Hello, We have been using lda_mailbox_autocreate to avoid to intialize empty mailboxes upon account creations. This does the job allright except that dovecot-lda is also allowed to autocreate sub folders which is a problem when using addresses extensions (adress+folder at domain.tld). It's easy for a malicious user to flood a mailbox with tons of subfolders. Is there a way to tell dovecot-lda it can only create the initial mailbox and maybe some special folders but nothing else? Thanks, Arnaud -- Arnaud Ab?lard jabber: arnaud.abelard at univ-nantes.fr / twitter: ArnY Administrateur Syst?me DSI Universit? de Nantes -
On 6.4.2013, at 18.18, Arnaud Ab?lard <arnaud.abelard at univ-nantes.fr> wrote:> We have been using lda_mailbox_autocreate to avoid to intialize empty mailboxes upon account creations. This does the job allright except that dovecot-lda is also allowed to autocreate sub folders which is a problem when using addresses extensions (adress+folder at domain.tld). It's easy for a malicious user to flood a mailbox with tons of subfolders. > > Is there a way to tell dovecot-lda it can only create the initial mailbox and maybe some special folders but nothing else?INBOX is autocreated regardless of lda_mailbox_autocreate setting. So just set it to "no".