dovecot - May 2007 - dovecot-shared being ignored?

So, I'm working on a shared folder. Everything is nice except for one bit. 

My dovecot-shared file in the Maildir is either being ignored, or doesn't 
work the way I think it does. Any messages copied into the Maildir using a 
mail client are mode 660 and owned by the user who did the copy. Perms on 
the dovecot-shared file are 700 (I'm using Solaris ACLs in addition to the 
Dovecot ACLs in order to prevent unauthorized access via means that don't 
pass through Dovecot's IMAP server... ie SFTP/SCP, and so I'm using 700 
with a rwx mask and access to the file set per user in the Solaris ACL).

The message files being created 660 means they are accessible via SFTP/SCP 
to anyone in the group, and we have a single one for (nearly) all users. 
This is not really acceptable, so if anyone can offer guidance on the 
dovecot-shared that'd be great. I checked the wiki, and it has very minimal 
information.

-Brian

On Fri, 2007-05-18 at 16:22 -0500, bhayden at umn.edu
wrote:
> So, I'm working on a shared folder. Everything is nice except for one
bit.
> 
> My dovecot-shared file in the Maildir is either being ignored, or
doesn't
> work the way I think it does. Any messages copied into the Maildir using a 
> mail client are mode 660 and owned by the user who did the copy. Perms on 
> the dovecot-shared file are 700 (I'm using Solaris ACLs in addition to
the
> Dovecot ACLs in order to prevent unauthorized access via means that
don't
> pass through Dovecot's IMAP server... ie SFTP/SCP, and so I'm using
700
> with a rwx mask and access to the file set per user in the Solaris ACL).
Well, first of all I don't understand why you're using 700 and not 600.
Also I don't understand where exactly you've applied ACLs, to mail files
themselves or to dovecot-shared? In any case Dovecot wouldn't even try
to copy the ACLs if you wanted that.

But as for why the mail files are 660, that's a bit weird. If you didn't
have dovecot-shared file at all, are they still created with 660? If so,
the only thing I can think of is that you've changed umask from
dovecot.conf. The default is umask=077 (and it's already been removed
from dovecot-example.conf because changing it doesn't work in any useful
way).

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL:
<http://dovecot.org/pipermail/dovecot/attachments/20070519/a7614c6b/attachment.bin>