Appearance
Note
Dovecot Pro's Lawful Interception Framework is not distributed as part of the base Dovecot Pro packages.
This plugin requires separate licensing to use. Contact Dovecot Pro SLA for further information.
Dovecot Pro provides a flexible, compliant, high performance lawful interception framework.
Users can be monitored by their interaction with the various Dovecot services. Relevant data is captured by hooking into the mail storage API and by parsing protocol data to and from mail access and delivery services (IMAP, POP3 and LMTP).
The overall structure of the framework consists of an intercept proxy and plugins that hook into various Dovecot services.
The intercept proxy handles the communication with the external interception receiver (a law enforcement entity or, more commonly, some sort of LI service provider). The intercept-proxy service has several backend classes that abstract the various intercept handover protocols that are involved. LI events are thus submitted by such a backend implementation.
The intercept-proxy accepts protocol data and/or message events from one of several Dovecot service plugins. There are plugins to capture:
Some LI service providers, such as Utimaco, also require access to a management API that allows management of surveillance targets.
| Backend | Description |
|---|---|
| fs | Reports are stored in a directory on the local Dovecot backend filesystem. |
| pine | Reports are passed to the remote PineApp API. |
| utimaco | Reports are passed to the remote Utimaco API. |
Lawful Interception is usually not blanket surveillance: only specific users are targeted. Therefore, various service plugins only enable interception when the intercept field from either passdb or userdb (depends on context) has a value.
Interception is enabled when the intercept field has any value. Additionally, this value is passed to the intercept-proxy as an intercept-ID in the interception session. Some intercept backends, such as Utimaco, use this as a means to convey a target identifier along with the events. This avoids the need to perform another lookup in the intercept-proxy service.
To assign the intercept field, usually additional lookups are needed in the auth configuration, since the surveillance information is not available from the normal user databases.
intercept| Default | [None] |
|---|---|
| Value | string |
If set, intercept is activated for this user.
Additionally, this value is passed to the intercept-proxy as an intercept-ID in the interception session.
Note
This is intended to be set in a user's session by userdb lookup.
It is documented here for completion's sake.
Note
The login-intercept plugin uses passdb extra fields instead of this value.
intercept_backend| Default | [None] |
|---|---|
| Value | string |
The intercept backend to use.
intercept_buffer_dir| Default | [None] |
|---|---|
| Value | string |
Path to temporary files creating intercepted data.
Needed only when intercept_buffer_max_size > 0.
intercept_buffer_max_size| Default | 0 |
|---|---|
| Value | size |
Write intercept buffers larger than this into temporary files in
intercept_buffer_dir.
If 0, buffers are always kept in memory.
intercept_proxy_path| Default | [None] |
|---|---|
| Value | string |
| Advanced Setting; this should not normally be changed. | |
Unix socket for connecting to intercept-proxy process.
intercept_tz| Default | <system time zone> |
|---|---|
| Value | string |
Allows choosing a time zone for the proxy that is different than the default system time zone. This is useful for some backends (Utimaco) that use timestamps without time zone field and expect a specific time zone.
The syntax is identical to the TZ environment variable.
See lda-intercept plugin.
See intercept-box plugin.