On 2021-02-16 18:34:32 -0200, Viktor Dukhovni wrote: > > On Feb 16, 2021, at 3:57 PM, Dominic Raferd <[email protected]> wrote: > > > >> In what way does that improve your security over the default, which > >> allows 1.0 and 1.1? > > As stated this is for auth clients i.e. our own people, using SMTPS or > > STARTTLS. There is no problem for us in enforcing it for them, they don't > > use old MTAs anyway and if they did this would force them to upgrade, which > > would be good. This also seems to be the OP's scenario (as his logs imply > > the problem comes from submission port i.e. 587). We use standard postfix > > settings for permitted protocols for outsider emails (port 25) because (as > > frequently advised here) lower security is better than no security at all. > > HTH > > Yes, on the submission port, dropping support for TLS < 1.2 > is much more reasonable, because presumably you can make > informed judgements as to what software the authorised users > have at their disposal.
But since smtpd_tls_mandatory_protocols is not specific to the submission port, I suppose that this should be done with a -o option in the master.cf file. Is that right? After searching a bit, I've seen that on https://forum.chatons.org/t/configuration-postfix-notation-cryptcheck/1684 some user has submission inet n - n - - smtpd -o smtpd_enforce_tls=yes -o smtpd_tls_protocols=!SSLv2,!SSLv3,!TLSv1,!TLSv1.1 Is there any reason that he uses smtpd_tls_protocols and not smtpd_tls_mandatory_protocols? This seems incorrect since smtpd_enforce_tls=yes is mandatory TLS. -- Vincent Lefèvre <[email protected]> - Web: <https://www.vinc17.net/> 100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/> Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)
