I think I've been able to print/export what I think are user keys with
the -U flag:
user@testbox :~$ sudo -u vmail doveadm -o
plugin/mail_crypt_private_password="${pass}" mailbox cryptokey export -u
user -U
Folder:
Public ID: 3498hg355a86c3c924a5841bb2e5c6e1b0c5496d5116c4fcb9askdjfalk34
Error:
-----BEGIN PRIVATE KEY-----
***REDACTED***
-----END PRIVATE KEY-----
user@testbox :~$ sudo -u vmail doveadm -o
plugin/mail_crypt_private_password="${pass}" mailbox cryptokey list -u
user -U
Folder Active Public ID
yes 3498hg355a86c3c924a5841bb2e5c6e1b0c5496d5116c4fcb9askdjfalk34
However, I can't seem to get the tool to print/export folder keys:
user@testbox :~$ sudo -u vmail doveadm -o
plugin/mail_crypt_private_password="${pass}" mailbox cryptokey list -u
user test
doveadm(user): Warning: mailbox cryptokey list: Nothing was matched. Use
-U or specify mask?
Folder Active Public ID
user@testbox :~$ sudo -u vmail doveadm -o
plugin/mail_crypt_private_password="${pass}" mailbox cryptokey list -u
user test/
doveadm(user): Warning: mailbox cryptokey list: Nothing was matched. Use
-U or specify mask?
Folder Active Public ID
user@testbox :~$ sudo -u vmail doveadm -o
plugin/mail_crypt_private_password="${pass}" mailbox cryptokey export -u
user
user@testbox :~$ sudo -u vmail doveadm -o
plugin/mail_crypt_private_password="${pass}" mailbox cryptokey export -u
user test/
user@testbox :~$ sudo -u vmail doveadm -o
plugin/mail_crypt_private_password="${pass}" mailbox cryptokey export -u
user test
user@testbox :~$ sudo -u vmail doveadm -o
plugin/mail_crypt_private_password="${pass}" mailbox cryptokey export -u
user *
user@testbox :~$
In the examples above, I was attempting to select keys for the 'test'
IMAP mail folder. I may just be misunderstanding the
encryption/decryption operations here, and possibly the mask parameter.
When I run the below command, it outputs the '.test.out' file but the
file is not encrypted, presumably because the public key was not specified:
sudo -u vmail doveadm fs put crypt
private_key_path=/tmp/doveadm_TvZAjG16218-30778:posix:prefix=/var/mail/domain/user/Maildir/test/cur/
1561754561.M105295P13988.smtp\,S\=3700\,W\=3780\:2\,RS .test.out
What is the correct syntax to export folder keys, assuming that what I
have exported above are the user keys? Do you need to specify both
private/public keys when encrypting/decrypting? I wouldn't think so.
Typically all that is needed for encryption is the public key, and for
decryption the private key.
My mail_crypt settings:
mail_attribute_dict = file:%h/Maildir/dovecot-attributes
mail_plugins = $mail_plugins mail_crypt
plugin {
mail_crypt_curve = secp521r1
mail_crypt_save_version = 2
mail_crypt_require_encrypted_user_key = yes
}
On 6/29/21 1:11 AM, Aki Tuomi wrote:
On 29/06/2021 06:05 Ben Burk <b...@burk.tech> wrote:
There is an example of manually encrypting/decrypting mail processed by the
mail_crypt plugin here:
https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/
It outlines how one would manually encrypt/decrypt messages using global keys:
doveadm fs get/put crypt
private_key_path=foo:public_key_path=foo2:posix:prefix=/path/to/files/root
path/to/file
Is there a way to accomplish this using per-user folder keys? Is there some way
of making sense of the information in the dovecot-attributes file to accomplish
this?
--
Ben Burk
BURK.TECH System Administrator
You can use
doveadm mailbox cryptokey export
to export folder keys.
Aki
--
Ben Burk
BURK.TECH System Administrator
