From 264dd9fcd064349de9256e4e2a5b0b6ec970b925 Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Tue, 2 Dec 2025 00:58:44 +0100 Subject: [PATCH] adapt Ilmari's hint on TLS version and ciphers --- .../docs/ispmail-trixie/180-relaying.mdx | 24 +++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-) diff --git a/src/content/docs/ispmail-trixie/180-relaying.mdx b/src/content/docs/ispmail-trixie/180-relaying.mdx index 1b16aee..0d0065e 100644 --- a/src/content/docs/ispmail-trixie/180-relaying.mdx +++ b/src/content/docs/ispmail-trixie/180-relaying.mdx @@ -143,8 +143,12 @@ Please replace `mail.example.org` by the FQDN you chose. ```sh title="Run this on your server" -postconf smtp_tls_security_level=may -postconf smtpd_tls_security_level=may +postconf smtp_tls_security_level=encrypt +postconf smtpd_tls_security_level=encrypt +postconf smtp_tls_mandatory_protocols=">=TLSv1.2" +postconf smtpd_tls_mandatory_protocols=">=TLSv1.2" +postconf smtp_tls_mandatory_ciphers=high +postconf smtpd_tls_mandatory_ciphers=high postconf smtpd_tls_cert_file=/etc/letsencrypt/live/mail.example.org/fullchain.pem postconf smtpd_tls_key_file=/etc/letsencrypt/live/mail.example.org/privkey.pem ``` @@ -152,12 +156,24 @@ postconf smtpd_tls_key_file=/etc/letsencrypt/live/mail.example.org/privkey.pem What it means: - **smtp_tls_security_level**: \ - Allow encrypted _outgoing_ SMTP connections but do not enforce it. + Enforce encrypted _outgoing_ SMTP connections. - **smtpd_tls_security_level**: \ - Allow encrypted _incoming_ SMTP connections but do not enforce it. + Enforce encrypted _incoming_ SMTP connections. +- **smtp_tls_mandatory_protocols** / **smtpd_tls_mandatory_protocols**: \ + Only allow recommended versions of [TLS](https://en.wikipedia.org/wiki/Transport_Layer_Security). Version 1.2 has been + introduced 2008. Version 1.3 is from 2018. +- **smtp_tls_mandatory_ciphers** / **smtpd_tls_mandatory_ciphers**: \ + The list of encryption algorithms that you allow for communnication. Default is _medium_. - **smtpd_tls_cert_file** and **smtpd_tls_key_file**: \ Where to find the private key and certificate for encryption. + + Please note that configuration in `main.cf` applies to all Postfix services. So the above configuration enabled encryption for both server-to-server and human-to-server (`submission`) services. The `smtpd_sasl_auth_enable` will only be set for the `submission` service to enable authentication there.[^1]