diff options
Diffstat (limited to 'roles/webmail/files/etc')
| -rw-r--r-- | roles/webmail/files/etc/nginx/sites-available/roundcube | 25 | ||||
| -rw-r--r-- | roles/webmail/files/etc/php5/mods-available/apcu.ini | 5 | ||||
| -rw-r--r-- | roles/webmail/files/etc/stunnel/ldap.conf | 6 |
3 files changed, 13 insertions, 23 deletions
diff --git a/roles/webmail/files/etc/nginx/sites-available/roundcube b/roles/webmail/files/etc/nginx/sites-available/roundcube index 1f347c5..8e0695d 100644 --- a/roles/webmail/files/etc/nginx/sites-available/roundcube +++ b/roles/webmail/files/etc/nginx/sites-available/roundcube @@ -18,8 +18,8 @@ server { server { - listen 443 spdy; - listen [::]:443 spdy; + listen 443 ssl http2; + listen [::]:443 ssl http2; server_name mail.fripost.org; server_name webmail.fripost.org; @@ -48,15 +48,11 @@ server { access_log off; } - # Deny all attempts to access hidden files, or files under hidden - # directories. - location ~ /\. { return 404; } - access_log /var/log/nginx/roundcube.access.log; error_log /var/log/nginx/roundcube.error.log info; - index index.php; client_max_body_size 64m; + location = / { index index.php; } location = /index.php { include snippets/fastcgi-php-ssl.conf; @@ -67,15 +63,14 @@ server { session.gc_maxlifetime=21600 session.gc_divisor=500 session.gc_probability=1"; - fastcgi_param PHP_ADMIN_VALUE "open_basedir=$document_root:/usr/share/roundcube:/etc/roundcube:/var/log/roundcube:/usr/share/php:/usr/share/javascript:/usr/share/tinymce:/usr/share/misc/magic + fastcgi_param PHP_ADMIN_VALUE "open_basedir=$document_root:/usr/share/roundcube:/etc/roundcube:/var/log/roundcube:/usr/share/php:/usr/share/javascript:/usr/share/tinymce:/usr/share/misc/magic:/dev upload_tmp_dir=$document_root/temp"; } - # Security rules - location ~ ^/(README|INSTALL|LICENSE|CHANGELOG|UPGRADING)$ { - return 404; - } - location ~ ^/(bin|SQL)/ { - return 404; - } + location /plugins/ {} + location /program/js/ {} + location /program/resources/ {} + location /skins/ {} + location / { internal; } + location ~ /\. { internal; } } diff --git a/roles/webmail/files/etc/php5/mods-available/apcu.ini b/roles/webmail/files/etc/php5/mods-available/apcu.ini deleted file mode 100644 index 9268c08..0000000 --- a/roles/webmail/files/etc/php5/mods-available/apcu.ini +++ /dev/null @@ -1,5 +0,0 @@ -extension=apcu.so -apc.shm_segments = 1 -apc.shm_size = 128M -apc.ttl = 3600 -apc.gc_ttl = 300 diff --git a/roles/webmail/files/etc/stunnel/ldap.conf b/roles/webmail/files/etc/stunnel/ldap.conf index 1149bce..b8c7787 100644 --- a/roles/webmail/files/etc/stunnel/ldap.conf +++ b/roles/webmail/files/etc/stunnel/ldap.conf @@ -31,7 +31,7 @@ socket = r:TCP_NODELAY=1 verify = 4 ; Disable support for insecure protocols -options = NO_SSLv2 +;options = NO_SSLv2 options = NO_SSLv3 options = NO_TLSv1 options = NO_TLSv1.1 @@ -39,8 +39,8 @@ options = NO_TLSv1.1 options = NO_COMPRESSION ; These options provide additional security at some performance degradation -options = SINGLE_ECDH_USE -options = SINGLE_DH_USE +;options = SINGLE_ECDH_USE +;options = SINGLE_DH_USE ; Select permitted SSL ciphers ciphers = EECDH+AESGCM:!MEDIUM:!LOW:!EXP:!aNULL:!eNULL |