
Security Password
=================

DBMail now supports a special, separate password.

This separate password allows you to specify behavior when users log into one
of the DBMail servers using this password.

The use-case for this feature is when you want to provide your users with an
unobtrusive way to delete all sensitive messages from their accounts, even when
under duress or active observation. When a lot of messages are affected the
login delay will be somewhat greater, but other than that, it is impossible to
tell that anything out of the ordinary has happpened.

Changes
-------

A small schema-migration is required and provided in
sql/DRIVER/upgrades/31202.xxx. If you run a version prior to 3.2.0 you will
have to apply it manually.

The password can be specified with the --security-password argument of
dbmail-users. The same encryption as for the regular password is used.

The behavior after logging in using this password can be set per user using the
--security-action argument of dbmail-users. Currently two actions are
hard-coded, but you can expand them as needed.

Security-action:
----------------

0: do nothing. This is also the default behavior.
1: delete everything. In this case all mailboxes owned by the authenticated 
   user are deleted immediately and irretrievably.
2 and higher: these can be configured through the security_action setting
   in dbmail.conf:

The first two are hard-coded, as said. It is not possible to override them in
dbmail.conf. Trying to do so will invalidate the entry in dbmail.conf.

An example:

security_action = 2:\Deleted;3:\Flagged \Deleted Important $Important

In this case two additional behaviors are defined. When a user has
security-action 2, and logs on using the security-password all messages that
have the \Deleted system-flag set are queued for later deletion by dbmail-util,
and are immediately inaccessible to the user.

For users with security-action 3, all messages that have the \Flagged or
\Deleted system flags, or have a user labels 'Important' or '$Important' are
queued for deletion and are also immediately inaccessible to the user.

Please Note:
------------

This feature is not without risks if used casually. Instruct your users
carefully! Also make sure the security password can never be the same as the
regular password because in that case it just won't work.

Messages that have been queued for deletion *can*, if required, be restored to
visibility by a system adminitrator by setting the status field. If the
security action was set to '1' however, only a restore from backup of the
database will bring back the deleted mail.


LDAP support is currently not available. Please contact support@nfg.nl if you
required this feature and need LDAP authentication.

#EOF
