CIS Dovecot Benchmark

This recommendation verifies that Dovecot is running the latest stable version on the Dovecot IMAP/POP3 mail server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Dovecot IMAP/POP3 mail server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify Dovecot version
dovecot --version
doveconf -n | head -5

# Update Dovecot to latest stable
apt-get update && apt-get install --only-upgrade dovecot-core dovecot-imapd dovecot-pop3d
systemctl restart dovecot

This recommendation verifies that Dovecot uses dedicated mail user and group on the Dovecot IMAP/POP3 mail server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Dovecot IMAP/POP3 mail server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Dovecot runs as dedicated user
ps -eo user,pid,comm | grep dovecot
doveconf -n | grep -E 'first_valid_uid|last_valid_uid|mail_uid'

# Configure dedicated user
# In /etc/dovecot/conf.d/10-mail.conf:
# mail_uid = vmail
# mail_gid = vmail
# first_valid_uid = 500
useradd -r -s /usr/sbin/nologin -d /var/vmail vmail
mkdir -p /var/vmail && chown -R vmail:vmail /var/vmail

This recommendation ensures that TLS is required with strong ciphers for all connections on the Dovecot IMAP/POP3 mail server. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Dovecot IMAP/POP3 mail server may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

# Check TLS configuration
doveconf -n | grep -E 'ssl|ssl_cert|ssl_key|ssl_min_protocol'

# Configure TLS in /etc/dovecot/conf.d/10-ssl.conf:
ssl = required
ssl_cert = </etc/dovecot/ssl/dovecot-cert.pem
ssl_key = </etc/dovecot/ssl/dovecot-key.pem
ssl_min_protocol = TLSv1.2
ssl_cipher_list = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305
ssl_prefer_server_ciphers = yes

This recommendation verifies that plaintext authentication is disabled without TLS on the Dovecot IMAP/POP3 mail server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Dovecot IMAP/POP3 mail server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

# Check disabled plaintext authentication
doveconf -n | grep -E 'disable_plaintext_auth|auth_mechanisms'

# Disable plaintext authentication
# In /etc/dovecot/conf.d/10-auth.conf:
disable_plaintext_auth = yes
auth_mechanisms = plain login
# These mechanisms are only allowed over TLS since ssl = required
# Consider adding CRAM-MD5 or SCRAM-SHA-256:
# auth_mechanisms = plain login cram-md5 scram-sha-256

This recommendation ensures that only required protocols are enabled on secure ports on the Dovecot IMAP/POP3 mail server. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Dovecot IMAP/POP3 mail server may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

# Check listening protocols and ports
doveconf -n | grep -E 'protocols|listen'
ss -tlnp | grep dovecot

# Restrict protocols and binding
# In /etc/dovecot/dovecot.conf:
protocols = imap lmtp sieve
# Do not enable pop3 unless required
listen = *, ::
# In /etc/dovecot/conf.d/10-master.conf:
service imap-login {
  inet_listener imap {
    port = 0
  }
  inet_listener imaps {
    port = 993
    ssl = yes
  }
}

This recommendation verifies that connection and process limits are configured on the Dovecot IMAP/POP3 mail server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Dovecot IMAP/POP3 mail server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check connection limits
doveconf -n | grep -E 'mail_max_userip|login_max_connections|login_max_processes'

# Configure connection limits
# In /etc/dovecot/conf.d/10-master.conf:
default_process_limit = 100
default_client_limit = 1000
# In /etc/dovecot/conf.d/20-imap.conf:
protocol imap {
  mail_max_userip_connections = 10
  imap_idle_notify_interval = 2 mins
}
# In login conf:
service imap-login {
  process_min_avail = 1
  service_count = 1
}

This recommendation verifies that authentication and login logging is enabled on the Dovecot IMAP/POP3 mail server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Dovecot IMAP/POP3 mail server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check logging configuration
doveconf -n | grep -E 'log_path|info_log_path|debug_log_path|syslog_facility'

# Configure logging
# In /etc/dovecot/conf.d/10-logging.conf:
log_path = syslog
syslog_facility = mail
auth_verbose = yes
auth_verbose_passwords = sha1
mail_debug = no
verbose_ssl = no
login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c %k

This recommendation verifies that mail event logging plugin is configured on the Dovecot IMAP/POP3 mail server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Dovecot IMAP/POP3 mail server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check mail process logging
doveconf -n | grep -E 'mail_log|notify'
doveconf -n | grep 'mail_plugins'

# Enable mail event logging plugin
# In /etc/dovecot/conf.d/10-mail.conf:
mail_plugins = $mail_plugins mail_log notify
# In /etc/dovecot/conf.d/20-imap.conf:
protocol imap {
  mail_plugins = $mail_plugins imap_quota
}
# In /etc/dovecot/conf.d/90-plugin.conf:
plugin {
  mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename
  mail_log_fields = uid box msgid size
}

This setting ensures that mailbox directory permissions are restricted on the Dovecot IMAP/POP3 mail server. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Dovecot IMAP/POP3 mail server is essential for defense in depth.

# Check mailbox permissions
find /var/vmail -type d -perm /o=rwx -ls 2>/dev/null | head -10
stat -c '%a %U %G' /var/vmail

# Restrict mailbox permissions
chown -R vmail:vmail /var/vmail
chmod -R 700 /var/vmail
find /var/vmail -type f -exec chmod 600 {} \;
find /var/vmail -type d -exec chmod 700 {} \;

This setting ensures that configuration file permissions are restricted on the Dovecot IMAP/POP3 mail server. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Dovecot IMAP/POP3 mail server is essential for defense in depth.

# Check configuration permissions
stat -c '%a %U %G' /etc/dovecot/dovecot.conf
find /etc/dovecot -type f -perm /o=rwx -ls 2>/dev/null

# Restrict configuration permissions
chown -R root:dovecot /etc/dovecot
chmod 640 /etc/dovecot/dovecot.conf
find /etc/dovecot -type f -exec chmod 640 {} \;
find /etc/dovecot -type d -exec chmod 750 {} \;
chmod 600 /etc/dovecot/ssl/*.pem

This recommendation verifies that mailbox quota limits are configured on the Dovecot IMAP/POP3 mail server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Dovecot IMAP/POP3 mail server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check quota configuration
doveconf -n | grep -E 'quota|quota_rule'
doveconf plugin/quota

# Configure mailbox quotas
# In /etc/dovecot/conf.d/90-quota.conf:
plugin {
  quota = maildir:User quota
  quota_rule = *:storage=1G
  quota_rule2 = Trash:storage=+100M
  quota_grace = 10%%
  quota_status_success = DUNNO
  quota_status_nouser = DUNNO
  quota_status_overquota = "552 5.2.2 Mailbox is full"
}

This recommendation verifies that Sieve filtering has safe limits configured on the Dovecot IMAP/POP3 mail server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Dovecot IMAP/POP3 mail server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Sieve filtering
doveconf -n | grep -E 'sieve|ManageSieve'
ls -la /etc/dovecot/sieve/ 2>/dev/null

# Configure Sieve filtering securely
# In /etc/dovecot/conf.d/90-sieve.conf:
plugin {
  sieve = file:~/sieve;active=~/.dovecot.sieve
  sieve_before = /etc/dovecot/sieve/before.d/
  sieve_after = /etc/dovecot/sieve/after.d/
  sieve_max_script_size = 1M
  sieve_max_actions = 32
  sieve_max_redirects = 4
  sieve_extensions = +editheader
}
service managesieve-login {
  inet_listener sieve {
    port = 4190
  }
}

This setting ensures that LMTP socket permissions are restricted on the Dovecot IMAP/POP3 mail server. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Dovecot IMAP/POP3 mail server is essential for defense in depth.

# Check LMTP and submission configuration
doveconf -n | grep -E 'submission|lmtp'
ss -tlnp | grep -E '24|587'

# Configure LMTP securely
# In /etc/dovecot/conf.d/10-master.conf:
service lmtp {
  unix_listener /var/spool/postfix/private/dovecot-lmtp {
    user = postfix
    group = postfix
    mode = 0600
  }
}
# Enable submission with auth:
service submission-login {
  inet_listener submission {
    port = 587
  }
}
submission_relay_host = smtp.internal
submission_relay_port = 25

This recommendation verifies that authentication backends use secure credential storage on the Dovecot IMAP/POP3 mail server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Dovecot IMAP/POP3 mail server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check PAM and system auth integration
doveconf -n | grep 'passdb\|userdb'
cat /etc/pam.d/dovecot 2>/dev/null

# Configure authentication backends securely
# In /etc/dovecot/conf.d/10-auth.conf:
# auth_cache_size = 10M
# auth_cache_ttl = 1 hour
# Prefer LDAP or SQL over PAM:
passdb {
  driver = sql
  args = /etc/dovecot/dovecot-sql.conf.ext
}
userdb {
  driver = sql
  args = /etc/dovecot/dovecot-sql.conf.ext
}
chmod 600 /etc/dovecot/dovecot-sql.conf.ext