Better (more secure) config.

see #75

modoboa_installer/scripts/files/postfix/main.cf.tpl

@@ -34,10 +34,11 @@ smtpd_tls_security_level = may
 smtpd_tls_received_header = yes
 
 # Disallow SSLv2 and SSLv3, only accept secure ciphers
+smtpd_tls_protocols = !SSLv2, !SSLv3
 smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
 smtpd_tls_mandatory_ciphers = high
-smtpd_tls_exclude_ciphers = ECDHE-RSA-RC4-SHA
-smtpd_tls_mandatory_exclude_ciphers = ECDHE-RSA-RC4-SHA
+smtpd_tls_mandatory_exclude_ciphers = aNULL, MD5 , DES, ADH, RC4, PSD, SRP, 3DES, eNULL
+smtpd_tls_exclude_ciphers = aNULL, MD5 , DES, ADH, RC4, PSD, SRP, 3DES, eNULL
 
 # Enable elliptic curve cryptography
 smtpd_tls_eecdh_grade = strong
@@ -45,6 +46,7 @@ smtpd_tls_eecdh_grade = strong
 # Use TLS if this is supported by the remote SMTP server, otherwise use plaintext.
 smtp_tls_security_level = may
 smtp_tls_loglevel = 1
+smtp_tls_exclude_ciphers = EXPORT, LOW
 
 ## Virtual transport settings
 #

modoboa_installer/scripts/files/postfix/master.cf.tpl

@@ -19,6 +19,7 @@ tlsproxy  unix  -       -       -       -       0       tlsproxy
 submission inet n       -       -       -       -       smtpd
   -o syslog_name=postfix/submission
   -o smtpd_tls_security_level=encrypt
+  -o tls_preempt_cipherlist=yes
   -o smtpd_sasl_auth_enable=yes
   -o smtpd_reject_unlisted_recipient=no
   -o smtpd_client_restrictions=permit_sasl_authenticated,reject