restrict managesieve port - thank you Thomas Gauweiler

This commit is contained in:
Christoph Haas 2025-12-09 00:57:52 +01:00
parent df1d49afdf
commit 912492287d

View file

@ -113,8 +113,8 @@ to authenticate your users which is relevant later when we set up _relaying_.
Earlier in this guide you created both a key and a certificate file to encrypt the communication with IMAPS and HTTPS Earlier in this guide you created both a key and a certificate file to encrypt the communication with IMAPS and HTTPS
between the users and your mail server. You need to tell Dovecot where to find these files. Also set between the users and your mail server. You need to tell Dovecot where to find these files. Also set
[ssl=required](https://doc.dovecot.org/2.4.1/core/config/ssl.html#how-to-specify-when-ssl-tls-is-required) to prevent [ssl=required](https://doc.dovecot.org/2.4.1/core/config/ssl.html#how-to-specify-when-ssl-tls-is-required) to prevent
that someone sends their password without encryption. Again we will create a new file `99-ispmail-ssl.conf` to that someone sends their password without encryption. Again we will create a new file `99-ispmail-ssl.conf` to override
override the defaults. the defaults.
<Aside type="danger" title="Important"> <Aside type="danger" title="Important">
@ -178,6 +178,32 @@ Dovecot can also read the path to a user's home directory and the user-ID and gr
a fixed schema for the home directory (`/var/vmail/DOMAIN/USER`) (as defined by `mail_home`) and the user and group are a fixed schema for the home directory (`/var/vmail/DOMAIN/USER`) (as defined by `mail_home`) and the user and group are
always `vmail` and `vmail`. always `vmail` and `vmail`.
### 99-ispmail-managesieve.conf
Later, we will implement server-side automation using **Sieve** rules. By default, Dovecot exposes two TCP ports to the
internet: 2000 and 4190. Port 2000 is deprecated anyway and can be safely disabled, while port 4190 is the one we will
use. However, unless you have a compelling reason, it is recommended not to make this port publicly accessible. So let
us restrict it to the _localhost_ interface:
```sh title="Run this on your server"
cat > /etc/dovecot/conf.d/99-ispmail-managesieve.conf << EOF
service managesieve-login {
# Listen only on localhost
inet_listener sieve {
listen= 127.0.0.1
port = 4190
}
# Disable the deprecated listener
inet_listener sieve_deprecated {
port = 0
}
}
EOF
```
_(Thanks to Thomas Gauweiler for spotting that.)_
## Restart and test ## Restart and test
Restart Dovecot from the shell: Restart Dovecot from the shell: