Skip to content

Commit 7164c05

Browse files
author
thom
committed
Update SSL params (#5423)
1 parent 2c62c9d commit 7164c05

11 files changed

+47
-29
lines changed

‎install/tpl/apache_ispconfig.vhost.master‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -70,15 +70,15 @@ NameVirtualHost *:<tmpl_var name="vhost_port">
7070
# SSL Configuration
7171
<tmpl_var name="ssl_comment">SSLEngine On
7272
<tmpl_if name='apache_version' op='>=' value='2.3.16' format='version'>
73-
<tmpl_var name="ssl_comment">SSLProtocol All -SSLv3
73+
<tmpl_var name="ssl_comment">SSLProtocol All -SSLv3 -TLSv1 -TLSv1.1
7474
<tmpl_else>
7575
<tmpl_var name="ssl_comment">SSLProtocol All -SSLv2 -SSLv3
7676
</tmpl_if>
7777
<tmpl_var name="ssl_comment">SSLCertificateFile /usr/local/ispconfig/interface/ssl/ispserver.crt
7878
<tmpl_var name="ssl_comment">SSLCertificateKeyFile /usr/local/ispconfig/interface/ssl/ispserver.key
7979
<tmpl_var name="ssl_bundle_comment">SSLCACertificateFile /usr/local/ispconfig/interface/ssl/ispserver.bundle
8080

81-
<tmpl_var name="ssl_comment">SSLCipherSuite ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
81+
<tmpl_var name="ssl_comment">SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
8282
<tmpl_var name="ssl_comment">SSLHonorCipherOrder On
8383
<tmpl_if name='apache_version' op='>=' value='2.4.3' format='version'>
8484
<tmpl_var name="ssl_comment">SSLCompression Off

‎install/tpl/debian6_dovecot2.conf.master‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,9 @@ mail_privileged_group = vmail
77
ssl_cert = </etc/postfix/smtpd.cert
88
ssl_key = </etc/postfix/smtpd.key
99
ssl_dh = </etc/dovecot/dh.pem
10-
ssl_protocols = !SSLv2 !SSLv3
11-
ssl_min_protocol = TLSv1
10+
ssl_min_protocol = TLSv1.2
11+
ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
12+
ssl_prefer_server_ciphers = no
1213
auth_verbose = yes
1314
mail_max_userip_connections = 100
1415
mail_plugins = quota

‎install/tpl/debian_dovecot2.conf.master‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,9 @@ mail_privileged_group = vmail
77
postmaster_address = postmaster@example.com
88
ssl_cert = </etc/postfix/smtpd.cert
99
ssl_key = </etc/postfix/smtpd.key
10-
ssl_protocols = !SSLv2 !SSLv3
10+
ssl_min_protocol = TLSv1.2
11+
ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
12+
ssl_prefer_server_ciphers = no
1113
auth_verbose = yes
1214
mail_max_userip_connections = 100
1315
mail_plugins = $mail_plugins quota

‎install/tpl/debian_postfix.conf.master‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ smtpd_sasl_auth_enable = yes
1414
broken_sasl_auth_clients = yes
1515
smtpd_sasl_authenticated_header = yes
1616
smtpd_restriction_classes = greylisting
17-
greylisting = check_policy_service inet:127.0.0.1:10023
17+
greylisting = check_policy_service inet:127.0.0.1:10023
1818
smtpd_recipient_restrictions = permit_mynetworks, reject_unknown_recipient_domain, check_recipient_access proxy:mysql:{config_dir}/mysql-verify_recipients.cf, permit_sasl_authenticated, reject_non_fqdn_recipient, reject_unauth_destination, check_recipient_access proxy:mysql:{config_dir}/mysql-virtual_recipient.cf{rbl_list}{greylisting}, check_policy_service unix:private/quota-status
1919
smtpd_use_tls = yes
2020
smtpd_tls_security_level = may
@@ -39,10 +39,13 @@ nested_header_checks = regexp:{config_dir}/nested_header_checks
3939
body_checks = regexp:{config_dir}/body_checks
4040
owner_request_special = no
4141
smtp_tls_security_level = may
42-
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
43-
smtpd_tls_protocols = !SSLv2,!SSLv3
44-
smtp_tls_protocols = !SSLv2,!SSLv3
42+
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
43+
smtpd_tls_protocols = !SSLv2,!SSLv3, !TLSv1, !TLSv1.1
44+
smtp_tls_protocols = !SSLv2,!SSLv3, !TLSv1, !TLSv1.1
4545
smtpd_tls_exclude_ciphers = RC4, aNULL
4646
smtp_tls_exclude_ciphers = RC4, aNULL
47+
smtpd_tls_mandatory_ciphers = medium
48+
tls_medium_cipherlist = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
49+
tls_preempt_cipherlist = no
4750
# needed for postfix < 3.3 when using reject_unverified_recipient (lmtp):
4851
enable_original_recipient = yes

‎install/tpl/fedora_dovecot2.conf.master‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,9 @@ log_timestamp = "%Y-%m-%d %H:%M:%S "
66
mail_privileged_group = vmail
77
ssl_cert = </etc/postfix/smtpd.cert
88
ssl_key = </etc/postfix/smtpd.key
9-
ssl_protocols = !SSLv2 !SSLv3
9+
ssl_min_protocol = TLSv1.2
10+
ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
11+
ssl_prefer_server_ciphers = no
1012
auth_verbose = yes
1113
mail_plugins = quota
1214
passdb {

‎install/tpl/fedora_postfix.conf.master‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -35,10 +35,13 @@ nested_header_checks = regexp:{config_dir}/nested_header_checks
3535
body_checks = regexp:{config_dir}/body_checks
3636
inet_interfaces = all
3737
smtp_tls_security_level = may
38-
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
39-
smtpd_tls_protocols = !SSLv2,!SSLv3
40-
smtp_tls_protocols = !SSLv2,!SSLv3
38+
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
39+
smtpd_tls_protocols = !SSLv2,!SSLv3, !TLSv1, !TLSv1.1
40+
smtp_tls_protocols = !SSLv2,!SSLv3, !TLSv1, !TLSv1.1
4141
smtpd_tls_exclude_ciphers = RC4, aNULL
4242
smtp_tls_exclude_ciphers = RC4, aNULL
43+
smtpd_tls_mandatory_ciphers = medium
44+
tls_medium_cipherlist = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
45+
tls_preempt_cipherlist = no
4346
# needed for postfix < 3.3 when using reject_unverified_recipient (lmtp):
4447
enable_original_recipient = yes

‎install/tpl/gentoo_postfix.conf.master‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -34,10 +34,13 @@ nested_header_checks = regexp:{config_dir}/nested_header_checks
3434
body_checks = regexp:{config_dir}/body_checks
3535
inet_interfaces = all
3636
smtp_tls_security_level = may
37-
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
38-
smtpd_tls_protocols = !SSLv2,!SSLv3
39-
smtp_tls_protocols = !SSLv2,!SSLv3
37+
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
38+
smtpd_tls_protocols = !SSLv2,!SSLv3, !TLSv1, !TLSv1.1
39+
smtp_tls_protocols = !SSLv2,!SSLv3, !TLSv1, !TLSv1.1
4040
smtpd_tls_exclude_ciphers = RC4, aNULL
4141
smtp_tls_exclude_ciphers = RC4, aNULL
42+
smtpd_tls_mandatory_ciphers = medium
43+
tls_medium_cipherlist = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
44+
tls_preempt_cipherlist = no
4245
# needed for postfix < 3.3 when using reject_unverified_recipient (lmtp):
4346
enable_original_recipient = yes

‎install/tpl/nginx_apps.vhost.master‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ server {
22
listen {apps_vhost_port} {ssl_on};
33
listen [::]:{apps_vhost_port} {ssl_on} ipv6only=on;
44

5-
{ssl_comment}ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
5+
{ssl_comment}ssl_protocols TLSv1.2;
66
{ssl_comment}ssl_certificate /usr/local/ispconfig/interface/ssl/ispserver.crt;
77
{ssl_comment}ssl_certificate_key /usr/local/ispconfig/interface/ssl/ispserver.key;
88

@@ -115,7 +115,7 @@ server {
115115
location /phpMyAdmin {
116116
rewrite ^/* /phpmyadmin last;
117117
}
118-
118+
119119
location /squirrelmail {
120120
root /usr/share/;
121121
index index.php index.html index.htm;

‎install/tpl/nginx_ispconfig.vhost.master‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
server {
22
listen {vhost_port} {ssl_on};
33
listen [::]:{vhost_port} {ssl_on} ipv6only=on;
4-
5-
{ssl_comment}ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
4+
5+
{ssl_comment}ssl_protocols TLSv1.2;
66
{ssl_comment}ssl_certificate /usr/local/ispconfig/interface/ssl/ispserver.crt;
77
{ssl_comment}ssl_certificate_key /usr/local/ispconfig/interface/ssl/ispserver.key;
88
{ssl_comment}ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';
99
{ssl_comment}ssl_prefer_server_ciphers on;
10-
10+
1111
# redirect to https if accessed with http
1212
{ssl_comment}error_page 497 https://$host:{vhost_port}$request_uri;
1313

@@ -44,7 +44,7 @@ server {
4444
location ~ /\. {
4545
deny all;
4646
}
47-
47+
4848
# location /phpmyadmin {
4949
# root /usr/share/;
5050
# index index.php index.html index.htm;
@@ -64,7 +64,7 @@ server {
6464
# location /phpMyAdmin {
6565
# rewrite ^/* /phpmyadmin last;
6666
# }
67-
#
67+
#
6868
# location /squirrelmail {
6969
# root /usr/share/;
7070
# index index.php index.html index.htm;

‎install/tpl/opensuse_dovecot2.conf.master‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,9 @@ log_timestamp = "%Y-%m-%d %H:%M:%S "
66
mail_privileged_group = vmail
77
ssl_cert = </etc/postfix/smtpd.cert
88
ssl_key = </etc/postfix/smtpd.key
9-
ssl_protocols = !SSLv2 !SSLv3
9+
ssl_min_protocol = TLSv1.2
10+
ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
11+
ssl_prefer_server_ciphers = no
1012
mail_plugins = quota
1113
passdb {
1214
args = /etc/dovecot/dovecot-sql.conf
@@ -79,7 +81,7 @@ mail_plugins = $mail_plugins quota
7981
#2.3+ group = vmail
8082
#2.3+ mode = 0660
8183
#2.3+ }
82-
#2.3+
84+
#2.3+
8385
#2.3+ unix_listener stats-writer {
8486
#2.3+ user = vmail
8587
#2.3+ group = vmail
@@ -122,4 +124,3 @@ namespace inbox {
122124
special_use = \Trash
123125
}
124126
}
125-

0 commit comments

Comments
 (0)