Route all internal SMTP traffic through IPsec.

13 files changed, 22 insertions, 238 deletions

diff --git a/roles/IMAP/tasks/mda.yml b/roles/IMAP/tasks/mda.yml
index 6dec897..ced15cc 100644
--- a/roles/IMAP/tasks/mda.yml
+++ b/roles/IMAP/tasks/mda.yml
@@ -25,21 +25,6 @@
     - recipient_canonical.pcre
     - transport
 
-- name: Copy the Postfix relay clientcerts map
-  template: src=etc/postfix/relay_clientcerts.j2
-            dest=/etc/postfix-{{ postfix_instance[inst].name }}/relay_clientcerts
-            owner=root group=root
-            mode=0644
-  tags:
-    - tls_policy
-
-- name: Compile the Postfix relay clientcerts map
-  postmap: cmd=postmap src=/etc/postfix-{{ postfix_instance[inst].name }}/relay_clientcerts db=cdb
-           owner=root group=root
-           mode=0644
-  tags:
-    - tls_policy
-
 - name: Compile the Postfix transport maps
   # trivial-rewrite(8) is a long-running process, so it's safer to reload
   postmap: cmd=postmap src=/etc/postfix-{{ postfix_instance[inst].name }}/transport db=cdb
diff --git a/roles/IMAP/templates/etc/postfix/main.cf.j2 b/roles/IMAP/templates/etc/postfix/main.cf.j2
index 6c0b024..faf17de 100644
--- a/roles/IMAP/templates/etc/postfix/main.cf.j2
+++ b/roles/IMAP/templates/etc/postfix/main.cf.j2
@@ -17,7 +17,10 @@ myhostname          = mda{{ imapno | default('') }}.$mydomain
 mydomain            = fripost.org
 append_dot_mydomain = no
 
-mynetworks_style = host
+mynetworks = 127.0.0.0/8, [::1]/128
+{%- if groups.all | length > 1 -%}
+           , {{ ipsec_subnet }}
+{% endif %}
 
 queue_directory       = /var/spool/postfix-{{ postfix_instance[inst].name }}
 data_directory        = /var/lib/postfix-{{ postfix_instance[inst].name }}
@@ -56,21 +59,8 @@ recipient_canonical_maps    = pcre:$config_directory/recipient_canonical.pcre
 # Don't rewrite remote headers
 local_header_rewrite_clients =
 
-
-relay_clientcerts               = cdb:$config_directory/relay_clientcerts
-smtpd_tls_security_level        = may
-smtpd_tls_ciphers               = high
-smtpd_tls_protocols             = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
-smtpd_tls_exclude_ciphers       = EXPORT, LOW, MEDIUM, aNULL, eNULL, DES, RC4, MD5
-smtpd_tls_cert_file             = /etc/postfix/ssl/{{ ansible_fqdn }}.pem
-smtpd_tls_key_file              = /etc/postfix/ssl/{{ ansible_fqdn }}.key
-smtpd_tls_dh1024_param_file     = /etc/ssl/dhparams.pem
-smtpd_tls_session_cache_database=
-smtpd_tls_received_header       = yes
-smtpd_tls_ask_ccert             = yes
-smtpd_tls_session_cache_timeout = 3600s
-smtpd_tls_fingerprint_digest    = sha256
-
+smtp_tls_security_level  = none
+smtpd_tls_security_level = none
 
 strict_rfc821_envelopes = yes
 smtpd_delay_reject      = yes
@@ -78,7 +68,6 @@ disable_vrfy_command    = yes
 
 smtpd_client_restrictions =
     permit_mynetworks
-    permit_tls_clientcerts
     # We are the only ones using this proxy, but if things go wrong we
     # want to know why
     defer
@@ -93,7 +82,6 @@ smtpd_sender_restrictions =
 smtpd_relay_restrictions =
     reject_non_fqdn_recipient
     permit_mynetworks
-    permit_tls_clientcerts
     reject
 
 smtpd_data_restrictions =
diff --git a/roles/MSA/templates/etc/postfix/main.cf.j2 b/roles/MSA/templates/etc/postfix/main.cf.j2
index 838135a..3c040b0 100644
--- a/roles/MSA/templates/etc/postfix/main.cf.j2
+++ b/roles/MSA/templates/etc/postfix/main.cf.j2
@@ -36,11 +36,7 @@ message_size_limit  = 67108864
 recipient_delimiter = +
 
 # Forward everything to our internal outgoing proxy
-{% if 'out' in group_names %}
-relayhost     = [127.0.0.1]:{{ postfix_instance.out.port }}
-{% else %}
-relayhost     = [outgoing.fripost.org]:{{ postfix_instance.out.port }}
-{% endif %}
+relayhost     = [{{ postfix_instance.out.addr | ipaddr }}]:{{ postfix_instance.out.port }}
 relay_domains =
 
 
@@ -57,21 +53,7 @@ header_checks  = pcre:$config_directory/anonymize_sender.pcre
 
 
 # TLS
-{% if 'out' in group_names %}
 smtp_tls_security_level         = none
-smtp_bind_address               = 127.0.0.1
-{% else %}
-smtp_tls_security_level         = encrypt
-smtp_tls_ciphers                = high
-smtp_tls_protocols              = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
-smtp_tls_exclude_ciphers        = EXPORT, LOW, MEDIUM, aNULL, eNULL, DES, RC4, MD5
-smtp_tls_cert_file              = /etc/postfix/ssl/{{ ansible_fqdn }}.pem
-smtp_tls_key_file               = /etc/postfix/ssl/{{ ansible_fqdn }}.key
-smtp_tls_session_cache_database = btree:$data_directory/smtp_tls_session_cache
-smtp_tls_policy_maps            = cdb:/etc/postfix/tls_policy
-smtp_tls_fingerprint_digest     = sha256
-{% endif %}
-
 smtpd_tls_security_level        = encrypt
 smtpd_tls_ciphers               = high
 smtpd_tls_protocols             = !SSLv2, !SSLv3
diff --git a/roles/MX/templates/etc/postfix/main.cf.j2 b/roles/MX/templates/etc/postfix/main.cf.j2
index a5caf46..718be00 100644
--- a/roles/MX/templates/etc/postfix/main.cf.j2
+++ b/roles/MX/templates/etc/postfix/main.cf.j2
@@ -36,11 +36,7 @@ message_size_limit  = 67108864
 recipient_delimiter = +
 
 # Forward everything to our internal outgoing proxy
-{% if 'out' in group_names %}
-relayhost     = [127.0.0.1]:{{ postfix_instance.out.port }}
-{% else %}
-relayhost     = [outgoing.fripost.org]:{{ postfix_instance.out.port }}
-{% endif %}
+relayhost     = [{{ postfix_instance.out.addr | ipaddr }}]:{{ postfix_instance.out.port }}
 relay_domains =
 
 
@@ -73,21 +69,7 @@ reserved-alias_destination_recipient_limit = 1
 smtp_data_done_timeout           = 1200s
 
 
-{% if 'out' in group_names %}
 smtp_tls_security_level         = none
-smtp_bind_address               = 127.0.0.1
-{% else %}
-smtp_tls_security_level         = encrypt
-smtp_tls_ciphers                = high
-smtp_tls_protocols              = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
-smtp_tls_exclude_ciphers        = EXPORT, LOW, MEDIUM, aNULL, eNULL, DES, RC4, MD5
-smtp_tls_cert_file              = /etc/postfix/ssl/{{ ansible_fqdn }}.pem
-smtp_tls_key_file               = /etc/postfix/ssl/{{ ansible_fqdn }}.key
-smtp_tls_session_cache_database = btree:$data_directory/smtp_tls_session_cache
-smtp_tls_policy_maps            = cdb:/etc/postfix/tls_policy
-smtp_tls_fingerprint_digest     = sha256
-{% endif %}
-
 smtpd_tls_security_level        = may
 smtpd_tls_ciphers               = medium
 smtpd_tls_protocols             = !SSLv2, !SSLv3
diff --git a/roles/MX/templates/etc/postfix/virtual/transport.j2 b/roles/MX/templates/etc/postfix/virtual/transport.j2
index 49f3696..126cb72 100644
--- a/roles/MX/templates/etc/postfix/virtual/transport.j2
+++ b/roles/MX/templates/etc/postfix/virtual/transport.j2
@@ -17,14 +17,5 @@
 reserved.fripost.org    reserved-alias:
 discard.fripost.org     discard:
 
-{% if 'LDA' in group_names %}
-mda.fripost.org smtpl:[127.0.0.1]:{{ postfix_instance.IMAP.port }}
-{% else %}
-mda.fripost.org smtp:[mda.fripost.org]:{{ postfix_instance.IMAP.port }}
-{% endif %}
-
-{% if 'lists' in group_names %}
-sympa.fripost.org smtpl:[127.0.0.1]:{{ postfix_instance.lists.port }}
-{% else %}
-sympa.fripost.org smtp:[lists.fripost.org]:{{ postfix_instance.lists.port }}
-{% endif %}
+mda.fripost.org   smtp:[{{ postfix_instance.IMAP.addr  | ipaddr }}]:{{ postfix_instance.IMAP.port  }}
+sympa.fripost.org smtp:[{{ postfix_instance.lists.addr | ipaddr }}]:{{ postfix_instance.lists.port }}
diff --git a/roles/common/tasks/mail.yml b/roles/common/tasks/mail.yml
index 092334f..6f690e6 100644
--- a/roles/common/tasks/mail.yml
+++ b/roles/common/tasks/mail.yml
@@ -36,37 +36,6 @@
   notify:
     - Reload Postfix
 
-- name: Create directory /etc/postfix/ssl
-  file: path=/etc/postfix/ssl
-        state=directory
-        owner=root group=root
-        mode=0755
-  tags:
-    - genkey
-
-- name: Generate a private key and a X.509 certificate for Postfix
-  command: genkeypair.sh x509
-                         --pubkey=/etc/postfix/ssl/{{ ansible_fqdn }}.pem
-                         --privkey=/etc/postfix/ssl/{{ ansible_fqdn }}.key
-                         --ou=Postfix --cn={{ ansible_fqdn }}
-                         -t rsa -b 4096 -h sha512
-  register: r3
-  changed_when: r3.rc == 0
-  failed_when: r3.rc > 1
-  notify:
-    - Restart Postfix
-  tags:
-    - genkey
-
-- name: Fetch Postfix's X.509 certificate
-  # Ensure we don't fetch private data
-  become: False
-  fetch_cmd: cmd="openssl x509"
-             stdin=/etc/postfix/ssl/{{ ansible_fqdn }}.pem
-             dest=certs/postfix/{{ ansible_fqdn }}.pem
-  tags:
-    - genkey
-
 - name: Add a 'root' alias
   lineinfile: dest=/etc/aliases create=yes
               regexp="^root{{':'}} "
@@ -81,25 +50,8 @@
 - name: Delete /etc/aliases.db
   file: path=/etc/aliases.db state=absent
 
-- name: Copy the Postfix TLS policy map
-  template: src=etc/postfix/tls_policy.j2
-            dest=/etc/postfix/tls_policy
-            owner=root group=root
-            mode=0644
-  when: "'out' not in group_names or 'MX' in group_names"
-  tags:
-    - tls_policy
-
-- name: Compile the Postfix TLS policy map
-  postmap: cmd=postmap src=/etc/postfix/tls_policy db=cdb
-           owner=root group=root
-           mode=0644
-  when: "'out' not in group_names or 'MX' in group_names"
-  tags:
-    - tls_policy
-
 - name: Start Postfix
   service: name=postfix state=started
-  when: not (r1.changed or r2.changed or r3.changed)
+  when: not (r1.changed or r2.changed)
 
 - meta: flush_handlers
diff --git a/roles/common/templates/etc/iptables/services.j2 b/roles/common/templates/etc/iptables/services.j2
index 247f98a..2def27f 100644
--- a/roles/common/templates/etc/iptables/services.j2
+++ b/roles/common/templates/etc/iptables/services.j2
@@ -26,31 +26,14 @@ out     tcp     636                                     # LDAPS
 {% endif %}
 {% if 'MX' in group_names %}
 in      tcp     25                                      # SMTP
-{% if 'MDA' not in group_names %}
-out     tcp     {{ postfix_instance.IMAP.port }}
-{% endif %}
-{% if 'lists' not in group_names %}
-out     tcp     {{ postfix_instance.lists.port }}
-{% endif %}
 {% endif %}
 {% if 'out' in group_names %}
-{% if groups.all | difference([inventory_hostname]) %}
-in      tcp     {{ postfix_instance.out.port }}
-{% endif %}
 out     tcp     25                                      # SMTP
-{% else %}
-out     tcp     {{ postfix_instance.out.port }}
 {% endif %}
 {% if 'IMAP' in group_names %}
 in      tcp     993                                     # IMAPS
 in      tcp     4190                                    # MANAGESIEVE
 {% endif %}
-{% if 'MDA' in group_names and 'MX' not in group_names %}
-in      tcp     {{ postfix_instance.IMAP.port }}
-{% endif %}
-{% if 'lists' in group_names and 'MX' not in group_names %}
-in      tcp     {{ postfix_instance.lists.port }}
-{% endif %}
 {% if 'MSA' in group_names %}
 in      tcp     587                                     # SMTP-AUTH
 {% endif %}
diff --git a/roles/common/templates/etc/postfix/main.cf.j2 b/roles/common/templates/etc/postfix/main.cf.j2
index 3f36418..8caaa82 100644
--- a/roles/common/templates/etc/postfix/main.cf.j2
+++ b/roles/common/templates/etc/postfix/main.cf.j2
@@ -30,32 +30,11 @@ virtual_alias_maps    = cdb:/etc/aliases
 alias_database        = $virtual_alias_maps
 
 # Forward everything to our internal outgoing proxy
-{% if 'out' in group_names %}
-relayhost     = [127.0.0.1]:{{ postfix_instance.out.port }}
-{% else %}
-relayhost     = [outgoing.fripost.org]:{{ postfix_instance.out.port }}
-{% endif %}
+relayhost     = [{{ postfix_instance.out.addr | ipaddr }}]:{{ postfix_instance.out.port }}
 relay_domains =
 
-{% if 'out' in group_names %}
-smtp_tls_security_level         = none
-smtp_bind_address               = 127.0.0.1
-{% else %}
-smtp_tls_security_level         = encrypt
-smtp_tls_ciphers                = high
-smtp_tls_protocols              = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
-smtp_tls_exclude_ciphers        = EXPORT, LOW, MEDIUM, aNULL, eNULL, DES, RC4, MD5
-smtp_tls_cert_file              = $config_directory/ssl/{{ ansible_fqdn }}.pem
-smtp_tls_key_file               = $config_directory/ssl/{{ ansible_fqdn }}.key
-smtp_tls_session_cache_database = btree:$data_directory/smtp_tls_session_cache
-smtp_tls_policy_maps            = cdb:$config_directory/tls_policy
-smtp_tls_fingerprint_digest     = sha256
-{% endif %}
-smtpd_tls_security_level        = none
-
-# Turn off all TCP/IP listener ports except that dedicated to
-# samhain(8), which sadly cannot use pickup through the sendmail binary.
-master_service_disable = !127.0.0.1:16132.inet inet
+smtp_tls_security_level  = none
+smtpd_tls_security_level = none
 
 {% set multi_instance = False %}
 {%- for g in postfix_instance.keys() | sort -%}
diff --git a/roles/common/templates/etc/postfix/master.cf.j2 b/roles/common/templates/etc/postfix/master.cf.j2
index 9a07dfd..c2ee395 100644
--- a/roles/common/templates/etc/postfix/master.cf.j2
+++ b/roles/common/templates/etc/postfix/master.cf.j2
@@ -23,8 +23,7 @@ cleanup_nochroot unix n -       n       -       0       cleanup
 {{ postfix_instance.MSA.port }} inet n       -       -       -       -       smtpd
   -o tls_high_cipherlist=EECDH+AESGCM:!MEDIUM:!LOW:!EXP:!aNULL:!eNULL
 {% elif inst in ['IMAP', 'out', 'lists'] %}
-{{ postfix_instance[inst].port }} inet n       -       -       -       -       smtpd
-  -o tls_high_cipherlist=HIGH:!aNULL:!eNULL:!3DES:!MD5:@STRENGTH
+[{{ postfix_instance[inst].addr }}]:{{ postfix_instance[inst].port }} inet n       -       -       -       -       smtpd
 {% endif %}
 pickup    fifo  n       -       -       60      1       pickup
 cleanup   unix  n       -       -       -       0       cleanup
diff --git a/roles/lists/tasks/mail.yml b/roles/lists/tasks/mail.yml
index 6678c52..a7c8bd6 100644
--- a/roles/lists/tasks/mail.yml
+++ b/roles/lists/tasks/mail.yml
@@ -22,21 +22,6 @@
         mode=0644
   # no need to reload upon change, as cleanup(8) is short-running
 
-- name: Copy the Postfix relay clientcerts map
-  template: src=etc/postfix/relay_clientcerts.j2
-            dest=/etc/postfix-{{ postfix_instance[inst].name }}/relay_clientcerts
-            owner=root group=root
-            mode=0644
-  tags:
-    - tls_policy
-
-- name: Compile the Postfix relay clientcerts map
-  postmap: cmd=postmap src=/etc/postfix-{{ postfix_instance[inst].name }}/relay_clientcerts db=cdb
-           owner=root group=root
-           mode=0644
-  tags:
-    - tls_policy
-
 - name: Compile the Postfix transport maps
   # trivial-rewrite(8) is a long-running process, so it's safer to reload
   postmap: cmd=postmap src=/etc/postfix-{{ postfix_instance[inst].name }}/transport db=cdb
diff --git a/roles/lists/templates/etc/postfix/main.cf.j2 b/roles/lists/templates/etc/postfix/main.cf.j2
index 397f759..933d540 100644
--- a/roles/lists/templates/etc/postfix/main.cf.j2
+++ b/roles/lists/templates/etc/postfix/main.cf.j2
@@ -17,7 +17,10 @@ myhostname          = lists.$mydomain
 mydomain            = fripost.org
 append_dot_mydomain = no
 
-mynetworks_style = host
+mynetworks = 127.0.0.0/8, [::1]/128
+{%- if groups.all | length > 1 -%}
+           , {{ ipsec_subnet }}
+{% endif %}
 
 queue_directory       = /var/spool/postfix-{{ postfix_instance[inst].name }}
 data_directory        = /var/lib/postfix-{{ postfix_instance[inst].name }}
@@ -48,21 +51,8 @@ sympa_destination_recipient_limit = 1
 # Don't rewrite remote headers
 local_header_rewrite_clients =
 
-
-relay_clientcerts               = cdb:$config_directory/relay_clientcerts
-smtpd_tls_security_level        = may
-smtpd_tls_ciphers               = high
-smtpd_tls_protocols             = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
-smtpd_tls_exclude_ciphers       = EXPORT, LOW, MEDIUM, aNULL, eNULL, DES, RC4, MD5
-smtpd_tls_cert_file             = /etc/postfix/ssl/{{ ansible_fqdn }}.pem
-smtpd_tls_key_file              = /etc/postfix/ssl/{{ ansible_fqdn }}.key
-smtpd_tls_dh1024_param_file     = /etc/ssl/dhparams.pem
-smtpd_tls_session_cache_database=
-smtpd_tls_received_header       = yes
-smtpd_tls_ask_ccert             = yes
-smtpd_tls_session_cache_timeout = 3600s
-smtpd_tls_fingerprint_digest    = sha256
-
+smtp_tls_security_level  = none
+smtpd_tls_security_level = none
 
 strict_rfc821_envelopes = yes
 smtpd_delay_reject      = yes
@@ -70,7 +60,6 @@ disable_vrfy_command    = yes
 
 smtpd_client_restrictions =
     permit_mynetworks
-    permit_tls_clientcerts
     # We are the only ones using this proxy, but if things go wrong we
     # want to know why
     defer
@@ -85,7 +74,6 @@ smtpd_sender_restrictions =
 smtpd_relay_restrictions =
     reject_non_fqdn_recipient
     permit_mynetworks
-    permit_tls_clientcerts
     reject
 
 smtpd_data_restrictions =
diff --git a/roles/out/tasks/main.yml b/roles/out/tasks/main.yml
index 0b68c83..96a557d 100644
--- a/roles/out/tasks/main.yml
+++ b/roles/out/tasks/main.yml
@@ -12,21 +12,6 @@
   notify:
     - Reload Postfix
 
-- name: Copy the Postfix relay clientcerts map
-  template: src=etc/postfix/relay_clientcerts.j2
-            dest=/etc/postfix-{{ postfix_instance[inst].name }}/relay_clientcerts
-            owner=root group=root
-            mode=0644
-  tags:
-    - tls_policy
-
-- name: Compile the Postfix relay clientcerts map
-  postmap: cmd=postmap src=/etc/postfix-{{ postfix_instance[inst].name }}/relay_clientcerts db=cdb
-           owner=root group=root
-           mode=0644
-  tags:
-    - tls_policy
-
 - meta: flush_handlers
 
 - name: Start Postfix
diff --git a/roles/out/templates/etc/postfix/main.cf.j2 b/roles/out/templates/etc/postfix/main.cf.j2
index 98c0185..235b866 100644
--- a/roles/out/templates/etc/postfix/main.cf.j2
+++ b/roles/out/templates/etc/postfix/main.cf.j2
@@ -51,20 +51,7 @@ smtp_tls_protocols              = !SSLv2, !SSLv3
 smtp_tls_note_starttls_offer    = yes
 smtp_tls_session_cache_database = btree:$data_directory/smtp_tls_session_cache
 
-relay_clientcerts               = cdb:$config_directory/relay_clientcerts
-smtpd_tls_security_level        = may
-smtpd_tls_ciphers               = high
-smtpd_tls_protocols             = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
-smtpd_tls_exclude_ciphers       = EXPORT, LOW, MEDIUM, aNULL, eNULL, DES, RC4, MD5
-smtpd_tls_cert_file             = /etc/postfix/ssl/{{ ansible_fqdn }}.pem
-smtpd_tls_key_file              = /etc/postfix/ssl/{{ ansible_fqdn }}.key
-smtpd_tls_dh1024_param_file     = /etc/ssl/dhparams.pem
-smtpd_tls_session_cache_database=
-smtpd_tls_received_header       = yes
-smtpd_tls_ask_ccert             = yes
-smtpd_tls_session_cache_timeout = 3600s
-smtpd_tls_fingerprint_digest    = sha256
-
+smtpd_tls_security_level        = none
 
 strict_rfc821_envelopes = yes
 smtpd_delay_reject      = yes
@@ -77,7 +64,6 @@ unverified_recipient_reject_code = 550
 
 smtpd_client_restrictions =
     permit_mynetworks
-    permit_tls_clientcerts
     # We are the only ones using this proxy, but if things go wrong we
     # want to know why
     defer
@@ -94,7 +80,6 @@ smtpd_relay_restrictions =
     reject_unknown_recipient_domain
     reject_unverified_recipient
     permit_mynetworks
-    permit_tls_clientcerts
     reject
 
 smtpd_data_restrictions =