diff options
| author | Guilhem Moulin <guilhem@fripost.org> | 2020-05-18 15:51:54 +0200 |
|---|---|---|
| committer | Guilhem Moulin <guilhem@fripost.org> | 2020-05-18 15:51:54 +0200 |
| commit | 42df93debccbcb1a18cd377b6de0b5b20527312f (patch) | |
| tree | acb669efd9b6f9d0d80e9563d2940192b3753925 /roles/webmail/templates/etc | |
| parent | f3e90041c28a74c94d06f419889691f533422c2f (diff) | |
stunnel4: Harden and socket-activate.
Diffstat (limited to 'roles/webmail/templates/etc')
| -rw-r--r-- | roles/webmail/templates/etc/stunnel/ldap.conf.j2 | 41 |
1 files changed, 41 insertions, 0 deletions
diff --git a/roles/webmail/templates/etc/stunnel/ldap.conf.j2 b/roles/webmail/templates/etc/stunnel/ldap.conf.j2 new file mode 100644 index 0000000..6fce2bc --- /dev/null +++ b/roles/webmail/templates/etc/stunnel/ldap.conf.j2 @@ -0,0 +1,41 @@ +; ************************************************************************** +; * Global options * +; ************************************************************************** + +pid = +foreground = yes + +; Only log messages at severity warning (4) and higher +debug = 4 + +; ************************************************************************** +; * Service defaults may also be specified in individual service sections * +; ************************************************************************** + +client = yes + +; Some performance tunings +socket = r:TCP_NODELAY=1 + +; Prevent MITM attacks +verifyPeer = yes + +; Disable support for insecure protocols +sslVersionMin = TLSv1.2 +options = NO_COMPRESSION + +; Select permitted SSL ciphers +ciphers = EECDH+AESGCM:EECDH+CHACHA20!MEDIUM!LOW!EXP!aNULL!eNULL + +; ************************************************************************** +; * Service definitions (remove all services for inetd mode) * +; ************************************************************************** + +[ldaps] +; dummy address (socket-activated) +accept = 127.0.0.1:0 +connect = {{ ipsec[ hostvars[groups.LDAP_provider[0]].inventory_hostname_short ] }}:636 +checkHost = ldap.fripost.org +CAfile = /etc/stunnel/certs/ldap.pem + +; vim:ft=dosini |