summaryrefslogtreecommitdiffstats
path: root/roles/webmail/templates/etc
diff options
context:
space:
mode:
authorGuilhem Moulin <guilhem@fripost.org>2020-05-18 15:51:54 +0200
committerGuilhem Moulin <guilhem@fripost.org>2020-05-18 15:51:54 +0200
commit42df93debccbcb1a18cd377b6de0b5b20527312f (patch)
treeacb669efd9b6f9d0d80e9563d2940192b3753925 /roles/webmail/templates/etc
parentf3e90041c28a74c94d06f419889691f533422c2f (diff)
stunnel4: Harden and socket-activate.
Diffstat (limited to 'roles/webmail/templates/etc')
-rw-r--r--roles/webmail/templates/etc/stunnel/ldap.conf.j241
1 files changed, 41 insertions, 0 deletions
diff --git a/roles/webmail/templates/etc/stunnel/ldap.conf.j2 b/roles/webmail/templates/etc/stunnel/ldap.conf.j2
new file mode 100644
index 0000000..6fce2bc
--- /dev/null
+++ b/roles/webmail/templates/etc/stunnel/ldap.conf.j2
@@ -0,0 +1,41 @@
+; **************************************************************************
+; * Global options *
+; **************************************************************************
+
+pid =
+foreground = yes
+
+; Only log messages at severity warning (4) and higher
+debug = 4
+
+; **************************************************************************
+; * Service defaults may also be specified in individual service sections *
+; **************************************************************************
+
+client = yes
+
+; Some performance tunings
+socket = r:TCP_NODELAY=1
+
+; Prevent MITM attacks
+verifyPeer = yes
+
+; Disable support for insecure protocols
+sslVersionMin = TLSv1.2
+options = NO_COMPRESSION
+
+; Select permitted SSL ciphers
+ciphers = EECDH+AESGCM:EECDH+CHACHA20!MEDIUM!LOW!EXP!aNULL!eNULL
+
+; **************************************************************************
+; * Service definitions (remove all services for inetd mode) *
+; **************************************************************************
+
+[ldaps]
+; dummy address (socket-activated)
+accept = 127.0.0.1:0
+connect = {{ ipsec[ hostvars[groups.LDAP_provider[0]].inventory_hostname_short ] }}:636
+checkHost = ldap.fripost.org
+CAfile = /etc/stunnel/certs/ldap.pem
+
+; vim:ft=dosini