jeboehm / docker-mailserver

Docker Mailserver based on the famous ISPMail guide
MIT License
353 stars 92 forks source link

[Request] enable TLSv1.3 explicitly to prevent default in some cases #228

Closed the-hotmann closed 1 year ago

the-hotmann commented 1 year ago

In addition to https://github.com/jeboehm/docker-mailserver/issues/208 since I forgot to add TLSv1.3

Postfix (mta)

https://github.com/jeboehm/docker-mailserver/blob/main/mta/Dockerfile#L60-L63

# enable tls 1.3 & 1.2 (TLSv1.3, TLSv1.2)
# disable tls 1.1 & 1.0 (!TLSv1.1, !TLSv1)
# disable ssl 3 & 2 (!SSLv3, !SSLv2)

smtpd_tls_mandatory_protocols = TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv3, !SSLv2
smtpd_tls_protocols = TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv3, !SSLv2
smtp_tls_mandatory_protocols = TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv3, !SSLv2
smtp_tls_protocols = TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv3, !SSLv2

For better structure I would recommend like the order above HIGHEST -> LOWEST - would make it more easy to maintain.

Sorry for the inconvinience

jeboehm commented 1 year ago

Thank you @MartinHotmann! This will be solved in #241