Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SMTP and DNS edits #69

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

SMTP and DNS edits #69

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions src/acknowledgements.tex
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ \section*{Acknowledgements}
Grigg, Ian \\
Horenbeck, Maarten \\
Huebl, Axel \\
Koetter, Patrick Ben \\
Kovacic, Daniel \\
Lenzhofer, Stefan \\
Lorünser, Thomas \\
Expand All @@ -28,6 +29,7 @@ \section*{Acknowledgements}
Roeckx, Kurt \\
Rublik, Martin \\
Seidl, Eva (PDF layout) \\
Strotmann, Carsten \\
Wagner, Sebastian («sebix») \\
Zangerl, Alexander \\
}\end{multicols}
Expand Down
2 changes: 2 additions & 0 deletions src/common/names.tex
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,8 @@
\newacronym{EDH}{edh}{Ephemeral Diffie-Hellman}
\newacronym{EECDH}{eecdh\alsoidx{Diffie--Hellman}\alsoidx{elliptic curve}}{%
elliptic curve ephemeral Diffie--Hellman}
\newacronym{MSA}{msa}{%
A message submission host from which messages sent by MUAs originates and will be transported towards its final destination}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok

\newacronym{PFS}{pfs}{%
perfect forward secrecy}
\newacronym{RSA}{rsa}{Rivest Shamir Adleman}
Expand Down
6 changes: 6 additions & 0 deletions src/configuration/DNS/resolv.conf/resolv.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
search example.com
# Local resolver
nameserver 127.0.1.1
# Trustworthy fallbacks
nameserver 192.0.2.1
nameserver 203.0.113.254
56 changes: 43 additions & 13 deletions src/configuration/MailServers/Postfix/main.cf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,25 +17,55 @@ append_dot_mydomain = no

readme_directory = no

readme_directory = no
## General TLS options
tls_ssl_options = NO_COMPRESSION
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This parameter is not available in all versions, see http://www.postfix.org/postconf.5.html#tls_ssl_options


# TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
# use 0 for Postfix >= 2.9, and 1 for earlier versions
## Server-side TLS
# Server certificate
smtpd_tls_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem
# Server key
smtpd_tls_key_file = /etc/ssl/private/ssl-cert-snakeoil.key
# TLS Logging
# Use 0 for Postfix >= 2.9, and 1 for earlier versions
smtpd_tls_loglevel = 0
# enable opportunistic TLS support in the SMTP server and client
# Enable opportunistic TLS support in the SMTP server
smtpd_tls_security_level = may
# Optional: If you have SMTP AUTH enabled, offer it after STARTTLS only
# in order to protect SASL's unencrypted PLAIN and LOGIN mechanisms
smtpd_tls_auth_only = yes

## Submission server TLS
# Disable unwanted protocols
mua_tls_mandatory_protocols = !SSLv2, !SSLv3
# Demand high ciphers
mua_tls_mandatory_ciphers=high
# Limit the cipher list
mua_high_cipherlist=EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should be a LaTeX macro as with the other config files.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What exactly should be a macro?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The cipherlist

Copy link
Member

@sebix sebix Dec 8, 2015 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The cipherlist-makro can't be used here anymore. The cipherstring ais slightly changed.

# TODO
mua_tls_eecdh_grade=ultra

## Client-side TLS
# Enable opportunistic TLS support in the SMTP client
smtp_tls_security_level = may
# Client certificate
smtp_tls_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem
# Client key
smtp_tls_key_file = /etc/ssl/private/ssl-cert-snakeoil.key
# Log when remote server offers STARTTLS (useful to identify partners for
# policies)
smtp_tls_note_starttls_offer = yes
# TODO
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What's todo here?

smtp_tls_loglevel = 1
# if you have authentication enabled, only offer it after STARTTLS
smtpd_tls_auth_only = yes
tls_ssl_options = NO_COMPRESSION

smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
smtpd_tls_mandatory_ciphers=high
tls_high_cipherlist=EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA
smtpd_tls_eecdh_grade=ultra

## Client-side DANE TLS
# Enable opportunistic and identified TLS support in the SMTP client
smtp_tls_security_level = dane
# Require DNSSEC DNS lookups
smtp_dns_support_level = dnssec
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not available in all versions: http://www.postfix.org/postconf.5.html#smtp_dns_support_level





smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
Expand Down
12 changes: 8 additions & 4 deletions src/configuration/MailServers/Postfix/master.cf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,8 +10,12 @@
# ==========================================================================
smtp inet n - - - - smtpd
submission inet n - - - - smtpd
-o smtpd_tls_security_level=encrypt
-o tls_preempt_cipherlist=yes
-o smtpd_tls_security_level=encrypt
-o tls_preempt_cipherlist=yes
-o smtpd_tls_mandatory_protocols=$mua_tls_mandatory_protocols
-o smtpd_tls_mandatory_ciphers=$mua_tls_mandatory_ciphers
-o tls_high_cipher_list=$mua_high_cipherlist
-o smtpd_tls_eecdh_grade=$mua_tls_eecdh_grade
# -o smtpd_sasl_auth_enable=yes
# -o smtpd_client_restrictions=permit_sasl_authenticated,reject
# -o milter_macro_daemon_name=ORIGINATING
Expand All @@ -37,7 +41,7 @@ proxywrite unix - - n - 1 proxymap
smtp unix - - - - - smtp
# When relaying mail as backup MX, disable fallback_relay to avoid MX loops
relay unix - - - - - smtp
-o smtp_fallback_relay=
-o smtp_fallback_relay=
# -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
showq unix n - - - - showq
error unix - - - - - error
Expand Down Expand Up @@ -102,7 +106,7 @@ ifmail unix - n n - - pipe
flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp unix - n n - - pipe
flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
scalemail-backend unix - n n - 2 pipe
scalemail-backend unix - n n - 2 pipe
flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
mailman unix - n n - - pipe
flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
Expand Down
3 changes: 3 additions & 0 deletions src/practical_settings.tex
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,6 @@
\section{DNS}
\label{sec:dns}
\input{practical_settings/dns}
\section{Webservers}
\label{sec:webservers}
\input{practical_settings/webserver}
Expand Down
Loading