install_postfix_advanced.sh, install_postfix_base.sh: adjust tls parameters of 'main.cf'.

2024-09-17 16:28:25 +02:00 · 2024-09-17 16:28:25 +02:00 · 240dfbb54a
commit 240dfbb54a
parent 3eb53b5463
2 changed files with 185 additions and 96 deletions
--- a/install_postfix_advanced.sh
+++ b/install_postfix_advanced.sh
@ -1830,64 +1830,109 @@ smtp_tls_CAfile = $_TLS_CA_FILE
 #smtpd_tls_CApath = /etc/postfix/certs


-# Disable SSLv2 SSLv3 - Postfix SMTP server 
+# TLS protocols accepted by the Postfix SMTP server with opportunistic TLS encryption. 
+# If the list is empty, the server supports all available TLS protocol versions. 
 # 
-# List of TLS protocols that the Postfix SMTP server will exclude or  
-# include with opportunistic TLS encryption.  
-smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1
+# default: see 'postconf -d' output
+#
+smtpd_tls_protocols = >=TLSv1.1
+
+# TLS protocols accepted by the Postfix SMTP server with mandatory TLS encryption.
+#
+smtpd_tls_mandatory_protocols = >=TLSv1.1
+
+
+# TLS protocols that the Postfix SMTP client will use with opportunistic TLS encryption.
+#
+# default: see 'postconf -d' output
+#
+smtp_tls_protocols = >=TLSv1.2
+
+# TLS protocols that the Postfix SMTP client will use with mandatory TLS encryption. 
 # 
-# The SSL/TLS protocols accepted by the Postfix SMTP server  
-# with mandatory TLS encryption. 
-smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1
+# default: see 'postconf -d' output
+#
+smtp_tls_mandatory_protocols = >=TLSv1.2


-# Disable SSLv2 SSLv3 - Postfix SMTP client 
-#  
-# List of TLS protocols that the Postfix SMTP client will exclude or  
-# include with opportunistic TLS encryption.  
-smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
-# 
-# List of SSL/TLS protocols that the Postfix SMTP client will use  
-# with mandatory TLS encryption 
-smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
+# The Postfix SMTP server security grade for ephemeral elliptic-curve 
+# Diffie-Hellman (EECDH) key exchange. As of Postfix 3.6, the value of this 
+# parameter is always ignored, and Postfix behaves as though the auto value 
+# (described below) was chosen. 
+#
+# auto
+#    Use the most preferred curve that is supported by both the client and the server. 
+#    This setting requires Postfix ≥ 3.2 compiled and linked with OpenSSL ≥ 1.0.2. This 
+#    is the default setting under the above conditions (and the only setting used with 
+#    Postfix ≥ 3.6).
+#
+# none
+#    Don't use EECDH. Ciphers based on EECDH key exchange will be disabled. This is the 
+#    default in Postfix versions 2.6 and 2.7.
+#
+# strong
+#    Use EECDH with approximately 128 bits of security at a reasonable computational cost. 
+#    This is the default in Postfix versions 2.8-3.5.
+#
+# ultra
+#    Use EECDH with approximately 192 bits of security at computational cost that is 
+#    approximately twice as high as 128 bit strength ECC.
+#
+smtpd_tls_eecdh_grade = auto


-## - Activate des "Ephemeral Elliptic Curve Diffie-Hellman" (EECDH) key exchange 
-## -    openssl > 1.0
-## -
-smtpd_tls_eecdh_grade = strong
-
-# standard list cryptographic algorithm
+# With SSLv3 and later, use the Postfix SMTP server's cipher preference order instead 
+# of the remote client's cipher preference order. 
+#
+# By default, the OpenSSL server selects the client's most preferred cipher that the 
+# server supports. With SSLv3 and later, the server may choose its own most preferred 
+# cipher that is supported (offered) by the client. 
+#
+# Setting "tls_preempt_cipherlist = yes" enables server cipher preferences.
+#
+# default: no
+#
 tls_preempt_cipherlist = yes

-# Disable ciphers which are less than 256-bit:
+
+# The minimum TLS cipher grade that the Postfix SMTP server will use with mandatory 
+# TLS encryption. The default grade ("medium") is sufficiently strong that any benefit 
+# from globally restricting TLS sessions to a more stringent grade is likely negligible, 
+# especially given the fact that many implementations still do not offer any stronger 
+# ("high" grade) ciphers, while those that do, will always use "high" grade ciphers. 
+# So insisting on "high" grade ciphers is generally counter-productive. Allowing "export" 
+# or "low" ciphers is typically not a good idea, as systems limited to just these are 
+# limited to obsolete browsers. No known SMTP clients fail to support at least one 
+# "medium" or "high" grade cipher. 
 #
-#smtpd_tls_mandatory_ciphers = high
+# default: medium
+#
+#smtpd_tls_mandatory_ciphers = medium
+
+# The minimum TLS cipher grade that the Postfix SMTP server will use with opportunistic 
+# TLS encryption. Cipher types listed in smtpd_tls_exclude_ciphers are excluded from the 
+# base definition of the selected cipher grade. 
+#
+# default: medium
 #
-# opportunistic
 smtpd_tls_ciphers = high


-# Exclude ciphers
+# List of ciphers or cipher types to exclude from the SMTP server cipher list at all
+# TLS security levels.
+#
+# DO NOT exclude ciphers unless it is essential to do so. This is not an OpenSSL cipherlist;
+# it is a simple list separated by whitespace and/or commas. The elements are a single cipher,
+# or one or more "+" separated cipher properties, in which case only ciphers matching all the
+# properties are excluded.
+#
 #smtpd_tls_exclude_ciphers =
-#   RC4
-#   aNULL
-#   SEED-SHA
-#   EXP
-#   MD5
-smtpd_tls_exclude_ciphers =
-   aNULL
-   eNULL
-   EXPORT
-   DES
-   RC4
-   MD5
-   PSK
-   aECDH
-   EDH-DSS-DES-CBC3-SHA
-   EDH-RSA-DES-CDC3-SHA
-   KRB5-DE5
-   CBC3-SHA
+
+# Additional list of ciphers or cipher types to exclude from the Postfix SMTP client cipher
+# list at mandatory TLS security levels. This list works in addition to the exclusions listed
+# with smtp_tls_exclude_ciphers
+#
+#smtp_tls_mandatory_exclude_ciphers =


 smtpd_tls_session_cache_database = btree:\${data_directory}/smtpd_scache
--- a/install_postfix_base.sh
+++ b/install_postfix_base.sh
@ -905,63 +905,107 @@ smtp_tls_CAfile = $_TLS_CA_FILE
 #smtpd_tls_CApath = /etc/postfix/certs


-# Disable SSLv2 SSLv3 - Postfix SMTP server 
-# 
-# List of TLS protocols that the Postfix SMTP server will exclude or  
-# include with opportunistic TLS encryption.  
-smtpd_tls_protocols = !SSLv2, !SSLv3
-# 
-# The SSL/TLS protocols accepted by the Postfix SMTP server  
-# with mandatory TLS encryption. 
-smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
-
-
-# Disable SSLv2 SSLv3 - Postfix SMTP client 
-#  
-# List of TLS protocols that the Postfix SMTP client will exclude or  
-# include with opportunistic TLS encryption.  
-smtp_tls_protocols = !SSLv2, !SSLv3
-# 
-# List of SSL/TLS protocols that the Postfix SMTP client will use  
-# with mandatory TLS encryption 
-smtp_tls_mandatory_protocols = !SSLv2, !SSLv3
-
-
-## - Activate des "Ephemeral Elliptic Curve Diffie-Hellman" (EECDH) key exchange 
-## -    openssl > 1.0
-## -
-smtpd_tls_eecdh_grade = strong
-
-# standard list cryptographic algorithm
-tls_preempt_cipherlist = yes
-
-# Disable ciphers which are less than 256-bit:
+# Disable SSLv2 SSLv3 - Postfix SMTP server
 #
-#smtpd_tls_mandatory_ciphers = high
+# List of TLS protocols that the Postfix SMTP server will exclude or
+# include with opportunistic TLS encryption.
+#smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1
+
+# TLS protocols accepted by the Postfix SMTP server with opportunistic TLS encryption.
 #
-# opportunistic
-smtpd_tls_ciphers = high
+#smtpd_tls_protocols = >=TLSv1
+
+# TLS protocols accepted by the Postfix SMTP server with mandatory TLS encryption.
+#
+#smtpd_tls_mandatory_protocols = >=TLSv1
+
+# TLS protocols that the Postfix SMTP client will use with opportunistic TLS encryption.
+#
+#smtp_tls_protocols = >=TLSv1
+
+# The minimum TLS cipher grade that the Postfix SMTP server will use with mandatory TLS encryption.
+#
+smtp_tls_mandatory_protocols = >=TLSv1.2


-# Exclude ciphers
+# The Postfix SMTP server security grade for ephemeral elliptic-curve
+# Diffie-Hellman (EECDH) key exchange. As of Postfix 3.6, the value of this
+# parameter is always ignored, and Postfix behaves as though the auto value
+# (described below) was chosen.
+#
+# auto
+#    Use the most preferred curve that is supported by both the client and the server.
+#    This setting requires Postfix ≥ 3.2 compiled and linked with OpenSSL ≥ 1.0.2. This
+#    is the default setting under the above conditions (and the only setting used with
+#    Postfix ≥ 3.6).
+#
+# none
+#    Don't use EECDH. Ciphers based on EECDH key exchange will be disabled. This is the
+#    default in Postfix versions 2.6 and 2.7.
+#
+# strong
+#    Use EECDH with approximately 128 bits of security at a reasonable computational cost.
+#    This is the default in Postfix versions 2.8-3.5.
+#
+# ultra
+#    Use EECDH with approximately 192 bits of security at computational cost that is
+#    approximately twice as high as 128 bit strength ECC.
+#
+smtpd_tls_eecdh_grade = auto
+
+
+# With SSLv3 and later, use the Postfix SMTP server's cipher preference order instead
+# of the remote client's cipher preference order.
+#
+# By default, the OpenSSL server selects the client's most preferred cipher that the
+# server supports. With SSLv3 and later, the server may choose its own most preferred
+# cipher that is supported (offered) by the client.
+#
+# Setting "tls_preempt_cipherlist = yes" enables server cipher preferences.
+#
+# default: no
+#
+#tls_preempt_cipherlist = no
+
+
+# The minimum TLS cipher grade that the Postfix SMTP server will use with mandatory
+# TLS encryption. The default grade ("medium") is sufficiently strong that any benefit
+# from globally restricting TLS sessions to a more stringent grade is likely negligible,
+# especially given the fact that many implementations still do not offer any stronger
+# ("high" grade) ciphers, while those that do, will always use "high" grade ciphers.
+# So insisting on "high" grade ciphers is generally counter-productive. Allowing "export"
+# or "low" ciphers is typically not a good idea, as systems limited to just these are
+# limited to obsolete browsers. No known SMTP clients fail to support at least one
+# "medium" or "high" grade cipher.
+#
+# default: medium
+#
+#smtpd_tls_mandatory_ciphers = medium
+
+# The minimum TLS cipher grade that the Postfix SMTP server will use with opportunistic
+# TLS encryption. Cipher types listed in smtpd_tls_exclude_ciphers are excluded from the
+# base definition of the selected cipher grade.
+#
+# default: medium
+#
+#smtpd_tls_ciphers = medium
+
+
+# List of ciphers or cipher types to exclude from the SMTP server cipher list at all
+# TLS security levels.
+#
+# DO NOT exclude ciphers unless it is essential to do so. This is not an OpenSSL cipherlist;
+# it is a simple list separated by whitespace and/or commas. The elements are a single cipher,
+# or one or more "+" separated cipher properties, in which case only ciphers matching all the
+# properties are excluded.
+#
 #smtpd_tls_exclude_ciphers =
-#   RC4
-#   aNULL
-#   SEED-SHA
-#   EXP
-#   MD5
-smtpd_tls_exclude_ciphers =
-   aNULL
-   eNULL
-   EXPORT
-   DES
-   RC4
-   MD5
-   PSK
-   aECDH
-   EDH-DSS-DES-CBC3-SHA
-   EDH-RSA-DES-CDC3-SHA
-   KRB5-DE5, CBC3-SHA
+
+# Additional list of ciphers or cipher types to exclude from the Postfix SMTP client cipher
+# list at mandatory TLS security levels. This list works in addition to the exclusions listed
+# with smtp_tls_exclude_ciphers
+#
+#smtp_tls_mandatory_exclude_ciphers =


 smtpd_tls_session_cache_database = btree:\${data_directory}/smtpd_scache