summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--roles/IMAP-proxy/files/etc/stunnel/imap.conf (renamed from roles/IMAP-proxy/files/etc/stunnel/stunnel.conf)19
-rw-r--r--roles/IMAP-proxy/tasks/main.yml4
2 files changed, 7 insertions, 16 deletions
diff --git a/roles/IMAP-proxy/files/etc/stunnel/stunnel.conf b/roles/IMAP-proxy/files/etc/stunnel/imap.conf
index f1c2a16..af29023 100644
--- a/roles/IMAP-proxy/files/etc/stunnel/stunnel.conf
+++ b/roles/IMAP-proxy/files/etc/stunnel/imap.conf
@@ -1,26 +1,16 @@
-; Sample stunnel configuration file for Unix by Michal Trojnara 2002-2012
-; Some options used here may be inadequate for your particular configuration
-; This sample file does *not* represent stunnel.conf defaults
-; Please consult the manual for detailed description of available options
-
; **************************************************************************
; * Global options *
; **************************************************************************
-; A copy of some devices and system files is needed within the chroot jail
-; Chroot conflicts with configuration file reload and many other features
-; Remember also to update the logrotate configuration.
-;chroot = /var/lib/stunnel4/
-; Chroot jail can be escaped if setuid option is not used
+; setuid()/setgid() to the specified user/group in daemon mode
setuid = stunnel4
setgid = stunnel4
; PID is created inside the chroot jail
-pid = /var/run/stunnel4/stunnel4.pid
+pid = /var/run/stunnel4/imap.pid
-; Debugging stuff (may useful for troubleshooting)
+; Only log messages at severity warning (4) and higher
debug = 4
-;output = /var/log/stunnel4/stunnel.log
; **************************************************************************
; * Service defaults may also be specified in individual service sections *
@@ -36,7 +26,7 @@ socket = a:SO_BINDTODEVICE=lo
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
-; Authentication stuff needs to be configured to prevent MITM attacks
+; Prevent MITM attacks
verify = 4
; Disable support for insecure protocols
@@ -49,6 +39,7 @@ options = NO_TLSv1.1
options = SINGLE_ECDH_USE
options = SINGLE_DH_USE
+; Select permitted SSL ciphers
ciphers = EECDH+AES:EDH+AES:!MEDIUM:!LOW:!EXP:!aNULL:!eNULL:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1
; **************************************************************************
diff --git a/roles/IMAP-proxy/tasks/main.yml b/roles/IMAP-proxy/tasks/main.yml
index 7773cb3..a75a612 100644
--- a/roles/IMAP-proxy/tasks/main.yml
+++ b/roles/IMAP-proxy/tasks/main.yml
@@ -83,8 +83,8 @@
- Restart stunnel
- name: Configure stunnel
- copy: src=etc/stunnel/stunnel.conf
- dest=/etc/stunnel/stunnel.conf
+ copy: src=etc/stunnel/imap.conf
+ dest=/etc/stunnel/imap.conf
owner=root group=root
mode=0644
register: r3