Re: [Dovecot] Dovecot 2.2. proxy_maybe and twice SSL connections

On Tue, 2013-02-19 at 12:39 +0400, Evgeny Basov wrote:

Hello.

1. I have two identically hosts

2. I have set up replication between two hosts

3. I have

   'Y' AS proxy_maybe

   in password_query.

4. password_query returns one of this one hosts

So the user typically goes to the same server, but on failures the query could return another host?

BTW. I'm hoping that at some point in future it would be enough to just set up two A records to DNS and client would connect automatically to the first one that works.

5. I set this parameters in dovecot config:

   disable_plaintext_auth = yes ssl = yes auth_mechanisms = plain login

   for enforce use encrypted connections by client programs.

When the client connects to host imap2 directly, connection is encrypted, it is good.

| client | ---- (1) ----> |imap2 (proxy_maybe='y', host = imap2)|

And when the client connects to another host, I have (1) and (2) connections are encrypted

| client | ---- (1) ----> |imap1 (proxy_maybe='y', host = imap2)| ---- (2) ----> |imap2|

but need only (1).

How do I have desired behavior? Is it possible?

Set login_trusted_networks so both servers trust each others. SSL isn't required then. Also the client's real IP address gets proxied to logs/etc then.