'\" t
.\"     Title: kopano-gateway.cfg
.\"    Author: [see the "Author" section]
.\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
.\"      Date: November 2016
.\"    Manual: Kopano Core user reference
.\"    Source: Kopano 8
.\"  Language: English
.\"
.TH "KOPANO\-GATEWAY.CFG" "5" "November 2016" "Kopano 8" "Kopano Core user reference"
.\" -----------------------------------------------------------------
.\" * Define some portability stuff
.\" -----------------------------------------------------------------
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.\" http://bugs.debian.org/507673
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\" -----------------------------------------------------------------
.\" * set default formatting
.\" -----------------------------------------------------------------
.\" disable hyphenation
.nh
.\" disable justification (adjust text to left margin only)
.ad l
.\" -----------------------------------------------------------------
.\" * MAIN CONTENT STARTS HERE *
.\" -----------------------------------------------------------------
.SH "NAME"
kopano-gateway.cfg \- The Kopano gateway configuration file
.SH "SYNOPSIS"
.PP
\fBgateway.cfg\fR
.SH "DESCRIPTION"
.PP
The
gateway.cfg
is a configuration file for the Kopano Gateway.
gateway.cfg
contains instructions for the software to set up the logging system and to enable or disable the POP3, POP3S, IMAP or IMAPS part of the service.
.SH "FILE FORMAT"
.PP
The file consists of one big section, but parameters can be grouped by functionality.
.PP
The parameters are written in the form:
.PP
\fBname\fR
=
\fIvalue\fR
.PP
The file is line\-based. Each newline\-terminated line represents either a comment, nothing, a parameter or a directive. A line beginning with `#\*(Aq is considered a comment, and will be ignored by Kopano. Parameter names are case sensitive. Lines beginning with `!\*(Aq are directives.
.PP
Directives are written in the form:
.PP
!\fBdirective\fR
\fI[argument(s)] \fR
.PP
The following directives exist:
.PP
\fBinclude\fR
.RS 4
Include and process
\fIargument\fR
.PP
Example: !include common.cfg
.RE
.SH "EXPLANATION OF EACH PARAMETER"
.SS server_hostname
.PP
Hostname of the server to print to a client in the logon greeting. Leave empty to use DNS to find the hostname.
.PP
Default:
.SS server_hostname_greeting
.PP
Whether to show the hostname in the logon greeting to clients. This config option is reloadable using the HUP signal.
.PP
Default:
\fIno\fR
.SS imap_listen
.PP
A space-separated list of address:port specifiers for where the server should
listen for unencrypted and STARTTLS-ed IMAP connections. IPv6 addresses need to
be enclosed in brackets (as in \fB[2001:db8::1]:236\fP), and the asterisk is
the multi-protocol address wildcard.
.PP
Default: \fI*:143\fP
.SS imaps_listen
A space-separated list of address:port spcifiers for implicit-SSL IMAP
connections, similar to \fBimap_listen\fP. Normally placed on port 993.
.PP
Default: \fI(empty)\fP
.SS pop3_listen
.PP
A space-separated list of address:port specifiers for where the server should
listen for unencrypted and STARTTLS-ed POP3 connections. IPv6 addresses need to
be enclosed in brackets (as in \fB[2001:db8::1]:236\fP), and the asterisk is
the multi-protocol address wildcard.
.PP
Default: \fI*:110\fP
.SS pop3s_listen
A space-separated list of address:port spcifiers for implicit-SSL POP3
connections, similar to \fBpop3_listen\fP. Normally placed on port 995.
.PP
Default: \fI(empty)\fP
.SS server_socket
.PP
The http address of the storage server.
.PP
Default:
\fIhttp://localhost:236/\fR
.PP
It is not advised to specify the UNIX socket here, but the http address instead. In default configuration the gateway will then be trusted by the storage server (as set in its local_admin_users configuration setting). Unless is run as an untrusted user, by specifying the
\fBrun_as_user\fR, the gateway always authenticates users even if they provide no or wrong credentials!
.SS run_as_user
.PP
After correctly starting, the gateway process will become this user, dropping root privileges. Note that the log file needs to be writeable by this user, and the directory too to create new logfiles after logrotation. This can also be achieved by setting the correct group and permissions.
.PP
Default value is empty, not changing the user after starting.
.SS run_as_group
.PP
After correctly starting, the gateway process will become this group, dropping root privileges.
.PP
Default value is empty, not changing the group after starting.
.SS pid_file
.PP
Write the process ID number to this file. This is used by the init.d script to correctly stop/restart the service.
.PP
Default:
\fI/var/run/kopano/gateway.pid\fR
.SS running_path
.PP
Change directory to this path when running in daemonize mode. When using the \-F switch to run in the foreground the directory will not be changed.
.PP
Default:
\fI/\fR
.SS coredump_enabled
.PP
When a crash occurs or an assertion fails, a coredump file can be generated by
the system for use with a crash report. For details, see the
\fBkopano\-coredump\fP(5) manpage.
.PP
Default: \fIsystemdefault\fP
.SS process_model
.PP
You can change the process model between
\fIfork\fR
and
\fIthread\fR. The forked model uses somewhat more resources, but if a crash is triggered, this will only affect one user. In the threaded model, a crash means all users are affected, and will not be able to use the service.
.PP
Default:
\fIthread\fR
.SS bypass_auth
.PP
This parameter can be used to skip password verification when connecting over the UNIX socket. Connecting through the UNIX socket can have a big performance gain, compared to the TCP socket of kopano-server. As kopano-gateway is usually running as the user kopano (which is a local_admin_user in kopano-server) this would normally mean that kopano-gateway would only verify usernames and no password (because its running as an administrator). When set to \fIno\fR (default value) forces verification of passwords, even when running as an administrator. For migrations you will want to set \fIyes\fR.
.PP
Default:
\fIno\fR
.SS imap_only_mailfolders
.PP
Enable the IMAP and IMAPS service to only show the mailfolders. This is the default behaviour. When this option is set to \*(Aqno\*(Aq, you will also be able to select you calendar and contacts and such. These views will not contain all information, since these items cannot be converted to a rfc\-822 mail item.
.PP
Default:
\fIyes\fR
.SS imap_public_folders
.PP
Enable the IMAP and IMAPS service to also show the public store with subfolders. This is the default behaviour. When this option is set to \*(Aqno\*(Aq, IMAP clients will only see the users\*(Aq folder.
.PP
Default:
\fIyes\fR
.SS imap_capability_idle
.PP
Allow IMAP clients to issue the IDLE command. When an IMAP client is idle, it may receive notifications from the server about changes of the selected folder. This may increase load on the server when many users are using the IMAP service.
.PP
Default:
\fIyes\fR
.SS imap_max_messagesize
.PP
Limit the maximum message size (in bytes) which can be created by an IMAP client. The maximum of this value is 4GB although this is not recommended. If the value is too high it will cause a segmentation fault. This value may contain a k, m or g multiplier.
.PP
Default:
\fI128M\fR
.SS imap_expunge_on_delete
.PP
Normally when you delete an e\-mail in an IMAP client, it will only be marked as deleted, and not removed from the folder. The client should send the EXPUNGE command to actually remove the item from the folder (where Kopano will place it in the soft\-delete system). When this option is set to
\fIyes\fR, the kopano\-gateway will issue the expunge command itself directly after a \*(Aqmark as delete\*(Aq command was received.
.PP
Default:
\fIno\fR
.SS imap_max_fail_commands
.PP
Maximum of failed commands before forcibly closing connection of client. This makes sure that a client which does repeatedly fails on a specific connection (like opening folders over and over again which do not exist) does not affect the overall performance of the gateway process. With the default value set to
\fI10\fR, normal operation will work for most productionenvironments. With IMAP migrations, this value should be set higher as many traditional IMAP migration tools try to fetch folders which do not necessarily exist before, so in a migration scenario this value should be set higher, at minimum to the number of folders to be migrated from the largest mailbox.
.PP
Default:
\fI10\fR
.SS imap_ignore_command_idle
.PP
Some MUAs are sending commands via idle causing the connection
to reach \fIimap_max_fail_commands\fR and leaves the client in a
broken state. The clients include Apple Mail. If you experience
problems or uses Apple Mail set this option to \fIyes\fR.
.PP
Default:
\fIno\fR
.SS disable_plaintext_auth
.PP
Disable all plaintext POP3 and IMAP authentications unless SSL/TLS is used (except for connections originating from localhost, to allow saslauthd with rimap). Obviously, this requires at least
\fIssl_private_key_file\fR
and
\fIssl_certificate_file\fR
to take effect.
.PP
Default:
\fIno\fR
.SS ssl_private_key_file
.PP
The gateway will use this file as private key for SSL TLS. This file can be created with:
\fBopenssl genrsa \-out /etc/kopano/gateway/privkey.pem 2048\fR.
.PP
Default:
\fI/etc/kopano/gateway/privkey.pem\fR
.SS ssl_certificate_file
.PP
The gateway will use this file as certificate for SSL TLS. A self\-signed certificate can be created with:
\fBopenssl req \-new \-x509 \-key /etc/kopano/gateway/privkey.pem \-out /etc/kopano/gateway/cert.pem \-days 1095\fR.
.PP
Default:
\fI/etc/kopano/gateway/cert.pem\fR
.SS ssl_verify_client
.PP
Enable client certificate verification with value yes. All other values disable the verification.
.PP
Default:
\fIno\fR
.SS ssl_verify_file
.PP
The file to verify the clients certificates with.
.PP
Default: value not set.
.SS ssl_verify_path
.PP
The path with the files to verify the clients certificates with.
.PP
Default: value not set.
.SS ssl_protocols
.PP
A space-separated list of disabled or enabled protocol names.
Supported protocol names depend on the system's SSL library;
depending on version, one or more of the following are available:
\fBTLSv1.3\fP, \fBTLSv1.2\fP, \fBTLSv1.1\fP, \fBSSLv3\fP,
\fBSSLv2\fP. To disable a protocol, prefix the name with an
exclamation mark.
.PP
Default: \fI!SSLv2 !SSLv3 !TLSv1 !TLSv1.1\fP
.SS ssl_ciphers
.PP
A colon-separated list of disabled or enabled SSL/TLS ciphers. Supported cipher
names depend on the system's SSL library, and are generally plentiful. To
disable a cipher or cipher group, prefix the name with a minus or exclamation
mark. Details and meaning of the syntax are described in ciphers(1).
.PP
Default:
\fIDEFAULT:!LOW:!SSLv2:!SSLv3:!TLSv1.0:!TLSv1.1:!EXPORT:!DH:!PSK:!kRSA:!aDSS:!aNULL:+AES\fP
.SS ssl_prefer_server_ciphers
.PP
In SSLv3 and newer, the server side gets to make the ultimate cipher pick out
of the set that both ends support. In doing so, it can either use the client
preference list, or, if this directive is set to "yes", its own list (as
determined by \fBssl_cipher\fP).
.PP
Default: \fIyes\fP
.SS ssl_curves
.PP
ECDH curves to use for SSL
.PP
Default:
\fIX25519:P-521:P-384:P-256\fP
.SS log_method
.PP
The method which should be used for logging. Valid values are:
.TP
\fBsyslog\fR
Use the syslog service. Messages will be sent using the "mail" facility tag. See also
\fBjournald.conf\fP(5) or \fBsyslog.conf\fP(5).
.TP
\fBfile\fP
Log to a file. The filename will be specified in
\fBlog_file\fR.
.TP
\fBauto\fP
Autoselect mode: If \fBlog_file\fP is set, that will be used.
Else, syslog will be used if it looks like it is available.
Else, stderr.
.PP
Default: \fIauto\fP
.SS log_file
.PP
When logging to a file, specify the filename in this parameter. Use
\fI\-\fR
(minus sign) for stderr output.
.PP
Default:
\fI\-\fP
.SS log_level
.PP
The level of output for logging in the range from 0 to 6. "0" means no logging,
"1" for critical messages only, "2" for error or worse, "3" for warning or
worse, "4" for notice or worse, "5" for info or worse, "6" debug.
.PP
Default:
\fI3\fP
.SS log_timestamp
.PP
Specify whether to prefix each log line with a timestamp in \*(Aqfile\*(Aq logging mode.
.PP
Default:
\fI1\fR
.SS log_buffer_size
.PP
Buffer logging in what sized blocks. The special value 0 selects line buffering.
.PP
Default:
\fI0\fR
.RE
.SH "RELOADING"
.PP
The following options are reloadable by sending the kopano\-gateway process a HUP signal:
.PP
log_level
.SH "FILES"
.PP
/etc/kopano/gateway.cfg
.RS 4
The Kopano gateway configuration file.
.RE
.SH "AUTHOR"
.PP
Written by Kopano.
.SH "SEE ALSO"
.PP
\fBkopano-gateway\fR(8)