Topic: how to permit manager to access e-mail from users

[Jáder]

Hi

I'd like to permit managers to read user e-mails without let them know user password.
The e-mail is a company asset so it's ok to manager access the @company mail... just do not know how to do that.

I think about this and found just one way: e-mail archiving (MailAchiva = http://wiki.contribs.org/MailArchiva ).
Anyone has other option ?

Regards

Jáder

[mmccarn]

If it's ok for all of your managers to be able to see/read *all* email on the server, you could configure your SME to keep a copy of all emails (http://wiki.contribs.org/Email#Keep_a_copy_of_all_emails), then give your managers the username and password for the 'maillog' user.

You might also be able to create a script that uses imapsync or imapcopy to periodically copy all email for a group of users into a sub-folder for the appropriate manager.

A little googling leads me to believe that implementing dovecot 'shared folders' would be tricky

[CharlieBrady]

You might also be able to create a script that uses imapsync or imapcopy to periodically copy all email for a group of users into a sub-folder for the appropriate manager.

Any imap access (e.g. by imapsync or imapcopy) would require the password for each individual mailbox.

I hope OP intends to inform all his/her users of the plan to spy on their email.

[Jáder]

If it's ok for all of your managers to be able to see/read *all* email on the server, you could configure your SME to keep a copy of all emails (http://wiki.contribs.org/Email#Keep_a_copy_of_all_emails), then give your managers the username and password for the 'maillog' user.

That would be an acceptable solution... I was aware of this optin... but do not remembered it.

You might also be able to create a script that uses imapsync or imapcopy to periodically copy all email for a group of users into a sub-folder for the appropriate manager.

I'd prefer this option... I'll offer this option as my first recomendation.
Even if I have to copy all e-mail to one single manager this way is flexible to help in several situations!
And to help with CharlieBrady comment about password, I could change owner of e-mails after copy files.

A little googling leads me to believe that implementing dovecot 'shared folders' would be tricky

??? Not sure about dovecot shared folders... or how they'd help me???
I found this: http://tumbleweed.org.za/2007/10/03/dovecot-shared-mailboxes-correct-way

[Jáder]

Any imap access (e.g. by imapsync or imapcopy) would require the password for each individual mailbox.

I hope OP intends to inform all his/her users of the plan to spy on their email.

Charlie

After copy messages/folders, a chmod to manager:manager would fix the password problem.

I'm not aware about what is "OP" (English is not my first lang) but in this company the users already now they e-mail is a company asset and can be monitored.
BTW here in Brasil was decided in a court of law that everything @ work belongs to company and nobody can expect privacy when using @company e-mail or tools.
The company cannot monitor user@ISP e-mail... but even personal (MSN when used from inside company) can be monitored!

Jáder

[CharlieBrady]

I'm not aware about what is "OP" (English is not my first lang) ...

http://www.urbandictionary.com/define.php?term=op

[CharlieBrady]

After copy messages/folders, a chmod to manager:manager would fix the password problem.

You miss my point. The copy using imapsync or imapcopy cannot occur without the password of the source mailbox. In any case, chmod does not solve any password problem - it only affects the ability to read messages once IMAP is accessed (using password).

[Stefano]

jader..

to move mails using imapsync you have to know users' password

here you find the script I'm using.. users have to save their password in a text file in their nome dir (so no one can read it but root)

/etc/users is a text file with the list of usernames, each one on a separate line..

take it as a suggestion

Code: [Select]

#!/bin/bash

IMAPSYNC=`which imapsync`
CAT=`which cat`

HOSTFROM="localhost"
HOSTTO="localhost"

MANAGER="manager_account_username"
PASS2="manager_account_password"


#OPTIONS="--useheader 'Message-ID' --skipsize "
OPTIONS=" "
$CAT /etc/users | while read USER ; do

FILE="/home/e-smith/files/users/$USER/home/passfile.txt"

MAILDIR="/home/e-smith/files/users/$USER/Maildir"

if [ -f $FILE ]
then
UTENTE="$USER"

    PASS1=$FILE


# adesso sincronizzo
$IMAPSYNC  --host1 $HOSTFROM  --user1 $UTENTE --passfile1 $PASS1 --sep1=/ --prefix1 '' --host2 $HOSTTO --user2 $MANAGER --password2 $PASS2 --authmech1 LOGIN --authmech2 LOGIN  --nofoldersizes   --subscribe $OPTIONS

fi 
done


[Jáder]

You miss my point. The copy using imapsync or imapcopy cannot occur without the password of the source mailbox. In any case, chmod does not solve any password problem - it only affects the ability to read messages once IMAP is accessed (using password).

ooooooppsss  :$ :$ :$  as all you can see I never used imapCOPY/SYNC
but to have passwords saved as text IS NOT AN OPTION.

SO... what about an script to just copy user1 mailbox to under Manager.MyUsersEmail  folder ?
would that be possible ? I'd prefer to copy using a rysnc command... just to avoid waste time/bandwidth ?

There are any other options to original problem?

[janet]

jader

I think you are better off using this method
http://wiki.contribs.org/Email#Keep_a_copy_of_all_emails
as it automatically sends a copy of all users sent and received email messages to the maillog user.

If you just copy all users mail folders periodically, then the user could have sent or received various email messages and deleted those, so you would not have a copy of the deleted messages sent or received.

Using the copy to maillog method will ensure that the administrator or manager truly receives all messages, no matter what attempts a user may make to conceal messages.

Also another approach that no one has mentioned.
For incoming messages only, you can send a copy to another user ie deliver locally and forward a copy (configurable on a per user basis).

[Jáder]

Hi Mary

The manager request access to e-mail because when a user is not present (medical absent / personal business outside company / personal holiday) he can see something on user's e-mail needs attention.
He do not like to search all e-mail (thousands or hundreds of thousand messages) to find out just one.
That's why I think to create a folder for manager named "MyUsersE-mail" and inside a folder for each user... and just sync Maildir from user to there... maybe once an hour!

The perfect situation would be a feature Novell Groupwise has (had??) to allows one person see other person e-mail: http://www.novell.com/documentation/gw8/gw8_userwin/?page=/documentation/gw8/gw8_userwin/data/aai4ois.html#aai4ois

That would be a great feature for SME . Maybe I open a NFR! 

[Stefano]

but to have passwords saved as text IS NOT AN OPTION.

as long as nobody can read it but the owner and root, I can't see the problem..

[Jáder]

It's a management decision.
All passwords are safe, individual and known only by the user.
This way user can pointed as only responsable for something done with his username/password.

If password is saved on  a plain text, more than one person knows (owner and sysadmin)
I'll use this option just as LAST LAST option.

anyway, thanks by your opinion and help.

[mmccarn]

The manager request access to e-mail because when a user is not present (medical absent / personal business outside company / personal holiday) he can see something on user's e-mail needs attention.

You could do this by configuring all user email accounts to 'deliver locally and forward' email to the appropriate manager, then configure rules in the manager's email client (or using the Mailsorting contrib) to sort the email into folders based on the original 'To:' field.

Or, install UserManager and Vacation, and have all users configure a vacation message that says 'I'm out.  Talk to my manager'. (The admin could manually create vacation messages for users who forgot to do so).

Zarafa provides email folder sharing like Groupwise and Exchange, but looks a bit 'bleeding edge' for a production server (and has some odd licensing in the free/community edition - 2 full 'exchange' users, unlimited imap/webmail/activesync users).

I tried to figure out how to setup shared email folders using symlinks and permissions and dovecot-shared.

[Jáder]

You could do this by configuring all user email accounts to 'deliver locally and forward' email to the appropriate manager, then configure rules in the manager's email client (or using the Mailsorting contrib) to sort the email into folders based on the original 'To:' field.

That sounds interesting... but just for received e-mail... outgoing e-mail wouldn't be stored that way.

Or, install UserManager and Vacation, and have all users configure a vacation message that says 'I'm out.  Talk to my manager'. (The admin could manually create vacation messages for users who forgot to do so).

That would be a laborious job... not an option right now... maybe as last option.

Zarafa provides email folder sharing like Groupwise and Exchange, but looks a bit 'bleeding edge' for a production server (and has some odd licensing in the free/community edition - 2 full 'exchange' users, unlimited imap/webmail/activesync users).

They all uses Thunderbird as client... so Outlook licensing is not a problem... I'd love to test Zarafa... I must to be prepared to have problems with mobile phone (sync) ... not sure if it's something I wanna to do ... but it's a REALLY  temptation
Zarafa has lots of ENTERPRISE options, proxy e-mail, sync, ... all included.

I tried to figure out how to setup shared email folders using symlinks and permissions and dovecot-shared.

let us to know if you have good results.
For now I'll try to demove my client of this request.... or find the less worst way to do the job.

[mmccarn]

That sounds interesting... but just for received e-mail... outgoing e-mail wouldn't be stored that way.

But if someone is out sick or on vaca, they probably aren't sending emails?

let us to know if you have good results.

I got distracted and forgot to finish this post:
I tried to figure out how to setup shared email folders using symlinks and permissions and dovecot-shared, but all I did was break my email completely through incorrect application of file and folder rights.

[Jáder]

But if someone is out sick or on vaca, they probably aren't sending emails?

True! But manager do not have access to any information he/she send previously! So is not a thread... it's just like ear one side of talking!

I got distracted and forgot to finish this post:
I tried to figure out how to setup shared email folders using symlinks and permissions and dovecot-shared, but all I did was break my email completely through incorrect application of file and folder rights.

Hum... so it's not an option... I'd prefer take my chances with Zarafa!

[mmccarn]

Bits and pieces of info on setting up shared email folders using symlinks on SME8beta7:
1) I get errors when creating groups in server-manager, and the new group is not added to /etc/group.
2) After you set permissions on the shared folders, you have to change the primary group for the manager in /etc/passwd
3) Mail is *delivered* by qmail, which still creates all new messages with a umask of 0600, with ownership set to user:user rather than user:primarygroup

Steps I've taken:
- download 'create_dovecot_shares' from http://www.cpan.org/authors/id/G/GH/GHENRY/create_dovecot_shares-1.07:

Code: [Select]

cd /usr/local/bin
wget -O create_dovecot_shares http://www.cpan.org/authors/id/G/GH/GHENRY/create_dovecot_shares-1.07
chmod +x create_dovecot_shares
- create 'workgroupa' in server-manager (got an error)

- manually add 'workgroupa' to /etc/group (use db accounts show workgroupa to get the correct group id number)

- manually change the primary group id number for 'managera' to the value for 'workgroupa' in /etc/passwd (bad idea, I'm sure).

- create the shared folders using 'create_dovecot_shares':

Code: [Select]

create_dovecot_shares --username=usera,userb,userc --group=workgroupa --share-with=managera --home=/home/e-smith/files/users/  --override
- fix the group and permission settings for existing files for all users:

Code: [Select]

cd /home/e-smith/files/users
chgrp -R workgroupa usera
chmod -R g+rw usera
chgrp -R workgroupa userb
chmod -R g+rw userb
chgrp -R workgroupa userc
chmod -R g+rw userc

- Kill all running dovecot processes on the server (ps auxwww |grep dovecot)

Still unresolved:
- new email is still created 'owned' by user:user with permissions of -rw-------
This might be fixable with a cron job that runs through your user folders and re-sets groups and permissions regularly.  There may also be a way to do this using qmail, so that new mail is created with the "correct" permissions.

- new folders won't be shared by default
It should be possible to run 'create_dovecot_shares' in a cron job to pick up new folders.

- I suspect there's a "SME Way" to change a user's primary group, rather than adding it manually to /etc/passwd.  I have at least confirmed that signal-event user-modify managera doesn't change the primary group setting in /etc/passwd...

- I don't know if my error creating groups is a general SME8beta7 issue, or if it is specific to my server.