From b4b988e5f2f6489c4d4c36744aa385be975ce03a Mon Sep 17 00:00:00 2001 From: Franziska Kunsmann Date: Sun, 8 Nov 2020 12:24:37 +0100 Subject: [PATCH] bundles/postfix: disable TLS1.0 and 1.1, disable weak ciphers --- bundles/postfix/files/main.cf | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/bundles/postfix/files/main.cf b/bundles/postfix/files/main.cf index b57afd1..30eff4a 100644 --- a/bundles/postfix/files/main.cf +++ b/bundles/postfix/files/main.cf @@ -25,7 +25,8 @@ smtp_tls_note_starttls_offer = yes smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache smtp_tls_security_level = dane smtp_dns_support_level = dnssec -smtp_tls_protocols = !SSLv2, !SSLv3 +smtp_tls_mandatory_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1 +smtp_tls_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1 smtp_tls_ciphers = high smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt @@ -43,8 +44,9 @@ smtpd_helo_restrictions = permit_mynetworks reject_invalid_helo_hostname smtpd_data_restrictions = reject_unauth_pipelining smtpd_tls_security_level = may smtpd_tls_mandatory_ciphers = high -smtpd_tls_mandatory_exclude_ciphers = aNULL, MD5 -smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 +smtpd_tls_exclude_ciphers = aNULL,LOW,EXP,MEDIUM,ADH,AECDH,MD5,DSS,ECDSA,CAMELLIA128,3DES,CAMELLIA256,RSA+AES,eNULL +smtpd_tls_mandatory_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1 +smtpd_tls_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1 smtpd_tls_ciphers = high smtpd_tls_auth_only=yes