Created
March 1, 2017 11:05
-
-
Save Xcess/71f7eeeda0a270b252f1de5d7308c0e2 to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
## | |
## Authentication processes | |
## | |
# Disable LOGIN command and all other plaintext authentications unless | |
# SSL/TLS is used (LOGINDISABLED capability). Note that if the remote IP | |
# matches the local IP (ie. you're connecting from the same computer), the | |
# connection is considered secure and plaintext authentication is allowed. | |
# See also ssl=required setting. | |
#disable_plaintext_auth = yes | |
# Authentication cache size (e.g. 10M). 0 means it's disabled. Note that | |
# bsdauth, PAM and vpopmail require cache_key to be set for caching to be used. | |
#auth_cache_size = 0 | |
# Time to live for cached data. After TTL expires the cached record is no | |
# longer used, *except* if the main database lookup returns internal failure. | |
# We also try to handle password changes automatically: If user's previous | |
# authentication was successful, but this one wasn't, the cache isn't used. | |
# For now this works only with plaintext authentication. | |
#auth_cache_ttl = 1 hour | |
# TTL for negative hits (user not found, password mismatch). | |
# 0 disables caching them completely. | |
#auth_cache_negative_ttl = 1 hour | |
# Space separated list of realms for SASL authentication mechanisms that need | |
# them. You can leave it empty if you don't want to support multiple realms. | |
# Many clients simply use the first one listed here, so keep the default realm | |
# first. | |
#auth_realms = | |
# Default realm/domain to use if none was specified. This is used for both | |
# SASL realms and appending @domain to username in plaintext logins. | |
#auth_default_realm = | |
# List of allowed characters in username. If the user-given username contains | |
# a character not listed in here, the login automatically fails. This is just | |
# an extra check to make sure user can't exploit any potential quote escaping | |
# vulnerabilities with SQL/LDAP databases. If you want to allow all characters, | |
# set this value to empty. | |
#auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@ | |
# Username character translations before it's looked up from databases. The | |
# value contains series of from -> to characters. For example "#@/@" means | |
# that '#' and '/' characters are translated to '@'. | |
#auth_username_translation = | |
# Username formatting before it's looked up from databases. You can use | |
# the standard variables here, eg. %Lu would lowercase the username, %n would | |
# drop away the domain if it was given, or "%n-AT-%d" would change the '@' into | |
# "-AT-". This translation is done after auth_username_translation changes. | |
#auth_username_format = %Lu | |
# If you want to allow master users to log in by specifying the master | |
# username within the normal username string (ie. not using SASL mechanism's | |
# support for it), you can specify the separator character here. The format | |
# is then <username><separator><master username>. UW-IMAP uses "*" as the | |
# separator, so that could be a good choice. | |
#auth_master_user_separator = | |
# Username to use for users logging in with ANONYMOUS SASL mechanism | |
#auth_anonymous_username = anonymous | |
# Maximum number of dovecot-auth worker processes. They're used to execute | |
# blocking passdb and userdb queries (eg. MySQL and PAM). They're | |
# automatically created and destroyed as needed. | |
#auth_worker_max_count = 30 | |
# Host name to use in GSSAPI principal names. The default is to use the | |
# name returned by gethostname(). Use "$ALL" (with quotes) to allow all keytab | |
# entries. | |
#auth_gssapi_hostname = | |
# Kerberos keytab to use for the GSSAPI mechanism. Will use the system | |
# default (usually /etc/krb5.keytab) if not specified. You may need to change | |
# the auth service to run as root to be able to read this file. | |
#auth_krb5_keytab = | |
# Do NTLM and GSS-SPNEGO authentication using Samba's winbind daemon and | |
# ntlm_auth helper. <doc/wiki/Authentication/Mechanisms/Winbind.txt> | |
#auth_use_winbind = no | |
# Path for Samba's ntlm_auth helper binary. | |
#auth_winbind_helper_path = /usr/bin/ntlm_auth | |
# Time to delay before replying to failed authentications. | |
#auth_failure_delay = 2 secs | |
# Require a valid SSL client certificate or the authentication fails. | |
auth_ssl_require_client_cert = yes | |
# Take the username from client's SSL certificate, using | |
# X509_NAME_get_text_by_NID() which returns the subject's DN's | |
# CommonName. | |
auth_ssl_username_from_cert = no | |
# Space separated list of wanted authentication mechanisms: | |
# plain login digest-md5 cram-md5 ntlm rpa apop anonymous gssapi otp skey | |
# gss-spnego | |
# NOTE: See also disable_plaintext_auth setting. | |
auth_mechanisms = plain | |
## | |
## Password and user databases | |
## | |
# | |
# Password database is used to verify user's password (and nothing more). | |
# You can have multiple passdbs and userdbs. This is useful if you want to | |
# allow both system users (/etc/passwd) and virtual users to login without | |
# duplicating the system users into virtual database. | |
# | |
# <doc/wiki/PasswordDatabase.txt> | |
# | |
# User database specifies where mails are located and what user/group IDs | |
# own them. For single-UID configuration use "static" userdb. | |
# | |
# <doc/wiki/UserDatabase.txt> | |
#!include auth-deny.conf.ext | |
#!include auth-master.conf.ext | |
!include auth-system.conf.ext | |
#!include auth-sql.conf.ext | |
#!include auth-ldap.conf.ext | |
#!include auth-passwdfile.conf.ext | |
#!include auth-checkpassword.conf.ext | |
#!include auth-vpopmail.conf.ext | |
#!include auth-static.conf.ext |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
## | |
## SSL settings | |
## | |
# SSL/TLS support: yes, no, required. <doc/wiki/SSL.txt> | |
ssl = yes | |
# PEM encoded X.509 SSL/TLS certificate and private key. They're opened before | |
# dropping root privileges, so keep the key file unreadable by anyone but | |
# root. Included doc/mkcert.sh can be used to easily generate self-signed | |
# certificate, just make sure to update the domains in dovecot-openssl.cnf | |
ssl_cert = </certs/mail/newcert.pem | |
ssl_key = </certs/mail/newkey.nopass.pem | |
# If key file is password protected, give the password here. Alternatively | |
# give it when starting dovecot with -p parameter. Since this file is often | |
# world-readable, you may want to place this setting instead to a different | |
# root owned 0600 file by using ssl_key_password = <path. | |
#ssl_key_password = | |
# PEM encoded trusted certificate authority. Set this only if you intend to use | |
# ssl_verify_client_cert=yes. The file should contain the CA certificate(s) | |
# followed by the matching CRL(s). (e.g. ssl_ca = </etc/ssl/certs/ca.pem) | |
ssl_ca = </certs/cacert.pem | |
# Require that CRL check succeeds for client certificates. | |
ssl_require_crl = no | |
# Directory and/or file for trusted SSL CA certificates. These are used only | |
# when Dovecot needs to act as an SSL client (e.g. imapc backend). The | |
# directory is usually /etc/ssl/certs in Debian-based systems and the file is | |
# /etc/pki/tls/cert.pem in RedHat-based systems. | |
#ssl_client_ca_dir = | |
#ssl_client_ca_file = | |
# Request client to send a certificate. If you also want to require it, set | |
# auth_ssl_require_client_cert=yes in auth section. | |
ssl_verify_client_cert = yes | |
# Which field from certificate to use for username. commonName and | |
# x500UniqueIdentifier are the usual choices. You'll also need to set | |
# auth_ssl_username_from_cert=yes. | |
#ssl_cert_username_field = commonName | |
# DH parameters length to use. | |
#ssl_dh_parameters_length = 1024 | |
# SSL protocols to use | |
#ssl_protocols = !SSLv2 | |
# SSL ciphers to use | |
#ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL | |
# Prefer the server's order of ciphers over client's. | |
#ssl_prefer_server_ciphers = no | |
# SSL crypto device to use, for valid values run "openssl engine" | |
#ssl_crypto_device = |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment