Lawful Intercept: Intercept Box (intercept-box) Plugin

Note

This plugin is provided by Dovecot Pro's Lawful Intercept Framework.

This is a mail storage driver intended to be configured to a special user that receives intercepted mails via LMTP or IMAP APPEND. Saving a mail to any of its folders results in the mail being saved to the specified fs/path. The saved mail is written to the intercept file without any modifications - no additional metadata is saved.

This plugin is independent of the rest of the intercept infrastructure, i.e. it doesn't use the intercept-proxy service or support any configurable drivers.

The way this plugin is intended to be used is to configure MTA to send mails to a special intercept user via LMTP. This user has a Sieve script, which gets the intercepted user information from the email headers or in the +detail of the recipient address.

The folder name is in format: <user> <timestamp> <type>. These fields can be used in intercept_box_path. The field contents are not validated in any way.

Configuration

intercept_box

Value	Named Filter

Named filter for intercept-box settings.

intercept_box_add_headers

Default	[None]
Value	String List
See Also	intercept_box_path

Headers to add to HTTP requests, when intercept_box is configured with HTTP-based fs storage.

See intercept_box_path for supported variable substitutions.

intercept_box_path

Default	[None]
Value	string

Path to save the mail intercepted via the intercept-box plugin.

For example:

intercept_box_path = %{crypted_user}/%{timestamp}.%{generate:guid128}.SMTP.%{type}.eml

Variable substitutions supported:

Variable	Description
user	user@domain (based on the folder name)
crypted_user	user@domain encrypted via intercept_crypted_user
timestamp	timestamp (based on the folder name)
type	type (based on the folder name)

Mail User Variables can also be used.

Example Configuration

protocol lmtp {
  # Generally, it is expected that userdb will return
  # "mail_location=intercept:" for users that need interception.

  mail_plugins {
    intercept_box = yes
  }
}

intercept_box {
  # POSIX interception
  fs posix {
    prefix = /tmp/intercept/%{user}/%{protocol}-
  }
  # TODO: dictmap example
}

intercept_box_crypt_key = secret
intercept_box_crypt_cipher = aes-256-cbc

intercept_box_path = %{crypted_user}/%{timestamp}.%{generate:guid128}.SMTP.%{type}.eml
intercept_box_add_headers {
  X-Dovecot-Hash = /intercept/trace/%{crypted_user | substr(0,2)}/%{crypted_user | substr(2,3)}/
}