From e42df60752ca47ed72f66f59457d5fe7d3308e83 Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Sun, 1 Dec 2019 19:07:42 +0100 Subject: [PATCH] Dovecot role fixed --- ansible/ispmail.yml | 6 +- ansible/roles/ispmail-dovecot/files/10-auth.conf | 128 ++++++++++++++++ ansible/roles/ispmail-dovecot/files/10-mail.conf | 83 ++++++++--- ansible/roles/ispmail-dovecot/files/10-master.conf | 31 ++-- ansible/roles/ispmail-dovecot/files/10-ssl.conf | 58 -------- .../roles/ispmail-dovecot/files/15-mailboxes.conf | 50 ------- ansible/roles/ispmail-dovecot/files/20-lmtp.conf | 8 +- ansible/roles/ispmail-dovecot/files/90-sieve.conf | 165 +++++++++++++++++---- .../roles/ispmail-dovecot/files/auth-sql.conf.ext | 6 +- ansible/roles/ispmail-dovecot/handlers/main.yml | 1 - ansible/roles/ispmail-dovecot/tasks/main.yml | 18 +-- .../roles/ispmail-dovecot/templates/10-ssl.conf | 80 ++++++++++ .../templates/dovecot-sql.conf.ext.j2 | 9 +- ansible/roles/ispmail-postfix/files/master.cf | 3 - ansible/roles/ispmail-postfix/handlers/main.yml | 3 - ansible/roles/ispmail-postfix/tasks/main.yml | 17 --- .../templates/mysql-email2email.cf.j2 | 2 +- .../templates/mysql-virtual-alias-maps.cf.j2 | 2 +- .../templates/mysql-virtual-mailbox-domains.cf.j2 | 2 +- .../templates/mysql-virtual-mailbox-maps.cf.j2 | 2 +- .../templates/roundcube-password-config.inc.php.j2 | 2 +- 21 files changed, 456 insertions(+), 220 deletions(-) create mode 100644 ansible/roles/ispmail-dovecot/files/10-auth.conf delete mode 100644 ansible/roles/ispmail-dovecot/files/10-ssl.conf delete mode 100644 ansible/roles/ispmail-dovecot/files/15-mailboxes.conf create mode 100644 ansible/roles/ispmail-dovecot/templates/10-ssl.conf diff --git a/ansible/ispmail.yml b/ansible/ispmail.yml index 2903d79..25782f8 100644 --- a/ansible/ispmail.yml +++ b/ansible/ispmail.yml @@ -19,8 +19,10 @@ tags: certificate - role: ispmail-database tags: database - # - ispmail-postfix - # - ispmail-dovecot + - role: ispmail-postfix + tags: postfix + - role: ispmail-dovecot + tags: dovecot - role: ispmail-webmail-apache-roundcube tags: roundcube # - ispmail-webmail-apache-horde diff --git a/ansible/roles/ispmail-dovecot/files/10-auth.conf b/ansible/roles/ispmail-dovecot/files/10-auth.conf new file mode 100644 index 0000000..9757224 --- /dev/null +++ b/ansible/roles/ispmail-dovecot/files/10-auth.conf @@ -0,0 +1,128 @@ +## +## Authentication processes +## + +# Disable LOGIN command and all other plaintext authentications unless +# SSL/TLS is used (LOGINDISABLED capability). Note that if the remote IP +# matches the local IP (ie. you're connecting from the same computer), the +# connection is considered secure and plaintext authentication is allowed. +# See also ssl=required setting. +#disable_plaintext_auth = yes + +# Authentication cache size (e.g. 10M). 0 means it's disabled. Note that +# bsdauth, PAM and vpopmail require cache_key to be set for caching to be used. +#auth_cache_size = 0 +# Time to live for cached data. After TTL expires the cached record is no +# longer used, *except* if the main database lookup returns internal failure. +# We also try to handle password changes automatically: If user's previous +# authentication was successful, but this one wasn't, the cache isn't used. +# For now this works only with plaintext authentication. +#auth_cache_ttl = 1 hour +# TTL for negative hits (user not found, password mismatch). +# 0 disables caching them completely. +#auth_cache_negative_ttl = 1 hour + +# Space separated list of realms for SASL authentication mechanisms that need +# them. You can leave it empty if you don't want to support multiple realms. +# Many clients simply use the first one listed here, so keep the default realm +# first. +#auth_realms = + +# Default realm/domain to use if none was specified. This is used for both +# SASL realms and appending @domain to username in plaintext logins. +#auth_default_realm = + +# List of allowed characters in username. If the user-given username contains +# a character not listed in here, the login automatically fails. This is just +# an extra check to make sure user can't exploit any potential quote escaping +# vulnerabilities with SQL/LDAP databases. If you want to allow all characters, +# set this value to empty. +#auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@ + +# Username character translations before it's looked up from databases. The +# value contains series of from -> to characters. For example "#@/@" means +# that '#' and '/' characters are translated to '@'. +#auth_username_translation = + +# Username formatting before it's looked up from databases. You can use +# the standard variables here, eg. %Lu would lowercase the username, %n would +# drop away the domain if it was given, or "%n-AT-%d" would change the '@' into +# "-AT-". This translation is done after auth_username_translation changes. +#auth_username_format = %Lu + +# If you want to allow master users to log in by specifying the master +# username within the normal username string (ie. not using SASL mechanism's +# support for it), you can specify the separator character here. The format +# is then . UW-IMAP uses "*" as the +# separator, so that could be a good choice. +#auth_master_user_separator = + +# Username to use for users logging in with ANONYMOUS SASL mechanism +#auth_anonymous_username = anonymous + +# Maximum number of dovecot-auth worker processes. They're used to execute +# blocking passdb and userdb queries (eg. MySQL and PAM). They're +# automatically created and destroyed as needed. +#auth_worker_max_count = 30 + +# Host name to use in GSSAPI principal names. The default is to use the +# name returned by gethostname(). Use "$ALL" (with quotes) to allow all keytab +# entries. +#auth_gssapi_hostname = + +# Kerberos keytab to use for the GSSAPI mechanism. Will use the system +# default (usually /etc/krb5.keytab) if not specified. You may need to change +# the auth service to run as root to be able to read this file. +#auth_krb5_keytab = + +# Do NTLM and GSS-SPNEGO authentication using Samba's winbind daemon and +# ntlm_auth helper. +#auth_use_winbind = no + +# Path for Samba's ntlm_auth helper binary. +#auth_winbind_helper_path = /usr/bin/ntlm_auth + +# Time to delay before replying to failed authentications. +#auth_failure_delay = 2 secs + +# Require a valid SSL client certificate or the authentication fails. +#auth_ssl_require_client_cert = no + +# Take the username from client's SSL certificate, using +# X509_NAME_get_text_by_NID() which returns the subject's DN's +# CommonName. +#auth_ssl_username_from_cert = no + +# Space separated list of wanted authentication mechanisms: +# plain login digest-md5 cram-md5 ntlm rpa apop anonymous gssapi otp skey +# gss-spnego +# NOTE: See also disable_plaintext_auth setting. +auth_mechanisms = plain login + +## +## Password and user databases +## + +# +# Password database is used to verify user's password (and nothing more). +# You can have multiple passdbs and userdbs. This is useful if you want to +# allow both system users (/etc/passwd) and virtual users to login without +# duplicating the system users into virtual database. +# +# +# +# User database specifies where mails are located and what user/group IDs +# own them. For single-UID configuration use "static" userdb. +# +# + +#!include auth-deny.conf.ext +#!include auth-master.conf.ext + +#!include auth-system.conf.ext +!include auth-sql.conf.ext +#!include auth-ldap.conf.ext +#!include auth-passwdfile.conf.ext +#!include auth-checkpassword.conf.ext +#!include auth-vpopmail.conf.ext +#!include auth-static.conf.ext diff --git a/ansible/roles/ispmail-dovecot/files/10-mail.conf b/ansible/roles/ispmail-dovecot/files/10-mail.conf index 3ef99fc..a660cb9 100644 --- a/ansible/roles/ispmail-dovecot/files/10-mail.conf +++ b/ansible/roles/ispmail-dovecot/files/10-mail.conf @@ -28,7 +28,7 @@ # # #mail_location = mbox:~/mail:INBOX=/var/mail/%u -mail_location = maildir:/var/vmail/%d/%n/Maildir +mail_location = maildir:~/Maildir # If you need to set multiple mailbox locations or want to change default # namespace settings, you can do it by defining namespace sections. @@ -47,12 +47,11 @@ namespace inbox { # Hierarchy separator to use. You should use the same separator for all # namespaces or some clients get confused. '/' is usually a good one. # The default however depends on the underlying mail storage format. - #separator = separator = . # Prefix required to access this namespace. This needs to be different for # all namespaces. For example "Public/". - #prefix = + #prefix = # Physical location of the mailbox. This is in same format as # mail_location, which is also the default for it. @@ -78,14 +77,7 @@ namespace inbox { # namespace handles them (empty prefix should always have this as "yes") #subscriptions = yes -# mailbox INBOX.Junk { -# auto = subscribe # autocreate and autosubscribe the Junk mailbox -# special_use = \Junk -# } -# mailbox INBOX.Trash { -# auto = subscribe # autocreate and autosubscribe the Trash mailbox -# special_use = \Trash -# } + # See 15-mailboxes.conf for definitions of special mailboxes. } # Example shared namespace configuration @@ -120,7 +112,7 @@ namespace inbox { # Group to enable temporarily for privileged operations. Currently this is # used only with INBOX when either its initial creation or dotlocking fails. # Typically this is set to "mail" to give access to /var/mail. -#mail_privileged_group = +mail_privileged_group = mail # Grant access to these supplementary groups for mail processes. Typically # these are used to set up access to shared mailboxes. Note that it may be @@ -135,10 +127,22 @@ namespace inbox { # or ~user/. #mail_full_filesystem_access = no -# Dictionary for key=value mailbox attributes. Currently used by URLAUTH, but -# soon intended to be used by METADATA as well. +# Dictionary for key=value mailbox attributes. This is used for example by +# URLAUTH and METADATA extensions. #mail_attribute_dict = +# A comment or note that is associated with the server. This value is +# accessible for authenticated users through the IMAP METADATA server +# entry "/shared/comment". +#mail_server_comment = "" + +# Indicates a method for contacting the server administrator. According to +# RFC 5464, this value MUST be a URI (e.g., a mailto: or tel: URL), but that +# is currently not enforced. Use for example mailto:admin@example.com. This +# value is accessible for authenticated users through the IMAP METADATA server +# entry "/shared/admin". +#mail_server_admin = + ## ## Mail processes ## @@ -162,7 +166,10 @@ namespace inbox { # methods. NFS users: flock doesn't work, remember to change mmap_disable. #lock_method = fcntl -# Directory in which LDA/LMTP temporarily stores incoming mails >128 kB. +# Directory where mails can be temporarily stored. Usually it's used only for +# mails larger than >= 128 kB. It's used by various parts of Dovecot, for +# example LDA/LMTP while delivering large mails or zlib plugin for keeping +# uncompressed mails. #mail_temp_dir = /tmp # Valid UID range for users, defaults to 500 and above. This is mostly @@ -190,7 +197,7 @@ namespace inbox { # WARNING: Never add directories here which local users can modify, that # may lead to root exploit. Usually this should be done only if you don't # allow shell access for users. -#valid_chroot_dirs = +#valid_chroot_dirs = # Default chroot directory for mail processes. This can be overridden for # specific users in user database by giving /./ in user's home directory @@ -198,7 +205,7 @@ namespace inbox { # need to do chrooting, Dovecot doesn't allow users to access files outside # their mail directory anyway. If your home directories are prefixed with # the chroot directory, append "/." to mail_chroot. -#mail_chroot = +#mail_chroot = # UNIX socket path to master authentication server to find users. # This is used by imap (for shared users) and lda. @@ -209,7 +216,7 @@ namespace inbox { # Space separated list of plugins to load for all services. Plugins specific to # IMAP, LDA, etc. are added to this list in their own .conf files. -#mail_plugins = +#mail_plugins = ## ## Mailbox handling optimizations @@ -217,7 +224,16 @@ namespace inbox { # Mailbox list indexes can be used to optimize IMAP STATUS commands. They are # also required for IMAP NOTIFY extension to be enabled. -#mailbox_list_index = no +#mailbox_list_index = yes + +# Trust mailbox list index to be up-to-date. This reduces disk I/O at the cost +# of potentially returning out-of-date results after e.g. server crashes. +# The results will be automatically fixed once the folders are opened. +#mailbox_list_index_very_dirty_syncs = yes + +# Should INBOX be kept up-to-date in the mailbox list index? By default it's +# not, because most of the mailbox accesses will open INBOX anyway. +#mailbox_list_index_include_inbox = no # The minimum number of mails in a mailbox before updates are done to cache # file. This allows optimizing Dovecot's behavior to do less disk writes at @@ -226,7 +242,7 @@ namespace inbox { # When IDLE command is running, mailbox is checked once in a while to see if # there are any new mails or other changes. This setting defines the minimum -# time to wait between those checks. Dovecot can also use dnotify, inotify and +# time to wait between those checks. Dovecot can also use inotify and # kqueue to find out immediately when changes occur. #mailbox_idle_check_interval = 30 secs @@ -245,6 +261,19 @@ namespace inbox { # These should exist only after Dovecot dies in the middle of saving mails. #mail_temp_scan_interval = 1w +# How many slow mail accesses sorting can perform before it returns failure. +# With IMAP the reply is: NO [LIMIT] Requested sort would have taken too long. +# The untagged SORT reply is still returned, but it's likely not correct. +#mail_sort_max_read_count = 0 + +protocol !indexer-worker { + # If folder vsize calculation requires opening more than this many mails from + # disk (i.e. mail sizes aren't in cache already), return failure and finish + # the calculation via indexer process. Disabled by default. This setting must + # be 0 for indexer-worker processes. + #mail_vsize_bg_after_count = 0 +} + ## ## Maildir-specific settings ## @@ -315,7 +344,7 @@ namespace inbox { # fallbacks to re-reading the whole mbox file whenever something in mbox isn't # how it's expected to be. The only real downside to this setting is that if # some other MUA changes message flags, Dovecot doesn't notice it immediately. -# Note that a full sync is done with SELECT, EXAMINE, EXPUNGE and CHECK +# Note that a full sync is done with SELECT, EXAMINE, EXPUNGE and CHECK # commands. #mbox_dirty_syncs = yes @@ -344,7 +373,7 @@ namespace inbox { ## # Maximum dbox file size until it's rotated. -#mdbox_rotate_size = 2M +#mdbox_rotate_size = 10M # Maximum dbox file age until it's rotated. Typically in days. Day begins # from midnight, so 1d = today, 2d = yesterday, etc. 0 = check disabled. @@ -380,3 +409,13 @@ namespace inbox { # variables: %{md4}, %{md5}, %{sha1}, %{sha256}, %{sha512}, %{size}. # Variables can be truncated, e.g. %{sha256:80} returns only first 80 bits #mail_attachment_hash = %{sha1} + +# Settings to control adding $HasAttachment or $HasNoAttachment keywords. +# By default, all MIME parts with Content-Disposition=attachment, or inlines +# with filename parameter are consired attachments. +# add-flags-on-save - Add the keywords when saving new mails. +# content-type=type or !type - Include/exclude content type. Excluding will +# never consider the matched MIME part as attachment. Including will only +# negate an exclusion (e.g. content-type=!foo/* content-type=foo/bar). +# exclude-inlined - Exclude any Content-Disposition=inline MIME part. +#mail_attachment_detection_options = diff --git a/ansible/roles/ispmail-dovecot/files/10-master.conf b/ansible/roles/ispmail-dovecot/files/10-master.conf index ff5d9f8..c3122a3 100644 --- a/ansible/roles/ispmail-dovecot/files/10-master.conf +++ b/ansible/roles/ispmail-dovecot/files/10-master.conf @@ -45,6 +45,12 @@ service pop3-login { } } +service submission-login { + inet_listener submission { + #port = 587 + } +} + service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix @@ -56,7 +62,7 @@ service lmtp { #inet_listener lmtp { # Avoid making LMTP visible for the entire internet #address = - #port = + #port = #} } @@ -74,6 +80,11 @@ service pop3 { #process_limit = 1024 } +service submission { + # Max. number of SMTP Submission processes (connections) + #process_limit = 1024 +} + service auth { # auth_socket_path points to this userdb socket by default. It's typically # used by dovecot-lda, doveadm, possibly imap process, etc. Users that have @@ -88,19 +99,17 @@ service auth { # To give the caller full permissions to lookup all users, set the mode to # something else than 0666 and Dovecot lets the kernel enforce the # permissions (e.g. 0777 allows everyone full permissions). - unix_listener auth-userdb { - #mode = 0666 - #user = - #group = - } - - # Postfix smtp-auth unix_listener /var/spool/postfix/private/auth { - mode = 0666 + mode = 0660 user = postfix group = postfix } + # Postfix smtp-auth + #unix_listener /var/spool/postfix/private/auth { + # mode = 0666 + #} + # Auth process is run as this user. #user = $default_internal_user } @@ -117,7 +126,7 @@ service dict { # For example: mode=0660, group=vmail and global mail_access_groups=vmail unix_listener dict { #mode = 0600 - #user = - #group = + #user = + #group = } } diff --git a/ansible/roles/ispmail-dovecot/files/10-ssl.conf b/ansible/roles/ispmail-dovecot/files/10-ssl.conf deleted file mode 100644 index 47ca04c..0000000 --- a/ansible/roles/ispmail-dovecot/files/10-ssl.conf +++ /dev/null @@ -1,58 +0,0 @@ -## -## SSL settings -## - -# SSL/TLS support: yes, no, required. -ssl = required - -# PEM encoded X.509 SSL/TLS certificate and private key. They're opened before -# dropping root privileges, so keep the key file unreadable by anyone but -# root. Included doc/mkcert.sh can be used to easily generate self-signed -# certificate, just make sure to update the domains in dovecot-openssl.cnf -ssl_cert = :]path[;