summaryrefslogtreecommitdiffstats
path: root/roles/common/templates
diff options
context:
space:
mode:
authorGuilhem Moulin <guilhem@fripost.org>2016-05-18 01:09:31 +0200
committerGuilhem Moulin <guilhem@fripost.org>2016-05-18 01:18:49 +0200
commit5425ed1ffa2953abdfdc819841665260dd38701d (patch)
tree6d22a57268e7a59ae8067f252fee468790098391 /roles/common/templates
parent71aefcc229f999f92b25e51b9444b313d95fbc86 (diff)
postfix: disable weak ciphers for the 'encrypt' TLS security level.
That is, on the MSA and in our local infrastructure.
Diffstat (limited to 'roles/common/templates')
-rw-r--r--roles/common/templates/etc/postfix/main.cf.j21
1 files changed, 1 insertions, 0 deletions
diff --git a/roles/common/templates/etc/postfix/main.cf.j2 b/roles/common/templates/etc/postfix/main.cf.j2
index 1b0bc4a..39952c2 100644
--- a/roles/common/templates/etc/postfix/main.cf.j2
+++ b/roles/common/templates/etc/postfix/main.cf.j2
@@ -42,6 +42,7 @@ smtp_tls_security_level = none
smtp_bind_address = 127.0.0.1
{% else %}
smtp_tls_security_level = encrypt
+smtp_tls_exclude_ciphers = EXPORT, LOW, MEDIUM, aNULL, eNULL, DES, RC4, MD5
smtp_tls_cert_file = $config_directory/ssl/{{ ansible_fqdn }}.pem
smtp_tls_key_file = $config_directory/ssl/{{ ansible_fqdn }}.key
smtp_tls_session_cache_database = btree:$data_directory/smtp_tls_session_cache