summaryrefslogtreecommitdiffstats
path: root/roles
Commit message (Collapse)AuthorAgeFiles
* Define new host "calima" serving Nextcloud.Guilhem Moulin2018-12-039
|
* Upgrade wiki baseline to Debian Stretch.Guilhem Moulin2018-12-034
|
* Upgrade MX baseline to Debian Stretch.Guilhem Moulin2018-12-031
|
* Upgrade webmail baseline to Debian Stretch.Guilhem Moulin2018-12-036
|
* Upgrade syntax to Ansible 2.7 (apt module).Guilhem Moulin2018-12-0325
|
* Postfix: replace cdb & btree tables with lmdb ones.Guilhem Moulin2018-12-0314
| | | | Cf. lmdb_table(5).
* IPsec: allow ISAKMP over IPv6.Guilhem Moulin2018-12-032
|
* Upgrade baseline to Debian Stretch.Guilhem Moulin2018-12-0323
|
* Skip samhain installation.Guilhem Moulin2018-12-034
| | | | It's become too verbose (too many false-positive)…
* Harden anti spam on the MX:es.Guilhem Moulin2018-06-095
|
* More logcheck-database tweaks.Guilhem Moulin2018-04-043
|
* lacme: explicitely bind to [::]:80.Guilhem Moulin2018-04-041
|
* Postfix: replace 'fifo' types with 'unix', as it's the new default.Guilhem Moulin2018-04-041
|
* sympa: wibbleGuilhem Moulin2018-04-042
|
* Firewall: Allow DNS queries over TCP.Guilhem Moulin2018-04-041
|
* APT: use deb.debian.org as archive source.Guilhem Moulin2018-04-041
|
* Postscreen: improve DNSBL sites and scores.Guilhem Moulin2018-04-041
|
* Amavis: bind server to INADDR_LOOPBACKGuilhem Moulin2018-04-041
|
* Perform recipient address verification on the MSA itself.Guilhem Moulin2018-04-044
|
* LDAP: Expose part of the database to Nextcloud.Guilhem Moulin2018-04-042
|
* Upgrade syntax to Ansible 2.5.Guilhem Moulin2018-04-043
|
* Upgrade syntax to Ansible 2.4.Guilhem Moulin2017-11-235
|
* More logcheck-database tweaks.Guilhem Moulin2017-09-143
|
* Fix detection of KVM guests.Guilhem Moulin2017-07-293
|
* rkhunter: Disable remote updates to fix CVE-2017-7480.Guilhem Moulin2017-07-291
|
* Use MariaDB as default MySQL flavor.Guilhem Moulin2017-07-295
|
* Don't install debsecan anymore by default.Guilhem Moulin2017-06-262
| | | | https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=789196
* MySQL: Use a single InnoDB file per table.Guilhem Moulin2017-06-151
|
* Webmail: don't allow outgoing TCP/993 connections.Guilhem Moulin2017-06-151
| | | | We're going through IPsec to communicate with the IMAP server.
* postfix-sender-login: strip extension before lookup.Guilhem Moulin2017-06-131
| | | | | | Users can add an extension (following postconf(5)'s $recipient_delimiter) to the local part of any envelope sender address already allowed.
* More logcheck-database tweaks.Guilhem Moulin2017-06-071
|
* postfix-msa: anonymize SASL-authenticated senders using IPv6.Guilhem Moulin2017-06-061
|
* dovecot-auth-proxy: Fix synopsis line.Guilhem Moulin2017-06-051
|
* postscreen: lower zen.spamhaus.org DNSBL score from 3 to 2 on the MX:es.Guilhem Moulin2017-06-051
| | | | | So being listed on that BL doesn't yield a flat reject if the IP isn't also listed to other lists.
* postfix-sender-login: wibbleGuilhem Moulin2017-06-052
|
* dovecot: enable user iteration and add a cronjob for `doveadm purge -A`Guilhem Moulin2017-06-059
|
* move postfix-sender-login.{service,socket} to files/.Guilhem Moulin2017-06-022
|
* postfix: enable XFORWARD command from our internal relays.Guilhem Moulin2017-06-021
|
* postfix: don't rate-limit our IPsec subnet.Guilhem Moulin2017-06-023
|
* postfix-sender-login: terminate the worker after 32*$nProc connections to ↵Guilhem Moulin2017-06-011
| | | | release ressources.
* postfix-sender-login: handle EINTR in read(2) and write(2) calls.Guilhem Moulin2017-06-011
|
* postfix-sender-login: pre-fork 2 servers.Guilhem Moulin2017-06-011
| | | | | On Linux perl's allow multiple children to block in a call to accept(2) so we don't need to place a lock around the call.
* Don't make Roundcube add a 'X-Sender' header with the sender's identity.Guilhem Moulin2017-06-011
|
* Don't let authenticated client use arbitrary sender addresses.Guilhem Moulin2017-06-0110
| | | | | | | | | | | | | | The following policy is now implemented: * users can use their SASL login name as sender address; * alias and/or list owners can use the address as envelope sender; * domain postmasters can use arbitrary sender addresses under their domains; * domain owners can use arbitrary sender addresses under their domains, unless it is also an existing account name; * for known domains without owner or postmasters, other sender addresses are not allowed; and * arbitrary sender addresses under unknown domains are allowed.
* /lib/systemd/system → /etc/systemd/systemGuilhem Moulin2017-05-3117
|
* Also install non-free firmwares on civett.Guilhem Moulin2017-05-302
|
* Install more sympa dependencies.Guilhem Moulin2017-05-291
|
* Use blackhole subdomain for sender addresses of verify probes.Guilhem Moulin2017-05-163
| | | | | | | | | | | These addresses need to be accepted on the MX:es, as recipients sometimes phone back during the SMTP session to check whether the sender exists. Since a time-dependent suffix is added to the local part (cf. http://www.postfix.org/postconf.5.html#address_verify_sender_ttl) it's not enough to drop incoming mails to ‘double-bounce@fripost.org’, and it's impractical to do the same for /^double-bounce.*@fripost\.org$/.
* Change group of executables in /usr/local/{bin,sbin} from root to staff.Guilhem Moulin2017-05-147
|
* webmail: use Zend opcache and configure APCu.Guilhem Moulin2017-05-143
|
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-25 04:14:53 +0000