OK, Du hast ja schon ein paar sinnvolle Anpassungen vorgenommen, die sind aber noch nicht ganz ausreichend.
Erstmal Deine aktuellen SSL/TLS bezogenen Optionen als Referenz:
Code: Select all
smtp_tls_loglevel = 1
smtp_tls_mandatory_protocols = !SSLv2 !SSLv3
smtp_tls_protocols = !SSLv2, !SSLv3
smtp_tls_security_level = may
smtp_use_tls = no
smtpd_tls_CAfile = /etc/postfix/cacert.pem
smtpd_tls_cert_file = /etc/postfix/postfix_default.pem
smtpd_tls_dh1024_param_file = /etc/postfix/dh1024.pem
smtpd_tls_eecdh_grade = strong | ultra
smtpd_tls_exclude_ciphers = CAMELLIA, RC4, 3DES, IDEA, SEED, PSK, SRP, DSS, eNULL, aNULL
smtpd_tls_key_file = $smtpd_tls_cert_file
smtpd_tls_loglevel = 1
smtpd_tls_mandatory_ciphers = high
smtpd_tls_mandatory_exclude_ciphers = CAMELLIA, RC4, 3DES, IDEA, SEED, PSK, SRP, DSS, eNULL, aNULL
smtpd_tls_mandatory_protocols = !SSLv2 !SSLv3
smtpd_tls_protocols = !SSLv2 !SSLv3
smtpd_tls_received_header = yes
smtpd_tls_security_level = may
smtpd_use_tls = yes
tls_eecdh_strong_curve = prime256v1
tls_eecdh_ultra_curve = secp384r1
tls_high_cipherlist = EECDH+AESGCM EECDH+SHA384 EECDH+SHA256 EECDH+SHA EDH+AESGCM EDH+SHA384 EDH+SHA256 EDH+SHA SHA384 SHA256
tls_preempt_cipherlist = yes
Dies wäre mein Vorschlag als Ersatz für Deine obigen SSL/TLS Optionen:
Code: Select all
smtp_tls_ciphers = medium
smtp_tls_exclude_ciphers = CAMELLIA, SEED, IDEA, RC2, RC4, aDSS, kECDHe, kECDHr, kDHd, kDHr, eNULL, aNULL, MEDIUM, LOW, EXPORT
smtp_tls_fingerprint_digest = sha1
smtp_tls_loglevel = 1
smtp_tls_mandatory_ciphers = medium
smtp_tls_mandatory_exclude_ciphers = CAMELLIA, SEED, IDEA, RC2, RC4, aDSS, kECDHe, kECDHr, kDHd, kDHr, eNULL, aNULL, MEDIUM, LOW, EXPORT
smtp_tls_mandatory_protocols = !SSLv2, !SSLv3
smtp_tls_note_starttls_offer = yes
smtp_tls_protocols = !SSLv2, !SSLv3
smtp_tls_security_level = may
smtp_use_tls = no
smtpd_tls_auth_only = yes
smtpd_tls_CAfile = /etc/postfix/cacert.pem
smtpd_tls_cert_file = /etc/postfix/postfix_default.pem
smtpd_tls_ciphers = medium
smtpd_tls_dh1024_param_file = /etc/postfix/dh1024.pem
smtpd_tls_eecdh_grade = strong | ultra
smtpd_tls_exclude_ciphers = CAMELLIA, SEED, IDEA, RC2, RC4, aDSS, kECDHe, kECDHr, kDHd, kDHr, eNULL, aNULL, MEDIUM, LOW, EXPORT
smtpd_tls_fingerprint_digest = sha1
smtpd_tls_key_file = $smtpd_tls_cert_file
smtpd_tls_loglevel = 1
smtpd_tls_mandatory_ciphers = medium
smtpd_tls_mandatory_exclude_ciphers = CAMELLIA, SEED, IDEA, RC2, RC4, aDSS, kECDHe, kECDHr, kDHd, kDHr, eNULL, aNULL, MEDIUM, LOW, EXPORT
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
smtpd_tls_protocols = !SSLv2, !SSLv3
smtpd_tls_received_header = yes
smtpd_tls_security_level = may
smtpd_use_tls = yes
tls_daemon_random_bytes = 64
tls_eecdh_strong_curve = prime256v1
tls_eecdh_ultra_curve = secp384r1
tls_high_cipherlist = EECDH+ECDSA+CHACHA20 EECDH+CHACHA20 EECDH+ECDSA+AESGCM EECDH+AESGCM EECDH+ECDSA+AES256 EECDH+AES256 EECDH+ECDSA+AES128 EECDH+AES128 EECDH+ECDSA+3DES EECDH+3DES EDH+CHACHA20 EDH+AESGCM EDH+AES256 EDH+AES128 EDH+3DES
tls_medium_cipherlist = EECDH+ECDSA+CHACHA20 EECDH+CHACHA20 EECDH+ECDSA+AESGCM EECDH+AESGCM EECDH+ECDSA+AES256 EECDH+AES256 EECDH+ECDSA+AES128 EECDH+AES128 EECDH+ECDSA+3DES EECDH+3DES EDH+CHACHA20 EDH+AESGCM EDH+AES256 EDH+AES128 EDH+3DES AESGCM AES256 AES128 3DES
tls_preempt_cipherlist = yes
tls_random_bytes = 64
tls_ssl_options = NO_COMPRESSION
Wenn Du 3DES vollständig loswerden willst, dann musst Du die *3DES Cipher aus den tls_(medium|high)_cipherlist entfernen. Bedenke aber, dass dadurch etwas ältere Mailserver, insbesondere kommerzielle Produkte wie MS-Exchange, dann nicht mehr mit Deinem Mailserver kommunizieren können. Dies betrifft leider noch sehr viele Firmen, Organisationen und Behörden.