Provided by: cyrus-common_2.4.18-3_amd64 bug

NAME

       imapd.conf - IMAP configuration file

DESCRIPTION

       /etc/imapd.conf  is  the  configuration  file for the Cyrus IMAP server.  It defines local
       parameters for IMAP.

       Each line of the /etc/imapd.conf file has the form

              option: value

       where option is the name of the configuration option being set and value is the value that
       the configuration option is being set to.

       Although  there  is no limit to the length of a line, a ``\'' (backslash) character may be
       used as the last character on a line to  force  it  to  continue  on  the  next  one.   No
       additional  whitespace  is  inserted  before or after the ``\''.  Note that a line that is
       split using ``\'' character(s) is still considered a single line.  For example

              option:\
               value1 value2 \
                value3

       is equivalent to

              option: value1 value2   value3

       Blank lines and lines beginning with ``#'' are ignored.

       For boolean and enumerated options, the values ``yes'', ``on'', ``t'', ``true'' and  ``1''
       turn the option on, the values ``no'', ``off'', ``f'', ``false'' and ``0'' turn the option
       off.

FIELD DESCRIPTIONS

       The sections below detail options that can be placed in the /etc/imapd.conf file, and show
       each  option's  default  value.  Some options have no default value, these are listed with
       ``<no default>''.  Some options default  to  the  empty  string,  these  are  listed  with
       ``<none>''.   It   is   also   possible   to   override  options  by  specifying  them  as
       <service_id>_<optionname>. One example is ``lmtp_admins'', which overrides ``admins'' just
       for  the  lmtp  service.  The <service_id> is the one you specified in the /etc/cyrus.conf
       file.

       admins: <empty string>
            The list of userids with administrative rights.  Separate each userid with  a  space.
            Sites using Kerberos authentication may use separate "admin" instances.

       Note  that  accounts  used by users should not be administrators.  Administrative accounts
       should not receive mail.  That is, if user "jbRo" is a user reading mail,  he  should  not
       also  be  in the admins line.  Some problems may occur otherwise, most notably the ability
       of administrators to create top-level mailboxes visible to  users,  but  not  writable  by
       users.

       afspts_localrealms: <none>
            The  list  of  realms  which  are  to  be  treated as local, and thus stripped during
            identifier canonicalization (for the AFSPTS ptloader module).  This is different from
            loginrealms  in  that it occurs later in the authorization process (as the user id is
            canonified for PTS lookup)

       afspts_mycell: <none>
            Cell to use for AFS PTS lookups.  Defaults to the local cell.

       allowallsubscribe: 0
            Allow subscription to nonexistent  mailboxes.   This  option  is  typically  used  on
            backend  servers  in  a  Murder  so  that users can subscribe to mailboxes that don't
            reside on their "home" server.  This option can also be used as a workaround for IMAP
            clients  which  don't  play  well  with  nonexistent or unselectable mailboxes (e.g.,
            Microsoft Outlook).

       allowanonymouslogin: 0
            Permit logins by the user "anonymous" using any password.  Also  allows  use  of  the
            SASL ANONYMOUS mechanism.

       allowapop: 1
            Allow use of the POP3 APOP authentication command.

       Note  that  this  command  requires  that  SASL  is  compiled  with APOP support, that the
       plaintext passwords are available in a SASL auxprop backend (e.g., sasldb), and  that  the
       system  can  provide enough entropy (e.g., from /dev/urandom) to create a challenge in the
       banner.

       allownewnews: 0
            Allow use of the NNTP NEWNEWS command.

       Note that this is a very expensive command and should  only  be  enabled  when  absolutely
       necessary.

       allowplaintext: 0
            Allow the use of cleartext passwords on the wire.

       To  allow the use of plaintext passwords for authentication, you can set ``allowplaintext:
       yes'' in imapd.conf. This will still allow PLAIN under TLS, but IMAP LOGIN  commands  will
       now fail.

       If  you  only  list  plaintext  authentication  mechanisms  in  ``sasl_mech_list'' and set
       ``allowplaintext: no'', only users on encrypted sessions (TLS or  SSL)  will  be  able  to
       authenticate.  On  the  other  hand,  if  you  list no plaintext authentication options in
       ``sasl_mech_list'', ``allowplaintext: yes'' would have no effect.

       allowusermoves: 0
            Allow moving user accounts (with associated meta-data) via RENAME or XFER.

       Note that measures should be taken to make sure that the user being moved  is  not  logged
       in, and cannot login during the move.  Failure to do so may result in the user's meta-data
       (seen state, subscriptions, etc) being corrupted or out of date.

       altnamespace: 0
            Use the alternate IMAP namespace, where personal folders reside at the same level  in
            the hierarchy as INBOX.

       This  option  ONLY  applies where interaction takes place with the client/user.  Currently
       this is limited to the IMAP protocol (imapd) and Sieve scripts (lmtpd).  This option  does
       NOT  apply to admin tools such as cyradm (admins ONLY), reconstruct, quota, etc., NOR does
       it affect LMTP delivery of messages directly to mailboxes via plus-addressing.

       annotation_db: skiplist
            The cyrusdb backend to use for mailbox annotations.

            Allowed values: berkeley, berkeley-hash, skiplist

       annotation_db_path: <none>
            The  absolute  path  to  the  annotations  db  file.   If  not  specified,  will   be
            confdir/annotations.db

       anyoneuseracl: 1
            Should  non-admin  users  be  allowed  to  set  ACLs  for  the 'anyone' user on their
            mailboxes?  In a large organization this can cause support problems, but it's enabled
            by default.

       annotation_definitions: <none>
            File containing external (third-party) annotation definitions.

       Each  line  of  the  file  specifies the properties of an annotation and has the following
       form:

              name, scope, attrib-type, proxy-type, attrib-names, acl

       name is  the  hierarchical  name  as  in  the  draft  standard,  typically  of  the   form
            /vendor/acme/blurdybloop

       scope
            specifies whether the annotation is for the server or a mailbox

       attrib-type
            specifies  the  attribute  data  type which is one of: string, boolean, int, uint, or
            content-type

       proxy-type
            specifies whether this attribute  is  for  the  backend  or  proxy  servers  or  both
            (proxy_and_backend)

       attrib-names
            is  the  space-separated  list  of  available attributes for the annotation. Possible
            attribute names are (where the suffixless foo permits both foo.priv and  foo.shared):
            alue,   value.shared,   value.priv,   size,  size.shared,  size.priv,  modifiedsince,
            modifiedsince.shared, modifiedsince.priv, content-type, content-type.shared, content-
            type.priv

       acl  is  the extra ACL requirements for setting annotations. This is the standard IMAP ACL
            permission bit string format. Particularly useful is the a  right  to  require  admin
            privileges. Note that some ACL requirements (read and write on the mailbox) are hard-
            wired in the server

       Blank lines and lines beginning with ``#'' are ignored.

       auditlog: 0
            Should cyrus output log entries for every action taken on a message file or mailboxes
            list  entry?   It's noisy so disabled by default, but can be very useful for tracking
            down what happened if things look strange

       auth_mech: unix
            The authorization mechanism to use.

            Allowed values: unix, pts, krb, krb5

       autocreatequota: 0
            If nonzero, normal users may create their own IMAP accounts by creating  the  mailbox
            INBOX.   The  user's  quota is set to the value if it is positive, otherwise the user
            has unlimited quota.

       berkeley_cachesize: 512
            Size (in kilobytes) of the shared memory buffer pool (cache)  used  by  the  berkeley
            environment.   The minimum allowed value is 20.  The maximum allowed value is 4194303
            (4GB).

       berkeley_locks_max: 50000
            Maximum number of locks to be held or requested in the berkeley environment.

       berkeley_txns_max: 100
            Maximum number of transactions to be supported in the berkeley environment.

       boundary_limit: 1000
            messages are parsed recursively and a deep enough MIME structure can  cause  a  stack
            overflow.   Do not parse deeper than this many layers of MIME structure.  The default
            of 1000 is much higher than any sane message should have.

       client_timeout: 10
            Number of seconds to wait before returning a timeout failure when performing a client
            connection (e.g., in a murder environment)

       commandmintimer: <none>
            Time in seconds. Any imap command that takes longer than this time is logged.

       configdirectory: <none>
            The pathname of the IMAP configuration directory.  This field is required.

       debug_command: <none>
            Debug  command  to  be  used  by processes started with -D option.  The string is a C
            format string that gets 3 options: the first is the name of the  executable  (without
            path).   The  second  is the pid (integer) and the third is the service ID.  Example:
            /usr/local/bin/gdb /usr/cyrus/bin/%s %d

       defaultacl: anyone lrs
            The Access Control List (ACL) placed on a newly-created (non-user) mailbox that  does
            not have a parent mailbox.

       defaultdomain: <none>
            The default domain for virtual domain support. Note that this domain is stripped from
            the email-address transmitted using LMTP, but it is not stripped  from  usernames  at
            login-time.  For  imapd/pop3d,  "user" and "user@defaultdomain" specify two different
            users.  Please check install-virtdomains.html for details.

       defaultpartition: <none>
            The partition name used  by  default  for  new  mailboxes.   If  not  specified,  the
            partition with the most free space will be used for new mailboxes.

       defaultserver: <none>
            The  backend  server  name  used by default for new mailboxes.  If not specified, the
            server with the most free space will be used for new mailboxes.

       deletedprefix: DELETED
            If "delete_mode" set to be "delayed", the prefix for the deleted mailboxes hierarchy.
            The hierarchy delimiter will be automatically appended.

       delete_mode: immediate
            The  manner  in which mailboxes are deleted. "immediate" mode is the default behavior
            in which mailboxes are removed immediately.  In "delayed" mode, mailboxes are renamed
            to  a  special  hiearchy defined by the "deletedprefix" option to be removed later by
            cyr_expire.

            Allowed values: immediate, delayed

       deleteright: c
            Deprecated - only used  for  backwards  compatibility  with  existing  installations.
            Lists the old RFC 2086 right which was used to grant the user the ability to delete a
            mailbox.  If a user has this right, they will automatically  be  given  the  new  'x'
            right.

       disable_user_namespace: 0
            Preclude  list  command  on  user namespace.  If set to 'yes', the LIST response will
            never include any other user's mailbox.  Admin users will always see  all  mailboxes.
            The default is 'no'

       disable_shared_namespace: 0
            Preclude  list  command  on  user namespace.  If set to 'yes', the LIST response will
            never include any non-user mailboxes.  Admin users will  always  see  all  mailboxes.
            The default is 'no'

       disconnect_on_vanished_mailbox: 0
            If  enabled,  IMAP/POP3/NNTP  clients  will  be  disconnected  by  the  server if the
            currently selected mailbox is (re)moved by another session.  Otherwise,  the  missing
            mailbox is treated as empty while in use by the client.

       duplicate_db: skiplist
            The cyrusdb backend to use for the duplicate delivery suppression and sieve.

            Allowed   values:  berkeley,  berkeley-nosync,  berkeley-hash,  berkeley-hash-nosync,
            skiplist, sql

       duplicate_db_path: <none>
            The  absolute  path  to  the  duplicate  db  file.   If  not   specified,   will   be
            confdir/deliver.db

       duplicatesuppression: 1
            If  enabled, lmtpd will suppress delivery of a message to a mailbox if a message with
            the same message-id  (or  resent-message-id)  is  recorded  as  having  already  been
            delivered  to  the  mailbox.  Records the mailbox and message-id/resent-message-id of
            all successful deliveries.

       expunge_mode: default
            The mode in which messages (and their  corresponding  cache  entries)  are  expunged.
            "default"  mode  is the default behavior in which the message files are purged at the
            time of the EXPUNGE, but index and cache records are retained to facilitate  QRESYNC.
            In  "delayed" mode, the message files are also retained, allowing unexpunge to rescue
            them.  In "immediate" mode, both the message files and the index records are  removed
            as  soon  as  possible.  In all cases, nothing will be finally purged until all other
            processes have closed the mailbox to ensure they never see data disappear under them.
            In  "default"  or  "delayed"  mode,  a  later  run of "cyr_expire" will clean out the
            retained records (and possibly message files).  This reduces the amount of  I/O  that
            takes  place  at  the time of EXPUNGE and should result in greater responsiveness for
            the client, especially when expunging a large number of messages.

            Allowed values: default, immediate, delayed

       expunge_days: 7
            Number of days to retain expunged messages before cleaning up  their  index  records.
            The default is 7.  This is necessary for QRESYNC to work correctly.  If combined with
            delayed expunge (above) you will also be able to unexpunge messages during this time.

       failedloginpause: 3
            Number of seconds to pause after a failed login.

       flushseenstate: 0
            If enabled, changes to the seen state will be flushed to disk immediately,  otherwise
            changes  will  be  cached and flushed when the mailbox is closed.  This option may be
            used to fix the problem of  previously  read  messages  being  marked  as  unread  in
            Microsoft Outlook, at the expense of a loss of performance/scalability.

       foolstupidclients: 0
            If enabled, only list the personal namespace when a LIST "*" is performed (it changes
            the request to a LIST "INBOX*").

       force_sasl_client_mech: <none>
            Force preference of a given SASL mechanism for client side operations  (e.g.,  murder
            environments).   This  is  separate  from  (and overridden by) the ability to use the
            <host shortname>_mechs option to set preferred mechanisms for a specific host

       fulldirhash: 0
            If enabled, uses an improved directory hashing scheme  which  hashes  on  the  entire
            username  instead  of  using  just  the  first letter as the hash.  This changes hash
            algorithm used for quota and user directories and if hashimapspool  is  enabled,  the
            entire mail spool.

       Note that this option CANNOT be changed on a live system.  The server must be quiesced and
       then the directories moved with the rehash utility.

       hashimapspool: 0
            If enabled, the partitions will also be hashed, in addition to the  hashing  done  on
            configuration  directories.   This  is  recommended if one partition has a very bushy
            mailbox tree.

       hostname_mechs: <none>
            Force a particular list of SASL mechanisms to be  used  when  authenticating  to  the
            backend  server  hostname  (where  hostname  is  the  short hostname of the server in
            question). If it is not specified it will query the server for  available  mechanisms
            and pick one to use. - Cyrus Murder

       hostname_password: <none>
            The password to use for authentication to the backend server hostname (where hostname
            is the short hostname of the server) - Cyrus Murder

       idlesocket: {configdirectory}/socket/idle
            Unix domain socket that idled listens on.

       ignorereference: 0
            For backwards compatibility with Cyrus 1.5.10 and earlier  --  ignore  the  reference
            argument in LIST or LSUB commands.

       imapidlepoll: 60
            The  interval  (in  seconds) for polling for mailbox changes and ALERTs while running
            the IDLE command.  This option is used  when  idled  is  not  enabled  or  cannot  be
            contacted.  The minimum value is 1.  A value of 0 will disable IDLE.

       imapidresponse: 1
            If  enabled,  the  server responds to an ID command with a parameter list containing:
            version,  vendor,  support-url,  os,  os-version,  command,  arguments,  environment.
            Otherwise the server returns NIL.

       imapmagicplus: 0
            Only  list a restricted set of mailboxes via IMAP by using userid+namespace syntax as
            the authentication/authorization id.  Using userid+ (with an  empty  namespace)  will
            list only subscribed mailboxes.

       implicit_owner_rights: lkxa
            The implicit Access Control List (ACL) for the owner of a mailbox.

       @include: <none>
            Directive  which  includes  the  specified file as part of the configuration.  If the
            path to the file is not absolute, CYRUS_PATH is prepended.

       improved_mboxlist_sort: 0
            If enabled, a special comparator will be used which will correctly sort mailbox names
            that contain characters such as ' ' and '-'.

       Note  that  this  option  SHOULD  NOT be changed on a live system.  The mailboxes database
       should be dumped (ctl_mboxlist) before the option is changed, removed, and  then  undumped
       after  changing the option.  When not using flat files for the subscriptions databases the
       same   has   to   be   done   (cyr_dbtool)   for   each    subscription    database    See
       improved_mboxlist_sort.html.

       internaldate_heuristic: standard
            Mechanism  to determine email internaldates on delivery/reconstruct.  "standard" uses
            time() when delivering a message, mtime on reconstruct.   "receivedheader"  looks  at
            the top most Received header or time/mtime otherwise

            Allowed values: standard, receivedheader

       ldap_authz: <none>
            SASL authorization ID for the LDAP server

       ldap_base: <empty string>
            Contains the LDAP base dn for the LDAP ptloader module

       ldap_bind_dn: <none>
            Bind  DN  for  the  connection  to  the  LDAP  server  (simple bind).  Do not use for
            anonymous simple binds

       ldap_deref: never
            Specify how aliases dereferencing is handled during search.

            Allowed values: search, find, always, never

       ldap_filter: (uid=%u)
            Specify a filter that searches user identifiers.  The following tokens can be used in
            the filter string:

            %%    = % %u   = user %U   = user portion of %u (%U = test when %u = test@domain.tld)
            %d    =  domain  portion  of  %u  if  available  (%d   =   domain.tld   when   %u   =
            %test@domain.tld),   otherwise   same   as   %r   %D     =   user   dn.    (use  when
            ldap_member_method: filter) %1-9 = domain tokens (%1 = tld, %2 =  domain  when  %d  =
            domain.tld)

            ldap_filter is not used when ldap_sasl is enabled.

       ldap_group_base: <empty string>
            LDAP base dn for ldap_group_filter.

       ldap_group_filter: (cn=%u)
            Specify  a  filter  that  searches  for  group identifiers.  See ldap_filter for more
            options.

       ldap_group_scope: sub
            Specify search scope for ldap_group_filter.

            Allowed values: sub, one, base

       ldap_id: <none>
            SASL authentication ID for the LDAP server

       ldap_mech: <none>
            SASL mechanism for LDAP authentication

       ldap_member_attribute: <none>
            See ldap_member_method.

       ldap_member_base: <empty string>
            LDAP base dn for ldap_member_filter.

       ldap_member_filter: (member=%D)
            Specify a filter for "ldap_member_method: filter".  See ldap_filter for more options.

       ldap_member_method: attribute
            Specify a group method.  The "attribute" method retrieves groups from a  multi-valued
            attribute specified in ldap_member_attribute.

            The  "filter"  method uses a filter, specified by ldap_member_filter, to find groups;
            ldap_member_attribute is a single-value attribute group name.

            Allowed values: attribute, filter

       ldap_member_scope: sub
            Specify search scope for ldap_member_filter.

            Allowed values: sub, one, base

       ldap_password: <none>
            Password for the connection to the LDAP server (SASL and simple bind).   Do  not  use
            for anonymous simple binds

       ldap_realm: <none>
            SASL realm for LDAP authentication

       ldap_referrals: 0
            Specify whether or not the client should follow referrals.

       ldap_restart: 1
            Specify  whether or not LDAP I/O operations are automatically restarted if they abort
            prematurely.

       ldap_sasl: 1
            Use SASL for LDAP binds in the LDAP PTS module.

       ldap_sasl_authc: <none>
            Deprecated.  Use ldap_id

       ldap_sasl_authz: <none>
            Deprecated.  Use ldap_authz

       ldap_sasl_mech: <none>
            Deprecated.  Use ldap_mech

       ldap_sasl_password: <none>
            Deprecated.  User ldap_password

       ldap_sasl_realm: <none>
            Deprecated.  Use ldap_realm

       ldap_scope: sub
            Specify search scope.

            Allowed values: sub, one, base

       ldap_servers: ldap://localhost/
            Deprecated.  Use ldap_uri

       ldap_size_limit: 1
            Specify a number of entries for a search request to return.

       ldap_start_tls: 0
            Use StartTLS extended operation.  Do not use ldaps:  ldap_uri  when  this  option  is
            enabled.

       ldap_time_limit: 5
            Specify a number of seconds for a search request to complete.

       ldap_timeout: 5
            Specify a number of seconds a search can take before timing out.

       ldap_tls_cacert_dir: <none>
            Path to directory with CA (Certificate Authority) certificates.

       ldap_tls_cacert_file: <none>
            File containing CA (Certificate Authority) certificate(s).

       ldap_tls_cert: <none>
            File containing the client certificate.

       ldap_tls_check_peer: 0
            Require  and  verify  server  certificate.   If  this option is yes, you must specify
            ldap_tls_cacert_file or ldap_tls_cacert_dir.

       ldap_tls_ciphers: <none>
            List of SSL/TLS ciphers  to  allow.   The  format  of  the  string  is  described  in
            ciphers(1).

       ldap_tls_key: <none>
            File containing the private client key.

       ldap_uri: <none>
            Contains a list of the URLs of all the LDAP servers when using the LDAP PTS module.

       ldap_version: 3
            Specify  the  LDAP  protocol  version.   If  ldap_start_tls  and/or ldap_use_sasl are
            enabled, ldap_version will be automatically set to 3.

       lmtp_downcase_rcpt: 0
            If enabled, lmtpd will convert the recipient addresses to  lowercase  (up  to  a  '+'
            character, if present).

       lmtp_fuzzy_mailbox_match: 0
            If enabled, and the mailbox specified in the detail part of the recipient (everything
            after the '+') does not exist, lmtpd will try to find  the  closest  match  (ignoring
            case, ignoring whitespace, falling back to parent) to the specified mailbox name.

       lmtp_over_quota_perm_failure: 0
            If  enabled,  lmtpd  returns  a  permanent failure code when a user's mailbox is over
            quota.  By default, the failure is temporary, causing the MTA to  queue  the  message
            and retry later.

       lmtp_strict_quota: 0
            If  enabled,  lmtpd  returns  a failure code when the incoming message will cause the
            user's mailbox to exceed its quota.  By default, the failure won't  occur  until  the
            mailbox is already over quota.

       lmtp_strict_rfc2821: 1
            By  default,  lmtpd  will  be  strict  (per  RFC 2821) with regards to which envelope
            addresses are allowed.  If this option is set to false, 8bit characters in the local-
            part  of  envelope  addresses  are  changed  to 'X' instead.  This is useful to avoid
            generating backscatter with certain MTAs like  Postfix  or  Exim  which  accept  such
            messages.

       lmtpsocket: {configdirectory}/socket/lmtp
            Unix  domain  socket that lmtpd listens on, used by deliver(8). This should match the
            path specified in cyrus.conf(5).

       lmtptxn_timeout: 300
            Timeout (in seconds) used during a lmtp transaction to a remote backend  (e.g.  in  a
            murder  environment).   Can  be  used  to  prevent  hung lmtpds on proxy hosts when a
            backend server becomes unresponsive during a lmtp transaction.  The default is 300  -
            change to zero for infinite.

       loginrealms: <empty string>
            The   list   of   remote  realms  whose  users  may  authenticate  using  cross-realm
            authentication identifiers.  Separate each realm name by  a  space.   (A  cross-realm
            identity is considered any identity returned by SASL with an "@" in it.) Note that to
            support multiple virtual domains on the same interface/IP, you need to list them  all
            as loginreals.  If you don't list them here, your users probably won't be able to log
            in.

       loginuseacl: 0
            If enabled, any authentication identity which has a rights on a user's INBOX may  log
            in as that user.

       logtimestamps: 0
            Include  notations  in  the  protocol telemetry logs indicating the number of seconds
            since the last command or response.

       mailbox_default_options: 0
            Default "options" field for the mailbox on create.  You'll want to know  what  you're
            doing  before  setting this, but it can apply some default annotations like duplicate
            supression

       mailnotifier: <none>
            Notifyd(8) method to use for "MAIL" notifications.  If not set, "MAIL"  notifications
            are disabled.

       maxheaderlines: 1000
            Maximum number of lines of header that will be processed into cache records.  Default
            1000.  If set to zero, it is unlimited.  If a message hits the limit, an  error  will
            be  logged and the rest of the lines in the header will be skipped.  This is to avoid
            malformed messages causing giant cache records

       maxmessagesize: 0
            Maximum incoming LMTP message size.  If non-zero, lmtpd will reject  messages  larger
            than  maxmessagesize  bytes.   If set to 0, this will allow messages of any size (the
            default).

       maxquoted: 131072
            Maximum size of a single quoted string for the parser.  Default 128k

       maxword: 131072
            Maximum size of a single word for the parser.  Default 128k

       mboxkey_db: skiplist
            The cyrusdb backend to use for mailbox keys.

            Allowed values: berkeley, skiplist

       mboxlist_db: skiplist
            The cyrusdb backend to use for the mailbox list.

            Allowed values: flat, berkeley, berkeley-hash, skiplist, sql

       mboxlist_db_path: <none>
            The  absolute  path  to  the  mailboxes  db  file.   If   not   specified   will   be
            confdir/mailboxes.db

       mboxname_lockpath: <none>
            Path to mailbox name lock files (default $conf/lock)

       metapartition_files: <empty string>
            Space-separated list of metadata files to be stored on a metapartition rather than in
            the mailbox directory on a spool partition.

            Allowed values: header, index, cache, expunge, squat

       metapartition-name: <none>
            The pathname of  the  metadata  partition  name,  corresponding  to  spool  partition
            partition-name.   For  any  mailbox  residing  in  a directory on partition-name, the
            metadata files listed in  metapartition_files  will  be  stored  in  a  corresponding
            directory  on  metapartition-name.    Note  that  not  every partition-name option is
            required  to  have  a  corresponding  metapartition-name  option,  so  that  you  can
            selectively choose which spool partitions will have separate metadata partitions.

       mupdate_authname: <none>
            The  SASL  username  (Authentication  Name) to use when authenticating to the mupdate
            server (if needed).

       mupdate_config: standard
            The configuration of the mupdate servers in the Cyrus Murder.  The "standard"  config
            is  one  in  which  there  are  discreet  frontend  (proxy) and backend servers.  The
            "unified" config is one in which a server can be both a frontend  and  backend.   The
            "replicated"  config  is  one  in  which  multiple backend servers all share the same
            mailspool, but each have their own "replicated" copy of mailboxes.db.

            Allowed values: standard, unified, replicated

       munge8bit: 1
            If enabled, lmtpd munges messages with 8-bit characters in the  headers.   The  8-bit
            characters  are  changed  to `X'.  If reject8bit is enabled, setting munge8bit has no
            effect.  (A proper solution to non-ASCII characters in headers is offered by RFC 2047
            and its predecessors.)

       mupdate_connections_max: 128
            The  max  number of connections that a mupdate process will allow, this is related to
            the  number  of  file  descriptors  in  the  mupdate  process.   Beyond  this  number
            connections will be immediately issued a BYE response.

       mupdate_password: <none>
            The SASL password (if needed) to use when authenticating to the mupdate server.

       mupdate_port: 3905
            The port of the mupdate server for the Cyrus Murder

       mupdate_realm: <none>
            The SASL realm (if needed) to use when authenticating to the mupdate server.

       mupdate_retry_delay: 20
            The base time to wait between connection retries to the mupdate server.

       mupdate_server: <none>
            The mupdate server for the Cyrus Murder

       mupdate_username: <empty string>
            The  SASL  username  (Authorization  Name)  to use when authenticating to the mupdate
            server

       mupdate_workers_max: 50
            The maximum number of mupdate worker threads (overall)

       mupdate_workers_maxspare: 10
            The maximum number of idle mupdate worker threads

       mupdate_workers_minspare: 2
            The minimum number of idle mupdate worker threads

       mupdate_workers_start: 5
            The number of mupdate worker threads to start

       netscapeurl: <none>
            If enabled at compile time, this specifies a URL to  reply  when  Netscape  asks  the
            server  where the mail administration HTTP server is.  Administrators should set this
            to a local resource.

       newsaddheaders: to
            Space-separated list of headers to be added to incoming usenet articles.   Added  To:
            headers  will contain email delivery addresses corresponding to each newsgroup in the
            Newsgroups: header.  Added Reply-To: headers will contain  email  delivery  addresses
            corresponding  to  each  newsgroup in the Followup-To: or Newsgroups: header.  If the
            specified header(s) already exist in an article, the email delivery addresses will be
            appended to the original header body(s).

            This option applies if and only if the newspostuser option is set.

            Allowed values: to, replyto

       newsgroups: *
            A  wildmat  pattern  specifying  which  mailbox  hierarchies  should  be  treated  as
            newsgroups.  Only mailboxes matching the wildmat will accept  and/or  serve  articles
            via  NNTP.  If not set, a default wildmat of "*" (ALL shared mailboxes) will be used.
            If the newsprefix option is also set, the  default  wildmat  will  be  translated  to
            "<newsprefix>.*"

       newsmaster: news
            Userid  that  is  used  for  checking  access  controls when executing Usenet control
            messages.  For instance, to allow articles to  be  automatically  deleted  by  cancel
            messages,  give  the  "news"  user  the 'd' right on the desired mailboxes.  To allow
            newsgroups to be automatically created, deleted  and  renamed  by  the  corresponding
            control  messages,  give  the  "news"  user  the  'c'  right  on  the desired mailbox
            hierarchies.

       newspeer: <none>
            A list of whitespace-separated news server specifications to which articles should be
            fed.      Each     server     specification    is    a    string    of    the    form
            [user[:pass]@]host[:port][/wildmat] where 'host' is the fully qualified  hostname  of
            the  server,  'port'  is the port on which the server is listening, 'user' and 'pass'
            are the authentication credentials and 'wildmat' is a pattern  that  specifies  which
            groups  should be fed.  If no 'port' is specified, port 119 is used.  If no 'wildmat'
            is specified, all groups are fed.  If 'user' is specified (even if empty),  then  the
            NNTP POST command will be used to feed the article to the server, otherwise the IHAVE
            command will be used.

            A '@' may be used in place of '!' in the wildmat to prevent feeding  articles  cross-
            posted to the given group, otherwise cross-posted articles are fed if any part of the
            wildmat matches.  For example,  the  string  "peer.example.com:*,!control.*,@local.*"
            would  feed  all groups except control messages and local groups to peer.example.com.
            In the case of cross-posting to local groups, these articles would not be fed.

       newspostuser: <none>
            Userid used to deliver usenet articles to newsgroup folders (usually via  lmtp2nntp).
            For example, if set to "post", email sent to "post+comp.mail.imap" would be delivered
            to the "comp.mail.imap" folder.

            When  set,  the  Cyrus  NNTP  server  will  add  the  header(s)  specified   in   the
            newsaddheaders  option  to  each  incoming  usenet article.  The added header(s) will
            contain email delivery addresses corresponding to each relevent  newsgroup.   If  not
            set, no headers are added to usenet articles.

       newsprefix: <none>
            Prefix  to  be  prepended  to  newsgroup names to make the corresponding IMAP mailbox
            names.

       newsrc_db_path: <none>
            The  absolute  path  to  the  newsrc  db   file.    If   not   specified,   will   be
            confdir/fetchnews.db

       nntptimeout: 3
            Set  the  length  of  the NNTP server's inactivity autologout timer, in minutes.  The
            minimum value is 3, the default.

       notifysocket: {configdirectory}/socket/notify
            Unix domain socket that the mail notification daemon listens on.

       notify_external: <none>
            Path to the external program that notifyd(8) will call to send mail notifications.

       The external program will be called with the following command line options:

       -c class

       -p priority

       -u user

       -m mailbox

       And the notification message will be available on stdin.

       partition-name: <none>
            The pathname of the  partition  name.   At  least  one  partition  pathname  MUST  be
            specified.   If  the  defaultpartition  option  is  used,  then  its pathname MUST be
            specified.  For example, if the value of the defaultpartion option is  default,  then
            the partition-default field is required.

       plaintextloginpause: 0
            Number  of  seconds  to  pause  after a successful plaintext login.  For systems that
            support strong authentication, this  permits  users  to  perceive  a  cost  of  using
            plaintext   passwords.    (This   does   not   affect   the  use  of  PLAIN  in  SASL
            authentications.)

       plaintextloginalert: <none>
            Message to send to client after a successful plaintext login.

       popexpiretime: -1
            The number of days advertised as being the minimum a message may be left on  the  POP
            server  before  it  is  deleted  (via the CAPA command, defined in the POP3 Extension
            Mechanism, which some clients may support).  "NEVER", the default, may  be  specified
            with a negative number.  The Cyrus POP3 server never deletes mail, no matter what the
            value of this parameter is.  However, if a site implements a less liberal policy,  it
            needs to change this parameter accordingly.

       popminpoll: 0
            Set the minimum amount of time the server forces users to wait between successive POP
            logins, in minutes.

       popsubfolders: 0
            Allow access to subfolders of INBOX via POP3 by using userid+subfolder syntax as  the
            authentication/authorization id.

       poppollpadding: 1
            Create  a  softer minimum poll restriction.  Allows poppollpadding connections before
            the minpoll restriction is triggered.  Additionally, one padding entry  is  recovered
            every  popminpoll  minutes.   This allows for the occasional polling rate faster than
            popminpoll, (i.e., for clients that require a send/receive to send  mail)  but  still
            enforces the rate long-term.  Default is 1 (disabled).

            The  easiest  way  to think of it is a queue of past connections, with one slot being
            filled for every connection, and one slot being  cleared  every  popminpoll  minutes.
            When the queue is full, the user will not be able to check mail again until a slot is
            cleared.  If the user waits a sufficient amount of time, they will get back  many  or
            all of the slots.

       poptimeout: 10
            Set  the  length  of  the  POP server's inactivity autologout timer, in minutes.  The
            minimum value is 10, the default.

       popuseacl: 0
            Enforce IMAP ACLs in the pop server.  Due to the nature of  the  POP3  protocol,  the
            only  rights  which are used by the pop server are 'r', 't', and 's' for the owner of
            the mailbox.  The 'r' right allows the user to open  the  mailbox  and  list/retrieve
            messages.   The  't'  right allows the user to delete messages.  The 's' right allows
            messages retrieved by the user to have the \Seen flag set (only if popuseimapflags is
            also enabled).

       popuseimapflags: 0
            If  enabled,  the  pop  server  will  set  and  obey IMAP flags.  Messages having the
            \Deleted flag are ignored as if they do not exist.  Messages that  are  retrieved  by
            the  client  will  have  the \Seen flag set.  All messages will have the \Recent flag
            unset.

       postmaster: postmaster
            Username that is used as the 'From' address in rejection MDNs produced by sieve.

       postuser: <empty string>
            Userid used to deliver messages to shared folders.  For  example,  if  set  to  "bb",
            email  sent  to  "bb+shared.blah" would be delivered to the "shared.blah" folder.  By
            default, an email address of "+shared.blah" would be used.

       proc_path: <none>
            Path to proc directory.  Default is NULL - must be an absolute path if specified.  If
            not specified, the path $confdir/proc/ will be used.

       proxy_authname: proxy
            The  authentication  name to use when authenticating to a backend server in the Cyrus
            Murder.

       proxy_compress: 0
            Try to enable protocol-specific compression when performing a client connection to  a
            backend server in the Cyrus Murder.

       Note  that  this  should  only be necessary over slow network connections.  Also note that
       currently only IMAP and MUPDATE support compression.

       proxy_password: <none>
            The default password to use when authenticating to a  backend  server  in  the  Cyrus
            Murder.   May  be  overridden  on  a  host-specific basis using the hostname_password
            option.

       proxy_realm: <none>
            The authentication realm to use when authenticating to a backend server in the  Cyrus
            Murder

       proxyd_allow_status_referral: 0
            Set  to  true  to  allow  proxyd  to  issue referrals to clients that support it when
            answering the STATUS command.  This is disabled by default since some  clients  issue
            many  STATUS commands in a row, and do not cache the connections that these referrals
            would cause, thus resulting in a higher authentication load on the respective backend
            server.

       proxyd_disable_mailbox_referrals: 0
            Set to true to disable the use of mailbox-referrals on the proxy servers.

       proxyservers: <none>
            A  list  of  users and groups that are allowed to proxy for other users, separated by
            spaces.  Any user listed in this will be allowed to login for  any  other  user:  use
            with  caution.   In a standard murder this option should ONLY be set on backends.  DO
            NOT SET on frontends or things won't work properly.

       pts_module: afskrb
            The PTS module to use.

            Allowed values: afskrb, ldap

       ptloader_sock: <none>
            Unix domain socket that ptloader listens on.  (defaults to configdir/ptclient/ptsock)

       ptscache_db: skiplist
            The cyrusdb backend to use for the pts cache.

            Allowed values: berkeley, berkeley-hash, skiplist

       ptscache_db_path: <none>
            The  absolute  path  to  the  ptscache  db  file.   If   not   specified,   will   be
            confdir/ptscache.db

       ptscache_timeout: 10800
            The  timeout  (in  seconds)  for  the  PTS cache database when using the auth_krb_pts
            authorization method (default: 3 hours).

       ptskrb5_convert524: 1
            When using the AFSKRB ptloader module with Kerberos 5 canonicalization, do the  final
            524  conversion  to get a n AFS style name (using '.' instead of '/', and using short
            names

       ptskrb5_strip_default_realm: 1
            When using the AFSKRB ptloader module with Kerberos  5  canonicalization,  strip  the
            default realm from the userid (this does not affect the stripping of realms specified
            by the afspts_localrealms option)

       qosmarking: cs0
            This specifies the Class Selector or Differentiated Services Code  Point  designation
            on IP headers (in the ToS field).

            Allowed values: cs0, cs1, cs2, cs3, cs4, cs5, cs6, cs7, af11, af12, af13, af21, af22,
            af23, af31, af32, af33, af41, af42, af43, ef

       quota_db: quotalegacy
            The cyrusdb backend to use for quotas.

            Allowed values: flat, berkeley, berkeley-hash, skiplist, sql, quotalegacy

       quota_db_path: <none>
            The absolute path for the quota database (if you choose a single-file quota DB type -
            or   the   base   path  if  you  choose  quotalegacy).   If  not  specified  will  be
            confdir/quota.db or confdir/quota/

       quotawarn: 90
            The percent of quota utilization over which the server generates warnings.

       quotawarnkb: 0
            The maximum amount of free space (in kB) at which to give a quota  warning  (if  this
            value  is  0,  or  if the quota is smaller than this amount, than warnings are always
            given).

       reject8bit: 0
            If enabled, lmtpd rejects messages with 8-bit characters in the headers.

       rfc2046_strict: 0
            If enabled, imapd will be strict (per RFC 2046) when matching MIME boundary  strings.
            This  means that boundaries containing other boundaries as substrings will be treated
            as identical.  Since enabling this option will break some messages created by  Eudora
            5.1  (and  earlier),  it is recommended that it be left disabled unless there is good
            reason to do otherwise.

       rfc3028_strict: 1
            If enabled, Sieve will be strict (per RFC 3028) with regards  to  which  headers  are
            allowed to be used in address and envelope tests.  This means that only those headers
            which are defined to contain addresses will be allowed in address tests and only "to"
            and  "from"  will  be  allowed  in  envelope tests.  When disabled, ANY grammatically
            correct header will be allowed.

       sasl_auto_transition: 0
            If enabled, the SASL library will automatically create  authentication  secrets  when
            given a plaintext password.  See the SASL documentation.

       sasl_maximum_layer: 256
            Maximum  SSF  (security  strength  factor)  that  the  server  will allow a client to
            negotiate.

       sasl_minimum_layer: 0
            The minimum SSF that the server will allow a client  to  negotiate.   A  value  of  1
            requires integrity protection; any higher value requires some amount of encryption.

       sasl_option: 0
            Any  SASL  option  can  be set by preceding it with "sasl_".  This file overrides the
            SASL configuration file.

       sasl_pwcheck_method: <none>
            The mechanism used by the server to  verify  plaintext  passwords.   Possible  values
            include "auxprop", "saslauthd", and "pwcheck".

       seenstate_db: skiplist
            The cyrusdb backend to use for the seen state.

            Allowed values: flat, berkeley, berkeley-hash, skiplist

       sendmail: /usr/lib/sendmail
            The  pathname  of  the  sendmail  executable.   Sieve  invokes  sendmail  for sending
            rejections, redirects and vacation responses.

       serverlist: <none>
            Whitespace separated list of backend server names.  Used for finding server with  the
            most available free space for proxying CREATE.

       servername: <none>
            This  is  the  hostname  visible  in  the greeting messages of the POP, IMAP and LMTP
            daemons. If it is unset, then the result returned from gethostname(2) is used.

       serverinfo: on
            The  server  information  to  display  in  the  greeting  and  capability  responses.
            Information is displayed as follows:

            "off" = no server information in the greeting or capabilities
            "min" = servername in the greeting; no server information in the capabilities
            "on"  =  servername  and  product  version  in  the  greeting; product version in the
            capabilities

            Allowed values: off, min, on

       sharedprefix: Shared Folders
            If using the alternate IMAP namespace, the prefix  for  the  shared  namespace.   The
            hierarchy delimiter will be automatically appended.

       sieve_allowreferrals: 1
            If  enabled, timsieved will issue referrals to clients when the user's scripts reside
            on a remote server (in a Murder).  Otherwise, timsieved will  proxy  traffic  to  the
            remote server.

       sieve_extensions:  fileinto  reject  vacation  imapflags  notify envelope relational regex
       subaddress copy imap4flags
            Space-separated list of Sieve  extensions  allowed  to  be  used  in  sieve  scripts,
            enforced  at  submission  by  timsieved(8).   Any previously installed script will be
            unaffected by this option and will continue to execute regardless of  the  extensions
            used.   This option has no effect on options that are disabled at compile time (e.g.,
            "regex").

            Allowed values: fileinto, reject, vacation,  imapflags,  notify,  include,  envelope,
            body, relational, regex, subaddress, copy, imap4flags

       sieve_maxscriptsize: 32
            Maximum  size  (in  kilobytes)  any  sieve  script  can be, enforced at submission by
            timsieved(8).

       sieve_maxscripts: 5
            Maximum number of sieve  scripts  any  user  may  have,  enforced  at  submission  by
            timsieved(8).

       sieve_utf8fileinto: 0
            If  enabled, the sieve engine expects folder names for the fileinto action in scripts
            to use UTF8 encoding.  Otherwise, modified UTF7 encoding should be used.

       sieve_sasl_send_unsolicited_capability: 0
            If enabled, timsieved will  emit  a  capability  response  after  a  successful  SASL
            authentication, per draft-martin-managesieve-12.txt .

       sievedir: /usr/sieve
            If sieveusehomedir is false, this directory is searched for Sieve scripts.

       sievenotifier: <none>
            Notifyd(8)   method   to   use  for  "SIEVE"  notifications.   If  not  set,  "SIEVE"
            notifications are disabled.

       This method is only used when no method is specified in the script.

       sieveusehomedir: 0
            If  enabled,  lmtpd  will  look  for  Sieve  scripts  in  user's  home   directories:
            ~user/.sieve.

       singleinstancestore: 1
            If  enabled,  imapd,  lmtpd and nntpd attempt to only write one copy of a message per
            partition and create hard links, resulting in a potentially large disk savings.

       skiplist_always_checkpoint: 1
            If enabled, this option forces the skiplist cyrusdb backend to always checkpoint when
            doing  a recovery.  This causes slightly more IO, but on the other hand leads to more
            efficient databases, and the entire file is already "hot".

       skiplist_unsafe: 0
            If enabled, this option forces the skiplist cyrusdb backend to not sync writes to the
            disk.  Enabling this option is NOT RECOMMENDED.

       soft_noauth: 1
            If  enabled,  lmtpd  returns  temporary  failures if the client does not successfully
            authenticate.  Otherwise lmtpd returns permanent failures (causing the mail to bounce
            immediately).

       specialusealways: 0
            If  enabled,  this  option  causes  LIST  and LSUB output to always include the XLIST
            "special-use" flags. See "xlist-*'"

       sql_database: <none>
            Name of the database which contains the cyrusdb table(s).

       sql_engine: <none>
            Name of the SQL engine to use.

            Allowed values: mysql, pgsql, sqlite

       sql_hostnames: <empty string>
            Comma separated list of SQL servers (in host[:port] format).

       sql_passwd: <none>
            Password to use for authentication to the SQL server.

       sql_user: <none>
            Username to use for authentication to the SQL server.

       sql_usessl: 0
            If enabled, a secure connection will be made to the SQL server.

       srvtab: <empty string>
            The pathname of srvtab file containing the server's  private  key.   This  option  is
            passed to the SASL library and overrides its default setting.

       submitservers: <none>
            A  list  of users and groups that are allowed to resolve "urlauth=submit+" IMAP URLs,
            separated by spaces.  Any user listed in this will be allowed to fetch  the  contents
            of any valid "urlauth=submit+" IMAP URL: use with caution.

       subscription_db: flat
            The cyrusdb backend to use for the subscriptions list.

            Allowed values: flat, berkeley, berkeley-hash, skiplist

       suppress_capabilities: <none>
            Suppress  the named capabilities from any capability response.  Use the exact case as
            it appears in the response,  e.g.   "suppress_capabilities:  ESEARCH  QRESYNC  WITHIN
            XLIST  LIST-EXTENDED" if you have a murder with 2.3.x backends and don't want clients
            being confused by new capabilities that some backends don't support.

       statuscache: 0
            Enable/disable the imap status cache.

       statuscache_db: skiplist
            The cyrusdb backend to use for the imap status cache.

            Allowed  values:  berkeley,  berkeley-nosync,  berkeley-hash,   berkeley-hash-nosync,
            skiplist, sql

       statuscache_db_path: <none>
            The   absolute  path  to  the  statuscache  db  file.   If  not  specified,  will  be
            confdir/statuscache.db

       sync_authname: <none>
            The authentication name to use when authenticating to a sync server.  Prefix  with  a
            channel name to only apply for that channel

       sync_compress: 0
            Enable  compression on replication traffic.  Prefix with a channel name to only apply
            for that channel

       sync_host: <none>
            Name of the host (replica running sync_server(8)) to which replication  actions  will
            be sent by sync_client(8).  Prefix with a channel name to only apply for that channel

       sync_log: 0
            Enable replication action logging by lmtpd(8), imapd(8), pop3d(8), and nntpd(8).  The
            log {configdirectory}/sync/log is used by sync_client(8) for "rolling" replication.

       sync_log_chain: 0
            Enable replication action logging  by  sync_server  as  well,  allowing  chaining  of
            replicas.  Use this on 'B' for A => B => C replication layout

       sync_log_channels: <none>
            If  specified,  log all events to multiple log files in directories specified by each
            "channel".  To run these log files, you need to pass the -n option to sync_client  -r
            with  the channel name.  Use this for a mesh style replication layout - every machine
            replicating to every other machine.

       sync_password: <none>
            The default password to use when authenticating to a  sync  server.   Prefix  with  a
            channel name to only apply for that channel

       sync_port: csync
            Name of the service (or port number) of the replication service on replica host.  The
            default is "csync" which is usally port 2005, but any service name  or  numeric  port
            can be specified.  Prefix with a channel name to only apply for that channel

       sync_realm: <none>
            The  authentication realm to use when authenticating to a sync server.  Prefix with a
            channel name to only apply for that channel

       sync_repeat_interval: 1
            Minimum interval (in seconds) between replication runs in rolling  replication  mode.
            If a replication run takes longer than this time, we repeat immediately.  Prefix with
            a channel name to only apply for that channel

       sync_shutdown_file: <none>
            Simple latch used to tell sync_client(8)  that  it  should  shut  down  at  the  next
            opportunity.  Safer than sending signals to running processes.  Prefix with a channel
            name to only apply for that channel

       syslog_prefix: <none>
            String to be prepended to the process name in syslog entries.

       tcp_keepalive: 0
            Enable keepalive on TCP connections

       tcp_keepalive_cnt: 0
            Number of TCP keepalive probes to send before declaring the  connection  dead  (0  ==
            system default)

       tcp_keepalive_idle: 0
            Number  of  seconds  a connection must be idle before keepalive probes are sent (0 ==
            system default)

       tcp_keepalive_intvl: 0
            Number of seconds between keepalive probes (0 == system default)

       temp_path: /tmp
            The pathname to store temporary files in

       timeout: 30
            The length of the IMAP server's inactivity autologout timer, in minutes.  The minimum
            value is 30, the default.

       tls_ca_file: <none>
            File containing one or more Certificate Authority (CA) certificates.

       tls_ca_path: <none>
            Path  to directory with certificates of CAs.  This directory must have filenames with
            the hashed value of the certificates (see openssl(XXX)).

       tlscache_db: skiplist
            The cyrusdb backend to use for the TLS cache.

            Allowed  values:  berkeley,  berkeley-nosync,  berkeley-hash,   berkeley-hash-nosync,
            skiplist, sql

       tlscache_db_path: <none>
            The   absolute   path   to   the  tlscache  db  file.   If  not  specified,  will  be
            confdir/tls_sessions.db

       tls_cert_file: <none>
            File containing the certificate presented for server authentication during  STARTTLS.
            A value of "disabled" will disable SSL/TLS.

       tls_cipher_list: DEFAULT
            The  list  of  SSL/TLS  ciphers  to  allow.  The format of the string is described in
            ciphers(1).

       tls_compression: 0
            deactivate TLS compression by default

       tls_eccurve: prime256v1
            The elliptic curve used for ECDHE. Default is NIST Suite B  prime256.   See  'openssl
            ecparam -list_curves' for possible values.

       tls_key_file: <none>
            File  containing  the  private  key  belonging to the server certificate.  A value of
            "disabled" will disable SSL/TLS.

       tls_prefer_server_ciphers: 0
            Prefer the ciphers on the server side instead of client side

       tls_require_cert: 0
            Require a client certificate for ALL services (imap, pop3, lmtp, sieve).

       tls_session_timeout: 1440
            The length of time (in minutes) that a TLS session will be cached  for  later  reuse.
            The maximum value is 1440 (24 hours), the default.  A value of 0 will disable session
            caching.

       tls_versions: tls1_0 tls1_1 tls1_2
            A list of SSL/TLS versions to  not  disable.  Cyrus  IMAP  SSL/TLS  starts  with  all
            protocols,  and substracts protocols not in this list. Newer versions of SSL/TLS will
            need to be added here to allow them to get disabled.

       umask: 077
            The umask value used by various Cyrus IMAP programs.

       userdeny_db: flat
            The cyrusdb backend to use for the user access list.

            Allowed values: flat, berkeley, berkeley-hash, skiplist, sql

       userdeny_db_path: <none>
            The  absolute  path  to  the  userdeny  db  file.   If   not   specified,   will   be
            confdir/user_deny.db

       user_folder_limit: 0
            Limit the number of folders a user can create in their INBOX.  Set to 0 (default) for
            no limit.  Only affects folders in user.

       username_tolower: 1
            Convert usernames to all lowercase before login/authentication.  This is useful  with
            authentication backends which ignore case during username lookups (such as LDAP).

       userprefix: Other Users
            If using the alternate IMAP namespace, the prefix for the other users namespace.  The
            hierarchy delimiter will be automatically appended.

       unix_group_enable: 1
            Should we look up groups when using auth_unix (disable this  if  you  are  not  using
            groups in ACLs for your IMAP server, and you are using auth_unix with a backend (such
            as LDAP) that can make getgrent() calls very slow)

       unixhierarchysep: 0
            Use the UNIX separator character '/' for delimiting levels of mailbox hierarchy.  The
            default is to use the netnews separator character '.'.

       virtdomains: off
            Enable  virtual  domain support.  If enabled, the user's domain will be determined by
            splitting a fully qualified userid at the last '@' or '%' symbol.  If the  userid  is
            unqualified,  and  the  virtdomains  option  is  set to "on", then the domain will be
            determined by doing a reverse lookup on  the  IP  address  of  the  incoming  network
            interface, otherwise the user is assumed to be in the default domain (if set).

            Allowed values: off, userid, on

       xlist-*: <none>
            Cyrus 2.4 ONLY - enable special use flags.  The valid names can be taken from GMail's
            XLIST documents or RFC 6154.  Attribute name  in  the  configuration  key  should  be
            defined  in  lowercase. The attribute value is case sensitive, may contain whitespace
            and must be valid UTF7-IMAP string.  It must exactly match the name of the  subfolder
            of a user's INBOX.

            Example: xlist-drafts: My Drafts

            Every  user  on  your server with a 'INBOX.My Drafts' folder will get the special use
            flag " versions of Cyrus have a much more flexible RFC 6154 compatible system.

       normalizeuid: 0
            Lowercase uid and strip leading and trailing blanks. It is recommended to set this to
            yes, especially if OpenLDAP is used as authentication source.

SEE ALSO

       imapd(8),  pop3d(8),  nntpd(8),  lmtpd(8), timsieved(8), idled(8), notifyd(8), deliver(8),
       master(8), ciphers(1)