On Tue, 2013-02-19 at 12:39 +0400, Evgeny Basov wrote: > Hello. > > 1. I have two identically hosts > 2. I have set up replication between two hosts > 3. I have > > 'Y' AS proxy_maybe > > in password_query. > 4. password_query returns one of this one hosts
So the user typically goes to the same server, but on failures the query could return another host? BTW. I'm hoping that at some point in future it would be enough to just set up two A records to DNS and client would connect automatically to the first one that works. > 5. I set this parameters in dovecot config: > > disable_plaintext_auth = yes > ssl = yes > auth_mechanisms = plain login > > for enforce use encrypted connections by client programs. > > > When the client connects to host imap2 directly, connection is > encrypted, it is good. > > | client | ---- (1) ----> |imap2 (proxy_maybe='y', host = imap2)| > > And when the client connects to another host, I have (1) and (2) > connections are encrypted > > | client | ---- (1) ----> |imap1 (proxy_maybe='y', host = imap2)| ---- > (2) ----> |imap2| > > but need only (1). > > How do I have desired behavior? Is it possible? Set login_trusted_networks so both servers trust each others. SSL isn't required then. Also the client's real IP address gets proxied to logs/etc then.
