Installation and Configuration Guide (2024)

The amount of instances of SOGo that will be spawnedto handle multiple requests simultaneously. When started from the initscript, that amount is overridden by the PREFORK valuein /etc/sysconfig/sogo or /etc/default/sogo. A value of 3 is areasonable default for low usage. The maximum value depends on the CPUand IO power provided by your machine: a value set too high willactually decrease performances under high load.

Defaults to 1 when unset.

This parameter controls the backlog size of thesocket listen queue. For large-scale deployments, this value must beadjusted in case all workers are busy and the parent processes receiveslots of incoming connections.

Defaults to 5 when unset.

The TCP listening address and port used by the SOGodaemon. The format is ipaddress:port. To bind to an IPv6 address, use[ipv6address]:port, e.g. [::1]:20000.

Defaults to 127.0.0.1:20000 when unset.

The file path where to log messages. Specify - to log tothe console.

Defaults to /var/log/sogo/sogo.log.

The file path where the parent process id will be written.

Defaults to /var/run/sogo/sogo.pid.

This parameter specifies the number of minutes after which a busy childprocess will be killed by the parent process.

Defaults to 10 (minutes).

Do not set this too low as child processes replying to clients on a slowinternet connection could be killed prematurely.

Parameter used to set the maximum allowed size for content beingsent to SOGo using a PUT or a POST call. This can also limit the fileattachment size being uploaded to SOGo when composing a mail. Thevalue is in kilobytes. By default, the value is 0, or disabled so nolimit will be set.

Parameter used to set the maximum allowed email message size whencomposing a mail. The value is in kilobytes. By default, the value is 0,or disabled so no limit will be set.

Parameter used to set the maximum amount of memory (inmegabytes) that a child can use. Reaching that value will force childrenprocesses to restart, in order to preserve system memory.

Defaults to 384.

Parameter used to set the hostname and optionally the port of thememcached server.

A path can also be used if the server must be reached via a Unix socket.

Defaults to localhost.

See memcached_servers_parse(3) for details on the syntax.

Parameter used to set the expiration (in seconds) of each object in thecache.

Defaults to 300.

Parameter used to define the way by which users will be authenticated.For C.A.S., specify cas. For SAML2, specify saml2. For anythingelse, leave that value empty.

Parameter used to set whether HTTP username should be trusted.

Defaults to NO when unset.

Parameter used to define a key to encrypt the passwords of remote Webcalendars when SOGoTrustProxyAuthentication is enabled.

When using C.A.S. authentication, this specifies the base url forreaching the C.A.S. service. This will be used by SOGo to deduce theproper login page as well as the other C.A.S. services that SOGo willuse.

Boolean value indicating whether the "Logout" link is enabled whenusing C.A.S. as authentication mechanism.

The "Logout" link will end up calling SOGoCASServiceURL/logout toterminate the client’s single sign-on C.A.S. session.

Parameter controlling WebDAV access to the Contacts collections.This can be used to deny access to these resources from Lightning forexample.

Defaults to YES when unset.

Parameter controlling WebDAV access to the Calendar collections.

This can be used to deny access to these resources from Lightning forexample.

Defaults to YES when unset.

The location of the SSL private key file on the filesystem that is usedby SOGo to sign and encrypt communications with the SAML2 identityprovider. This file must be generated for each running SOGo service(rather than host). Make sure this file is readable by the SOGo user.

The location of the SSL certificate file. This file must be generatedfor each running SOGo service. Make sure this file is readable by the SOGo user.

The location of the metadata file that describes the services availableon the SAML2 identify provider. The content of this file is usually generateddirectly by your SAML 2.0 IdP solution. For example, using SimpleSAMLphp, youcan get the metadata directly from https://MYSERVER/simplesaml/saml2/idp/metadata.phpMake sure this file is readable by the SOGo user.

The location of the SSL public key file on the filesystem that is usedby SOGo to sign and encrypt communications with the SAML2 identityprovider. This file should be part of the setup of your identityprovider. Make sure this file is readable by the SOGo user.

The location of the SSL certificate file. This file should be part ofthe setup of your identity provider. Make sure this file is readable by the SOGo user.

The attribute provided by the IdP to identify the user in SOGo.

Boolean value indicated whether the "Logout" link is enabled when usingSAML2 as authentication mechanism. When using this feature, SOGo will invokethe IdP to proceed with the logout procedure. When the user clicks on the logoutbutton, a redirection will be made to the IdP to trigger the logout.

The URL to which redirect the user after the "Logout" link is clicked.SOGoSAML2LogoutEnabled must be set to YES. If unset, the user will beredirected to a blank page.

Mandatory parameter used to set a default time zone for users. The defaulttimezone is set to UTC. The Olson database is a standard database thattakes all the time zones around the world into account and representsthem along with their history. On GNU/Linux systems, time zonedefinition files are available under /usr/share/zoneinfo. Listing theavailable files will give you the name of the available time zones.This could be America/New_York, Europe/Berlin, Asia/Tokyo orAfrica/Lubumbashi.

In our example, we set the time zone to America/Montreal.

Parameter used to prevent sogo from adding the mail header X-Forward thatcontains the user ip. Set to YES to disable this header. Default to NO.

Parameter used to set the default domain name used by SOGo. SOGo usesthis parameter to build the list of valid email addresses for users.

In our example, we set the default domain to acme.com.

Parameter used to set whether SOGo sends or not email notifications tomeeting participants. Possible values are:

Defaults to NO when unset.

Same as above, but the notifications are triggered on the creation of acalendar or an address book.

Same as above, but the notifications are sent to the involved users ofa calendar or address book’s ACLs.

Parameter used to define the default roles when giving permissions to auser to access a calendar. Defaults roles are ignored for publicaccesses. Must be an array of up to five strings. Each string defining arole for an event category must begin with one of those values:

And each string must end with one of those values:

The array can also contain one or many of the following strings:

Example: SOGoCalendarDefaultRoles = ("ObjectCreator", "PublicViewer");

Defaults to no role when unset. Recommended values are PublicViewerand ConfidentialDAndTViewer.

Parameter used to define the default roles when giving permissions to auser to access an address book. Defaults roles are ignored for publicaccesses. Must be an array of one or many of the following strings:

Example: SOGoContactsDefaultRoles = ("ObjectEditor");

Defaults to no role when unset.

Parameter used to set which usernames require administrative privilegesover all the users tables. For example, this could be used to postevents in the users calendar without requiring the user to configurehis/her ACLs. In this case you will need to specify those superuser’susernames like this: SOGoSuperUsernames = (<username1>[, <username2>, ...]);

Parameter used to set the default language used in the Web interfacefor SOGo. Possible values are:

Parameter used to set whether SOGo sends or not email receipts whensomeone changes his/her own calendar. Possible values are:

Defaults to NO when unset. User can overwrite this from the calendarproperties window.

Parameter used to set whether SOGo sends or not email receipts when amodification is being done to his/her own calendar by someone else.Possible values are:

Defaults to NO when unset. User can overwrite this from the calendarproperties window.

Parameter used to specify an LDAP attribute that should be displayedwhen auto-completing user searches.

When set to YES, this will force all-day events sent over by iPhoneOS based devices to be transparent. This means that the all-day eventswill not be considered during freebusy lookups.

Defaults to NO when unset.

Parameter used to allow or not your users to share publicly (ie.,requiring not authentication) their calendars and address books.

Possible values are:

Defaults to NO when unset.

List of modules where sharing should be disabled, for example (Mail, Calendar). Modules can be Mail, Contacts and Calendar. Default value empty list (sharing enabled for everybody).

List of modules where sharing with any authenticated user option should be disabled, for example (Mail, Calendar). Modules can be Mail, Contacts and Calendar. Default value empty list (sharing enabled for everybody).

List of modules where export should be disabled, for example (Mail, Calendar). Modules can be Mail, Contacts and Calendar. Default value empty list (export enabled for everybody).

Parameter used to allow or not users to change their passwords fromSOGo.

Possible values are:

Defaults to NO when unset.

For this feature to work properly when authenticating against AD orSamba4, the LDAP connection must use SSL/TLS. Server side restrictionscan also cause the password change to fail, in which case SOGo will onlylog a Constraint violation (0x13) error. These restrictions includepassword too young, complexity constraints not satisfied, user cannotchange password, etc…​ Also note that Samba has a minimum password ageof 1 day by default.

Parameter used to configure which languages are available from SOGo’sWeb interface. Available languages are specified as an array of string.

The default value is: ( "Arabic", "Basque", "Catalan", "Czech", "Dutch", "Danish", "Welsh", "English", "SpanishSpain", "SpanishArgentina", "Finnish", "French", "Galician", "German", "Icelandic", "Italian", "Hungarian", "BrazilianPortuguese", "NorwegianBokmal", "NorwegianNynorsk", "Polish", "Russian", "Slovak", "Ukrainian", "Swedish" )

Parameter used to control if SOGo should hide or not the system emailaddress (UIDFieldName@SOGoMailDomain). This is currently limited toCalDAV (calendar-user-address-set).

Defaults to NO when unset.

Parameter used to control the minimum length to be used for the searchstring (attendee completion, address book search, etc.) prior triggeringthe server-side search operation.

Defaults to 2 when unset - which means a search operation will betriggered on the 3rd typed character.

Parameter used to control the number of failed login attempts requiredduring SOGoMaximumFailedLoginInterval seconds or more. If conditionsare met, the account will be blocked for SOGoFailedLoginBlockIntervalseconds since the first failed login attempt.

Default value is 0, or disabled.

Number of seconds, defaults to 10.

Number of seconds, defaults to 300 (or 5 minutes). Note thatSOGoCacheCleanupInterval must be set to a value equal or higher thanSOGoFailedLoginBlockInterval.

Parameter used to control the number of email messages a user can sendfrom SOGo’s webmail interface, to SOGoMaximumRecipientCount, inSOGoMaximumSubmissionInterval seconds or more. If conditions are metor exceeded, the user won’t be able to send mails forSOGoMessageSubmissionBlockInterval seconds.

Default value is 0, or disabled.

Maximum number of recipients. Default value is 0, or disabled.

Number of seconds, defaults to 30.

Number of seconds, default to 300 (or 5 minutes). Note thatSOGoMessageSubmissionBlockInterval must be set to a value equal or lower thanSOGoCacheCleanupInterval.

Parameter used to control the number of requests a user can send to the SOGoserver in SOGoMaximumRequestInterval seconds or more. If conditions are metor exceeded, the user will not be able to perform requests on the SOGo serverfor SOGoRequestBlockInterval seconds and will receive 429 HTTP responses forany requests being made. Default value is 0, or disabled

Number of seconds, defaults to 30.

Number of seconds, defaults to 300 (or 5 minutes). Note that SOGoCacheCleanupIntervalmust be set to a value equal or higher than SOGoRequestBlockInterval.

Parameter used to enable or not XSRF (Cross-site request forgery, also known as CSRF) protection in SOGo. Make sure your Web server configuration doesn’t add the HttpOnly flag to the Set-Cookie header as the CSRF token cookie is intended to be read by the JavaScript by design.Default value is YES, or enabled.

Parameter used to set the LDAP and/or SQL sources used forauthentication and global address books. Multiple sources can bespecified as an array of dictionaries.

Boolean enable password recovery with secret question or secondary e-mail. Default value is NO.

List of domains where password recovery is enabled, for example (example.org, example.net). If empty array (), disabled for all domains. If not set, enabled for all domains.

From email when SOGoPasswordRecoverySecondaryEmail is set and no user domain is defined - otherwise it will use noreply@foo.bar where foo.bar is the selected user domain. Default value is noreply@domain.com.

User password recovery mode. Values can be Disabled, SecretQuestion or SecondaryEmail.

User password recovery secret question. Values can be SecretQuestion1, SecretQuestion2 or SecretQuestion3.

User password recovery secret question answer when mode is SecretQuestion.

User password recovery e-mail when mode is SecondaryEmail.

JWT secret according to RFC-7519. Default value is SOGo.

Disable identity creation for users in preferences. If YES, users won’t be able to add new identities and will allow to change only full name, signature and default identity. Default value is NO. Note : If this settings is set to YES, it will not be possible to crete auxiliary mail accounts.

Enable URL encryption to make SOGo GDPR compatible. Setting this parameter to YES will encrypt username in URL. The encryption data are cached to avoid high cpu usage, if the value of thie parameter is changed, memcached server needs to be restarted. Default value is NO.

Passphrase for SOGoURLEncryptionEnabled. The string must be 128 bits (16 characters). If this settings change, the cache server must be restarted, and the DAV url will change. Default value is SOGoSuperSecret0.

Add <div class="raw-html-embed sogo-raw-html-embed"> around signature to avoid CKEditor 5 modifying HTML code and breaking signature (https://bugs.sogo.nu/view.php?id=5920). Default value is YES (tag is added).

Parameter to define what kind is the secret: plain to directly put the secret in SOGoSecretValue, envto put the name of a environment variable in SOGoSecretValue or none to not use any secret.For now, it is only used to encrypt/decrypt auxiliary account’s password. the secret must be256 bits long i.e. 32 utf8 chars string.

Defaults to none when unset

Parameter used whenever SOGo need a secret to encrypt/decrypt. For now,only for password of auxiliary accounts. If SOGoSecretType is plain,directly put the secret here. if SOGoSecretType is env, put the nameof the environment variable here. Must be set with SOGoSecretType.If SOGoSecretType is not none, sogo won’t start is the value is unfetchable or incorrect

There is no default value

The type of this user source, set to ldap` for an LDAP source.

The identification name of the LDAP repository. This must be unique -even when using multiple domains.

The field that returns the complete name.

The field that starts a user DN if bindFields is not used. This fieldmust be unique across the entire SOGo domain.

The field that returns the login name of a user.

The returned value must be unique across the whole SOGo installationsince it is used to identify the user in the folder_info databasetable.

An array of fields that returns the user’s email addresses (defaults tomail when unset). Note that SOGo will always automatically strip theprotocol value from the attribute if the attribute name is proxyAddresses.

An array of fields to match against the search string when filteringusers (defaults to sn, displayName, cn, mail, and telephoneNumberwhen unset).

The field that returns either an URI to the IMAP server as describedfor SOGoIMAPServer, or a simple server hostname that would be used as areplacement for the hostname part in the URI provided by theSOGoIMAPServer parameter.

The field that returns the IMAP login name for the user (defaults tothe value of UIDFieldName when unset).

The field that returns either an URI to the SIEVE server as describedfor SOGoSieveServer, or a simple server hostname that would be used asa replacement for the hostname part in the URI provided by theSOGoSieveServer parameter.

The base DN of your user entries. You can use %d in this value if youwant the base DN to be built dynamically from the user’s domain duringthe login process. If you use that, you might always enable bindAsCurrentUser.

For example: baseDN = "ou=%d,ou=domains,dc=example,dc=com";

Moreover, if you use the dynamic base DN, you should use setUIDFieldName to mail in order to be able to extract the domainname automatically during the backup/restore process.

If set, SOGo will try to determine if the value of the fieldcorresponds to either "group", "location" or "thing". If that’s thecase, SOGo will consider the returned entry to be a resource.

For LDAP-based sources, SOGo can also automatically determine if it’s aresource if the entry has the CalendarResource objectClass set.

The value of this attribute is the maximum number of concurrent eventsto which a resource can be part of at any point in time.

If this is set to 0, or if the attribute is missing, it means nolimit. If set to -1, no limit is imposed but the resource willbe marked as busy the first time it is booked.

The filter to use for LDAP queries, it should be defined as anEOQualifier. The following operators are supported:

Multiple qualifiers can be joined by using OR and AND, they can alsobe grouped together by using parenthesis. Attribute values should bequoted to avoid unexpected behaviour.

For example: filter = "(objectClass='mailUser' OR objectClass='mailGroup') AND accountStatus='active' AND uid <> 'alice'";

Either BASE, ONE or SUB.

The DN of the login name to use for binding to your server.

Its password.

If set to YES, SOGo will always keep binding to the LDAP server usingthe DN of the currently authenticated user. If bindFields is set,bindDN and bindPassword will still be required to find the proper DN of the user.

An array of fields to use when doing indirect binds.

Lookup fields for LDAP queries. Default is (*). This can be utilizedto lookup operational fields (which are per default not part of the result)such as memberOf: lookupFields = ("*", "memberOf");

A space-delimited list of LDAP URLs or LDAP hostnames.

LDAP URLs are specified in RFC 4516 and have the following generalformat:

scheme://host:port/DN?attributes?scope?filter?extensions

Note that SOGo doesn’t currently support DN, attributes, scope andfilter in such URLs. Using them may have undefined side effects.

URLs examples:

Port number of the LDAP server.

A non-default port should be part of the ldap URL in the hostnameparameter.

Either SSL or STARTTLS

SSL should be specified as ldaps:// in the LDAP URL. STARTTLS shouldbe specified as a LDAP Extension in the LDAP URL (e.g.ldap://127.0.0.1/????!StartTLS)

The algorithm used for password encryption when changing passwordswithout Password Policies enabled.

Possible values are: none, plain, crypt, md5, md5-crypt,sha256-crypt and sha512-crypt, smd5, cram-md5 and sha, sha256,sha512 and its ssha (e.g. ssha or ssha256) variants(plus setting of the encoding with .b64 or .hex).

Note that cram-md5 is not actually using cram-md5 (due to the lack ofchallenge-response mechanism), its just saving the intermediate MD5context as Dovecot stores in its database.

Also note that sha256-crypt and sha512-crypt requires that youroperating system supports glibc 2.7 or more recent.

If set to YES, this LDAP source is used for authentication

If set to YES, SOGo will use the extended LDAP Password Policiesattributes. If you LDAP server does not support those and you activatethis feature, every LDAP requests will fail. Note that some LDAP serversrequire LDAP/SSL for password policies to work. This is the case forexample with 389 Directory Server.

If set to YES, SOGo will automatically update the sambaNTPasswordand sambaLMPassword attributes when changing passwords. The attributesmust be called sambaNTPassword and sambaLMPassword. You must also makesure the correct ACL is set in your LDAP server to allow users to changetheir own sambaNTPassword and sambaLMPassword password attributes.Defaults to NO when unset.

If set to YES, this LDAP source is used as a shared address book(with read-only access). Note that if set to NO, autocompletion willnot work for entries in this source and thus, freebusy lookups.

If set as an address book, the human identification name of the LDAPrepository

If set to YES, listing of this LDAP source is only possible when performing a search (respecting the SOGoSearchMinimumWordLength parameter) or when explicitly typing a single dot.Defaults to YES when unset.

Number of entries displayed when listRequiresDot is enabled. Default value is -1 (all records / equals to SOGoLDAPQueryLimit). This parameter must be less or equal to SOGoLDAPQueryLimit. If source is LDAP, the LDAP overlay sssvlv must be enabled on the system for server side sorting.

If set to YES, disable recursive search. Consider this option when groups have the same name than a member (https://bugs.sogo.nu/view.php?id=5913).Defaults to NO when unset.

Limits the access of any module through a constraint based on an LDAPattribute; must be a dictionary with keys Mail, and/or Calendar,and/or ActiveSync for example:

ModulesConstraints = {Calendar = {ou = employees;};};

A dictionary that maps contact attributes used by SOGo to the LDAPattributes used by the schema of the LDAP source. Each entry must havean attribute name as key and an array of strings as value. This enablesactual fields to be mapped one after another when fetching contactinformation.

See the LDAP Attribute Mapping section below for an example and a listof supported attributes.

When the modifiers list (see below) is set, or when using LDAP-baseduser address books (see abOU below), this list of object classes willbe applied to new records as they are created.

A list (array) of names identifying groups within the LDAP source. If notset, SOGo will use group, groupofnames, groupofuniquenamesand posixgroup.

A list (array) of usernames that are authorized to performmodifications to the address book defined by this LDAP source.

This field enables LDAP-based user address books by specifying the valueof the address book container beneath each user entry, for example:ou=addressbooks,uid=username,dc=domain.

Parameter used to specify an attribute that should appear inautocompletion of the web interface.

Parameter used to limit the number of returned results from the LDAPserver whenever SOGo performs a LDAP query (for example, duringaddresses completion in a shared address book).

Parameter to define the timeout of LDAP queries. The actual time limitfor operations is also bounded by the maximum time that the server isconfigured to allow.

Defaults to 0 (unlimited).

Parameter used to enable group expansion from the Web interface.

Defaults to NO when unset.

Parameter used to set the database URL so that SOGo can retrieve userprofiles.

For MySQL, set the database URL to something like:mysql://sogo:sogo@127.0.0.1:3306/sogo/sogo_user_profile.

Parameter used to set the database URL so that SOGo can retrieve thelocation of user folders (address books and calendars).

For Oracle, set the database URL to something like:oracle://sogo:sogo@127.0.0.1:1526/sogo/sogo_folder_info.

Parameter used to set the database URL so that SOGo can store andretrieve secured user sessions information. For PostgreSQL, the databaseURL could be set to something like:postgresql://sogo:sogo@127.0.0.1:5432/sogo/sogo_sessions_folder.

Parameter used to set the database URL for email-based alarms (that canbe set on events and tasks). This parameter is relevant only ifSOGoEnableEMailAlarms is set to YES. For PostgreSQL, the databaseURL could be set to something like:postgresql://sogo:sogo@127.0.0.1:5432/sogo/sogo_alarms_folder

See the "EMail reminders" section in this document for more information.

Parameter used to disable organizer’s calendar event check

Parameter used to set the database URL so that SOGo can use to storeall content data. You must also set OCSAclURL and OCSCacheFolderURLif you set this parameter. Using these parameters will allow SOGo to usea total of nine database tables - and prevent SOGo from creating threedatabase tables per collection.

For PostgresSQL, set the database URL to something like:postgresql://sogo:sogo@127.0.0.1:5432/sogo/sogo_store.

Parameter used to set the database URL so that SOGo can use to storeall ACL data. You must also set OCSStoreURL and OCSCacheFolderURLif you set this parameter.

For PostgresSQL, set the database URL to something like:postgresql://sogo:sogo@127.0.0.1:5432/sogo/sogo_acl.

Parameter used to set the database URL so that SOGo can use to storeall cache data. You must also set OCSStoreURL and OCSAclURLif you set this parameter.

For PostgresSQL, set the database URL to something like:postgresql://sogo:sogo@127.0.0.1:5432/sogo/sogo_cache_folder.

Parameter used to set the database URL so that SOGo can use to storeall administration elements.

For PostgresSQL, set the database URL to something like:postgresql://sogo:sogo@127.0.0.1:5432/sogo/sogo_admin.

The type of this user source, set to sql for a SQL source.

The identification name of the SQL repository. This must be unique -even when using multiple domains.

Database URL of the view used by SOGo. The view expects columns to bepresent. Required columns are:

Other columns can exist and will actually be mapped automatically ifthey have the same name as popular LDAP attributes (such as givenName,sn, department, title, telephoneNumber, etc.).

An array of dictionaries that define regular expressions used to determine whether a new password is valid.

Each dictionary must contain the key "regex" associated to a string representing a regularexpression. It can also contain the key "label" to briefly describe the constraint to the user. Example:

userPasswordPolicy = ( { label = "Minimum of 1 lowercase letter"; regex = "[a-z]"; }, { label = "Minimum of 1 uppercase letter"; regex = "[A-Z]"; }, { label = "Minimum of 1 digit"; regex = "[0-9]"; }, { label = "Minimum of 2 special symbols"; regex = "([%$&*(){}!?\@#].*){2,}"; }, { label = "Minimum length of 8 characters"; regex = ".{8,}"; });

Pre-defined constants can also be used :

userPasswordPolicy = ( { label = "POLICY_MIN_LOWERCASE_LETTER"; value = 1; }, { label = "POLICY_MIN_UPPERCASE_LETTER"; value = 1; }, { label = "POLICY_MIN_DIGIT"; value = 2; }, { label = "POLICY_MIN_SPECIAL_SYMBOLS"; value = 1; }, { label = "POLICY_MIN_LENGTH"; value = 8; });

The default algorithm used for password encryption when changingpasswords. Possible values are: none, plain, crypt, md5,md5-crypt, smd5, cram-md5, ldap-md5, and sha, sha256,sha256-crypt, sha512, sha512-crypt, its ssha (e.g. ssha orssha256) variants, blf-crypt, PBKDF2, and sym-aes-128-cbc.The argon2i and argon2id password hashing algorithms are supportedif SOGo is compiled with libsodium. argon2 is a synonym for argon2i.Passwords can have the scheme prepended in the form{scheme}encryptedPass.

Note that cram-md5 is not actually using cram-md5 (due to the lack ofchallenge-response mechanism), its just saving the intermediate MD5context as Dovecot stores in its database.

The default behaviour is to store newly set passwords without thescheme (default: NO). This can be overridden by setting to YES andwill result in passwords stored as {scheme}encryptedPass. Forsym-aes-128-cbc, always set this to NO.

For sym-aes-128-cbc, a global key file is required. This valuemust be set to the full path where the key file is. The key filemust also be readable by the sogo user.

If set to YES, this SQL source is used for authentication.

If set to YES, this SQL source is used as a shared address book(with read-only access). Note that if set to NO, autocompletion willnot work for entries in this source and thus, freebusy lookups.

A filter that limits which users can authenticate from this source.

If set as an address book, the human identification name of the SQLrepository.

An array of fields that specifies the column names that contain validauthentication usernames (defaults to c_uid when unset).

An array of fields that specifies the column names that holdadditional email addresses (beside the mail column) for each user.Values must be unique and not appear in more than one column.Space-separated values allowed in all additional columns (besides in mail).

An array of fields to match against the search string when filteringusers (defaults to c_cn and mail when unset).

The field that returns the IMAP hostname for the user.

The field that returns the IMAP login name for the user (defaults toc_uid when unset).

The field that returns the Sieve hostname for the user.

If set, SOGo will try to determine if the value of the fieldcorresponds to either "group", "location" or "thing". If that’s thecase, SOGo will consider the returned entry to be a resource.

The value of this field is the maximum number of concurrent events towhich a resource can be part of at any point in time.

If this is set to 0, or if the attribute is missing, it means nolimit and the resource will always be marked as free. If set to -1,no limit is imposed but the resource will be marked as busy the firsttime it is booked. If greater than 0, the resource will get marked asbusy once it reaches the value.

If set, SOGo will use the value of that field as the domain associatedto the user.

See the Multi-domains Configuration section in this document for moreinformation.

If set to YES, listing of this SQL source is only possible when performing a search (respecting the SOGoSearchMinimumWordLength parameter) or when explicitly typing a single dot.Defaults to YES when unset.

Limits the access of any module through a constraint based on a SQLcolumn whose value is a string (e.g. char or varchar column type);must be a dictionary with keys Mail, and/or Calendar,and/or ActiveSync for example:

ModulesConstraints = {Calendar = {c_ou = employees;};};

Parameter used to set how SOGo sends mail messages. Possible valuesare:

The DNS name or IP address of the SMTP server used whenSOGoMailingMechanism is set to smtp.Supported formats are: smtp://domain:port, smtps://domain,domain:port, smtp://domain:port/?tls=YES. Using the optiontls=YES will enforce using STARTTLS SMTP connections. Thus,smtp://localhost:587/?tls=YES would use the default MUA porton localhost with STARTTLS enforced.To disable TLS verification for localhost domains, addtlsVerifyMode=allowInsecureLocalhost to such connections:smtp://localhost:587/?tls=YES&tlsVerifyMode=allowInsecureLocalhost.

Activate SMTP authentication and specifies which type is in use.Current, only PLAIN is supported and other values will causethe authentication to fail.

Enable specific SMTP user account for system e-mails (notifications, reminders, …​). Default is NO.

SMTP account username for master account (SOGoSMTPMasterUserEnabled enabled).

SMTP account password for master account (SOGoSMTPMasterUserEnabled enabled).

The path of the sendmail binary.

Defaults to /usr/lib/sendmail.

Parameter used to specify if, when logging in to the SMTP server, theprimary email address of the user will be used instead of the username.Possible values are:

Defaults to NO when unset.

Parameter used to set the IMAP folder name used to store draftsmessages.

Defaults to Drafts when unset.

Use a / as a hierarchy separator if referring to an IMAP subfolder.For example: INBOX/Drafts. You must use a / even if your realIMAP separator is a ..

Parameter used to set the IMAP folder name used to store sent messages.

Defaults to Sent when unset.

Use a / as a hierarchy separator if referring to an IMAP subfolder.For example: INBOX/Sent. You must use a / even if your realIMAP separator is a ..

Parameter used to set the IMAP folder name used to store deletedmessages.

Defaults to Trash when unset.

Use a / as a hierarchy separator if referring to an IMAP subfolder.For example: INBOX/Trash. You must use a / even if your realIMAP separator is a ..

Parameter used to set the IMAP folder name used to store junkmessages.

Defaults to Junk when unset.

Use a / as a hierarchy separator if referring to an IMAP subfolder.For example: INBOX/Junk. You must use a / even if your realIMAP separator is a .. Also see the SOGoMailJunkSettings formore options regarding junk/not-junk actions.

Parameter used to set the CAS service name (URL) of the imap service.This is useful if SOGo is connecting to the IMAP service through aproxy. When using pam_cas, this parameter should be set to the samevalue as the -s argument of the imap pam service.

Parameter used to set the DNS name or IP address of the IMAP serverused by SOGo. You can also use SSL or TLS by providing a value using aURL with a fully qualified domain name, such as:

Parameter used to set the DNS name or IP address of the Sieve(managesieve) server used by SOGo. You must use an URL such as:

You can also use TLS by providing a value using a URL with a fullyqualified domain name, such as:

Note that TLS is supported but SSL is not.

Parameter used to specify which encoding is used for IMAP folder namesin Sieve filters. Defaults to UTF-7. The other possible value isUTF-8.

Parameter used to specify if the Web interface should only showsubscribed IMAP folders. Possible values are:

Defaults to NO when unset.

Parameter used to specify which RFC the IMAP server implements withrespect to ACLs. Possible values are:

Defaults to rfc4314 when unset.

Parameter used to specify if the IMAP server implements the InternetMessage Access Protocol Extension. Possible values are:

Defaults to NO when unset.

Parameter used to specify if, when logging in to the IMAP server, theprimary email address of the user will be used instead of the username.Possible values are:

Defaults to NO when unset.

Parameter used to set the path where temporary email drafts arewritten. If you change this value, you must also modify the dailycronjob sogo-tmpwatch.

Defaults to /var/spool/sogo.

Parameter used to set the path where temporary files will be storedby SOPE when dealing with MIME messages.

Defaults to /tmp.

Disables IMAP pooling when set to YES. Enable pooling by setting toNO or using a caching proxy like imapproxy.

The default value is YES.

Trigger the use of the IMAP AUTHENTICATE command with the specifiedSASL mechanism. Using AUTHENTICATE instead of LOGIN is also necessaryto enable UTF-8 characters in users' passwords. To enable simple use ofAUTHENTICATE for this purpose, set this setting to plain. Please notethat this feature might be limited at this time.

Prefix to prepend to names in IMAP ACL transactions, to indicate thename is a group name, not a user name.

RFC4314 gives examples where group names are prefixed with $. Dovecot,for one, follows this scheme, and will, for example, apply permissionsfor $admins to all users in group admins in the absence of specificpermissions for the individual user.

The default prefix is $.

Parameter used to define the Web page title.

Defaults to SOGo when unset.

Parameter used to define the URL to online help for SOGo. When set,an additional icon will appear near the logout button in SOGo’sweb interface. The URL will always be open in a separate page.

Parameter used to specify which module to show after login. Possiblevalues are:

Defaults to Mail when unset.

Parameter used to specify the relative URL of the site favion.

When unset, defaults to the file sogo.ico under the default webresources directory.

Parameter used to specify the path of the zip binary used to archivemessages.

Defaults to /usr/bin/zip when unset.

Parameter used to change the quota returned by the IMAP server bymultiplying it by the specified ratio. Acts as a soft quota. Example:0.8.

Parameter used to set if email replies should use Outlook’s style.

Defaults to NO when unset.

Parameter used to specify the default order of the columns from theSOGo webmail interface. The parameter is an array, for example:

SOGoMailListViewColumnsOrder = (Flagged, Attachment, Priority, From, Subject, Unread, Date, Size);

Parameter used to enable automatic insertion of unknown mail recipientsin an address book. The destination address book is defined by theparameter SOGoSelectedAddressBook.

Defaults to NO when unset.

Parameter used to enable S/MIME certificate management from the account editor of thepreferences window.

Defaults to YES when unset.

Parameter used to specify the address book in which to add unknown mailrecipients if SOGoMailAddOutgoingAddresses is enabled.

Defauls to collected when unset.

Parameter used to enable fetching of avatars from remote services.

Defaults to YES when unset.

Parameter used to activate fetching of avatars from Gravatar.

Defaults to YES when unset.

Parameter used to activate the edition from the preferences window of avacation message.

Requires Sieve script support on the IMAP host.

Defaults to NO when unset.

When enabling this parameter, one may have to also enable the associatedcronjob in /etc/cron.d/sogo in order to activate automatic vacationmessage activation and expiration if your Sieve server does not supportthe date extension.

See the Cronjob — Vacation messages activation and expiration sectionbelow for details.

Defaults to YES when unset.

Parameter used to define a default vacation subject if user don’t specify acustom subject.

Defaults to the characters "Auto: " followed by the original subject when unset,as stated by RFC 5230.

Parameter used to specify the path of a text file whose content must beprepended to the user’s vacation message. For example:

SOGoVacationHeaderTemplateFile = /etc/sogo/autoresponder.header.txt;

The following template variables can appear in the content:

Parameter used to specify the path of a text file whose content must beappended to the user’s vacation message. For example:

SOGoVacationFooterTemplateFile = /etc/sogo/autoresponder.footer.txt;

See SOGoVacationHeaderTemplateFile for available template variables.

Parameter used to activate the edition from the preferences window of aforwarding email address. Requires Sieve script support on the IMAPhost.

Defaults to NO when unset.

Parameter used to set constraints on possible addresses used whenautomatically forwarding mails. When set to 0 (default), no constraintis enforced. When set to 1, only internal domains can be used.When set to 2, only external domains defined in SOGoForwardConstraintsDomainscan be used. When set to 3, internal domains and other domains definedin SOGoForwardConstraintsDomains can be used.

Parameter used to set which external domains are allowedwhen SOGoForwardConstraints is set to 2 or 3. For example, setting:

SOGoForwardConstraintsDomains = ("gmail.com", "googlemail.com");

will allow users to forward emails to only gmail.com and googlemail.com domains.When empty or undefined, no constraints are imposed.

Parameter used to activate the edition from the preferences window ofnotifications for emails. Requires Sieve script support on the IMAPhost.

Defaults to NO when unset.

Parameter used to activate the edition from the preferences windows ofserver-side mail filters. Requires Sieve script support on the IMAPhost.

Defaults to NO when unset.

Parameter used to set the full path of the Sieve script that will beautomatically prepended to any Sieve scripts a user might define. The filemust be encoded in UTF-8 and it must also respect the RFC5228 syntax.

Parameter used to set the full path of the Sieve script that will beautomatically appended to any Sieve scripts a user might define. The filemust be encoded in UTF-8 and it must also respect the RFC5228 syntax.

Parameter used to define initial Sieve scripts for users. The usercan still modify the scripts and the initial values will be writtento the Sieve server upon first login.

Parameter used to define the polling intervals (in minutes)available to the user. The parameter is an array that can contain thefollowing numbers:

Defaults to the list above when unset.

Parameter used to define the polling interval at which the Webinterface queries the server for new data. Possible values are:

Defaults to manually when unset.

Parameter used to activate the auxiliary IMAP accounts in SOGo. Whenset to YES, users can add other IMAP accounts that will be visiblefrom the SOGo Webmail interface.

Defaults to NO when unset.

Parameter used to specify which calendar is used when creating an eventor a task. Possible values are:

Defaults to selected when unset.

The hour at which the day starts (0 through 12).

Defaults to 8 when unset.

The hour at which the day ends (12 through 23).

Defaults to 18 when unset.

The day at which the week starts in the week and month views (0through 6). 0 indicates Sunday.

Defaults to 0 when unset.

Parameter used to defined how is identified the first week of the year.Possible values are:

Defaults to January1 when unset.

The format used to display time in the timeline of the day and weekviews. Please refer to the documentation for the date command or thestrftime C function for the list of available format sequence.

Defaults to %H:%M.

Parameter used to define the categories that can be associated toevents. This parameter is an array of arbitrary strings.

Defaults to a list that depends on the language.

Parameter used to define the colour of categories. This parameteris a dictionary of category name/color.

Defaults to #F0F0F0 for all categories when unset.

Parameter used to defined the default classification for new events.Possible values are:

Defaults to PUBLIC when unset.

Parameter used to defined the default classification for new tasks.Possible values are:

Defaults to PUBLIC when unset.

Parameter used to defined a default reminder for new events. Possiblevalues are:

The number of days to include in the free busy information. Theparameter is an array of two numbers, the first being the number of daysprior to the current day and the second being the number of daysfollowing the current day.

Defaults to (7, 7) when unset.

The number of days, at maximum, to include in DAV calendar responses.For example, when set to 180, SOGo will not include in DAV calendarresponses events that are older than 180 days from the current date.

Defaults to 0 when unset - which means no limit is imposed.

Parameter used to specify if off-hours should be automatically added tothe free-busy information. Off hours included weekends and periodscovered between SOGoDayEndTime and SOGoDayStartTime.

Defaults to NO when unset.

The method the message is to be forwarded. Possible values are:

Defaults to inline when unset.

Show recipients or sender full email in mailboxes if set to YES. Default value is NO.

Hide attachements for inline images if set to YES. Default value is NO.

The string to use as full name when composing an email, ifSOGoMailCustomFromEnabled is set in the user’s domain defaults.

When unset, the full name specified in the user sources for the user isused instead.

The string to use as email address when composing an email, ifSOGoMailCustomFromEnabled is set in the user’sdomain defaults. When unset, the email specified in the user sources forthe user is used instead.

The reply placement with respect to the quoted message. Possible valuesare:

Defaults to below.

The email address to use in the reply-to header field when the usersends a message, if SOGoMailCustomFromEnabled is set in the user’sdomain defaults.

Ignored when empty.

The placement of the signature with respect to the quoted message.Possible values are:

Defaults to below.

Add signature to new message

Defaults to YES.

Add signature to reply

Defaults to YES.

Add signature to forward

Defaults to YES.

The message composition format. Possible values are:

Defaults to html.

Force mail composer window to always open in either the current windowor in a popup window. Possible values are:

Parameter used to enable email-based alarms on events and tasks.

Defaults to NO when unset.

For this feature to work correctly, one must also set theOCSEMailAlarmsFolderURL parameter and enable the associated cronjob.See the Cronjob — EMail reminders section from this document for moreinformation.

Parameter used to define the categories that can be associated tocontacts. This parameter is an array of arbitrary strings.

Defaults to a list that depends on the language.

Parameter used to define a list of additional JavaScript files loadedby SOGo for all displayed web pages. This parameter is an array ofstrings corresponding of paths to the arbitrary JavaScript files. Thepaths are relative to the WebServerResources directory, which isusually found under /usr/lib/GNUstep/SOGo/.

Parameter used to allow or not users to specify custom "From" addressesfrom SOGo’s preferences panel.

Defaults to NO when unset.

Parameter used to set the default formatting of a subscription foldername. Available variables are:

Defaults to %{FolderName} (%{UserName} <%{Email}>) when unset.

Parameter used to enable an extra preferences tab using the content ofthe template named UIxAdditionalPreferences.wox. This template shouldbe put under ~sogo/GNUstep/Library/SOGo/Templates/PreferencesUI/.

Parameter used to enable email junk settings. The value is a dictionaryand the follow keys are supported: vendor (which must be set to "generic"for now), junkEmailAddress which sets the email address to whom SOGo willsend junk mails to, notJunkEmailAddress which sets the email address towhom SOGo will send non-junk mails to and limit, which is an integer valueand sets the maximum number of mails that will be attached to ajunk/not junk report sent by SOGo. Example:

SOGoMailJunkSettings = {vendor = "generic";junkEmailAddress = "spam@foo.com";notJunkEmailAddress = "ham@foo.com";limit = 10;};

Parameter used to keep mails in the drafts folder once they have beensent by SOGo. Defaults to NO when unset.

Parameter used to enable user identification by domain. Users will beable (without being required) to login using the form username@domain,meaning that values of UIDFieldName no longer have to be unique amongall domains but only within the same domain. Internally, users willalways be identified by the concatenation of their username and domain.

Consequently, activating this parameter on an existing system impliesthat user identifierswill change and their previous calendars andaddress books will no longer be accessible unless a conversion isperformed.

Defaults to NO when unset.

Parameter used to define which domains should be selectable from thelogin page. This parameter is an array of keys from the domainsdictionary.

Defaults to an empty array, which means that no domains appear on thelogin page. If you prefer having the domain names listed, just use theseas keys for the the domains dictionary.

Parameter used to set domains visible among themselves. This parameteris an array of arrays.

Example: SOGoDomainsVisibility = ( (acme, coyote) );

Defaults to an empty array, which means domains are isolated from eachother.