Configuring postfix and dovecot for Secure IMAP and SMTP

Question

I have a clean install of postfix and dovecot-core dovecot-imapd dovecot-lmtpd installed on Debian 8 OS.

I want to configure mail to work with PAM but I want to restrict it to users who are part of the usermail group so not every linux user has mail access.

I'd also like to make sure the following files were configured properly. I want to make sure user/pass is not sent in plain text and that it is encrypted.

I am showing only the lines I have modified. For a section I wasn't sure of, I have asked a question.

dovecot/10-auth.conf

disable_plaintext_auth = yes
auth_username_chars = abcdefg....AbCdefg...0123...@

Should plain login be used for Secure SMTP and IMAPS or just plain?

auth_mechanisms = plain login 

This if for PAM authentication

!include auth-system.conf.ext

dovecot/10-master.conf

All others are commented out so only IMAPS will work.

service imap-login {
  inet_listener imaps {
    port = 993
    ssl = yes
  }
|

Is postfix the correct user, or should I be using dovecot here?

service lmtp {
  unix_listener /var/spool/postfix/private/dovecot-lmtp {
  mode = 0600
  user = postfix
  group = postfix
}

service auth {

Do I need to use this instead of Postfix smtp-auth?

  unix_listener auth-userdb {
    #mode =
    #user =
    #group =
  }

Should this be using postfix or dovecot as the user?

  # Postfix smtp-auth
  unix_listener /var/spool/postfix/private/auth {
  mode = 0666
  user=postfix
  group=postfix
}

dovecot/10-mail.conf

Is it okay to use maildir instead of Maildir? Would email clients or the server have issues using all lowercase?

mail_location = maildir:~/Maildir

dovecot/10-ssl.conf

ssl = required

ssl_cert = /etc/dovecot/*.pem
ssl_key = /etc/dovecot/private/*.pem

Do I need to exclude !SSLv2 and !SSLv3 to force TLS?

Here is the output of dovecot -n:

 mail_location = maildir:~/Maildir
 namespace inbox {
   inbox = yes
   location =
   prefix =
 }
 passdb {
   driver = pam
 }
 protocols = imap lmtp
 service auth {
   unix_listener /var/spool/postfix/private/auth {
     group = postfix
     user = postfix
     mode = 0666
   }
 }
 service imap-login {
   inet_listener imaps {
     port = 993
     ssl = yes
   }
 }
 service lmtp {
   unix_listener /var/spool/postfix/private/dovecot-lmtp {
     group = postfix
     user = postfix
     mode = 0600
   }
 }
 ssl = required
 userdb {
   driver = passwd
 }

postfix/main.cf

virtual_transport = lmtp:unix:private/dovecot-lmtp
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
smtpd_tls_auth_only = yes

postfix/master.cf

I just uncommented this line:

submission inet n       -       -       -       -       smtpd

UPDATE:

With this config I'm getting an error message when trying to send mail from client to a gmail acount. My iPhone also gets an authentication error message. The user has been created and using the password entered.

Warning: hostname mobile.a.b.c.d-mycingular.net does not resolve to address a.b.c.d
connect from unknown
warning: SASL: connect to private/auth failed: no such file or directory
fatal: no SASL authentication mechanisms
/usr/lib/postfix/smtpd bad command startup --throttling

Answer 1

dovecot/10-auth.conf

You should set both PLAIN and LOGIN, your actual configuration looks good.

dovecot/10-master.conf

That's not necessary to comment the other services, with

ssl = required

In your dovecot configuration, users will only be able to login if they are connected through ssl. That's a better approach since users may want to use STARTTLS.

For the authentification socket, you should use the user that is running the 3rd party service, in this case you should set postfix as user.

dovecot/10-mail.conf

You can set maildir without uppercases without any issues here.

dovecot/10-ssl.conf

You will not force tls by disabling SSLv2 and SSLv3 but you are going to prevent users from using SSL.

postfix/main.cf

This part looks good.

warning: SASL: connect to private/auth failed: no such file or directory

is meaning that the dovecot authentification cannot be found. You should ensure the authentification socket file is present in this directory