Re: where to put dbmail.conf

Reindl Harald <[email protected]> Fri, 3 Apr 2020 22:29:07 +0200
Newsgroups	gmane.mail.imap.dbmail
Organization	the lounge interactive design
Message-ID	<[email protected]>
This is a multi-part message in MIME format.
--------------7B01A8BA9F74D833A01055AC
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: 8bit



Am 03.04.20 um 22:04 schrieb David in Denver:
> are no instruction on how to start or restart dbmail for ANY platform
> regardless of OS.
> 
> Oh look, no useful docs.  what a surprise


again: if you can't stand basic adminstrazion atsks don't run a mailserver

attached systemd-units running fine for neraly a decade, maybe some
options are not available one stone old systems and if you ahve some
crap still not using systemd welcome the modern world

and no - not every security option may apply to your environment - i
dont give a shit about anything before Fedora 31

--------------7B01A8BA9F74D833A01055AC
Content-Type: text/x-dbus-service; charset=UTF-8;
 name="dbmail-imapd.service"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
 filename="dbmail-imapd.service"

[Unit]
Description=DBMail IMAP Server
After=mysqld.service mysqld-dbmail.service
Before=dovecot.service

[Service]
Type=simple
ExecStart=/usr/sbin/dbmail-imapd -D
Environment="LANG=C.UTF-8"
Restart=always
RestartSec=1
StartLimitBurst=100
TimeoutStopSec=5
LimitNOFILE=50000
TasksMax=2048

CapabilityBoundingSet=CAP_DAC_OVERRIDE CAP_IPC_LOCK CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID
MemoryDenyWriteExecute=yes
PrivateDevices=yes
PrivateTmp=yes
ProtectControlGroups=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
RestrictAddressFamilies=AF_INET AF_INET6 AF_LOCAL AF_UNIX AF_NETLINK
IPAddressDeny=any
IPAddressAllow=localhost
SystemCallArchitectures=x86-64
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap acct modify_ldt add_key adjtimex clock_adjtime delete_module fanotify_init finit_module get_mempolicy init_module io_destroy io_getevents iopl ioperm io_setup io_submit io_cancel kcmp kexec_load keyctl lookup_dcookie mbind migrate_pages mount move_pages open_by_handle_at perf_event_open pivot_root process_vm_readv process_vm_writev ptrace remap_file_pages request_key set_mempolicy swapoff swapon umount2 uselib vmsplice

ProtectSystem=strict
ReadWritePaths=-/run
ReadWritePaths=-/tmp
ReadWritePaths=-/var/tmp
ReadWritePaths=-/var/log

InaccessiblePaths=-/boot
InaccessiblePaths=-/home
InaccessiblePaths=-/media
InaccessiblePaths=-/root
InaccessiblePaths=-/etc/dbus-1
InaccessiblePaths=-/etc/httpd
InaccessiblePaths=-/etc/ssh
InaccessiblePaths=-/run/console
InaccessiblePaths=-/run/dbus
InaccessiblePaths=-/run/lock
InaccessiblePaths=-/run/mount
InaccessiblePaths=-/run/systemd/generator
InaccessiblePaths=-/run/systemd/system
InaccessiblePaths=-/run/systemd/users
InaccessiblePaths=-/run/udev
InaccessiblePaths=-/run/user
InaccessiblePaths=-/usr/local/scripts
InaccessiblePaths=-/var/lib/dbus
InaccessiblePaths=-/var/lib/dnf
InaccessiblePaths=-/var/lib/rpm
InaccessiblePaths=-/var/lib/systemd
InaccessiblePaths=-/var/spool

# ExecStart=/usr/bin/valgrind --tool=memcheck --leak-check=yes --log-file=/var/log/valgrind/imapd.log /usr/sbin/dbmail-imapd -D
# ExecStart=/usr/bin/valgrind --tool=helgrind --log-file=/var/log/valgrind/imapd.log /usr/sbin/dbmail-imapd -D

[Install]
WantedBy=multi-user.target

--------------7B01A8BA9F74D833A01055AC
Content-Type: text/x-dbus-service; charset=UTF-8;
 name="dbmail-lmtpd.service"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
 filename="dbmail-lmtpd.service"

[Unit]
Description=DBMail LMTP Server
After=mysqld.service mysqld-dbmail.service

[Service]
Type=simple
ExecStart=/usr/sbin/dbmail-lmtpd -D
Environment="LANG=C.UTF-8"
Restart=always
RestartSec=1
TimeoutStopSec=5
LimitNOFILE=50000

CapabilityBoundingSet=CAP_DAC_OVERRIDE CAP_IPC_LOCK CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID
MemoryDenyWriteExecute=yes
PrivateDevices=yes
PrivateTmp=yes
ProtectControlGroups=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
RestrictAddressFamilies=AF_INET AF_INET6 AF_LOCAL AF_UNIX AF_NETLINK
IPAddressDeny=any
IPAddressAllow=localhost
SystemCallArchitectures=x86-64
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap acct modify_ldt add_key adjtimex clock_adjtime delete_module fanotify_init finit_module get_mempolicy init_module io_destroy io_getevents iopl ioperm io_setup io_submit io_cancel kcmp kexec_load keyctl lookup_dcookie mbind migrate_pages mount move_pages open_by_handle_at perf_event_open pivot_root process_vm_readv process_vm_writev ptrace remap_file_pages request_key set_mempolicy swapoff swapon umount2 uselib vmsplice

ProtectSystem=strict
ReadWritePaths=-/run
ReadWritePaths=-/tmp
ReadWritePaths=-/var/tmp
ReadWritePaths=-/var/log
ReadWritePaths=-/var/spool/postfix
ReadWritePaths=-/var/lib/postfix

InaccessiblePaths=-/boot
InaccessiblePaths=-/home
InaccessiblePaths=-/media
InaccessiblePaths=-/root
InaccessiblePaths=-/etc/dbus-1
InaccessiblePaths=-/etc/httpd
InaccessiblePaths=-/etc/ssh
InaccessiblePaths=-/run/console
InaccessiblePaths=-/run/dbus
InaccessiblePaths=-/run/lock
InaccessiblePaths=-/run/mount
InaccessiblePaths=-/run/systemd/generator
InaccessiblePaths=-/run/systemd/system
InaccessiblePaths=-/run/systemd/users
InaccessiblePaths=-/run/udev
InaccessiblePaths=-/run/user
InaccessiblePaths=-/usr/local/scripts
InaccessiblePaths=-/var/lib/dbus
InaccessiblePaths=-/var/lib/dnf
InaccessiblePaths=-/var/lib/rpm
InaccessiblePaths=-/var/lib/systemd

# ExecStart=/usr/bin/valgrind --tool=memcheck --leak-check=yes --log-file=/var/log/valgrind/lmtpd.log /usr/sbin/dbmail-lmtpd -D
# ExecStart=/usr/bin/valgrind --tool=helgrind --log-file=/var/log/valgrind/lmtpd.log /usr/sbin/dbmail-lmtpd -D

[Install]
WantedBy=multi-user.target

--------------7B01A8BA9F74D833A01055AC
Content-Type: text/x-dbus-service; charset=UTF-8;
 name="dbmail-pop3d.service"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
 filename="dbmail-pop3d.service"

[Unit]
Description=DBMail POP3 Server
After=mysqld.service mysqld-dbmail.service
Before=dovecot.service

[Service]
Type=simple
ExecStart=/usr/sbin/dbmail-pop3d -D
Environment="LANG=C.UTF-8"
Restart=always
RestartSec=1
TimeoutStopSec=5
LimitNOFILE=50000
TasksMax=2048

CapabilityBoundingSet=CAP_DAC_OVERRIDE CAP_IPC_LOCK CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID
MemoryDenyWriteExecute=yes
PrivateDevices=yes
PrivateTmp=yes
ProtectControlGroups=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
RestrictAddressFamilies=AF_INET AF_INET6 AF_LOCAL AF_UNIX AF_NETLINK
IPAddressDeny=any
IPAddressAllow=localhost
SystemCallArchitectures=x86-64
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap acct modify_ldt add_key adjtimex clock_adjtime delete_module fanotify_init finit_module get_mempolicy init_module io_destroy io_getevents iopl ioperm io_setup io_submit io_cancel kcmp kexec_load keyctl lookup_dcookie mbind migrate_pages mount move_pages open_by_handle_at perf_event_open pivot_root process_vm_readv process_vm_writev ptrace remap_file_pages request_key set_mempolicy swapoff swapon umount2 uselib vmsplice

ProtectSystem=strict
ReadWritePaths=-/run
ReadWritePaths=-/tmp
ReadWritePaths=-/var/tmp
ReadWritePaths=-/var/log

InaccessiblePaths=-/boot
InaccessiblePaths=-/home
InaccessiblePaths=-/media
InaccessiblePaths=-/root
InaccessiblePaths=-/etc/dbus-1
InaccessiblePaths=-/etc/httpd
InaccessiblePaths=-/etc/ssh
InaccessiblePaths=-/run/console
InaccessiblePaths=-/run/dbus
InaccessiblePaths=-/run/lock
InaccessiblePaths=-/run/mount
InaccessiblePaths=-/run/systemd/generator
InaccessiblePaths=-/run/systemd/system
InaccessiblePaths=-/run/systemd/users
InaccessiblePaths=-/run/udev
InaccessiblePaths=-/run/user
InaccessiblePaths=-/usr/local/scripts
InaccessiblePaths=-/var/lib/dbus
InaccessiblePaths=-/var/lib/dnf
InaccessiblePaths=-/var/lib/rpm
InaccessiblePaths=-/var/lib/systemd
InaccessiblePaths=-/var/spool

# ExecStart=/usr/bin/valgrind --tool=memcheck --leak-check=yes --log-file=/var/log/valgrind/pop3d.log /usr/sbin/dbmail-pop3d -D
# ExecStart=/usr/bin/valgrind --tool=helgrind --log-file=/var/log/valgrind/pop3d.log /usr/sbin/dbmail-pop3d -D

[Install]
WantedBy=multi-user.target

--------------7B01A8BA9F74D833A01055AC
Content-Type: text/x-dbus-service; charset=UTF-8;
 name="dbmail-timsieved.service"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
 filename="dbmail-timsieved.service"

[Unit]
Description=DBMail SIEVE Server
After=mysqld.service mysqld-dbmail.service

[Service]
Type=simple
ExecStart=/usr/sbin/dbmail-timsieved -D
Environment="LANG=C.UTF-8"
Restart=always
RestartSec=1
TimeoutStopSec=5
LimitNOFILE=50000

CapabilityBoundingSet=CAP_DAC_OVERRIDE CAP_IPC_LOCK CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID
MemoryDenyWriteExecute=yes
PrivateDevices=yes
PrivateTmp=yes
ProtectControlGroups=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
RestrictAddressFamilies=AF_INET AF_INET6 AF_LOCAL AF_UNIX AF_NETLINK
SystemCallArchitectures=x86-64
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap  acct modify_ldt add_key adjtimex clock_adjtime delete_module fanotify_init finit_module get_mempolicy init_module io_destroy io_getevents iopl ioperm io_setup io_submit io_cancel kcmp kexec_load keyctl lookup_dcookie mbind migrate_pages mount move_pages open_by_handle_at perf_event_open pivot_root process_vm_readv process_vm_writev ptrace remap_file_pages request_key set_mempolicy swapoff swapon umount2 uselib vmsplice

ProtectSystem=strict
ReadWritePaths=-/run
ReadWritePaths=-/tmp
ReadWritePaths=-/var/tmp
ReadWritePaths=-/var/log

InaccessiblePaths=-/boot
InaccessiblePaths=-/home
InaccessiblePaths=-/media
InaccessiblePaths=-/root
InaccessiblePaths=-/etc/dbus-1
InaccessiblePaths=-/etc/httpd
InaccessiblePaths=-/etc/ssh
InaccessiblePaths=-/run/console
InaccessiblePaths=-/run/dbus
InaccessiblePaths=-/run/lock
InaccessiblePaths=-/run/mount
InaccessiblePaths=-/run/systemd/generator
InaccessiblePaths=-/run/systemd/system
InaccessiblePaths=-/run/systemd/users
InaccessiblePaths=-/run/udev
InaccessiblePaths=-/run/user
InaccessiblePaths=-/usr/local/scripts
InaccessiblePaths=-/var/lib/dbus
InaccessiblePaths=-/var/lib/dnf
InaccessiblePaths=-/var/lib/rpm
InaccessiblePaths=-/var/lib/systemd
InaccessiblePaths=-/var/spool

# ExecStart=/usr/bin/valgrind --tool=memcheck --leak-check=yes --log-file=/var/log/valgrind/timsieved.log /usr/sbin/dbmail-timsieved -D
# ExecStart=/usr/bin/valgrind --tool=helgrind --log-file=/var/log/valgrind/timsieved.log /usr/sbin/dbmail-timsieved -D

[Install]
WantedBy=multi-user.target

--------------7B01A8BA9F74D833A01055AC
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KREJtYWlsIG1h
aWxpbmcgbGlzdApEQm1haWxAbGlzdHMubmZnLm5sCmh0dHBzOi8vbGlzdHMubmZnLm5sL2NnaS1i
aW4vbWFpbG1hbi9saXN0aW5mby9kYm1haWwK

--------------7B01A8BA9F74D833A01055AC--