On Tue, 2013-02-19 at 12:39 +0400, Evgeny Basov wrote:

Hello.

1. I have two identically hosts

2. I have set up replication between two hosts

3. I have

   'Y' AS proxy_maybe

   in password_query.

4. password_query returns one of this one hosts

So the user typically goes to the same server, but on failures the query could return another host?

BTW. I'm hoping that at some point in future it would be enough to just set up two A records to DNS and client would connect automatically to the first one that works.

5. I set this parameters in dovecot config:

   disable_plaintext_auth = yes ssl = yes auth_mechanisms = plain login

   for enforce use encrypted connections by client programs.

When the client connects to host imap2 directly, connection is encrypted, it is good.

| client | ---- (1) ----> |imap2 (proxy_maybe='y', host = imap2)|

And when the client connects to another host, I have (1) and (2) connections are encrypted

| client | ---- (1) ----> |imap1 (proxy_maybe='y', host = imap2)| ---- (2) ----> |imap2|

but need only (1).

How do I have desired behavior? Is it possible?

Set login_trusted_networks so both servers trust each others. SSL isn't required then. Also the client's real IP address gets proxied to logs/etc then.

At 12PM +0400 on 19/02/13 you (Evgeny Basov) wrote:

5. I set this parameters in dovecot config:

   disable_plaintext_auth = yes ssl = yes auth_mechanisms = plain login

<snip>

And when the client connects to another host, I have (1) and (2) connections are encrypted

| client | ---- (1) ----> |imap1 (proxy_maybe='y', host = imap2)| ---- (2) ----> |imap2|

but need only (1).

That's not a good idea. SSL is not very much overhead, and trusting your internal networks to the point of having plaintext passwords going over the wire is not very safe.

Ben