- Ensure GCC and the header files for libcrypto (OpenSSL) and libsodium are installed.
-
Use
make dovecot-install
to download and build dovecot 2.2.21 in a sub-directory. It's a local installation and your system wont be affected. -
Type
make all
to compile the plugin. -
Find the plugin at dovecot/target/lib/dovecot/lib18_scrambler_plugin.so.
In order to run, the plugin needs the following configuration values (via the dovecot environment).
-
scrambler_plain_password
The plain user password. It's used to derive the hashed password to decrypt the private key. -
scrambler_enabled
Can be1
or0
. -
scrambler_public_key
The public key of the user. Formatted as pem. -
scrambler_private_key
The encrypted private key of the user. Formatted as pem. -
scrambler_private_key_salt
The salt of the hashed password that has been used to encrypt the private key. -
userdb_scrambler_N
The scrypt parameter N used to derive the hashed password that has been used to encrypt
the private key. -
userdb_scrambler_r
The scrypt parameter r used to derive the hashed password that has been used to encrypt
the private key. -
userdb_scrambler_p
The scrypt parameter p used to derive the hashed password that has been used to encrypt
the private key. -
userdb_scrambler_keylen
The length of the hashed password that has been used to encrypt the private key.
TODO config/passwd-generator
openssl genpkey -algorithm rsa -pkeyopt rsa_keygen_bits:8192 -aes128 -pass stdin -out [email protected]
openssl rsa -outform pem -pubout -in [email protected]
openssl rsa -outform pem -aes128 -passout stdin -in [email protected]
CREATE TABLE users
(
id
INTEGER NOT NULL,
username
VARCHAR(255) NOT NULL,
domain
VARCHAR(255) NOT NULL,
password
TEXT,
PRIMARY KEY(id)
);
CREATE TABLE "keys" (
userid
INTEGER,
enabled
INTEGER NOT NULL,
scrypt_N
NUMERIC NOT NULL,
scrypt_r
INTEGER NOT NULL,
scrypt_p
INTEGER NOT NULL,
scrypt_keylen
INTEGER NOT NULL,
scrypt_salt
TEXT NOT NULL,
public_key
TEXT NOT NULL,
private_key
TEXT NOT NULL,
FOREIGN KEY(userid
) REFERENCES users ( id )
)
The migration of unencrypted mailboxes has to be done by a separate tool and is not part of this project.
Concept, design and realization by Posteo e.K.. The implementation was provided by simia.tech GbR. An security audit has been provided by Cure53.