evgeny/modoboa-installer
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enable forward secrecy by default.

Browse Source 
fix #26
This commit is contained in:
Antoine Nguyen
2016-03-29 14:57:41 +02:00
parent dfbab52ee1
commit 098fb207e0
2 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
modoboa_installer/scripts/files/postfix/main.cf.tpl
View File

@@ -27,11 +27,21 @@ smtpd_use_tls = yes
smtpd_tls_auth_only = no smtpd_tls_auth_only = no
smtpd_tls_key_file = %tls_key_file smtpd_tls_key_file = %tls_key_file
smtpd_tls_cert_file = %tls_cert_file smtpd_tls_cert_file = %tls_cert_file
smtpd_tls_dh1024_param_file = ${config_directory}/dh2048.pem
smtpd_tls_loglevel = 1 smtpd_tls_loglevel = 1
smtpd_tls_session_cache_database = btree:$data_directory/smtpd_tls_session_cache smtpd_tls_session_cache_database = btree:$data_directory/smtpd_tls_session_cache
smtpd_tls_security_level = may smtpd_tls_security_level = may
smtpd_tls_received_header = yes smtpd_tls_received_header = yes
# Disallow SSLv2 and SSLv3, only accept secure ciphers
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
smtpd_tls_mandatory_ciphers = high
smtpd_tls_exclude_ciphers = ECDHE-RSA-RC4-SHA
smtpd_tls_mandatory_exclude_ciphers = ECDHE-RSA-RC4-SHA
# Enable elliptic curve cryptography
smtpd_tls_eecdh_grade = strong
## Virtual transport settings ## Virtual transport settings
# #
%{dovecot_enabled}virtual_transport = lmtp:unix:private/dovecot-lmtp %{dovecot_enabled}virtual_transport = lmtp:unix:private/dovecot-lmtp

4
modoboa_installer/scripts/postfix.py
View File

@@ -62,3 +62,7 @@ class Postfix(base.Installer):
.format(python_path, script_path, self.dbengine, .format(python_path, script_path, self.dbengine,
" ".join(extensions), db_url, self.config_dir)) " ".join(extensions), db_url, self.config_dir))
utils.exec_cmd(cmd) utils.exec_cmd(cmd)
# Generate EDH parameters
cmd = "openssl dhparam -out dh2048.pem 2048"
utils.exec_cmd(cmd, cwd=self.config_dir)