tom/ansible
1
0
Fork 0
forked from infra/ansible
Code Issues Pull Requests Projects Releases Wiki Activity

Switch dovecot to LDAP auth.

Browse Source
This commit is contained in:
Markus 2016-03-03 08:02:56 +01:00
parent 056c86a7ea
commit 7f5f30bd4f
2 changed files with 8 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
roles/mail/templates/dovecot/dovecot-ldap.conf.ext.j2
View File

@ -45,14 +45,14 @@ dnpass = {{ ldap_bindpw }}
# Use TLS to connect to the LDAP server. # Use TLS to connect to the LDAP server.
tls = yes tls = yes
# TLS options, currently supported only with OpenLDAP: # TLS options, currently supported only with OpenLDAP:
#tls_ca_cert_file = #tls_ca_cert_file = TODO
#tls_ca_cert_dir = #tls_ca_cert_dir =
#tls_cipher_suite = #tls_cipher_suite =
# TLS cert/key is used only if LDAP server requires a client certificate. # TLS cert/key is used only if LDAP server requires a client certificate.
#tls_cert_file = #tls_cert_file =
#tls_key_file = #tls_key_file =
# Valid values: never, hard, demand, allow, try # Valid values: never, hard, demand, allow, try
#tls_require_cert = #tls_require_cert = TODO
# Use the given ldaprc path. # Use the given ldaprc path.
#ldaprc_path = #ldaprc_path =

16
roles/mail/templates/dovecot/local.conf.j2
View File

@ -1,7 +1,8 @@
auth_mechanisms = plain login auth_mechanisms = plain login
auth_verbose = yes auth_verbose = yes
auth_debug=yes auth_debug=yes
disable_plaintext_auth = yes
mail_debug = yes mail_debug = yes
log_path = /var/log/dovecot/errors.log log_path = /var/log/dovecot/errors.log
info_log_path = /var/log/dovecot/info.log info_log_path = /var/log/dovecot/info.log
@ -21,14 +22,9 @@ ssl_key = </etc/dovecot/ssl/{{ ansible_fqdn }}.key
ssl_protocols = !SSLv2 !SSLv3 ssl_protocols = !SSLv2 !SSLv3
ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
#passdb {
# driver = ldap
# args = /etc/dovecot/dovecot-ldap.conf.ext
#}
passdb { passdb {
driver = static driver = ldap
args = password=fnord args = /etc/dovecot/dovecot-ldap.conf.ext
} }
userdb { userdb {
@ -46,11 +42,11 @@ service auth {
service imap-login { service imap-login {
inet_listener imap { inet_listener imap {
address = 127.0.0.1 ::1 address = 0.0.0.0 ::
port = 143 port = 143
} }
inet_listener imaps { inet_listener imaps {
address = 0.0.0.0 address = 0.0.0.0 ::
port = 993 port = 993
} }
} }