.\" Copyright (c) 2010-2018 Dovecot authors, see the included COPYING file
.TH DOVEADM\-MAILBOX\-CRYPTOKEY 1 "2016-01-12" "Dovecot v2.3" "Dovecot"
.SH NAME
doveadm\-mailbox\-cryptokey \- Mail crypt plugin management
.\"------------------------------------------------------------------------
.SH SYNOPSIS
.BR doveadm " -o
.IR plugin/mail_crypt_private_password=password "
.BR [ " \-Dv " ] [ " \-f
.IR formatter " ]
.BR " mailbox cryptokey export|generate|list|password " [ " \-u
.IR username
.BR | " \-A " ] [ " \-S " ] [ " \-F "
.IR file " ]
.BR [ "
.IR other "
.IR options " ]
.br
.SH DESCRIPTION
Generate new keypair for user or folder. The new keypair is marked as active.
.SH OPTIONS
.IR options :
.\"-------------------------------------
.TP
.B \-A
If the
.B \-A
option is present, the
.I command
will be performed for all users.
Using this option in combination with system users from
.B userdb { driver = passwd }
is not recommended, because it contains also users with a lower UID than
the one configured with the
.I first_valid_uid
setting.
.sp
When the SQL userdb module is used make sure that the
.I iterate_query
setting in
.I /etc/dovecot/dovecot\-sql.conf.ext
matches your database layout.
When using the LDAP userdb module, make sure that the
.IR iterate_attrs " and " iterate_filter
settings in
.I /etc/dovecot/dovecot-ldap.conf.ext
match your LDAP schema.
Otherwise
.BR doveadm (1)
will be unable to iterate over all users.
.\"-------------------------------------
.TP
.BI \-F\  file
Execute the
.I command
for all the users in the
.IR file .
This is similar to the
.B \-A
option,
but instead of getting the list of users from the userdb,
they are read from the given
.IR file .
The
.I file
contains one username per line.
.\"-------------------------------------
.TP
.BI \-S\  socket_path
The option\(aqs argument is either an absolute path to a local UNIX domain
socket, or a hostname and port
.RI ( hostname : port ),
in order to connect a remote host via a TCP socket.
.sp
This allows an administrator to execute
.BR doveadm (1)
mail commands through the given socket.
.\"-------------------------------------
.TP
.BI \-u\  user/mask
Run the
.I command
only for the given
.IR user .
It\(aqs also possible to use
.RB \(aq * \(aq
and
.RB \(aq ? \(aq
wildcards (e.g. \-u *@example.org).
.br
When neither the
.B \-A
option, nor the
.BI \-F\  file
option, nor the
.BI \-u\  user
was specified, the
.I command
will be executed with the environment of the
currently logged in user.
.\"------------------------------------------------------------------------
.TP
.BI \-o\  plugin/mail_crypt_private_password=password
Dovecot option, needed if you use password protected keys
.SH SUBCOMMANDS
.BR export " [ " \-U " ] " |
.IR mailbox-mask 
.TP
.B \-U
Operate on user keypair only
.PP
Exports user's or folder's keypair(s) in PEM format.
If the keys are password protected, \-o is needed.
.PP
.\"------------------------------------------------------------------------
.BR generate " [ " \-Rf "  [ " \-U " ] " | 
.IR mailbox-mask " ]
.TP
.B \-U
Operate on user keypair only
.TP
.BI \-R
Re-encrypt all folder keys with current active user key
.TP
.B \-f
Force keypair creation, normally keypair is only created if none found
.PP
Generates new keypair for user or folder. If you want to generate new user key
and use it to secure your folder keys, use generate \-u username \-UR.
.PP
If you want to password-protect your key here, use \-o.
.PP
.\"------------------------------------------------------------------------
.BR list " [ " \-U " ] " |
.IR mailbox-mask
.TP
.B \-U
Operate on user keypair only
.PP
List all keys for user or folder. No password is required.
.PP
.\"------------------------------------------------------------------------
.BR password " [ " \-N " | " \-n
.IR password " ]
.BR " [ " \-O " | " \-o
.IR password " ]
.BR [ " \-C " ]
.TP
.B \-O
Ask for old password
.TP
.BI \-o\ old-password
Provide old password
.TP
.B \-N
Ask for new password
.TP
.BI \-n\ new-password
Provide new password
.TP
.B \-C
Clear (unset/remove) password. Your key will not be protected by password.
.PP
Set, change or clear password from your user key.
.SH SEE ALSO
.BR doveadm(1)