summaryrefslogtreecommitdiffstats
path: root/roles/MX/templates/etc/postfix
diff options
context:
space:
mode:
authorGuilhem Moulin <guilhem@fripost.org>2016-05-18 01:09:31 +0200
committerGuilhem Moulin <guilhem@fripost.org>2016-05-18 01:18:49 +0200
commit5425ed1ffa2953abdfdc819841665260dd38701d (patch)
tree6d22a57268e7a59ae8067f252fee468790098391 /roles/MX/templates/etc/postfix
parent71aefcc229f999f92b25e51b9444b313d95fbc86 (diff)
postfix: disable weak ciphers for the 'encrypt' TLS security level.
That is, on the MSA and in our local infrastructure.
Diffstat (limited to 'roles/MX/templates/etc/postfix')
-rw-r--r--roles/MX/templates/etc/postfix/main.cf.j21
1 files changed, 1 insertions, 0 deletions
diff --git a/roles/MX/templates/etc/postfix/main.cf.j2 b/roles/MX/templates/etc/postfix/main.cf.j2
index a9e7ee4..46af8e9 100644
--- a/roles/MX/templates/etc/postfix/main.cf.j2
+++ b/roles/MX/templates/etc/postfix/main.cf.j2
@@ -84,6 +84,7 @@ smtp_tls_security_level = none
smtp_bind_address = 127.0.0.1
{% else %}
smtp_tls_security_level = encrypt
+smtp_tls_exclude_ciphers = EXPORT, LOW, MEDIUM, aNULL, eNULL, DES, RC4, MD5
smtp_tls_cert_file = /etc/postfix/ssl/{{ ansible_fqdn }}.pem
smtp_tls_key_file = /etc/postfix/ssl/{{ ansible_fqdn }}.key
smtp_tls_session_cache_database = btree:$data_directory/smtp_tls_session_cache