Lawful Intercept: Intercept Box (intercept-box) Plugin

Note

This plugin is provided by Dovecot Pro's Lawful Intercept Framework.

This is a mail storage driver intended to be configured to a special user that receives intercepted mails via LMTP.

Saving a mail to any of its folders results in the mail being saved to the specified fs/path.

Configuration

intercept_box_add_hdr

Default	[None]
Value	string
See Also	intercept_box_path

Add an extra HTTP request header when intercept_box_fs points to HTTP-based storage.

See intercept_box_path for supported variable substitutions.

intercept_box_crypt_cipher

Default	[None]
Value	string
See Also	intercept_box_crypt_key

Encryption cipher used to generate the %{crypted_user} variable.

intercept_box_crypt_key

Default	[None]
Value	string
See Also	intercept_box_crypt_cipher

Secret encryption key used to generate the %{crypted_user} variable.

intercept_box_fs

Default	[None]
Value	string

Configuration for intercept-box plugin.

Example for POSIX interception:

intercept_box_fs = posix:prefix=/tmp/intercept/%u/%s-

intercept_box_path

Default	[None]
Value	string

Path to save the mail intercepted via the intercept-box plugin.

The folder-name elements are specified in the order user, timestamp, type,

For example:

intercept_box_path = %%{crypted_user}/%%{timestamp}.%%{guid128}.SMTP.%%{type}.eml

Variable substitutions supported:

Variable	Long Name	Description
%u	user	user@domain
%n	username	user
%d	domain	domain
%s	service	imap/pop3/lmtp
%l	lip	local IP
%r	rip	remote IP
%a	lport	local port
%b	rport	remote port
%h	home	user's home directory
	crypted_user	user@domain encrypted and hex-encoded
	timestamp	timestamp
	type	type
	guid	unique GUID including hostname
	guid128	unique hex-encoded 128bit GUID

Example Configuration

protocol lmtp {
  # Generally, it is expected that userdb will return
  # "mail_location=intercept:" for users that need interception.

  mail_plugins = $mail_plugins intercept_box
}

plugin {
  # POSIX interception
  intercept_box_fs = posix:prefix=/tmp/intercept/%u/%s-
  # TODO: dictmap example

  intercept_box_crypt_key = secret
  intercept_box_crypt_cipher = aes-256-cbc

  intercept_box_path = %%{crypted_user}/%%{timestamp}.%%{guid128}.SMTP.%%{type}.eml
  intercept_box_add_hdr = X-Dovecot-Hash:/intercept/trace/%%2{crypted_user}/%%2.3{crypted_user}/
}