From 51d5f3ea06048faf27dd87bf477ba3aceb76a364 Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Mon, 18 Nov 2019 12:13:21 +0000 Subject: [PATCH 01/12] bigpicture.svg --- Untitled Diagram(2).svg | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 Untitled Diagram(2).svg diff --git a/Untitled Diagram(2).svg b/Untitled Diagram(2).svg new file mode 100644 index 0000000..cefbcf4 --- /dev/null +++ b/Untitled Diagram(2).svg @@ -0,0 +1,3 @@ + + +
MX of example.com?
<div>MX of example.com?</div>
A record of mx.example.org?
A record of mx.example.org?SMTP
Sending
mail server
[Not supported by viewer]
"mx.example.com"
"mx.example.com"
"85.25.72.76"
"85.25.72.76"
2
[Not supported by viewer]
1
[Not supported by viewer]
3
[Not supported by viewer]
DNS
DNS
4
[Not supported by viewer]
5
[Not supported by viewer]
6
[Not supported by viewer]
/var/vmail
[Not supported by viewer]
7
[Not supported by viewer] \ No newline at end of file From 055f1f0fbac2c59d224e4c79c9505f712b15fdcc Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Mon, 18 Nov 2019 15:31:44 +0000 Subject: [PATCH 02/12] Added relaying.svg --- relaying.svg | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 relaying.svg diff --git a/relaying.svg b/relaying.svg new file mode 100644 index 0000000..11e0a88 --- /dev/null +++ b/relaying.svg @@ -0,0 +1,3 @@ + + +
MX of example.net?
<div>MX of example.net?</div>
A record of mx.example.net?
A record of mx.example.net?SMTP
Destination
mail server
[Not supported by viewer]
"mx.example.net"
"mx.example.net"
"2001:616:c8:48a::5"
"2001:616:c8:48a::5"
1
[Not supported by viewer]
3
[Not supported by viewer]
DNS
DNSLook upuser indatabaseCheckusernameandpassword
2
[Not supported by viewer]
4
[Not supported by viewer]
SMTP with
authentication
[Not supported by viewer]
User
[Not supported by viewer]
5
[Not supported by viewer] \ No newline at end of file From 0320010a8c61dd86fc8c6e22908f061a6b5e25d1 Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Tue, 19 Nov 2019 12:10:13 +0100 Subject: [PATCH 03/12] Moved SVGs out of the way --- Untitled Diagram(2).svg | 3 --- relaying.svg | 3 --- 2 files changed, 6 deletions(-) delete mode 100644 Untitled Diagram(2).svg delete mode 100644 relaying.svg diff --git a/Untitled Diagram(2).svg b/Untitled Diagram(2).svg deleted file mode 100644 index cefbcf4..0000000 --- a/Untitled Diagram(2).svg +++ /dev/null @@ -1,3 +0,0 @@ - - -
MX of example.com?
<div>MX of example.com?</div>
A record of mx.example.org?
A record of mx.example.org?SMTP
Sending
mail server
[Not supported by viewer]
"mx.example.com"
"mx.example.com"
"85.25.72.76"
"85.25.72.76"
2
[Not supported by viewer]
1
[Not supported by viewer]
3
[Not supported by viewer]
DNS
DNS
4
[Not supported by viewer]
5
[Not supported by viewer]
6
[Not supported by viewer]
/var/vmail
[Not supported by viewer]
7
[Not supported by viewer] \ No newline at end of file diff --git a/relaying.svg b/relaying.svg deleted file mode 100644 index 11e0a88..0000000 --- a/relaying.svg +++ /dev/null @@ -1,3 +0,0 @@ - - -
MX of example.net?
<div>MX of example.net?</div>
A record of mx.example.net?
A record of mx.example.net?SMTP
Destination
mail server
[Not supported by viewer]
"mx.example.net"
"mx.example.net"
"2001:616:c8:48a::5"
"2001:616:c8:48a::5"
1
[Not supported by viewer]
3
[Not supported by viewer]
DNS
DNSLook upuser indatabaseCheckusernameandpassword
2
[Not supported by viewer]
4
[Not supported by viewer]
SMTP with
authentication
[Not supported by viewer]
User
[Not supported by viewer]
5
[Not supported by viewer] \ No newline at end of file From fcc145082a788ffcdc1f14169fb2bd2088bd74e7 Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Sun, 1 Dec 2019 17:22:38 +0100 Subject: [PATCH 04/12] Roles packages, certificate and roundcube fixed --- ansible/group_vars/all | 6 +- ansible/hosts | 3 +- ansible/ispmail.yml | 31 +++--- ansible/roles/ispmail-certificate/tasks/main.yml | 1 - ansible/roles/ispmail-database/tasks/main.yml | 48 ++++----- .../templates/dovecot-sql.conf.ext.j2 | 2 +- ansible/roles/ispmail-packages/tasks/main.yml | 42 ++++---- .../templates/mysql-email2email.cf.j2 | 2 +- .../templates/mysql-virtual-alias-maps.cf.j2 | 2 +- .../templates/mysql-virtual-mailbox-domains.cf.j2 | 2 +- .../templates/mysql-virtual-mailbox-maps.cf.j2 | 2 +- .../files/roundcube-managesieve-config.inc.php | 101 ------------------- .../handlers/main.yml | 5 + .../tasks/main.yml | 108 ++++++++++++++------- .../templates/config.inc.php.j2 | 90 +++++++++++++++++ .../plugins/managesieve/config.inc.php.j2 | 1 + .../templates/plugins/password/config.inc.php.j2 | 13 +++ .../templates/roundcube-password-config.inc.php.j2 | 2 +- .../templates/vhosts/http.j2 | 8 ++ .../templates/vhosts/https.j2 | 12 +++ 20 files changed, 277 insertions(+), 204 deletions(-) delete mode 100644 ansible/roles/ispmail-webmail-apache-roundcube/files/roundcube-managesieve-config.inc.php create mode 100644 ansible/roles/ispmail-webmail-apache-roundcube/handlers/main.yml create mode 100644 ansible/roles/ispmail-webmail-apache-roundcube/templates/config.inc.php.j2 create mode 100644 ansible/roles/ispmail-webmail-apache-roundcube/templates/plugins/managesieve/config.inc.php.j2 create mode 100644 ansible/roles/ispmail-webmail-apache-roundcube/templates/plugins/password/config.inc.php.j2 create mode 100644 ansible/roles/ispmail-webmail-apache-roundcube/templates/vhosts/http.j2 create mode 100644 ansible/roles/ispmail-webmail-apache-roundcube/templates/vhosts/https.j2 diff --git a/ansible/group_vars/all b/ansible/group_vars/all index 9100a67..100851c 100644 --- a/ansible/group_vars/all +++ b/ansible/group_vars/all @@ -2,8 +2,12 @@ # Set this to true to create a john@example.org account with password 'summersun' ispmail_populate_test_data: true +# Set the host name that will be used in the URL for webmail. +# Make sure its properly set in your DNS zone. +ispmail_fqdn: yoda.workaround.org + # MySQL password for read-only user -ispmail_mysql_mailuser_password: ChangeMe +ispmail_mysql_mailserver_password: ChangeMe # MySQL password for administrative root user ispmail_mysql_root_password: ChangeMeRoot diff --git a/ansible/hosts b/ansible/hosts index 05614f6..e932d40 100644 --- a/ansible/hosts +++ b/ansible/hosts @@ -1 +1,2 @@ -localhost ansible_connection=local \ No newline at end of file +localhost ansible_connection=local +yoda.workaround.org diff --git a/ansible/ispmail.yml b/ansible/ispmail.yml index aa961eb..88a3c17 100644 --- a/ansible/ispmail.yml +++ b/ansible/ispmail.yml @@ -4,20 +4,23 @@ - hosts: all tasks: - - name: "Checking operating system version" - assert: - that: ansible_distribution_release == 'buster' - fail_msg: 'This Ansible playbook is only supported on Debian Buster.' - success_msg: 'Debian Buster found - that makes me happy.' + - name: "Checking operating system version" + assert: + that: ansible_distribution_release == 'buster' + fail_msg: "This Ansible playbook is only supported on Debian Buster." + success_msg: "Debian Buster found - that makes me happy." - hosts: all roles: - #- dumpvars - - ispmail-packages -# - ispmail-certificate - - ispmail-database -# - ispmail-postfix -# - ispmail-dovecot -# - ispmail-webmail - - ispmail-webmail-apache-horde - - ispmail-tests + #- dumpvars + - role: ispmail-packages + tags: packages + - role: ispmail-certificate + tags: certificate + # - ispmail-database + # - ispmail-postfix + # - ispmail-dovecot + - role: ispmail-webmail-apache-roundcube + tags: roundcube + # - ispmail-webmail-apache-horde + #- ispmail-tests diff --git a/ansible/roles/ispmail-certificate/tasks/main.yml b/ansible/roles/ispmail-certificate/tasks/main.yml index 0ee1fb6..10dc8c5 100644 --- a/ansible/roles/ispmail-certificate/tasks/main.yml +++ b/ansible/roles/ispmail-certificate/tasks/main.yml @@ -12,4 +12,3 @@ creates: /etc/ssl/certs/mailserver.pem - name: Restrict access permissions of the private key file: path=/etc/ssl/private/mailserver.pem mode=0640 - diff --git a/ansible/roles/ispmail-database/tasks/main.yml b/ansible/roles/ispmail-database/tasks/main.yml index 626a231..8c81e02 100644 --- a/ansible/roles/ispmail-database/tasks/main.yml +++ b/ansible/roles/ispmail-database/tasks/main.yml @@ -1,8 +1,16 @@ --- - name: Installing required Python mysqldb module for Ansible to manage databases -# apt: name=python-mysqldb + # apt: name=python-mysqldb apt: name=python-pymysql +- name: Create .my.cnf + template: + src: "root-my-cnf.j2" + dest: "/root/.my.cnf" + owner: root + group: root + mode: 0600 + - name: Set a new root password mysql_user: check_implicit_admin: yes @@ -14,49 +22,41 @@ - localhost - 127.0.0.1 -- name: Create .my.cnf - template: - src: "root-my-cnf.j2" - dest: "/root/.my.cnf" - owner: root - group: root - mode: 0600 - - name: creating mailserver MySQL database #become: true mysql_db: name: mailserver # - name: creating Roundcube MySQL database -# mysql_db: +# mysql_db: # name: roundcube - name: copying MySQL database schema to server - copy: - src: schema.sql + copy: + src: schema.sql dest: /tmp - name: setting up SQL schema of mailserver database - mysql_db: - name: mailserver - state: import + mysql_db: + name: mailserver + state: import target: /tmp/schema.sql - name: creating MySQL user to read the mailserver database - mysql_user: - name: mailuser - password: "{{ispmail_mysql_mailuser_password}}" + mysql_user: + name: mailuser + password: "{{ispmail_mysql_mailserver_password}}" priv: mailserver.*:SELECT,INSERT,UPDATE,DELETE # - name: creating MySQL user for roundcube -# mysql_user: -# name: roundcube +# mysql_user: +# name: roundcube # password: "{{ispmail_mysql_roundcube_password}}" # priv: roundcube.*:ALL - name: copying MySQL test data to server - copy: + copy: src: test.sql dest: /tmp when: ispmail_populate_test_data == true - name: populating the database with test data - mysql_db: - name: mailserver - state: import + mysql_db: + name: mailserver + state: import target: /tmp/test.sql when: ispmail_populate_test_data == true diff --git a/ansible/roles/ispmail-dovecot/templates/dovecot-sql.conf.ext.j2 b/ansible/roles/ispmail-dovecot/templates/dovecot-sql.conf.ext.j2 index 9d044b7..568975a 100644 --- a/ansible/roles/ispmail-dovecot/templates/dovecot-sql.conf.ext.j2 +++ b/ansible/roles/ispmail-dovecot/templates/dovecot-sql.conf.ext.j2 @@ -141,7 +141,7 @@ #iterate_query = SELECT username AS user FROM users driver = mysql -connect = host=127.0.0.1 dbname=mailserver user=mailuser password={{ispmail_mysql_mailuser_password}} +connect = host=127.0.0.1 dbname=mailserver user=mailuser password={{ispmail_mysql_mailserver_password}} default_pass_scheme = SHA256-CRYPT password_query = SELECT email as user, password FROM virtual_users WHERE email='%u'; diff --git a/ansible/roles/ispmail-packages/tasks/main.yml b/ansible/roles/ispmail-packages/tasks/main.yml index fcf29ad..13b5803 100644 --- a/ansible/roles/ispmail-packages/tasks/main.yml +++ b/ansible/roles/ispmail-packages/tasks/main.yml @@ -5,23 +5,27 @@ update_cache: yes vars: packages: - - etckeeper - - certbot - - pwgen - - mariadb-server - - postfix - - postfix-mysql - # - roundcube - # - roundcube-mysql - # - roundcube-plugins - # - roundcube-plugins-extra - - swaks - - dovecot-mysql - - dovecot-pop3d - - dovecot-imapd - - dovecot-lmtpd - - dovecot-managesieved - - adminer - - rspamd - - fail2ban + - etckeeper + - certbot + - pwgen + - mariadb-server + - postfix + - postfix-mysql + # - roundcube + # - roundcube-mysql + # - roundcube-plugins + # - roundcube-plugins-extra + - swaks + - dovecot-mysql + - dovecot-pop3d + - dovecot-imapd + - dovecot-lmtpd + - dovecot-managesieved + - apache2 + - php + - adminer + - rspamd + - fail2ban + - ca-certificates + - mutt # TODO: shorewall diff --git a/ansible/roles/ispmail-postfix/templates/mysql-email2email.cf.j2 b/ansible/roles/ispmail-postfix/templates/mysql-email2email.cf.j2 index 0d6ea98..cdf6cee 100644 --- a/ansible/roles/ispmail-postfix/templates/mysql-email2email.cf.j2 +++ b/ansible/roles/ispmail-postfix/templates/mysql-email2email.cf.j2 @@ -1,5 +1,5 @@ user = mailuser -password = {{ispmail_mysql_mailuser_password}} +password = {{ispmail_mysql_mailserver_password}} hosts = 127.0.0.1 dbname = mailserver query = SELECT email FROM virtual_users WHERE email='%s' diff --git a/ansible/roles/ispmail-postfix/templates/mysql-virtual-alias-maps.cf.j2 b/ansible/roles/ispmail-postfix/templates/mysql-virtual-alias-maps.cf.j2 index ba49b2f..9aad48d 100644 --- a/ansible/roles/ispmail-postfix/templates/mysql-virtual-alias-maps.cf.j2 +++ b/ansible/roles/ispmail-postfix/templates/mysql-virtual-alias-maps.cf.j2 @@ -1,5 +1,5 @@ user = mailuser -password = {{ispmail_mysql_mailuser_password}} +password = {{ispmail_mysql_mailserver_password}} hosts = 127.0.0.1 dbname = mailserver query = SELECT destination FROM virtual_aliases WHERE source='%s' diff --git a/ansible/roles/ispmail-postfix/templates/mysql-virtual-mailbox-domains.cf.j2 b/ansible/roles/ispmail-postfix/templates/mysql-virtual-mailbox-domains.cf.j2 index 443f77c..bca5edb 100644 --- a/ansible/roles/ispmail-postfix/templates/mysql-virtual-mailbox-domains.cf.j2 +++ b/ansible/roles/ispmail-postfix/templates/mysql-virtual-mailbox-domains.cf.j2 @@ -1,5 +1,5 @@ user = mailuser -password = {{ispmail_mysql_mailuser_password}} +password = {{ispmail_mysql_mailserver_password}} hosts = 127.0.0.1 dbname = mailserver query = SELECT 1 FROM virtual_domains WHERE name='%s' diff --git a/ansible/roles/ispmail-postfix/templates/mysql-virtual-mailbox-maps.cf.j2 b/ansible/roles/ispmail-postfix/templates/mysql-virtual-mailbox-maps.cf.j2 index 0207bbb..46ced80 100644 --- a/ansible/roles/ispmail-postfix/templates/mysql-virtual-mailbox-maps.cf.j2 +++ b/ansible/roles/ispmail-postfix/templates/mysql-virtual-mailbox-maps.cf.j2 @@ -1,5 +1,5 @@ user = mailuser -password = {{ispmail_mysql_mailuser_password}} +password = {{ispmail_mysql_mailserver_password}} hosts = 127.0.0.1 dbname = mailserver query = SELECT 1 FROM virtual_users WHERE email='%s' diff --git a/ansible/roles/ispmail-webmail-apache-roundcube/files/roundcube-managesieve-config.inc.php b/ansible/roles/ispmail-webmail-apache-roundcube/files/roundcube-managesieve-config.inc.php deleted file mode 100644 index cc53cb0..0000000 --- a/ansible/roles/ispmail-webmail-apache-roundcube/files/roundcube-managesieve-config.inc.php +++ /dev/null @@ -1,101 +0,0 @@ -// Taken from /usr/share/roundcube/plugins/managesieve/config.inc.php.dist - array( -// 'verify_peer' => true, -// 'verify_depth' => 3, -// 'cafile' => '/etc/openssl/certs/ca.crt', -// ), -// ); -$config['managesieve_conn_options'] = null; - -// default contents of filters script (eg. default spam filter) -$config['managesieve_default'] = '/etc/dovecot/sieve/global'; - -// The name of the script which will be used when there's no user script -$config['managesieve_script_name'] = 'managesieve'; - -// Sieve RFC says that we should use UTF-8 endcoding for mailbox names, -// but some implementations does not covert UTF-8 to modified UTF-7. -// Defaults to UTF7-IMAP -$config['managesieve_mbox_encoding'] = 'UTF-8'; - -// I need this because my dovecot (with listescape plugin) uses -// ':' delimiter, but creates folders with dot delimiter -$config['managesieve_replace_delimiter'] = ''; - -// disabled sieve extensions (body, copy, date, editheader, encoded-character, -// envelope, environment, ereject, fileinto, ihave, imap4flags, index, -// mailbox, mboxmetadata, regex, reject, relational, servermetadata, -// spamtest, spamtestplus, subaddress, vacation, variables, virustest, etc. -// Note: not all extensions are implemented -$config['managesieve_disabled_extensions'] = array(); - -// Enables debugging of conversation with sieve server. Logs it into /sieve -$config['managesieve_debug'] = false; - -// Enables features described in http://wiki.kolab.org/KEP:14 -$config['managesieve_kolab_master'] = false; - -// Script name extension used for scripts including. Dovecot uses '.sieve', -// Cyrus uses '.siv'. Doesn't matter if you have managesieve_kolab_master disabled. -$config['managesieve_filename_extension'] = '.sieve'; - -// List of reserved script names (without extension). -// Scripts listed here will be not presented to the user. -$config['managesieve_filename_exceptions'] = array(); - -// List of domains limiting destination emails in redirect action -// If not empty, user will need to select domain from a list -$config['managesieve_domains'] = array(); - -// Enables separate management interface for vacation responses (out-of-office) -// 0 - no separate section (default), -// 1 - add Vacation section, -// 2 - add Vacation section, but hide Filters section -$config['managesieve_vacation'] = 0; - -// Default vacation interval (in days). -// Note: If server supports vacation-seconds extension it is possible -// to define interval in seconds here (as a string), e.g. "3600s". -$config['managesieve_vacation_interval'] = 0; - -// Some servers require vacation :addresses to be filled with all -// user addresses (aliases). This option enables automatic filling -// of these on initial vacation form creation. -$config['managesieve_vacation_addresses_init'] = false; - -// Supported methods of notify extension. Default: 'mailto' -$config['managesieve_notify_methods'] = array('mailto'); diff --git a/ansible/roles/ispmail-webmail-apache-roundcube/handlers/main.yml b/ansible/roles/ispmail-webmail-apache-roundcube/handlers/main.yml new file mode 100644 index 0000000..af398e8 --- /dev/null +++ b/ansible/roles/ispmail-webmail-apache-roundcube/handlers/main.yml @@ -0,0 +1,5 @@ +--- +- name: restart apache + service: + name: apache2 + state: restarted diff --git a/ansible/roles/ispmail-webmail-apache-roundcube/tasks/main.yml b/ansible/roles/ispmail-webmail-apache-roundcube/tasks/main.yml index 3019f6a..eff658e 100644 --- a/ansible/roles/ispmail-webmail-apache-roundcube/tasks/main.yml +++ b/ansible/roles/ispmail-webmail-apache-roundcube/tasks/main.yml @@ -5,40 +5,74 @@ update_cache: yes vars: packages: - #- roundcube - #- roundcube-plugins - - php-horde-imp - - php-horde-ingo - - php-horde-kronolith - - php-horde-turba -# - name: Creating random des_key for Roundcube -# shell: pwgen 24 -# register: roundcube_random_des_key -# - name: Deploying Roundcube configuration -# template: -# src: roundcube-config.inc.php.j2 -# dest: /etc/roundcube/config.inc.php -# owner: root -# group: www-data -# mode: 0640 -# - name: Deploying Roundcube managesieve plugin configuration -# copy: -# src: roundcube-managesieve-config.inc.php -# dest: /etc/roundcube/plugins/managesieve/config.inc.php -# mode: 0640 -# - name: Deploying Roundcube password plugin configuration -# template: -# src: roundcube-password-config.inc.php.j2 -# dest: /etc/roundcube/plugins/password/config.inc.php -# owner: root -# group: www-data -# mode: 0640 -# - name: Copy ISPmail logo -# copy: -# src: ispmail-logo.png -# dest: /var/lib/roundcube/ -# - name: Copy Roundcube database config file -# template: -# src: roundcube-debian-db.php.j2 -# dest: /etc/roundcube/debian-db.php -# mode: 0640 + - roundcube + - roundcube-plugins + - roundcube-plugins-extra + - roundcube-mysql +- name: Creating random des_key for Roundcube + shell: pwgen 24 1 + register: roundcube_random_des_key +- name: Deploying Roundcube configuration + template: + src: config.inc.php.j2 + dest: /etc/roundcube/config.inc.php + owner: root + group: www-data + mode: 0640 +- name: Deploying Roundcube managesieve plugin configuration + template: + src: plugins/managesieve/config.inc.php.j2 + dest: /etc/roundcube/plugins/managesieve/config.inc.php + owner: root + group: www-data + mode: 0640 +- name: Deploying Roundcube password plugin configuration + template: + src: plugins/password/config.inc.php.j2 + dest: /etc/roundcube/plugins/password/config.inc.php + owner: root + group: www-data + mode: 0640 +- name: Copy ISPmail logo + copy: + src: ispmail-logo.png + dest: /var/lib/roundcube/skins/larry/ +- name: Enable Apache rewrite and ssl module + shell: a2enmod {{item}} + args: + creates: /etc/apache2/mods-enabled/{{item}}.load + with_items: + - rewrite + - ssl + notify: restart apache +- name: Create DocumentRoot for HTTP vhost + file: + path: /var/www/{{ispmail_fqdn}} + state: directory + owner: www-data + group: www-data +- name: Remove Apache default vhost pointing to dummy page + file: + path: /etc/apache2/sites-enabled/000-default.conf + state: absent + notify: restart apache +- name: Configure HTTP vhost + template: + src: vhosts/http.j2 + dest: /etc/apache2/sites-available/{{ispmail_fqdn}}-http.conf + notify: restart apache +- name: Enable HTTP vhost + shell: a2ensite {{ispmail_fqdn}}-http.conf + args: + creates: /etc/apache2/sites-enabled/{{ispmail_fqdn}}-http.conf + notify: restart apache +- name: Configure HTTPS vhost + template: + src: vhosts/https.j2 + dest: /etc/apache2/sites-available/{{ispmail_fqdn}}-https.conf + notify: restart apache +- name: Enable HTTPS vhost + shell: a2ensite {{ispmail_fqdn}}-https.conf + args: + creates: /etc/apache2/sites-enabled/{{ispmail_fqdn}}-https.conf + notify: restart apache diff --git a/ansible/roles/ispmail-webmail-apache-roundcube/templates/config.inc.php.j2 b/ansible/roles/ispmail-webmail-apache-roundcube/templates/config.inc.php.j2 new file mode 100644 index 0000000..6bf304a --- /dev/null +++ b/ansible/roles/ispmail-webmail-apache-roundcube/templates/config.inc.php.j2 @@ -0,0 +1,90 @@ + + ServerName {{ispmail_fqdn}} + DocumentRoot /var/www/{{ispmail_fqdn}} + + RewriteEngine On + RewriteCond %{REQUEST_URI} !\.well-known/acme-challenge + RewriteRule ^(.*)$ https://%{SERVER_NAME}/ [R=301,L] + diff --git a/ansible/roles/ispmail-webmail-apache-roundcube/templates/vhosts/https.j2 b/ansible/roles/ispmail-webmail-apache-roundcube/templates/vhosts/https.j2 new file mode 100644 index 0000000..4a609c6 --- /dev/null +++ b/ansible/roles/ispmail-webmail-apache-roundcube/templates/vhosts/https.j2 @@ -0,0 +1,12 @@ + + ServerName {{ispmail_fqdn}} + DocumentRoot /var/lib/roundcube + + SSLEngine on + SSLCertificateKeyFile /etc/ssl/private/mailserver.pem + SSLCertificateFile /etc/ssl/certs/mailserver.pem + + # When using Let's Encrypt use these line instead: + # SSLCertificateKeyFile /etc/letsencrypt/live/{{ispmail_fqdn}}/privkey.pem + # SSLCertificateFile /etc/letsencrypt/live/{{ispmail_fqdn}}/fullchain.pem + From a248bb006e2bbd96575d67e048bb56c78b1f455b Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Sun, 1 Dec 2019 17:23:46 +0100 Subject: [PATCH 05/12] Alias to /adminer added --- .../roles/ispmail-webmail-apache-roundcube/templates/vhosts/https.j2 | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ansible/roles/ispmail-webmail-apache-roundcube/templates/vhosts/https.j2 b/ansible/roles/ispmail-webmail-apache-roundcube/templates/vhosts/https.j2 index 4a609c6..6c9cf25 100644 --- a/ansible/roles/ispmail-webmail-apache-roundcube/templates/vhosts/https.j2 +++ b/ansible/roles/ispmail-webmail-apache-roundcube/templates/vhosts/https.j2 @@ -2,6 +2,8 @@ ServerName {{ispmail_fqdn}} DocumentRoot /var/lib/roundcube + Alias /adminer /usr/share/adminer/adminer + SSLEngine on SSLCertificateKeyFile /etc/ssl/private/mailserver.pem SSLCertificateFile /etc/ssl/certs/mailserver.pem From f863a7a444e1a68ea791881cb64e942d06728b30 Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Sun, 1 Dec 2019 17:45:15 +0100 Subject: [PATCH 06/12] Database role works --- ansible/group_vars/all | 5 ++- ansible/ispmail.yml | 3 +- ansible/roles/ispmail-database/files/test.sql | 2 +- ansible/roles/ispmail-database/tasks/main.yml | 60 ++++++++++++++------------- 4 files changed, 38 insertions(+), 32 deletions(-) diff --git a/ansible/group_vars/all b/ansible/group_vars/all index 100851c..e5e2f95 100644 --- a/ansible/group_vars/all +++ b/ansible/group_vars/all @@ -7,7 +7,10 @@ ispmail_populate_test_data: true ispmail_fqdn: yoda.workaround.org # MySQL password for read-only user -ispmail_mysql_mailserver_password: ChangeMe +ispmail_mysql_mailserver_password: ChangeMeServer + +# MySQL password for read-write user +ispmail_mysql_mailadmin_password: ChangeMeAdmin # MySQL password for administrative root user ispmail_mysql_root_password: ChangeMeRoot diff --git a/ansible/ispmail.yml b/ansible/ispmail.yml index 88a3c17..2903d79 100644 --- a/ansible/ispmail.yml +++ b/ansible/ispmail.yml @@ -17,7 +17,8 @@ tags: packages - role: ispmail-certificate tags: certificate - # - ispmail-database + - role: ispmail-database + tags: database # - ispmail-postfix # - ispmail-dovecot - role: ispmail-webmail-apache-roundcube diff --git a/ansible/roles/ispmail-database/files/test.sql b/ansible/roles/ispmail-database/files/test.sql index f997d58..3ddc641 100644 --- a/ansible/roles/ispmail-database/files/test.sql +++ b/ansible/roles/ispmail-database/files/test.sql @@ -12,7 +12,7 @@ REPLACE INTO `mailserver`.`virtual_users` ( `email` ) VALUES ( - '1', '1', CONCAT('{PLAIN-MD5}', MD5( 'summersun' )) , 'john@example.org' + '1', '1', '{BLF-CRYPT}$2y$05$m.GdQNMyUFNG0vPsaXxSB.0ZQqZhe1e9Un841oBcWi6U6HRF2Kmky', 'john@example.org' ); REPLACE INTO `mailserver`.`virtual_aliases` ( `id`, diff --git a/ansible/roles/ispmail-database/tasks/main.yml b/ansible/roles/ispmail-database/tasks/main.yml index 8c81e02..71743f2 100644 --- a/ansible/roles/ispmail-database/tasks/main.yml +++ b/ansible/roles/ispmail-database/tasks/main.yml @@ -3,52 +3,53 @@ # apt: name=python-mysqldb apt: name=python-pymysql -- name: Create .my.cnf - template: - src: "root-my-cnf.j2" - dest: "/root/.my.cnf" - owner: root - group: root - mode: 0600 +# - name: Create .my.cnf +# template: +# src: "root-my-cnf.j2" +# dest: "/root/.my.cnf" +# owner: root +# group: root +# mode: 0600 -- name: Set a new root password - mysql_user: - check_implicit_admin: yes - user: root - password: "{{ ispmail_mysql_root_password }}" - login_unix_socket: /var/run/mysqld/mysqld.sock - host: "{{ item }}" - with_items: - - localhost - - 127.0.0.1 +# - name: Set a new root password +# mysql_user: +# check_implicit_admin: yes +# user: root +# password: "{{ ispmail_mysql_root_password }}" +# login_unix_socket: /var/run/mysqld/mysqld.sock +# host: "{{ item }}" +# with_items: +# - localhost +# - 127.0.0.1 - name: creating mailserver MySQL database - #become: true mysql_db: + login_unix_socket: /var/run/mysqld/mysqld.sock name: mailserver - -# - name: creating Roundcube MySQL database -# mysql_db: -# name: roundcube - name: copying MySQL database schema to server copy: src: schema.sql dest: /tmp - name: setting up SQL schema of mailserver database mysql_db: + login_unix_socket: /var/run/mysqld/mysqld.sock name: mailserver state: import target: /tmp/schema.sql +- name: creating MySQL user mailadmin + mysql_user: + login_unix_socket: /var/run/mysqld/mysqld.sock + name: mailadmin + password: "{{ispmail_mysql_mailadmin_password}}" + priv: mailserver.*:SELECT,INSERT,UPDATE,DELETE + host: localhost - name: creating MySQL user to read the mailserver database mysql_user: - name: mailuser + login_unix_socket: /var/run/mysqld/mysqld.sock + name: mailserver password: "{{ispmail_mysql_mailserver_password}}" - priv: mailserver.*:SELECT,INSERT,UPDATE,DELETE -# - name: creating MySQL user for roundcube -# mysql_user: -# name: roundcube -# password: "{{ispmail_mysql_roundcube_password}}" -# priv: roundcube.*:ALL + priv: mailserver.*:SELECT + host: 127.0.0.1 - name: copying MySQL test data to server copy: src: test.sql @@ -56,6 +57,7 @@ when: ispmail_populate_test_data == true - name: populating the database with test data mysql_db: + login_unix_socket: /var/run/mysqld/mysqld.sock name: mailserver state: import target: /tmp/test.sql From f4b3a16944660464989a3dbff148a2e0f128e84e Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Sun, 1 Dec 2019 17:45:22 +0100 Subject: [PATCH 07/12] Include Roundcube's security config --- ansible/roles/ispmail-webmail-apache-roundcube/templates/vhosts/https.j2 | 1 + 1 file changed, 1 insertion(+) diff --git a/ansible/roles/ispmail-webmail-apache-roundcube/templates/vhosts/https.j2 b/ansible/roles/ispmail-webmail-apache-roundcube/templates/vhosts/https.j2 index 6c9cf25..0283cc0 100644 --- a/ansible/roles/ispmail-webmail-apache-roundcube/templates/vhosts/https.j2 +++ b/ansible/roles/ispmail-webmail-apache-roundcube/templates/vhosts/https.j2 @@ -3,6 +3,7 @@ DocumentRoot /var/lib/roundcube Alias /adminer /usr/share/adminer/adminer + Include /etc/roundcube/apache.conf SSLEngine on SSLCertificateKeyFile /etc/ssl/private/mailserver.pem From e42df60752ca47ed72f66f59457d5fe7d3308e83 Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Sun, 1 Dec 2019 19:07:42 +0100 Subject: [PATCH 08/12] Dovecot role fixed --- ansible/ispmail.yml | 6 +- ansible/roles/ispmail-dovecot/files/10-auth.conf | 128 ++++++++++++++++ ansible/roles/ispmail-dovecot/files/10-mail.conf | 83 ++++++++--- ansible/roles/ispmail-dovecot/files/10-master.conf | 31 ++-- ansible/roles/ispmail-dovecot/files/10-ssl.conf | 58 -------- .../roles/ispmail-dovecot/files/15-mailboxes.conf | 50 ------- ansible/roles/ispmail-dovecot/files/20-lmtp.conf | 8 +- ansible/roles/ispmail-dovecot/files/90-sieve.conf | 165 +++++++++++++++++---- .../roles/ispmail-dovecot/files/auth-sql.conf.ext | 6 +- ansible/roles/ispmail-dovecot/handlers/main.yml | 1 - ansible/roles/ispmail-dovecot/tasks/main.yml | 18 +-- .../roles/ispmail-dovecot/templates/10-ssl.conf | 80 ++++++++++ .../templates/dovecot-sql.conf.ext.j2 | 9 +- ansible/roles/ispmail-postfix/files/master.cf | 3 - ansible/roles/ispmail-postfix/handlers/main.yml | 3 - ansible/roles/ispmail-postfix/tasks/main.yml | 17 --- .../templates/mysql-email2email.cf.j2 | 2 +- .../templates/mysql-virtual-alias-maps.cf.j2 | 2 +- .../templates/mysql-virtual-mailbox-domains.cf.j2 | 2 +- .../templates/mysql-virtual-mailbox-maps.cf.j2 | 2 +- .../templates/roundcube-password-config.inc.php.j2 | 2 +- 21 files changed, 456 insertions(+), 220 deletions(-) create mode 100644 ansible/roles/ispmail-dovecot/files/10-auth.conf delete mode 100644 ansible/roles/ispmail-dovecot/files/10-ssl.conf delete mode 100644 ansible/roles/ispmail-dovecot/files/15-mailboxes.conf create mode 100644 ansible/roles/ispmail-dovecot/templates/10-ssl.conf diff --git a/ansible/ispmail.yml b/ansible/ispmail.yml index 2903d79..25782f8 100644 --- a/ansible/ispmail.yml +++ b/ansible/ispmail.yml @@ -19,8 +19,10 @@ tags: certificate - role: ispmail-database tags: database - # - ispmail-postfix - # - ispmail-dovecot + - role: ispmail-postfix + tags: postfix + - role: ispmail-dovecot + tags: dovecot - role: ispmail-webmail-apache-roundcube tags: roundcube # - ispmail-webmail-apache-horde diff --git a/ansible/roles/ispmail-dovecot/files/10-auth.conf b/ansible/roles/ispmail-dovecot/files/10-auth.conf new file mode 100644 index 0000000..9757224 --- /dev/null +++ b/ansible/roles/ispmail-dovecot/files/10-auth.conf @@ -0,0 +1,128 @@ +## +## Authentication processes +## + +# Disable LOGIN command and all other plaintext authentications unless +# SSL/TLS is used (LOGINDISABLED capability). Note that if the remote IP +# matches the local IP (ie. you're connecting from the same computer), the +# connection is considered secure and plaintext authentication is allowed. +# See also ssl=required setting. +#disable_plaintext_auth = yes + +# Authentication cache size (e.g. 10M). 0 means it's disabled. Note that +# bsdauth, PAM and vpopmail require cache_key to be set for caching to be used. +#auth_cache_size = 0 +# Time to live for cached data. After TTL expires the cached record is no +# longer used, *except* if the main database lookup returns internal failure. +# We also try to handle password changes automatically: If user's previous +# authentication was successful, but this one wasn't, the cache isn't used. +# For now this works only with plaintext authentication. +#auth_cache_ttl = 1 hour +# TTL for negative hits (user not found, password mismatch). +# 0 disables caching them completely. +#auth_cache_negative_ttl = 1 hour + +# Space separated list of realms for SASL authentication mechanisms that need +# them. You can leave it empty if you don't want to support multiple realms. +# Many clients simply use the first one listed here, so keep the default realm +# first. +#auth_realms = + +# Default realm/domain to use if none was specified. This is used for both +# SASL realms and appending @domain to username in plaintext logins. +#auth_default_realm = + +# List of allowed characters in username. If the user-given username contains +# a character not listed in here, the login automatically fails. This is just +# an extra check to make sure user can't exploit any potential quote escaping +# vulnerabilities with SQL/LDAP databases. If you want to allow all characters, +# set this value to empty. +#auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@ + +# Username character translations before it's looked up from databases. The +# value contains series of from -> to characters. For example "#@/@" means +# that '#' and '/' characters are translated to '@'. +#auth_username_translation = + +# Username formatting before it's looked up from databases. You can use +# the standard variables here, eg. %Lu would lowercase the username, %n would +# drop away the domain if it was given, or "%n-AT-%d" would change the '@' into +# "-AT-". This translation is done after auth_username_translation changes. +#auth_username_format = %Lu + +# If you want to allow master users to log in by specifying the master +# username within the normal username string (ie. not using SASL mechanism's +# support for it), you can specify the separator character here. The format +# is then . UW-IMAP uses "*" as the +# separator, so that could be a good choice. +#auth_master_user_separator = + +# Username to use for users logging in with ANONYMOUS SASL mechanism +#auth_anonymous_username = anonymous + +# Maximum number of dovecot-auth worker processes. They're used to execute +# blocking passdb and userdb queries (eg. MySQL and PAM). They're +# automatically created and destroyed as needed. +#auth_worker_max_count = 30 + +# Host name to use in GSSAPI principal names. The default is to use the +# name returned by gethostname(). Use "$ALL" (with quotes) to allow all keytab +# entries. +#auth_gssapi_hostname = + +# Kerberos keytab to use for the GSSAPI mechanism. Will use the system +# default (usually /etc/krb5.keytab) if not specified. You may need to change +# the auth service to run as root to be able to read this file. +#auth_krb5_keytab = + +# Do NTLM and GSS-SPNEGO authentication using Samba's winbind daemon and +# ntlm_auth helper. +#auth_use_winbind = no + +# Path for Samba's ntlm_auth helper binary. +#auth_winbind_helper_path = /usr/bin/ntlm_auth + +# Time to delay before replying to failed authentications. +#auth_failure_delay = 2 secs + +# Require a valid SSL client certificate or the authentication fails. +#auth_ssl_require_client_cert = no + +# Take the username from client's SSL certificate, using +# X509_NAME_get_text_by_NID() which returns the subject's DN's +# CommonName. +#auth_ssl_username_from_cert = no + +# Space separated list of wanted authentication mechanisms: +# plain login digest-md5 cram-md5 ntlm rpa apop anonymous gssapi otp skey +# gss-spnego +# NOTE: See also disable_plaintext_auth setting. +auth_mechanisms = plain login + +## +## Password and user databases +## + +# +# Password database is used to verify user's password (and nothing more). +# You can have multiple passdbs and userdbs. This is useful if you want to +# allow both system users (/etc/passwd) and virtual users to login without +# duplicating the system users into virtual database. +# +# +# +# User database specifies where mails are located and what user/group IDs +# own them. For single-UID configuration use "static" userdb. +# +# + +#!include auth-deny.conf.ext +#!include auth-master.conf.ext + +#!include auth-system.conf.ext +!include auth-sql.conf.ext +#!include auth-ldap.conf.ext +#!include auth-passwdfile.conf.ext +#!include auth-checkpassword.conf.ext +#!include auth-vpopmail.conf.ext +#!include auth-static.conf.ext diff --git a/ansible/roles/ispmail-dovecot/files/10-mail.conf b/ansible/roles/ispmail-dovecot/files/10-mail.conf index 3ef99fc..a660cb9 100644 --- a/ansible/roles/ispmail-dovecot/files/10-mail.conf +++ b/ansible/roles/ispmail-dovecot/files/10-mail.conf @@ -28,7 +28,7 @@ # # #mail_location = mbox:~/mail:INBOX=/var/mail/%u -mail_location = maildir:/var/vmail/%d/%n/Maildir +mail_location = maildir:~/Maildir # If you need to set multiple mailbox locations or want to change default # namespace settings, you can do it by defining namespace sections. @@ -47,12 +47,11 @@ namespace inbox { # Hierarchy separator to use. You should use the same separator for all # namespaces or some clients get confused. '/' is usually a good one. # The default however depends on the underlying mail storage format. - #separator = separator = . # Prefix required to access this namespace. This needs to be different for # all namespaces. For example "Public/". - #prefix = + #prefix = # Physical location of the mailbox. This is in same format as # mail_location, which is also the default for it. @@ -78,14 +77,7 @@ namespace inbox { # namespace handles them (empty prefix should always have this as "yes") #subscriptions = yes -# mailbox INBOX.Junk { -# auto = subscribe # autocreate and autosubscribe the Junk mailbox -# special_use = \Junk -# } -# mailbox INBOX.Trash { -# auto = subscribe # autocreate and autosubscribe the Trash mailbox -# special_use = \Trash -# } + # See 15-mailboxes.conf for definitions of special mailboxes. } # Example shared namespace configuration @@ -120,7 +112,7 @@ namespace inbox { # Group to enable temporarily for privileged operations. Currently this is # used only with INBOX when either its initial creation or dotlocking fails. # Typically this is set to "mail" to give access to /var/mail. -#mail_privileged_group = +mail_privileged_group = mail # Grant access to these supplementary groups for mail processes. Typically # these are used to set up access to shared mailboxes. Note that it may be @@ -135,10 +127,22 @@ namespace inbox { # or ~user/. #mail_full_filesystem_access = no -# Dictionary for key=value mailbox attributes. Currently used by URLAUTH, but -# soon intended to be used by METADATA as well. +# Dictionary for key=value mailbox attributes. This is used for example by +# URLAUTH and METADATA extensions. #mail_attribute_dict = +# A comment or note that is associated with the server. This value is +# accessible for authenticated users through the IMAP METADATA server +# entry "/shared/comment". +#mail_server_comment = "" + +# Indicates a method for contacting the server administrator. According to +# RFC 5464, this value MUST be a URI (e.g., a mailto: or tel: URL), but that +# is currently not enforced. Use for example mailto:admin@example.com. This +# value is accessible for authenticated users through the IMAP METADATA server +# entry "/shared/admin". +#mail_server_admin = + ## ## Mail processes ## @@ -162,7 +166,10 @@ namespace inbox { # methods. NFS users: flock doesn't work, remember to change mmap_disable. #lock_method = fcntl -# Directory in which LDA/LMTP temporarily stores incoming mails >128 kB. +# Directory where mails can be temporarily stored. Usually it's used only for +# mails larger than >= 128 kB. It's used by various parts of Dovecot, for +# example LDA/LMTP while delivering large mails or zlib plugin for keeping +# uncompressed mails. #mail_temp_dir = /tmp # Valid UID range for users, defaults to 500 and above. This is mostly @@ -190,7 +197,7 @@ namespace inbox { # WARNING: Never add directories here which local users can modify, that # may lead to root exploit. Usually this should be done only if you don't # allow shell access for users. -#valid_chroot_dirs = +#valid_chroot_dirs = # Default chroot directory for mail processes. This can be overridden for # specific users in user database by giving /./ in user's home directory @@ -198,7 +205,7 @@ namespace inbox { # need to do chrooting, Dovecot doesn't allow users to access files outside # their mail directory anyway. If your home directories are prefixed with # the chroot directory, append "/." to mail_chroot. -#mail_chroot = +#mail_chroot = # UNIX socket path to master authentication server to find users. # This is used by imap (for shared users) and lda. @@ -209,7 +216,7 @@ namespace inbox { # Space separated list of plugins to load for all services. Plugins specific to # IMAP, LDA, etc. are added to this list in their own .conf files. -#mail_plugins = +#mail_plugins = ## ## Mailbox handling optimizations @@ -217,7 +224,16 @@ namespace inbox { # Mailbox list indexes can be used to optimize IMAP STATUS commands. They are # also required for IMAP NOTIFY extension to be enabled. -#mailbox_list_index = no +#mailbox_list_index = yes + +# Trust mailbox list index to be up-to-date. This reduces disk I/O at the cost +# of potentially returning out-of-date results after e.g. server crashes. +# The results will be automatically fixed once the folders are opened. +#mailbox_list_index_very_dirty_syncs = yes + +# Should INBOX be kept up-to-date in the mailbox list index? By default it's +# not, because most of the mailbox accesses will open INBOX anyway. +#mailbox_list_index_include_inbox = no # The minimum number of mails in a mailbox before updates are done to cache # file. This allows optimizing Dovecot's behavior to do less disk writes at @@ -226,7 +242,7 @@ namespace inbox { # When IDLE command is running, mailbox is checked once in a while to see if # there are any new mails or other changes. This setting defines the minimum -# time to wait between those checks. Dovecot can also use dnotify, inotify and +# time to wait between those checks. Dovecot can also use inotify and # kqueue to find out immediately when changes occur. #mailbox_idle_check_interval = 30 secs @@ -245,6 +261,19 @@ namespace inbox { # These should exist only after Dovecot dies in the middle of saving mails. #mail_temp_scan_interval = 1w +# How many slow mail accesses sorting can perform before it returns failure. +# With IMAP the reply is: NO [LIMIT] Requested sort would have taken too long. +# The untagged SORT reply is still returned, but it's likely not correct. +#mail_sort_max_read_count = 0 + +protocol !indexer-worker { + # If folder vsize calculation requires opening more than this many mails from + # disk (i.e. mail sizes aren't in cache already), return failure and finish + # the calculation via indexer process. Disabled by default. This setting must + # be 0 for indexer-worker processes. + #mail_vsize_bg_after_count = 0 +} + ## ## Maildir-specific settings ## @@ -315,7 +344,7 @@ namespace inbox { # fallbacks to re-reading the whole mbox file whenever something in mbox isn't # how it's expected to be. The only real downside to this setting is that if # some other MUA changes message flags, Dovecot doesn't notice it immediately. -# Note that a full sync is done with SELECT, EXAMINE, EXPUNGE and CHECK +# Note that a full sync is done with SELECT, EXAMINE, EXPUNGE and CHECK # commands. #mbox_dirty_syncs = yes @@ -344,7 +373,7 @@ namespace inbox { ## # Maximum dbox file size until it's rotated. -#mdbox_rotate_size = 2M +#mdbox_rotate_size = 10M # Maximum dbox file age until it's rotated. Typically in days. Day begins # from midnight, so 1d = today, 2d = yesterday, etc. 0 = check disabled. @@ -380,3 +409,13 @@ namespace inbox { # variables: %{md4}, %{md5}, %{sha1}, %{sha256}, %{sha512}, %{size}. # Variables can be truncated, e.g. %{sha256:80} returns only first 80 bits #mail_attachment_hash = %{sha1} + +# Settings to control adding $HasAttachment or $HasNoAttachment keywords. +# By default, all MIME parts with Content-Disposition=attachment, or inlines +# with filename parameter are consired attachments. +# add-flags-on-save - Add the keywords when saving new mails. +# content-type=type or !type - Include/exclude content type. Excluding will +# never consider the matched MIME part as attachment. Including will only +# negate an exclusion (e.g. content-type=!foo/* content-type=foo/bar). +# exclude-inlined - Exclude any Content-Disposition=inline MIME part. +#mail_attachment_detection_options = diff --git a/ansible/roles/ispmail-dovecot/files/10-master.conf b/ansible/roles/ispmail-dovecot/files/10-master.conf index ff5d9f8..c3122a3 100644 --- a/ansible/roles/ispmail-dovecot/files/10-master.conf +++ b/ansible/roles/ispmail-dovecot/files/10-master.conf @@ -45,6 +45,12 @@ service pop3-login { } } +service submission-login { + inet_listener submission { + #port = 587 + } +} + service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix @@ -56,7 +62,7 @@ service lmtp { #inet_listener lmtp { # Avoid making LMTP visible for the entire internet #address = - #port = + #port = #} } @@ -74,6 +80,11 @@ service pop3 { #process_limit = 1024 } +service submission { + # Max. number of SMTP Submission processes (connections) + #process_limit = 1024 +} + service auth { # auth_socket_path points to this userdb socket by default. It's typically # used by dovecot-lda, doveadm, possibly imap process, etc. Users that have @@ -88,19 +99,17 @@ service auth { # To give the caller full permissions to lookup all users, set the mode to # something else than 0666 and Dovecot lets the kernel enforce the # permissions (e.g. 0777 allows everyone full permissions). - unix_listener auth-userdb { - #mode = 0666 - #user = - #group = - } - - # Postfix smtp-auth unix_listener /var/spool/postfix/private/auth { - mode = 0666 + mode = 0660 user = postfix group = postfix } + # Postfix smtp-auth + #unix_listener /var/spool/postfix/private/auth { + # mode = 0666 + #} + # Auth process is run as this user. #user = $default_internal_user } @@ -117,7 +126,7 @@ service dict { # For example: mode=0660, group=vmail and global mail_access_groups=vmail unix_listener dict { #mode = 0600 - #user = - #group = + #user = + #group = } } diff --git a/ansible/roles/ispmail-dovecot/files/10-ssl.conf b/ansible/roles/ispmail-dovecot/files/10-ssl.conf deleted file mode 100644 index 47ca04c..0000000 --- a/ansible/roles/ispmail-dovecot/files/10-ssl.conf +++ /dev/null @@ -1,58 +0,0 @@ -## -## SSL settings -## - -# SSL/TLS support: yes, no, required. -ssl = required - -# PEM encoded X.509 SSL/TLS certificate and private key. They're opened before -# dropping root privileges, so keep the key file unreadable by anyone but -# root. Included doc/mkcert.sh can be used to easily generate self-signed -# certificate, just make sure to update the domains in dovecot-openssl.cnf -ssl_cert = :]path[;