From b16aa5bd33e5ca4bdc8a0734e8db1f42611aa75b Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Tue, 19 Mar 2019 02:27:42 +0100
Subject: MSA: Open 465/TCP for Email Submission over TLS.

See RFC 8314 sec. 3.3 "Cleartext Considered Obsolete".
---
 roles/common/templates/etc/fail2ban/jail.local.j2 | 2 +-
 roles/common/templates/etc/iptables/services.j2   | 1 +
 roles/common/templates/etc/postfix/master.cf.j2   | 3 +++
 3 files changed, 5 insertions(+), 1 deletion(-)

(limited to 'roles/common/templates/etc')

diff --git a/roles/common/templates/etc/fail2ban/jail.local.j2 b/roles/common/templates/etc/fail2ban/jail.local.j2
index c493958..618fbd7 100644
--- a/roles/common/templates/etc/fail2ban/jail.local.j2
+++ b/roles/common/templates/etc/fail2ban/jail.local.j2
@@ -75,7 +75,7 @@ logpath = /var/log/mail.log
 [sasl]
 
 enabled  = true
-port     = submission
+port     = submission,submissions
 filter   = postfix-sasl
 logpath  = /var/log/mail.warn
 {% endif %}
diff --git a/roles/common/templates/etc/iptables/services.j2 b/roles/common/templates/etc/iptables/services.j2
index 93342cb..6dd5aae 100644
--- a/roles/common/templates/etc/iptables/services.j2
+++ b/roles/common/templates/etc/iptables/services.j2
@@ -36,6 +36,7 @@ in      tcp     4190                                    # MANAGESIEVE
 out     tcp     2703                                    # Razor2
 {% endif %}
 {% if 'MSA' in group_names %}
+in      tcp     465                                     # SMTP-AUTH
 in      tcp     587                                     # SMTP-AUTH
 {% endif %}
 {% if 'webmail' in group_names or 'lists' in group_names or 'wiki' in group_names or 'nextcloud' in group_names %}
diff --git a/roles/common/templates/etc/postfix/master.cf.j2 b/roles/common/templates/etc/postfix/master.cf.j2
index d9cb5d3..c481ad4 100644
--- a/roles/common/templates/etc/postfix/master.cf.j2
+++ b/roles/common/templates/etc/postfix/master.cf.j2
@@ -20,6 +20,9 @@ dnsblog   unix  -       -       y       -       0       dnsblog
 {% elif inst == 'MSA' %}
 submission inet n       -       y       -       -       smtpd
   -o tls_high_cipherlist=EECDH+AESGCM:!MEDIUM:!LOW:!EXP:!aNULL:!eNULL
+submissions inet n      -       y       -       -       smtpd
+  -o smtpd_tls_wrappermode=yes
+  -o tls_high_cipherlist=EECDH+AESGCM:!MEDIUM:!LOW:!EXP:!aNULL:!eNULL
 {% if groups.webmail | difference([inventory_hostname]) | length > 0 %}
 [{{ postfix_instance.MSA.addr }}]:{{ postfix_instance.MSA.port }} inet n       -       y       -       -       smtpd
   -o broken_sasl_auth_clients=no
-- 
cgit v1.2.3