From 31ef7a78bc78a6ce2a24bcc6a4a11574bb2d5483 Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Mon, 3 Dec 2018 03:31:01 +0100
Subject: Upgrade webmail baseline to Debian Stretch.
---
.../files/etc/nginx/sites-available/roundcube | 25 +++++++++-------------
.../webmail/files/etc/php5/mods-available/apcu.ini | 5 -----
roles/webmail/files/etc/stunnel/ldap.conf | 6 +++---
3 files changed, 13 insertions(+), 23 deletions(-)
delete mode 100644 roles/webmail/files/etc/php5/mods-available/apcu.ini
(limited to 'roles/webmail/files/etc')
diff --git a/roles/webmail/files/etc/nginx/sites-available/roundcube b/roles/webmail/files/etc/nginx/sites-available/roundcube
index 1f347c5..8e0695d 100644
--- a/roles/webmail/files/etc/nginx/sites-available/roundcube
+++ b/roles/webmail/files/etc/nginx/sites-available/roundcube
@@ -18,8 +18,8 @@ server {
server {
- listen 443 spdy;
- listen [::]:443 spdy;
+ listen 443 ssl http2;
+ listen [::]:443 ssl http2;
server_name mail.fripost.org;
server_name webmail.fripost.org;
@@ -48,15 +48,11 @@ server {
access_log off;
}
- # Deny all attempts to access hidden files, or files under hidden
- # directories.
- location ~ /\. { return 404; }
-
access_log /var/log/nginx/roundcube.access.log;
error_log /var/log/nginx/roundcube.error.log info;
- index index.php;
client_max_body_size 64m;
+ location = / { index index.php; }
location = /index.php {
include snippets/fastcgi-php-ssl.conf;
@@ -67,15 +63,14 @@ server {
session.gc_maxlifetime=21600
session.gc_divisor=500
session.gc_probability=1";
- fastcgi_param PHP_ADMIN_VALUE "open_basedir=$document_root:/usr/share/roundcube:/etc/roundcube:/var/log/roundcube:/usr/share/php:/usr/share/javascript:/usr/share/tinymce:/usr/share/misc/magic
+ fastcgi_param PHP_ADMIN_VALUE "open_basedir=$document_root:/usr/share/roundcube:/etc/roundcube:/var/log/roundcube:/usr/share/php:/usr/share/javascript:/usr/share/tinymce:/usr/share/misc/magic:/dev
upload_tmp_dir=$document_root/temp";
}
- # Security rules
- location ~ ^/(README|INSTALL|LICENSE|CHANGELOG|UPGRADING)$ {
- return 404;
- }
- location ~ ^/(bin|SQL)/ {
- return 404;
- }
+ location /plugins/ {}
+ location /program/js/ {}
+ location /program/resources/ {}
+ location /skins/ {}
+ location / { internal; }
+ location ~ /\. { internal; }
}
diff --git a/roles/webmail/files/etc/php5/mods-available/apcu.ini b/roles/webmail/files/etc/php5/mods-available/apcu.ini
deleted file mode 100644
index 9268c08..0000000
--- a/roles/webmail/files/etc/php5/mods-available/apcu.ini
+++ /dev/null
@@ -1,5 +0,0 @@
-extension=apcu.so
-apc.shm_segments = 1
-apc.shm_size = 128M
-apc.ttl = 3600
-apc.gc_ttl = 300
diff --git a/roles/webmail/files/etc/stunnel/ldap.conf b/roles/webmail/files/etc/stunnel/ldap.conf
index 1149bce..b8c7787 100644
--- a/roles/webmail/files/etc/stunnel/ldap.conf
+++ b/roles/webmail/files/etc/stunnel/ldap.conf
@@ -31,7 +31,7 @@ socket = r:TCP_NODELAY=1
verify = 4
; Disable support for insecure protocols
-options = NO_SSLv2
+;options = NO_SSLv2
options = NO_SSLv3
options = NO_TLSv1
options = NO_TLSv1.1
@@ -39,8 +39,8 @@ options = NO_TLSv1.1
options = NO_COMPRESSION
; These options provide additional security at some performance degradation
-options = SINGLE_ECDH_USE
-options = SINGLE_DH_USE
+;options = SINGLE_ECDH_USE
+;options = SINGLE_DH_USE
; Select permitted SSL ciphers
ciphers = EECDH+AESGCM:!MEDIUM:!LOW:!EXP:!aNULL:!eNULL
--
cgit v1.2.3