restrict managesieve port - thank you Thomas Gauweiler
This commit is contained in:
parent
df1d49afdf
commit
912492287d
1 changed files with 28 additions and 2 deletions
|
|
@ -113,8 +113,8 @@ to authenticate your users which is relevant later when we set up _relaying_.
|
||||||
Earlier in this guide you created both a key and a certificate file to encrypt the communication with IMAPS and HTTPS
|
Earlier in this guide you created both a key and a certificate file to encrypt the communication with IMAPS and HTTPS
|
||||||
between the users and your mail server. You need to tell Dovecot where to find these files. Also set
|
between the users and your mail server. You need to tell Dovecot where to find these files. Also set
|
||||||
[ssl=required](https://doc.dovecot.org/2.4.1/core/config/ssl.html#how-to-specify-when-ssl-tls-is-required) to prevent
|
[ssl=required](https://doc.dovecot.org/2.4.1/core/config/ssl.html#how-to-specify-when-ssl-tls-is-required) to prevent
|
||||||
that someone sends their password without encryption. Again we will create a new file `99-ispmail-ssl.conf` to
|
that someone sends their password without encryption. Again we will create a new file `99-ispmail-ssl.conf` to override
|
||||||
override the defaults.
|
the defaults.
|
||||||
|
|
||||||
<Aside type="danger" title="Important">
|
<Aside type="danger" title="Important">
|
||||||
|
|
||||||
|
|
@ -178,6 +178,32 @@ Dovecot can also read the path to a user's home directory and the user-ID and gr
|
||||||
a fixed schema for the home directory (`/var/vmail/DOMAIN/USER`) (as defined by `mail_home`) and the user and group are
|
a fixed schema for the home directory (`/var/vmail/DOMAIN/USER`) (as defined by `mail_home`) and the user and group are
|
||||||
always `vmail` and `vmail`.
|
always `vmail` and `vmail`.
|
||||||
|
|
||||||
|
### 99-ispmail-managesieve.conf
|
||||||
|
|
||||||
|
Later, we will implement server-side automation using **Sieve** rules. By default, Dovecot exposes two TCP ports to the
|
||||||
|
internet: 2000 and 4190. Port 2000 is deprecated anyway and can be safely disabled, while port 4190 is the one we will
|
||||||
|
use. However, unless you have a compelling reason, it is recommended not to make this port publicly accessible. So let
|
||||||
|
us restrict it to the _localhost_ interface:
|
||||||
|
|
||||||
|
```sh title="Run this on your server"
|
||||||
|
cat > /etc/dovecot/conf.d/99-ispmail-managesieve.conf << EOF
|
||||||
|
service managesieve-login {
|
||||||
|
# Listen only on localhost
|
||||||
|
inet_listener sieve {
|
||||||
|
listen= 127.0.0.1
|
||||||
|
port = 4190
|
||||||
|
}
|
||||||
|
|
||||||
|
# Disable the deprecated listener
|
||||||
|
inet_listener sieve_deprecated {
|
||||||
|
port = 0
|
||||||
|
}
|
||||||
|
}
|
||||||
|
EOF
|
||||||
|
```
|
||||||
|
|
||||||
|
_(Thanks to Thomas Gauweiler for spotting that.)_
|
||||||
|
|
||||||
## Restart and test
|
## Restart and test
|
||||||
|
|
||||||
Restart Dovecot from the shell:
|
Restart Dovecot from the shell:
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue