adapt Ilmari's hint on TLS version and ciphers
This commit is contained in:
parent
af7e759c74
commit
264dd9fcd0
1 changed files with 20 additions and 4 deletions
|
|
@ -143,8 +143,12 @@ Please replace `mail.example.org` by the FQDN you chose.
|
||||||
</Aside>
|
</Aside>
|
||||||
|
|
||||||
```sh title="Run this on your server"
|
```sh title="Run this on your server"
|
||||||
postconf smtp_tls_security_level=may
|
postconf smtp_tls_security_level=encrypt
|
||||||
postconf smtpd_tls_security_level=may
|
postconf smtpd_tls_security_level=encrypt
|
||||||
|
postconf smtp_tls_mandatory_protocols=">=TLSv1.2"
|
||||||
|
postconf smtpd_tls_mandatory_protocols=">=TLSv1.2"
|
||||||
|
postconf smtp_tls_mandatory_ciphers=high
|
||||||
|
postconf smtpd_tls_mandatory_ciphers=high
|
||||||
postconf smtpd_tls_cert_file=/etc/letsencrypt/live/mail.example.org/fullchain.pem
|
postconf smtpd_tls_cert_file=/etc/letsencrypt/live/mail.example.org/fullchain.pem
|
||||||
postconf smtpd_tls_key_file=/etc/letsencrypt/live/mail.example.org/privkey.pem
|
postconf smtpd_tls_key_file=/etc/letsencrypt/live/mail.example.org/privkey.pem
|
||||||
```
|
```
|
||||||
|
|
@ -152,12 +156,24 @@ postconf smtpd_tls_key_file=/etc/letsencrypt/live/mail.example.org/privkey.pem
|
||||||
What it means:
|
What it means:
|
||||||
|
|
||||||
- **smtp_tls_security_level**: \
|
- **smtp_tls_security_level**: \
|
||||||
Allow encrypted _outgoing_ SMTP connections but do not enforce it.
|
Enforce encrypted _outgoing_ SMTP connections.
|
||||||
- **smtpd_tls_security_level**: \
|
- **smtpd_tls_security_level**: \
|
||||||
Allow encrypted _incoming_ SMTP connections but do not enforce it.
|
Enforce encrypted _incoming_ SMTP connections.
|
||||||
|
- **smtp_tls_mandatory_protocols** / **smtpd_tls_mandatory_protocols**: \
|
||||||
|
Only allow recommended versions of [TLS](https://en.wikipedia.org/wiki/Transport_Layer_Security). Version 1.2 has been
|
||||||
|
introduced 2008. Version 1.3 is from 2018.
|
||||||
|
- **smtp_tls_mandatory_ciphers** / **smtpd_tls_mandatory_ciphers**: \
|
||||||
|
The list of encryption algorithms that you allow for communnication. Default is _medium_.
|
||||||
- **smtpd_tls_cert_file** and **smtpd_tls_key_file**: \
|
- **smtpd_tls_cert_file** and **smtpd_tls_key_file**: \
|
||||||
Where to find the private key and certificate for encryption.
|
Where to find the private key and certificate for encryption.
|
||||||
|
|
||||||
|
<Aside type="tip" title="Losen the encryption?">
|
||||||
|
In rare cases you may fail to communicate with other computers because they only support older TLS versions (up to
|
||||||
|
1.1) or ciphers that are not considered secure nowadays. In that case you can remove the `smtpd_tls_security_level`,
|
||||||
|
`smtpd_tls_mandatory_protocols` and `smtpd_tls_mandatory_ciphers` settings from your `main.cf` file and fall back to
|
||||||
|
the relaxed security requirements.
|
||||||
|
</Aside>
|
||||||
|
|
||||||
Please note that configuration in `main.cf` applies to all Postfix services. So the above configuration enabled
|
Please note that configuration in `main.cf` applies to all Postfix services. So the above configuration enabled
|
||||||
encryption for both server-to-server and human-to-server (`submission`) services. The `smtpd_sasl_auth_enable` will only
|
encryption for both server-to-server and human-to-server (`submission`) services. The `smtpd_sasl_auth_enable` will only
|
||||||
be set for the `submission` service to enable authentication there.[^1]
|
be set for the `submission` service to enable authentication there.[^1]
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue