internal" href="#the-syslog-facility">The syslog facility</a></li>
<li class="toctree-l3"><a class="reference internal" href="#mail-directory-recovery">Mail Directory Recovery</a><ul>
<li class="toctree-l4"><a class="reference internal" href="#reconstructing-mailbox-directories">Reconstructing Mailbox Directories</a></li>
<li class="toctree-l4"><a class="reference internal" href="#reconstructing-the-mailboxes-file">Reconstructing the Mailboxes File</a></li>
<li class="toctree-l4"><a class="reference internal" href="#reconstructing-quota-roots">Reconstructing Quota Roots</a></li>
<li class="toctree-l4"><a class="reference internal" href="#removing-quota-roots">Removing Quota Roots</a></li>
<li class="toctree-l4"><a class="reference internal" href="#subscriptions">Subscriptions</a></li>
</ul>
</li>
<li class="toctree-l3"><a class="reference internal" href="#configuration-directory">Configuration Directory</a><ul>
<li class="toctree-l4"><a class="reference internal" href="#log-directory">Log Directory</a></li>
<li class="toctree-l4"><a class="reference internal" href="#proc-directory">Proc Directory</a></li>
</ul>
</li>
<li class="toctree-l3"><a class="reference internal" href="#message-delivery">Message Delivery</a><ul>
<li class="toctree-l4"><a class="reference internal" href="#local-mail-transfer-protocol-lmtp">Local Mail Transfer Protocol (lmtp)</a></li>
<li class="toctree-l4"><a class="reference internal" href="#single-instance-store">Single Instance Store</a></li>
<li class="toctree-l4"><a class="reference internal" href="#duplicate-delivery-suppression">Duplicate Delivery Suppression</a></li>
</ul>
</li>
<li class="toctree-l3"><a class="reference internal" href="#sieve-a-mail-filtering-language">Sieve, a Mail Filtering Language</a></li>
<li class="toctree-l3"><a class="reference internal" href="#cyrus-murder-the-imap-aggregator">Cyrus Murder, the IMAP Aggregator</a></li>
</ul>
</li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="../../setup.html">Setup</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../operations.html">Operations</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../developers.html">Developers</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../support.html">Support/Community</a></li>
</ul>
<p class="caption" role="heading"><span class="caption-text">Cyrus SASL</span></p>
<ul>
<li class="toctree-l1"><a class="reference external" href="http://www.cyrusimap.org/sasl">Cyrus SASL</a></li>
</ul>
</div>
</div>
</nav>
<section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
<i data-toggle="wy-nav-top" class="fa fa-bars"></i>
<a href="../../index.html">Cyrus IMAP</a>
</nav>
<div class="wy-nav-content">
<div class="rst-content">
<div role="navigation" aria-label="Page navigation">
<ul class="wy-breadcrumbs">
<li><a href="../../index.html" class="icon icon-home" aria-label="Home"></a></li>
<li class="breadcrumb-item"><a href="../../overview.html">Overview</a></li>
<li class="breadcrumb-item active">Concepts</li>
<li class="wy-breadcrumbs-aside">
<a href="https://github.com/cyrusimap/cyrus-imapd/blob/master/docsrc/imap/concepts/overview_and_concepts.rst" class="fa fa-github"> Edit on GitHub</a>
</li>
</ul>
<hr/>
</div>
<div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
<div itemprop="articleBody">
<section id="concepts">
<h1>Concepts<a class="headerlink" href="#concepts" title="Permalink to this heading"></a></h1>
<p>This section gives an overview of several aspects of the Cyrus IMAP
server, as they relate to deployment. In an effort to reduce
duplication of information, we will often direct you to documentation
in other areas. Please do follow such referrals.</p>
<section id="access-control-lists">
<h2>Access Control Lists<a class="headerlink" href="#access-control-lists" title="Permalink to this heading"></a></h2>
<p>Access to each mailbox is controlled by access control
lists. Access Control Lists (ACLs) provide a powerful mechanism for
specifying the users, or groups of users, who have permission to access
the mailboxes, and the degree of that access.</p>
<p>An ACL is a list of zero or more entries. Each entry contains a
mailbox, an Access Control Identifier (ACI) and a set of rights. The
ACI specifies the user or group of users for which the entry
applies. The set of rights is one or more letters or digits, each
letter or digit conferring a particular privilege.</p>
<section id="working-with-acls">
<h3>Working with ACLs<a class="headerlink" href="#working-with-acls" title="Permalink to this heading"></a></h3>
<p>ACLs are manipulated via these subcommands within the
<a class="reference internal" href="../reference/manpages/systemcommands/cyradm.html#std-cyrusman-cyradm-8">cyradm(8)</a> program:</p>
<blockquote>
<div><ul class="simple">
<li><p><a class="reference internal" href="../reference/manpages/systemcommands/cyradm.html#imap-reference-manpages-systemcommands-cyradm-setaclmailbox"><span class="std std-ref">setaclmailbox</span></a></p></li>
<li><p><a class="reference internal" href="../reference/manpages/systemcommands/cyradm.html#imap-reference-manpages-systemcommands-cyradm-listaclmailbox"><span class="std std-ref">listaclmailbox</span></a></p></li>
<li><p><a class="reference internal" href="../reference/manpages/systemcommands/cyradm.html#imap-reference-manpages-systemcommands-cyradm-deleteaclmailbox"><span class="std std-ref">deleteaclmailbox</span></a></p></li>
</ul>
</div></blockquote>
</section>
<section id="sample-acl">
<h3>Sample ACL<a class="headerlink" href="#sample-acl" title="Permalink to this heading"></a></h3>
<p>A typical ACL is expressed like this:</p>
<pre class="literal-block"><strong>setaclmailbox</strong> <em>mailbox</em> <em>id</em> <em>rights</em> [<em>id</em> <em>rights</em> ...]</pre>
<p>where <em>mailbox</em> is the name of the mailbox to which the ACL is applied,
<em>id</em> is the ACI for the user or group for which the ACL applies, and
<em>rights</em> is a concatenated list of Access Rights from the list below.</p>
<p>A real world example may look like this:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">setaclmailbox</span> <span class="n">user</span><span class="o">/</span><span class="n">bovik</span><span class="o">/</span><span class="n">public</span> <span class="n">bovik</span> <span class="nb">all</span> <span class="n">group</span><span class="p">:</span><span class="n">users</span> <span class="n">lrsp</span> <span class="n">anyone</span> <span class="n">lrs</span>
</pre></div>
</div>
<p>Here are samples illustrated via output from the <code class="docutils literal notranslate"><span class="pre">listaclmailbox</span></code>
command in <a class="reference internal" href="../reference/manpages/systemcommands/cyradm.html#std-cyrusman-cyradm-8">cyradm(8)</a>:</p>
<pre class="literal-block">localhost> <strong>listaclmailbox tech/%</strong>
tech/Commits:
group:tech lrswipkxtea
anyone lrs
tech/abuse:
group:tech lrswipkxtecda
anyone lrsp
tech/security:
anyone lrsp
group:tech lrswipkxtecda
tech/support:
group:tech lrswipkxtecda
anyone lrsp
localhost> <strong>listaclmailbox user/bovik/%</strong>
user/bovik/Drafts:
bovik lrswipkxtecda
user/bovik/Sent:
bovik lrswipkxtecda
user/bovik/Sent Items:
bovik lrswipkxtecda
user/bovik/Spam:
anyone p
bovik lrswipkxtecda
user/bovik/Trash:
bovik lrswipkxtecda</pre>
</section>
<section id="access-rights">
<h3>Access Rights<a class="headerlink" href="#access-rights" title="Permalink to this heading"></a></h3>
<p>The following lists Access Rights that can be used in an Access Control
List entry.</p>
<dl class="simple">
<dt>l</dt><dd><p>The user may see that the mailbox exists (<strong>lookup</strong>).</p>
</dd>
<dt>r</dt><dd><p>The user may read the mailbox (<strong>read</strong>).</p>
</dd>
<dt>s</dt><dd><p>Keep per-user seen state (i.e. modify the "Seen" flag)
(<strong>setseen</strong>).</p>
</dd>
<dt>w</dt><dd><p>The user may modify flags and keywords other than "Seen" and
"Deleted". (<strong>write</strong>)</p>
</dd>
<dt>i</dt><dd><p>The user may insert (append) new messages into the mailbox
(<strong>insert</strong>).</p>
</dd>
<dt>p</dt><dd><p>The user may send email to the submission address for the mailbox
(<strong>post</strong>).</p>
</dd>
<dt>c</dt><dd><p>[<strong>deprecated</strong>: see <code class="docutils literal notranslate"><span class="pre">k</span></code> right, below.]</p>
</dd>
<dt>k</dt><dd><p>The user may create new mailboxes in this mailbox, delete the
current mailbox, or rename the mailbox (<strong>create</strong>).</p>
</dd>
<dt>x</dt><dd><p>The user may delete the mailbox itself. (<strong>deletembox</strong>)</p>
</dd>
<dt>t</dt><dd><p>The user may store the "Deleted" flag. In other words, delete
messages.</p>
</dd>
<dt>e</dt><dd><p>The user may Expunge messages which have the "Deleted" flag already
set (<strong>expunge</strong>).</p>
</dd>
<dt>d</dt><dd><p>This "legacy" right is treated by the software as a macro for <code class="docutils literal notranslate"><span class="pre">te</span></code>
(<strong>deletemsg</strong> && <strong>expunge</strong>).</p>
</dd>
<dt>n</dt><dd><p>The user may store annotations for a message (<strong>annotatemsg</strong>)</p>
</dd>
<dt>a</dt><dd><p>The user may change the <em>Access Control Information</em> (ACI) on the
mailbox (<strong>administer</strong>).</p>
</dd>
</dl>
<p>For a complete reference to Access Rights, please see
<a class="reference internal" href="../reference/admin/access-control/rights-reference.html#imap-admin-access-control-lists-rights-reference"><span class="std std-ref">Access Control Lists Rights Reference</span></a></p>
<p>Rights are combined through concatenation. Please see
<a class="reference internal" href="../reference/admin/access-control/combining-rights.html#imap-admin-access-control-combining-rights"><span class="std std-ref">Combining Access Rights</span></a></p>
</section>
<section id="access-control-defaults">
<h3>Access Control Defaults<a class="headerlink" href="#access-control-defaults" title="Permalink to this heading"></a></h3>
<section id="administrators">
<h4>Administrators<a class="headerlink" href="#administrators" title="Permalink to this heading"></a></h4>
<p>Regardless of the ACL on a mailbox, users who are listed in the
<code class="docutils literal notranslate"><span class="pre">admins</span></code> configuration option in <a class="reference internal" href="../reference/manpages/configs/imapd.conf.html#std-cyrusman-imapd.conf-5">imapd.conf(5)</a> implicitly
have the <code class="docutils literal notranslate"><span class="pre">l</span></code> and <code class="docutils literal notranslate"><span class="pre">a</span></code> rights on all mailboxes.</p>
<p>Administrators can also see across domains which normal users cannot.</p>
<div class="admonition warning">
<p class="admonition-title">Warning</p>
<p>An admin user should not be a normal email account.</p>
</div>
</section>
<section id="mailbox-owners">
<h4>Mailbox owners<a class="headerlink" href="#mailbox-owners" title="Permalink to this heading"></a></h4>
<p>The user who owns a mailbox folder has additional rights which are set
regardless of any additional ACLs. These are:</p>
<ul class="simple">
<li><p><strong>l</strong> - <a class="reference internal" href="../reference/admin/access-control/rights-reference.html#imap-admin-access-control-right-l"><span class="std std-ref">lookup</span></a></p></li>
<li><p><strong>k</strong> - <a class="reference internal" href="../reference/admin/access-control/rights-reference.html#imap-admin-access-control-right-k"><span class="std std-ref">create subfolders</span></a></p></li>
<li><p><strong>x</strong> - <a class="reference internal" href="../reference/admin/access-control/rights-reference.html#imap-admin-access-control-right-x"><span class="std std-ref">delete this folder</span></a></p></li>
<li><p><strong>a</strong> - <a class="reference internal" href="../reference/admin/access-control/rights-reference.html#imap-admin-access-control-right-a"><span class="std std-ref">administer</span></a></p></li>
</ul>
<p>These are set in <code class="docutils literal notranslate"><span class="pre">implicit_owner_rights</span></code> of <a class="reference internal" href="../reference/manpages/configs/imapd.conf.html#std-cyrusman-imapd.conf-5">imapd.conf(5)</a>.</p>
</section>
<section id="default">
<h4>Default<a class="headerlink" href="#default" title="Permalink to this heading"></a></h4>
<p>For all other mailboxes not owned by a user, any user accessing these
mailboxes have the following default privileges:</p>
<ul class="simple">
<li><p><strong>l</strong> - <a class="reference internal" href="../reference/admin/access-control/rights-reference.html#imap-admin-access-control-right-l"><span class="std std-ref">lookup</span></a></p></li>
<li><p><strong>r</strong> - <a class="reference internal" href="../reference/admin/access-control/rights-reference.html#imap-admin-access-control-right-r"><span class="std std-ref">read contents</span></a></p></li>
<li><p><strong>s</strong> - <a class="reference internal" href="../reference/admin/access-control/rights-reference.html#imap-admin-access-control-right-s"><span class="std std-ref">seen</span></a></p></li>
</ul>
<p>These are set in <code class="docutils literal notranslate"><span class="pre">defaultacl</span></code> of <a class="reference internal" href="../reference/manpages/configs/imapd.conf.html#std-cyrusman-imapd.conf-5">imapd.conf(5)</a>.</p>
</section>
<section id="initial-acls-for-newly-created-mailboxes">
<h4>Initial ACLs for Newly Created Mailboxes<a class="headerlink" href="#initial-acls-for-newly-created-mailboxes" title="Permalink to this heading"></a></h4>
<p>When a mailbox is created, its ACL starts off with a copy of the ACL of its closest parent mailbox. When a user is created, the ACL on the user's <code class="docutils literal notranslate"><span class="pre">INBOX</span></code> starts off with a single entry granting all rights to the user. When a non-user mailbox is created and does not have a parent, its ACL is initialized to the value of the <code class="docutils literal notranslate"><span class="pre">defaultacl</span></code> option in <a class="reference internal" href="../reference/manpages/configs/imapd.conf.html#std-cyrusman-imapd.conf-5">imapd.conf(5)</a>.</p>
</section>
<section id="other-implicit-rights">
<h4>Other Implicit Rights<a class="headerlink" href="#other-implicit-rights" title="Permalink to this heading"></a></h4>
<p>Note that some rights are available implicitly, for example 'anonymous'
always has 'p' on user INBOXes, and users always have <code class="docutils literal notranslate"><span class="pre">la</span></code> rights on
mailboxes within their INBOX hierarchy.</p>
</section>
</section>
<section id="access-control-identifier-aci">
<h3>Access Control Identifier (ACI)<a class="headerlink" href="#access-control-identifier-aci" title="Permalink to this heading"></a></h3>
<p>The Access Control Identifier (ACI) part of an ACL entry specifies the
user or group for which the entry applies. Group identifiers are
distinguished by the prefix "group:". For example, "group:accounting".</p>
<p>There are two special identifiers, "anonymous", and "anyone". The meaning of
other identifiers usually depends on the
<a class="reference internal" href="../reference/admin/access-control/identifiers.html#imap-admin-access-control-authorization-mechanisms"><span class="std std-ref">authorization mechanism</span></a>
being used.</p>
<section id="anonymous-and-anyone">
<h4><code class="docutils literal notranslate"><span class="pre">anonymous</span></code> and <code class="docutils literal notranslate"><span class="pre">anyone</span></code><a class="headerlink" href="#anonymous-and-anyone" title="Permalink to this heading"></a></h4>
<p>With any authorization mechanism, two special identifiers are defined.
The identifier <code class="docutils literal notranslate"><span class="pre">anonymous</span></code> refers to the anonymous, or unauthenticated
user. The identifier <code class="docutils literal notranslate"><span class="pre">anyone</span></code> refers to all users, including the
anonymous user.</p>
<p>Both <code class="docutils literal notranslate"><span class="pre">anonymous</span></code> and <code class="docutils literal notranslate"><span class="pre">anyone</span></code> may commonly be used with the <strong>post</strong>
right <code class="docutils literal notranslate"><span class="pre">p</span></code> to allow message insertion to mailboxes.</p>
</section>
</section>
<section id="negative-rights">
<h3>Negative Rights<a class="headerlink" href="#negative-rights" title="Permalink to this heading"></a></h3>
<p>Any of the above defined identifiers may be prefixed with a <code class="docutils literal notranslate"><span class="pre">-</span></code>
character. The associated rights are then removed from that identifier.
These are referred to as <em>negative rights</em>.</p>
</section>
<section id="calculating-a-users-rights">
<h3>Calculating a Users' Rights<a class="headerlink" href="#calculating-a-users-rights" title="Permalink to this heading"></a></h3>
<p>To calculate the set of rights granted to a user, the server first
calculates the union of all of the rights granted to the user and to
all groups the user is a member of. The server then calculates and
removes the union of all the negative rights granted to the user and to
all groups the user is a member of.</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">anyone</span> <span class="n">lrsp</span>
<span class="n">fred</span> <span class="n">lwi</span>
<span class="o">-</span><span class="n">anonymous</span> <span class="n">s</span>
</pre></div>
</div>
<p>The user <code class="docutils literal notranslate"><span class="pre">fred</span></code> will be granted the rights <code class="docutils literal notranslate"><span class="pre">lrswip</span></code> and the
anonymous user will be granted the rights <code class="docutils literal notranslate"><span class="pre">lrp</span></code>.</p>
</section>
</section>
<section id="login-authentication">
<span id="imap-concepts-login-authentication"></span><h2>Login Authentication<a class="headerlink" href="#login-authentication" title="Permalink to this heading"></a></h2>
<p>This section discusses different types of authentication (ways of logging in) that can be used with Cyrus IMAP.</p>
<p>The Cyrus IMAP server uses the Cyrus SASL library for authentication. This section describes how to configure SASL with use with Cyrus imapd. Please consult the <a class="reference external" href="https://www.cyrusimap.org/sasl/index.html#sasl-index" title="(in Cyrus SASL v2.1.28)"><span class="xref std std-ref">Cyrus SASL System Administrator's Guide</span></a> for more detailed, up-to-date information.</p>
<section id="anonymous-login">
<h3>Anonymous Login<a class="headerlink" href="#anonymous-login" title="Permalink to this heading"></a></h3>
<p>Regardless of the SASL mechanism used by an individual connection, the
server may support anonymous login. If the <code class="docutils literal notranslate"><span class="pre">allowanonymouslogin</span></code>
option in <a class="reference internal" href="../reference/manpages/configs/imapd.conf.html#std-cyrusman-imapd.conf-5">imapd.conf(5)</a> is turned on, then the server will
permit plaintext password logins using the user <code class="docutils literal notranslate"><span class="pre">anonymous</span></code> and any
password.</p>
<p>Additionally, the server will enable any SASL mechanisms that allow anonymous logins.</p>
</section>
<section id="plaintext-authentication">
<h3>Plaintext Authentication<a class="headerlink" href="#plaintext-authentication" title="Permalink to this heading"></a></h3>
<p>The SASL library has several ways of verifying plaintext passwords. Plaintext passwords are passed either by the IMAP <code class="docutils literal notranslate"><span class="pre">LOGIN</span></code> command or by the SASL <code class="docutils literal notranslate"><span class="pre">PLAIN</span></code> mechanism (under a TLS layer).</p>
<ul class="simple">
<li><p>PAM</p></li>
<li><p>GSSAPI: Plaintext passwords are verified by obtaining a ticket for the server's Kerberos identity, to protect against Kerberos server spoofing attacks.</p></li>
<li><p><code class="docutils literal notranslate"><span class="pre">/etc/passwd</span></code></p></li>
<li><p><code class="docutils literal notranslate"><span class="pre">/etc/shadow</span></code>: <code class="docutils literal notranslate"><span class="pre">sasl_auto_transition</span></code> automatically creates secrets for shared secret authentication when given a password.</p></li>
</ul>
<p>The method of plaintext password verification is always through the SASL library, even in the case of the internal LOGIN command. This is to allow the SASL library to be the only source of authentication information. You'll want to look at the <code class="docutils literal notranslate"><span class="pre">sasl_pwcheck_method</span></code> option in the SASL documentation to understand how to configure a plaintext password verifier for your system.</p>
<p>To disallow the use of plaintext passwords for authentication, you can set <code class="docutils literal notranslate"><span class="pre">allowplaintext:</span> <span class="pre">no</span></code> in imapd.conf. This will still allow PLAIN under TLS, but IMAP LOGIN commands will now fail.</p>
</section>
<section id="kerberos-logins">
<h3>Kerberos Logins<a class="headerlink" href="#kerberos-logins" title="Permalink to this heading"></a></h3>
<p>The Kerberos SASL mechanism supports the <code class="docutils literal notranslate"><span class="pre">GSSAPI</span></code> authentication mechanism. The mechanism requires that a <code class="docutils literal notranslate"><span class="pre">keytab</span></code> file exist in the location given in the <code class="docutils literal notranslate"><span class="pre">sasl_keytab</span></code> configuration option. The <code class="docutils literal notranslate"><span class="pre">keytab</span></code> file must be readable by the Cyrus server and must contain a <code class="docutils literal notranslate"><span class="pre">$service/$host@$realm</span></code> service key. <code class="docutils literal notranslate"><span class="pre">$host</span></code> is the first component of the server's host name, the FQDN or IP address (whatever the client uses). <code class="docutils literal notranslate"><span class="pre">$realm</span></code> is the server's Kerberos realm. <code class="docutils literal notranslate"><span class="pre">$service</span></code> is name of the service: <code class="docutils literal notranslate"><span class="pre">imap</span></code>, <code class="docutils literal notranslate"><span class="pre">HTTP</span></code>, <code class="docutils literal notranslate"><span class="pre">sieve</span></code>.</p>
<p>The server will permit logins by identities in the local realm and identities in the realms listed in the <code class="docutils literal notranslate"><span class="pre">loginrealms</span></code> option in <a class="reference internal" href="../reference/manpages/configs/imapd.conf.html#std-cyrusman-imapd.conf-5">imapd.conf(5)</a>.</p>
<p>If the <code class="docutils literal notranslate"><span class="pre">loginuseacl</span></code> configuration option is turned on, than any Kerberos identity that is granted the <code class="docutils literal notranslate"><span class="pre">a</span></code> right on the user's <code class="docutils literal notranslate"><span class="pre">INBOX</span></code> is permitted to log in as that user.</p>
</section>
<section id="shared-secrets-logins">
<h3>Shared Secrets Logins<a class="headerlink" href="#shared-secrets-logins" title="Permalink to this heading"></a></h3>
<p>The SCRAM mechanisms require the user and the server to share a secret (generally a password) that can be used for comparison without actually passing the password in the clear across the network. For these mechanisms, you will need to supply a source of passwords, such as the sasldb (which is described more fully in the <a class="reference external" href="https://www.cyrusimap.org/sasl/index.html#sasl-index" title="(in Cyrus SASL v2.1.28)"><span class="xref std std-ref">Cyrus SASL distribution</span></a>).</p>
</section>
</section>
<section id="quotas">
<h2>Quotas<a class="headerlink" href="#quotas" title="Permalink to this heading"></a></h2>
<p>Quotas allow server administrators to limit resources used by hierarchies of mailboxes on the server.</p>
<section id="working-with-quotas">
<h3>Working with Quotas<a class="headerlink" href="#working-with-quotas" title="Permalink to this heading"></a></h3>
<p>Quotas are manipulated via these subcommands within the
<a class="reference internal" href="../reference/manpages/systemcommands/cyradm.html#std-cyrusman-cyradm-8">cyradm(8)</a> program:</p>
<blockquote>
<div><ul class="simple">
<li><p><a class="reference internal" href="../reference/manpages/systemcommands/cyradm.html#imap-reference-manpages-systemcommands-cyradm-setquota"><span class="std std-ref">setquota</span></a></p></li>
<li><p><a class="reference internal" href="../reference/manpages/systemcommands/cyradm.html#imap-reference-manpages-systemcommands-cyradm-listquota"><span class="std std-ref">listquota</span></a></p></li>
<li><p><a class="reference internal" href="../reference/manpages/systemcommands/cyradm.html#imap-reference-manpages-systemcommands-cyradm-listquotaroot"><span class="std std-ref">listquotaroot</span></a></p></li>
</ul>
</div></blockquote>
</section>
<section id="monitor-and-repair">
<h3>Monitor and Repair<a class="headerlink" href="#monitor-and-repair" title="Permalink to this heading"></a></h3>
<p>Quotas may be monitored and repaired via the <a class="reference internal" href="../reference/manpages/systemcommands/quota.html#std-cyrusman-quota-8">quota(8)</a>
command:</p>
<blockquote>
<div><ul class="simple">
<li><p><a class="reference internal" href="../reference/manpages/systemcommands/quota.html#imap-reference-manpages-systemcommands-quota"><span class="std std-ref">quota</span></a></p></li>
</ul>
</div></blockquote>
</section>
<section id="supported-quota-types">
<h3>Supported Quota Types<a class="headerlink" href="#supported-quota-types" title="Permalink to this heading"></a></h3>
<p>The Cyrus IMAP server supports quotas on Storage (KB), Messages (#),
Folders (#) and Annotation Storage (KB). These types each have their
own identifier:</p>
<blockquote>
<div><ul class="simple">
<li><p>STORAGE</p></li>
<li><p>MESSAGE</p></li>
<li><p>X-NUM-FOLDERS</p></li>
<li><p>X-ANNOTATION-STORAGE</p></li>
</ul>
</div></blockquote>
<section id="storage-quotas">
<h4>Storage Quotas<a class="headerlink" href="#storage-quotas" title="Permalink to this heading"></a></h4>
<p>Storage quotas are defined as the number of kilobytes (KB) of the
relevant <span class="target" id="index-0"></span><a class="rfc reference external" href="https://datatracker.ietf.org/doc/html/rfc822.html"><strong>RFC 822</strong></a> messages located within a quota root. Each copy of
a message is counted independently, even when the server can conserve
disk space use by making hard links to message files. The additional
disk space overhead used by mailbox index and cache files is not
charged against a quota. On servers with <code class="docutils literal notranslate"><span class="pre">delete_mode:</span> <span class="pre">delayed</span></code>
and/or <code class="docutils literal notranslate"><span class="pre">expunge_mode:delayed</span></code> space used by deleted mailboxes or
expunged messages are not charged against quota.</p>
</section>
<section id="numeric-quotas">
<h4>Numeric Quotas<a class="headerlink" href="#numeric-quotas" title="Permalink to this heading"></a></h4>
<p>Numeric Quotas are quite simply a limit on the number of a particular
class of object. Cyrus IMAP currently supports quotas on the number of
messages and/or folders below a given quota root.</p>
</section>
</section>
<section id="quota-roots">
<h3>Quota Roots<a class="headerlink" href="#quota-roots" title="Permalink to this heading"></a></h3>
<p>Quotas are applied to quota roots, which can be at any level of the mailbox hierarchy. Quota roots need not also be mailboxes.</p>
<p>Quotas on a quota root apply to the sum of the usage of any mailbox at that level and any sub-mailboxes of that level that are not underneath a quota root on a sub-hierarchy. This means that each mailbox is limited by at most one quota root.</p>
<p>For example, if the mailboxes</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">user</span><span class="o">/</span><span class="n">bovik</span>
<span class="n">user</span><span class="o">/</span><span class="n">bovik</span><span class="o">/</span><span class="nb">list</span><span class="o">/</span><span class="n">imap</span>
<span class="n">user</span><span class="o">/</span><span class="n">bovik</span><span class="o">/</span><span class="nb">list</span><span class="o">/</span><span class="n">info</span><span class="o">-</span><span class="n">cyrus</span>
<span class="n">user</span><span class="o">/</span><span class="n">bovik</span><span class="o">/</span><span class="n">saved</span>
<span class="n">user</span><span class="o">/</span><span class="n">bovik</span><span class="o">/</span><span class="n">todo</span>
</pre></div>
</div>
<p>exist and the quota roots</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">user</span><span class="o">/</span><span class="n">bovik</span>
<span class="n">user</span><span class="o">/</span><span class="n">bovik</span><span class="o">/</span><span class="nb">list</span>
<span class="n">user</span><span class="o">/</span><span class="n">bovik</span><span class="o">/</span><span class="n">saved</span>
</pre></div>
</div>
<p>exist, then the quota root <code class="docutils literal notranslate"><span class="pre">user/bovik</span></code> applies to the mailboxes <code class="docutils literal notranslate"><span class="pre">user/bovik</span></code> and <code class="docutils literal notranslate"><span class="pre">user/bovik/todo</span></code>; the quota root <code class="docutils literal notranslate"><span class="pre">user/bovik/list</span></code> applies to the mailboxes <code class="docutils literal notranslate"><span class="pre">user/bovik/list/imap</span></code> and <code class="docutils literal notranslate"><span class="pre">user/bovik/list/info-cyrus</span></code>; and the quota root <code class="docutils literal notranslate"><span class="pre">user/bovik/saved</span></code> applies to the mailbox <code class="docutils literal notranslate"><span class="pre">user/bovik/saved</span></code>.</p>
<p>Quota roots are created automatically when they are mentioned in the
<a class="reference internal" href="../reference/manpages/systemcommands/cyradm.html#imap-reference-manpages-systemcommands-cyradm-setquota"><span class="std std-ref">setquota</span></a> command. Quota
roots may not be deleted through the protocol, see Removing Quota Roots
for instructions on how to delete them.</p>
</section>
<section id="controlling-quota-behavior">
<h3>Controlling Quota Behavior<a class="headerlink" href="#controlling-quota-behavior" title="Permalink to this heading"></a></h3>
<p>How restrictive quotas will be may be tailored to the needs of different
sites, via the use of several settings in <a class="reference internal" href="../reference/manpages/configs/imapd.conf.html#std-cyrusman-imapd.conf-5">imapd.conf(5)</a>.</p>
<p>Please consult the <a class="reference internal" href="../reference/admin/quotas.html#imap-admin-quotas-config"><span class="std std-ref">Controlling Quota Behavior</span></a> section of the Cyrus
IMAP Administrator Guide for complete details.</p>
</section>
<section id="mail-delivery-behavior">
<h3>Mail Delivery Behavior<a class="headerlink" href="#mail-delivery-behavior" title="Permalink to this heading"></a></h3>
<section id="mailboxes-near-quota">
<h4>Mailboxes Near Quota<a class="headerlink" href="#mailboxes-near-quota" title="Permalink to this heading"></a></h4>
<p>Normally, in order for a message to be <em>appended</em> into a mailbox, the
quota root for the mailbox must have enough unused storage that
appending the message will not cause the quota to go over limit.</p>
<p>Mail delivery (posting) is a special case. In order for a message to be
delivered to a mailbox, the quota root for the mailbox merely need not
already be over the limit <em>in the default configuration</em>.</p>
<p>As long as usage is not over the limit, new messages may be delivered
regardless of size, unless <code class="docutils literal notranslate"><span class="pre">lmtp_strict_quota:</span> <span class="pre">on</span></code> is set in
<a class="reference internal" href="../reference/manpages/configs/imapd.conf.html#std-cyrusman-imapd.conf-5">imapd.conf(5)</a>. In that case, delivery of messages will be
rejected would such delivery exceed quota.</p>
<p>If a delivery puts the mailbox's usage over the quota, the server will
issue an alert notifying the user that usage is close to or over the
limit, permitting them to correct it. If delivery were not permitted in
this case, the user would have no practical way of knowing that there
was mail that could not be delivered.</p>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>While the Cyrus IMAP server may from time to time issue alerts,
there is great variability in how IMAP clients handle these.
Further, such alerts are only visible to users <em>while they are
connected</em>.</p>
<p>Therefore, many sites find it preferable to install cron jobs which
use the <a class="reference internal" href="../reference/manpages/systemcommands/quota.html#std-cyrusman-quota-8">quota(8)</a> command to produce periodic reports of
users at or near quota, so administrators may nag them or so that
warnings may be issued to users via some other mechanism.</p>
</div>
</section>
<section id="mailboxes-over-quota">
<h4>Mailboxes Over Quota<a class="headerlink" href="#mailboxes-over-quota" title="Permalink to this heading"></a></h4>
<p>If the usage is over the limit, mail delivery will fail with a temporary
error (LMTP error 452), unless <code class="docutils literal notranslate"><span class="pre">lmtp_over_quota_perm_failure:</span> <span class="pre">on</span></code>
is set in <a class="reference internal" href="../reference/manpages/configs/imapd.conf.html#std-cyrusman-imapd.conf-5">imapd.conf(5)</a> in which case a permanent error
(LMTP error 552) will be returned.</p>
<p>A temporary error will <em>typically</em> cause the delivery system to requeue
the message and re-attempt delivery for a few days (permitting the user
time to notice and correct the problem) before returning the mail to
the sender.</p>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>Such requeuing behaviour is controlled by the MTA (i.e. Sendmail,
EXIM or Postfix) and as such is outside the purview of this
document.</p>
</div>
</section>
</section>
<section id="quota-warnings-upon-select-when-user-has-d-rights">
<h3>Quota Warnings Upon Select When User Has <code class="docutils literal notranslate"><span class="pre">d</span></code> Rights<a class="headerlink" href="#quota-warnings-upon-select-when-user-has-d-rights" title="Permalink to this heading"></a></h3>
<p>When a user selects a mailbox whose quota root has usage that is close to or
over the limit and the user has <code class="docutils literal notranslate"><span class="pre">d</span></code> rights on the mailbox, the server will
issue an alert notifying the user that usage is close to or over the limit.
The threshold of usage at which the server will issue quota warnings is set
by the <code class="docutils literal notranslate"><span class="pre">quotawarnpercent</span></code> configuration option.</p>
<p>The server only issues warnings when the user has <code class="docutils literal notranslate"><span class="pre">d</span></code> rights because only
users with <code class="docutils literal notranslate"><span class="pre">d</span></code> rights are capable of correcting the problem.</p>
</section>
<section id="quotas-and-partitions">
<h3>Quotas and Partitions<a class="headerlink" href="#quotas-and-partitions" title="Permalink to this heading"></a></h3>
<p>Quota roots are independent of partitions. A single quota root can apply to mailboxes in different partitions.</p>
</section>
</section>
<section id="new-mail-notification">
<h2>New Mail Notification<a class="headerlink" href="#new-mail-notification" title="Permalink to this heading"></a></h2>
<p>The Cyrus IMAP server comes with a notification daemon which supports
multiple mechanisms for notifying users of new mail. Notifications can
be configured to be sent upon normal delivery (<code class="docutils literal notranslate"><span class="pre">MAIL</span></code> class) and/or
sent as requested by a Sieve script (<code class="docutils literal notranslate"><span class="pre">SIEVE</span></code> class).</p>
<p>By default, both types of notifications are disabled. Notifications are
enabled by using one or both of the following configuration options:</p>
<ul class="simple">
<li><p>the <code class="docutils literal notranslate"><span class="pre">mailnotifier</span></code> option selects the <a class="reference internal" href="../reference/manpages/systemcommands/notifyd.html#std-cyrusman-notifyd-8">notifyd(8)</a> method
to use for <code class="docutils literal notranslate"><span class="pre">MAIL</span></code> class notifications</p></li>
<li><p>the <code class="docutils literal notranslate"><span class="pre">sievenotifier</span></code> option selects the <a class="reference internal" href="../reference/manpages/systemcommands/notifyd.html#std-cyrusman-notifyd-8">notifyd(8)</a>
method to use for <code class="docutils literal notranslate"><span class="pre">SIEVE</span></code> class notifications (when no method is
specified by the Sieve action)</p></li>
</ul>
</section>
<section id="partitions">
<h2>Partitions<a class="headerlink" href="#partitions" title="Permalink to this heading"></a></h2>
<p>Partitions allow administrators to store different mailboxes in different parts of the Unix filesystem. This is intended to be used to allow hierarchies of mailboxes to be spread across multiple disks.</p>
<section id="specifying-partitions-with-create">
<h3>Specifying Partitions with "create"<a class="headerlink" href="#specifying-partitions-with-create" title="Permalink to this heading"></a></h3>
<p>When an administrator creates a new mailbox, the name of the partition for the mailbox may be specified using an optional second argument to the "create" command. Non-administrators are not permitted to specify the partition of a mailbox. If the partition is not specified, then the mailbox inherits the partition of its most immediate parent mailbox. If the mailbox has no parent, it gets the partition specified in the "defaultpartition" configuration option.</p>
<p>The optional second argument to the "create" command can usually be given only when using a specialized Cyrus-aware administrative client such as <code class="docutils literal notranslate"><span class="pre">cyradm</span></code>.</p>
</section>
<section id="changing-partitions-with-rename">
<h3>Changing Partitions with "rename"<a class="headerlink" href="#changing-partitions-with-rename" title="Permalink to this heading"></a></h3>
<p>An administrator may change the partition of a mailbox by using the
rename command with an optional third argument. When a third argument
to rename is given, the first and second arguments can be the
same; this changes the partition of a mailbox without changing its
name. If a third argument to rename is not given and the first
argument is not <code class="docutils literal notranslate"><span class="pre">INBOX</span></code>, the partition of a mailbox does not change.
If a third argument to rename is not given and the first argument is
<code class="docutils literal notranslate"><span class="pre">INBOX</span></code>, the newly created mailbox gets the same partition it would
get from the <code class="docutils literal notranslate"><span class="pre">create</span></code> command.</p>
</section>
</section>
<section id="news">
<h2>News<a class="headerlink" href="#news" title="Permalink to this heading"></a></h2>
<p>Cyrus has the ability to export Usenet via IMAP and/or export shared
IMAP mailboxes via an NNTP server which is included with Cyrus.</p>
</section>
<section id="pop3-server">
<h2>POP3 Server<a class="headerlink" href="#pop3-server" title="Permalink to this heading"></a></h2>
<p>The Cyrus IMAP server software comes with a compatibility POP3 server.
Due to limitations in the POP3 protocol, the server can only access a
user's <code class="docutils literal notranslate"><span class="pre">INBOX</span></code> and only one instance of a POP3 server may exist for any
one user at any time. While a POP3 server has a user's <code class="docutils literal notranslate"><span class="pre">INBOX</span></code> open,
expunge operations from any concurrent IMAP session will fail.</p>
<p>When Kerberos login authentication is being used, the POP3 server
uses the server identity
<code class="docutils literal notranslate"><span class="pre">pop.host@realm</span></code> instead of
<code class="docutils literal notranslate"><span class="pre">imap.host@realm</span></code>, where
<code class="docutils literal notranslate"><span class="pre">host</span></code> is the first component of the server's host
name and <code class="docutils literal notranslate"><span class="pre">realm</span></code> is the server's Kerberos realm.</p>
</section>
<section id="the-syslog-facility">
<h2>The syslog facility<a class="headerlink" href="#the-syslog-facility" title="Permalink to this heading"></a></h2>
<p>The Cyrus IMAP server software sends log messages to the <code class="docutils literal notranslate"><span class="pre">local6</span></code>
syslog facility. The severity levels used are:</p>
<ul class="simple">
<li><p><strong>CRIT</strong> - Critical errors which probably require prompt administrator action</p></li>
<li><p><strong>ERR</strong> - I/O errors, including failure to update quota usage. The syslog message includes the specific file and Unix error.</p></li>
<li><p><strong>WARNING</strong> - Protection mechanism failures, client inactivity timeouts</p></li>
<li><p><strong>NOTICE</strong> - Authentications, both successful and unsuccessful</p></li>
<li><p><strong>INFO</strong> - Mailbox openings, duplicate delivery suppression</p></li>
</ul>
</section>
<section id="mail-directory-recovery">
<h2>Mail Directory Recovery<a class="headerlink" href="#mail-directory-recovery" title="Permalink to this heading"></a></h2>
<p>This section describes the various databases used by the Cyrus IMAP
server software and what can be done to recover from various
inconsistencies in these databases.</p>
<section id="reconstructing-mailbox-directories">
<h3>Reconstructing Mailbox Directories<a class="headerlink" href="#reconstructing-mailbox-directories" title="Permalink to this heading"></a></h3>
<p>The largest database is the mailbox directories. Each
mailbox directory contains the following files:</p>
<dl>
<dt>message files</dt><dd><p>There is one file per message, containing the message in <span class="target" id="index-1"></span><a class="rfc reference external" href="https://datatracker.ietf.org/doc/html/rfc822.html"><strong>RFC 822</strong></a> format. Lines in the message are separated by CRLF, not just LF. The file name of each message is the message's UID followed by a dot (.).</p>
<p>In netnews newsgroups, the message files instead follow the format and naming conventions imposed by the netnews software.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">cyrus.header</span></code></dt><dd><p>This file contains a magic number and variable-length information about the mailbox itself.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">cyrus.index</span></code></dt><dd><p>This file contains fixed-length information about the mailbox itself and each message in the mailbox.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">cyrus.cache</span></code></dt><dd><p>This file contains variable-length information about each message in the mailbox.</p>
</dd>
<dt><code class="docutils literal notranslate"><span class="pre">cyrus.seen</span></code></dt><dd><p>This file contains variable-length state information about each reader of the mailbox who has <code class="docutils literal notranslate"><span class="pre">s</span></code> permissions.</p>
</dd>
</dl>
<p>The <code class="docutils literal notranslate"><span class="pre">reconstruct</span></code> program can be used to recover from
corruption in mailbox directories. If <code class="docutils literal notranslate"><span class="pre">reconstruct</span></code> can find
existing header and index files, it attempts to preserve any data in
them that is not derivable from the message files themselves. The
state <code class="docutils literal notranslate"><span class="pre">reconstruct</span></code> attempts to preserve includes the flag
names, flag state, and internal date. <code class="docutils literal notranslate"><span class="pre">Reconstruct</span></code>
derives all other information from the message files.</p>
<p>An administrator may recover from a damaged disk by restoring message
files from a backup and then running reconstruct to regenerate what it
can of the other files.</p>
<p>The <code class="docutils literal notranslate"><span class="pre">reconstruct</span></code> program does not adjust the quota usage
recorded in any quota root files. After running reconstruct, it is
advisable to run <code class="docutils literal notranslate"><span class="pre">quota</span> <span class="pre">-f</span></code> (described below) in order to fix
the quota root files.</p>
</section>
<section id="reconstructing-the-mailboxes-file">
<h3>Reconstructing the Mailboxes File<a class="headerlink" href="#reconstructing-the-mailboxes-file" title="Permalink to this heading"></a></h3>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>CURRENTLY UNAVAILABLE</p>
</div>
<p>The mailboxes file in the configuration directory is the most critical
file in the entire Cyrus IMAP system. It contains a sorted list of
each mailbox on the server, along with the mailboxes quota root and
ACL.</p>
<p>To reconstruct a corrupted mailboxes file, run the <code class="docutils literal notranslate"><span class="pre">reconstruct</span>
<span class="pre">-m</span></code> command. The <code class="docutils literal notranslate"><span class="pre">reconstruct</span></code> program, when invoked
with the <code class="docutils literal notranslate"><span class="pre">-m</span></code> switch, scavenges and corrects whatever data it
can find in the existing mailboxes file. It then scans all partitions
listed in the imapd.conf file for additional mailbox directories to
put in the mailboxes file.</p>
<p>The <code class="docutils literal notranslate"><span class="pre">cyrus.header</span></code> file in each mailbox directory stores a
redundant copy of the mailbox ACL, to be used as a backup when
rebuilding the mailboxes file.</p>
</section>
<section id="reconstructing-quota-roots">
<h3>Reconstructing Quota Roots<a class="headerlink" href="#reconstructing-quota-roots" title="Permalink to this heading"></a></h3>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>The following instructions are valid where <code class="docutils literal notranslate"><span class="pre">quota_db:</span> <span class="pre">quotalegacy</span></code>
is set in <a class="reference internal" href="../reference/manpages/configs/imapd.conf.html#std-cyrusman-imapd.conf-5">imapd.conf(5)</a>. If your site uses a different
quota DB type, then these steps do not apply.</p>
</div>
<p>The subdirectory <code class="docutils literal notranslate"><span class="pre">quota</span></code> of the configuration directory (specified in
the <code class="docutils literal notranslate"><span class="pre">configdirectory</span></code> configuration option) contains one file per
quota root, with the file name being the name of the quota root. These
files store the quota usage and limits of each of the quota roots.</p>
<p>The <code class="docutils literal notranslate"><span class="pre">quota</span></code> program, when invoked with the <code class="docutils literal notranslate"><span class="pre">-f</span></code>
switch, recalculates the quota root of each mailbox and the quota
usage of each quota root.</p>
</section>
<section id="removing-quota-roots">
<h3>Removing Quota Roots<a class="headerlink" href="#removing-quota-roots" title="Permalink to this heading"></a></h3>
<p>To remove a quota root, remove the quota root's file. Then run
<code class="docutils literal notranslate"><span class="pre">quota</span> <span class="pre">-f</span></code> to make the quota files consistent again.</p>
</section>
<section id="subscriptions">
<h3>Subscriptions<a class="headerlink" href="#subscriptions" title="Permalink to this heading"></a></h3>
<p>The subdirectory <code class="docutils literal notranslate"><span class="pre">user</span></code> of the configuration directory contains user
subscriptions. There is one file per user, with a filename of the
userid followed by <code class="docutils literal notranslate"><span class="pre">.sub</span></code>. Each file contains a sorted list of
subscribed mailboxes.</p>
<p>There is no program to recover from damaged subscription files. A
site may recover from lost subscription files by restoring from backups.</p>
</section>
</section>
<section id="configuration-directory">
<h2>Configuration Directory<a class="headerlink" href="#configuration-directory" title="Permalink to this heading"></a></h2>
<p>Many objects in the configuration directory are discussed in
the Database Recovery section. This section documents two
other directories that reside in the configuration directory.</p>
<section id="log-directory">
<h3>Log Directory<a class="headerlink" href="#log-directory" title="Permalink to this heading"></a></h3>
<p>The subdirectory <code class="docutils literal notranslate"><span class="pre">log</span></code> under the configuration directory permits
administrators to keep protocol telemetry logs on a per-user basis.</p>
<p>If a subdirectory of <code class="docutils literal notranslate"><span class="pre">log</span></code> exists with the same name as a user, the
IMAP and POP3 servers will keep a telemetry log of protocol sessions
authenticating as that user. The telemetry log is stored in the
subdirectory with a filename of the server process-id and starts with
the first command following authentication.</p>
</section>
<section id="proc-directory">
<h3>Proc Directory<a class="headerlink" href="#proc-directory" title="Permalink to this heading"></a></h3>
<p>The subdirectory <code class="docutils literal notranslate"><span class="pre">proc</span></code> under the configuration directory
contains one file per active server process. The file name is the ASCII
representation of the process id and the file contains the following
tab-separated fields:</p>
<ul class="simple">
<li><p>hostname of the client</p></li>
<li><p>login name of the user, if logged in</p></li>
<li><p>selected mailbox, if a mailbox is selected</p></li>
</ul>
<p>The file may contain arbitrary characters after the first newline
character.</p>
<p>The <code class="docutils literal notranslate"><span class="pre">proc</span></code> subdirectory is normally be cleaned out on
server reboot.</p>
</section>
</section>
<section id="message-delivery">
<h2>Message Delivery<a class="headerlink" href="#message-delivery" title="Permalink to this heading"></a></h2>
<p>Mail transport agents such as Sendmail, Postfix, or Exim communicate
with the Cyrus server via LMTP (the Local Mail Transport Protocol)
implemented by the LMTP daemon. This can be done either directly by the
MTA (prefered, for performance reasons) or via the <code class="docutils literal notranslate"><span class="pre">deliver</span></code> LMTP
client.</p>
<section id="local-mail-transfer-protocol-lmtp">
<h3>Local Mail Transfer Protocol (lmtp)<a class="headerlink" href="#local-mail-transfer-protocol-lmtp" title="Permalink to this heading"></a></h3>
<p>LMTP, the Local Mail Transfer Protocol, is a variant of SMTP design for
transferring mail to the final message store. LMTP allows MTAs to deliver
"local" mail over a network. This is an easy optimization so that the
IMAP server doesn't need to maintain a queue of messages or run an
MTA.</p>
<p>The Cyrus server implements LMTP via the <code class="docutils literal notranslate"><span class="pre">lmtpd</span></code> daemon. LMTP
can either be used over a network via TCP or local via a UNIX domain
socket. There are security differences between these two alternatives; read
more below.</p>
<p>For final delivery via LMTP over a TCP socket, it is necessary to use
LMTP AUTH. This is accomplished using SASL to authenticate the delivering
user. If your mail server is performing delivery via LMTP AUTH (that is,
using a SASL mechanism), you will want their authentication id to be an
LMTP admins (either via the <code class="docutils literal notranslate"><span class="pre">admins</span></code> imapd.conf option or via the
<code class="docutils literal notranslate"><span class="pre"><service>_admins</span></code> option, typically <code class="docutils literal notranslate"><span class="pre">lmtp_admins</span></code>).</p>
<p>Alternatively you may deliver via LMTP to a unix domain socket, and the
connection will be preauthenticated as an administrative user (and access
control is accomplished by controlling access to the socket).</p>
<p>Note that if a user has a sieve script, the sieve script runs authorized
as <em>that</em> user, and the rights of the posting user are ignored for the purposes
of determining the outcome of the sieve script.</p>
</section>
<section id="single-instance-store">
<h3>Single Instance Store<a class="headerlink" href="#single-instance-store" title="Permalink to this heading"></a></h3>
<p>If a delivery attempt mentions several recipients (only possible if
the MTA is speaking LMTP to <code class="docutils literal notranslate"><span class="pre">lmtpd</span></code>), the server attempts to
store as few copies of a message as possible. It will store one copy
of the message per partition, and create hard links for all other
recipients of the message.</p>
<p>Single instance store can be turned off by using the
"singleinstancestore" flag in the configuration file.</p>
</section>
<section id="duplicate-delivery-suppression">
<h3>Duplicate Delivery Suppression<a class="headerlink" href="#duplicate-delivery-suppression" title="Permalink to this heading"></a></h3>
<p>A message is considered a duplicate if two copies of a message with
the same message-id and the same envelope recipient are received.
Cyrus uses the duplicate delivery database to hold this information,
and it looks approximately 3 days back in the default install.</p>
<p>Duplicate delivery suppression can be turned off by using the
"duplicatesuppression" flag in the configuration file.</p>
</section>
</section>
<section id="sieve-a-mail-filtering-language">
<h2>Sieve, a Mail Filtering Language<a class="headerlink" href="#sieve-a-mail-filtering-language" title="Permalink to this heading"></a></h2>
<p>Sieve is a mail filtering language that can filter mail into an appropriate
IMAP mailbox as it is delivered via lmtp.</p>
</section>
<section id="cyrus-murder-the-imap-aggregator">
<h2>Cyrus Murder, the IMAP Aggregator<a class="headerlink" href="#cyrus-murder-the-imap-aggregator" title="Permalink to this heading"></a></h2>
<p>Cyrus now supports the distribution of mailboxes across a number of IMAP
servers to allow for horizontal scalability.</p>
</section>
</section>
</div>
</div>
<footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
<a href="features/server-aggregation.html" class="btn btn-neutral float-left" title="Cyrus IMAP Murder (Server Aggregation)" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
<a href="../../setup.html" class="btn btn-neutral float-right" title="Setup" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
</div>
<hr/>
<div role="contentinfo">
<p>© Copyright 1993–2025, The Cyrus Team.</p>
</div>
Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
<a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
provided by <a href="https://readthedocs.org">Read the Docs</a>.
</footer>
</div>
</div>
</section>
</div>
<script>
jQuery(function () {
SphinxRtdTheme.Navigation.enable(true);
});
</script>
</body>
</html>
|
