mirror of
https://github.com/stalwartlabs/proxy.git
synced 2026-10-30 16:15:29 +00:00
66 lines
3.0 KiB
Plaintext
66 lines
3.0 KiB
Plaintext
# ===========================================================================
|
|
# Legacy backend trust: Dovecot + Postfix settings for the migration proxy.
|
|
#
|
|
# These are the changes the legacy Dovecot and Postfix stack needs so that the
|
|
# migration proxy can front it. They do two things:
|
|
#
|
|
# 1. Trust the proxy to announce the real client address. The proxy forwards it
|
|
# over the XCLIENT command (Postfix submission and Dovecot ManageSieve/POP3)
|
|
# and the IMAP ID command, instead of a PROXY protocol header. Without this
|
|
# trust the backend records the proxy's address as the client; logins still
|
|
# work, but the real client address is lost.
|
|
#
|
|
# 2. Provide a master user, so the migration tool (Vandelay) can read any
|
|
# mailbox over IMAP with a single administrative credential rather than each
|
|
# user's password.
|
|
#
|
|
# Replace the address 203.0.113.10 with the proxy's actual address. Restrict the
|
|
# trust to the proxy, not to the whole network, so that arbitrary hosts cannot
|
|
# spoof a client address.
|
|
# ===========================================================================
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Dovecot: /etc/dovecot/dovecot.conf (or a file under /etc/dovecot/conf.d)
|
|
# ---------------------------------------------------------------------------
|
|
|
|
# Trust the proxy to forward the real client address via XCLIENT and the IMAP ID
|
|
# command. List the proxy's address only.
|
|
login_trusted_networks = 203.0.113.10/32
|
|
|
|
# Master user support, used by Vandelay to read any mailbox during migration. The
|
|
# login presented is "<user>%<master-user>" (here the separator is "%"), with the
|
|
# master user's password. For example, reading alice's mailbox uses the login
|
|
# "alice@example.com%vmadmin" and vmadmin's password.
|
|
auth_master_user_separator = %
|
|
|
|
passdb {
|
|
driver = passwd-file
|
|
master = yes
|
|
args = scheme=PLAIN username_format=%u /etc/dovecot/master-users
|
|
}
|
|
|
|
# /etc/dovecot/master-users (one line; use a real password hash in production,
|
|
# for example one produced by "doveadm pw -s SHA512-CRYPT"):
|
|
# vmadmin:{PLAIN}ChangeThisMasterPassword
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Postfix: apply with postconf, or add to /etc/postfix/main.cf
|
|
# ---------------------------------------------------------------------------
|
|
|
|
# Trust the proxy to announce the real client over XCLIENT on the SMTP and
|
|
# submission services. List the proxy's address only.
|
|
#
|
|
# postconf -e "smtpd_authorized_xclient_hosts=203.0.113.10/32"
|
|
#
|
|
# main.cf equivalent:
|
|
# smtpd_authorized_xclient_hosts = 203.0.113.10/32
|
|
|
|
# After changing either server, reload it:
|
|
# doveadm reload # Dovecot
|
|
# postfix reload # Postfix
|
|
#
|
|
# To confirm XCLIENT is being honoured, sign in through the proxy and check the
|
|
# Dovecot login line: the "rip=" field should show the real client address rather
|
|
# than the proxy's. If it shows the proxy's address, login_trusted_networks does
|
|
# not include the proxy.
|