Hi, thank's everybody, today afternoon i apply the suggest
and i test solution.
I post the actual configuration that i will test:
vmail users is present too, i create ssh-keygen for users vmail and relative home directory and permit ssh with no password with user vmail on two servers. Then i use the configuration below
i leave comment the line below or i need to active it excuse but i don't understand clear cause my terrible english?
#dsync_remote_cmd = ssh -l%{login} %{host} doveadm dsync-server -u%u -l%{lock_timeout} -n%{namespace}
and apply this on two servers
service doveadm { # if you're using a single virtual user, set this to start ssh as vmail # (not root) # user = vmail }
service config { # needed to grant access to /var/run/dovecot/config for service doveadm # unix_listener config { user = vmail } }
Thank's everyboy
Il 15 marzo 2012 22:55, Timo Sirainen tss@iki.fi ha scritto:
Plus the scripts that
- when calling ssh dsync first writes the username to stdout (before dsync starts communicating)
and
- dsync.sh on remote first reads the username from stdin, before execing dsync itself
Because it's not possible to give -u $username parameter in the authorized_keys cmd itself. That's the only changing parameter that is needed.
On 15.3.2012, at 23.49, David Ford wrote:
in ~privilgeduser/.ssh/authorized keys:
from=<list of hosts key is valid for> cmd=dsync.sh pubkey...
On 03/15/2012 05:05 PM, Timo Sirainen wrote:
Then again it's safer to use system user accounts than a single vmail account that has access to everyone's emails. And if you allow ssh login only with public key authentication I don't think there are much security issues. And finally, it would be possible to write a small wrapper that allows the root's public key auth to only execute dsync-user.sh script that can't do anything except sync a specified user's mails.
-- Rispetta l'ambiente: se non ti รจ necessario, non stampare questa mail.
Ing. Matteo Cazzador Email: mcazzador@gmail.com