mir/postfix
2
0
Fork 0
mirror of https://github.com/vdukhovni/postfix synced 2025-08-30 05:38:06 +00:00
Code Issues Releases Wiki Activity

postfix-2.11.6

Browse Source
This commit is contained in:
Wietse Venema 2015-07-20 00:00:00 -05:00 committed by Viktor Dukhovni
parent a419793471
commit 8a74f34720
19 changed files with 408 additions and 455 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
postfix/HISTORY
View File

@ -19664,3 +19664,23 @@ Apologies for any names omitted.
Incompatibility: specifying "make makefiles" with "CC=command"
will no longer override the default WARN setting.
20150501
Support for Linux 4.*, and some simplification for future
makedefs files. Files: makedefs, util/sys_defs.h.
20150718
Security: opportunistic TLS by default uses "medium" or
stronger ciphers instead of "export" or stronger. See the
RELEASE_NOTES file for how to get the old settings back.
Files: global/mail_params.h, proto/TLS_README.html,
proto/postconf.proto, and files derived from those.
20150719
Security: Postfix TLS support by default no longer uses
SSLv2 or SSLv3. See the RELEASE_NOTES file for how to get
the old settings back. Files: global/mail_params.h,
proto/postconf.proto, and files derived from those.

82
postfix/README_FILES/TLS_README
View File

@ -569,13 +569,15 @@ use public-key fingerprints, upgrade to Postfix 2.9.6 or later.
SSeerrvveerr--ssiiddee cciipphheerr ccoonnttrroollss
The Postfix SMTP server supports 5 distinct cipher security levels as specified
by the smtpd_tls_mandatory_ciphers configuration parameter, which determines
the cipher grade with mandatory TLS encryption. The default value is "medium"
which is essentially 128-bit encryption or better. With opportunistic TLS
encryption, the minimum accepted cipher grade is typically "export". The
corresponding smtpd_tls_ciphers parameter (Postfix >= 2.6) controls the cipher
grade used with opportunistic TLS.
The Postfix SMTP server supports 5 distinct cipher grades as specified by the
smtpd_tls_mandatory_ciphers configuration parameter, which determines the
minimum cipher grade with mandatory TLS encryption. The default minimum cipher
grade for mandatory TLS is "medium" which is essentially 128-bit encryption or
better. The smtpd_tls_ciphers parameter (Postfix >= 2.6) controls the minimum
cipher grade used with opportunistic TLS. Here, the default minimum cipher
grade is "medium" for Postfix releases after the middle of 2015, "export" for
older Postfix releases. With Postfix < 2.6, the minimum opportunistic TLS
cipher grade is always "export".
By default anonymous ciphers are enabled. They are automatically disabled when
remote SMTP client certificates are requested. If clients are expected to
@ -585,15 +587,12 @@ anonymous ciphers by setting "smtpd_tls_mandatory_exclude_ciphers = aNULL" or
SMTP client to check the server certificate, so excluding anonymous ciphers is
generally unnecessary.
The "smtpd_tls_ciphers" configuration parameter (Postfix >= 2.6) provides
control over the minimum cipher grade for opportunistic TLS. With Postfix <
2.6, the minimum opportunistic TLS cipher grade is always "export".
With mandatory TLS encryption, the Postfix SMTP server will by default disable
SSLv2. SSLv2 is used only when TLS encryption is optional. The mandatory TLS
With mandatory and opportunistic TLS encryption, the Postfix SMTP server by
default disables SSLv2 and SSLv3 with Postfix releases after the middle of
2015; older releases only disable SSLv2 for mandatory TLS. The mandatory TLS
protocol list is specified via the smtpd_tls_mandatory_protocols configuration
parameter. The corresponding smtpd_tls_protocols parameter (Postfix >= 2.6)
controls the SSL/TLS protocols used with opportunistic TLS.
parameter. The smtpd_tls_protocols parameter (Postfix >= 2.6) controls the SSL/
TLS protocols used with opportunistic TLS.
Note that the OpenSSL library only supports protocol exclusion (not inclusion).
For this reason, Postfix can exclude only protocols that are known at the time
@ -777,13 +776,10 @@ server. Otherwise, messages are sent in the clear. Opportunistic TLS can be
configured by setting "smtp_tls_security_level = may". For LMTP, use the
corresponding "lmtp_" parameter.
Since sending in the clear is acceptable, demanding stronger than default TLS
security mostly reduces inter-operability. If you must restrict TLS protocol or
cipher selection even with opportunistic TLS, the "smtp_tls_ciphers" and
"smtp_tls_protocols" configuration parameters (Postfix >= 2.6) provide control
over the protocols and cipher grade used with opportunistic TLS. With earlier
releases the opportunistic TLS cipher grade is always "export" and no protocols
are disabled.
The "smtp_tls_ciphers" and "smtp_tls_protocols" configuration parameters
(Postfix >= 2.6) provide control over the cipher grade and protocols used with
opportunistic TLS. With earlier Postfix releases, opportunistic TLS always uses
the cipher grade "export" and enables all protocols.
With opportunistic TLS, mail delivery continues even if the server certificate
is untrusted or bears the wrong name. When the TLS handshake fails for an
@ -844,7 +840,7 @@ Examples:
In the example below, traffic to example.com and its sub-domains via the
corresponding MX hosts always uses TLS. The SSLv2 protocol will be disabled
(the default setting of smtp_tls_mandatory_protocols excludes "SSLv2"). Only
(the default setting of smtp_tls_mandatory_protocols excludes SSLv2+3). Only
high- or medium-strength (i.e. 128 bit or better) ciphers will be used by
default for all "encrypt" security level sessions.
@ -1629,15 +1625,15 @@ ddaannee
TLSA records in DNSSEC. If no TLSA records are found, the effective
security level used is may. If TLSA records are found, but none are usable,
the effective security level is encrypt. When usable TLSA records are
obtained for the remote SMTP server, SSLv2 is automatically disabled (see
smtp_tls_mandatory_protocols), and the server certificate must match the
TLSA records. RFC 6698 (DANE) TLS authentication and DNSSEC support is
obtained for the remote SMTP server, SSLv2+3 are automatically disabled
(see smtp_tls_mandatory_protocols), and the server certificate must match
the TLSA records. RFC 6698 (DANE) TLS authentication and DNSSEC support is
available with Postfix 2.11 and later.
ddaannee--oonnllyy
Mandatory DANE TLS. The TLS policy for the destination is obtained via TLSA
records in DNSSEC. If no TLSA records are found, or none are usable, no
connection is made to the server. When usable TLSA records are obtained for
the remote SMTP server, SSLv2 is automatically disabled (see
the remote SMTP server, SSLv2+3 are automatically disabled (see
smtp_tls_mandatory_protocols), and the server certificate must match the
TLSA records. RFC 6698 (DANE) TLS authentication and DNSSEC support is
available with Postfix 2.11 and later.
@ -1768,13 +1764,13 @@ Example:
CClliieenntt--ssiiddee cciipphheerr ccoonnttrroollss
The Postfix SMTP client supports 5 distinct cipher security levels as specified
by the smtp_tls_mandatory_ciphers configuration parameter. This setting
controls the minimum acceptable SMTP client TLS cipher grade for use with
mandatory TLS encryption. The default value "medium" is suitable for most
destinations with which you may want to enforce TLS, and is beyond the reach of
today's cryptanalytic methods. See smtp_tls_policy_maps for information on how
to configure ciphers on a per-destination basis.
The Postfix SMTP client supports 5 distinct cipher grades as specified by the
smtp_tls_mandatory_ciphers configuration parameter. This setting controls the
minimum acceptable SMTP client TLS cipher grade for use with mandatory TLS
encryption. The default value "medium" is suitable for most destinations with
which you may want to enforce TLS, and is beyond the reach of today's
cryptanalytic methods. See smtp_tls_policy_maps for information on how to
configure ciphers on a per-destination basis.
By default anonymous ciphers are allowed, and automatically disabled when
remote SMTP server certificates are verified. If you want to disable anonymous
@ -1786,14 +1782,16 @@ TLS session cache space, if certificates are ignored, there is little point in
requesting them.
The "smtp_tls_ciphers" configuration parameter (Postfix >= 2.6) provides
control over the minimum cipher grade for opportunistic TLS. With Postfix <
2.6, the minimum opportunistic TLS cipher grade is always "export".
control over the minimum cipher grade for opportunistic TLS. The default
minimum cipher grade for opportunistic TLS is "medium" for Postfix releases
after the middle of 2015, and "export" for older releases. With Postfix < 2.6,
the minimum opportunistic TLS cipher grade is always "export".
With mandatory TLS encryption, the Postfix SMTP client will by default disable
SSLv2. SSLv2 is used only when TLS encryption is optional. The mandatory TLS
protocol list is specified via the smtp_tls_mandatory_protocols configuration
parameter. The corresponding smtp_tls_protocols parameter (Postfix >= 2.6)
controls the SSL/TLS protocols used with opportunistic TLS.
With mandatory and opportunistic TLS encryption, the Postfix SMTP client will
by default disable SSLv2 and SSLv3. The mandatory TLS protocol list is
specified via the smtp_tls_mandatory_protocols configuration parameter. The
corresponding smtp_tls_protocols parameter (Postfix >= 2.6) controls the SSL/
TLS protocols used with opportunistic TLS.
Example:
@ -1806,7 +1804,7 @@ Example:
# Legacy form for Postfix < 2.5:
smtp_tls_mandatory_protocols = SSLv3, TLSv1
# Also available with Postfix >= 2.6:
smtp_tls_ciphers = export
smtp_tls_ciphers = medium
smtp_tls_protocols = !SSLv2
CClliieenntt--ssiiddee SSMMTTPPSS ssuuppppoorrtt

34
postfix/RELEASE_NOTES
View File

@ -14,6 +14,40 @@ specifies the release date of a stable release or snapshot release.
If you upgrade from Postfix 2.9 or earlier, read RELEASE_NOTES-2.10
before proceeding.
Incompatible change with Postfix 2.11.6
---------------------------------------
As of the middle of 2015, all supported Postfix releases no longer
enable "export" grade ciphers for opportunistic TLS, and no longer
use the deprecated SSLv2 and SSLv3 protocols for mandatory or
opportunistic TLS.
These changes are very unlikely to cause problems with server-to-server
communication over the Internet, but they may result in interoperability
problems with ancient client or server implementations on internal
networks. To address this problem, you can revert the changes with:
Postfix SMTP client settings:
lmtp_tls_ciphers = export
smtp_tls_ciphers = export
lmtp_tls_protocols = !SSLv2
smtp_tls_protocols = !SSLv2
lmtp_tls_mandatory_protocols = !SSLv2
smtp_tls_mandatory_protocols = !SSLv2
Postfix SMTP server settings:
smtpd_tls_ciphers = export
smtpd_tls_protocols =
smtpd_tls_mandatory_protocols = !SSLv2
These settings, if put in main.cf, affect all Postfix SMTP client
or server communication, which may be undesirable. To be more
selective, use "-o name=value" parameter overrides on specific
services in master.cf. Execute the command "postfix reload" to make
the changes effective.
Major changes - tls
-------------------

70
postfix/html/TLS_README.html
View File

@ -810,14 +810,16 @@ to Postfix 2.9.6 or later. </p>
<h3><a name="server_cipher">Server-side cipher controls</a> </h3>
<p> The Postfix SMTP server supports 5 distinct cipher security levels
as specified by the <a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a> configuration parameter,
which determines the cipher grade with mandatory TLS encryption. The
default value is "medium" which is essentially 128-bit encryption or better.
With opportunistic TLS encryption, the minimum accepted cipher grade is
typically "export". The corresponding <a href="postconf.5.html#smtpd_tls_ciphers">smtpd_tls_ciphers</a> parameter
(Postfix &ge; 2.6) controls the cipher grade used with opportunistic
TLS. </p>
<p> The Postfix SMTP server supports 5 distinct cipher grades as
specified by the <a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a> configuration parameter,
which determines the minimum cipher grade with mandatory TLS
encryption. The default minimum cipher grade for mandatory TLS is
"medium" which is essentially 128-bit encryption or better. The
<a href="postconf.5.html#smtpd_tls_ciphers">smtpd_tls_ciphers</a> parameter (Postfix &ge; 2.6) controls the minimum
cipher grade used with opportunistic TLS. Here, the default minimum
cipher grade is "medium" for Postfix releases after the middle of
2015, "export" for older Postfix releases. With Postfix &lt; 2.6,
the minimum opportunistic TLS cipher grade is always "export". </p>
<p> By default anonymous ciphers are enabled. They are automatically
disabled when remote SMTP client certificates are requested. If
@ -828,17 +830,12 @@ by setting "<a href="postconf.5.html#smtpd_tls_mandatory_exclude_ciphers">smtpd_
a remote SMTP client to check the server certificate, so excluding
anonymous ciphers is generally unnecessary. </p>
<p> The "<a href="postconf.5.html#smtpd_tls_ciphers">smtpd_tls_ciphers</a>" configuration parameter (Postfix &ge;
2.6) provides control over the minimum cipher grade for opportunistic
TLS. With
Postfix &lt; 2.6, the minimum opportunistic TLS cipher grade is always
"export". </p>
<p> With mandatory TLS encryption, the Postfix SMTP server will by
default disable SSLv2. SSLv2 is used only when TLS encryption
is optional. The mandatory TLS protocol list is specified via the
<p> With mandatory and opportunistic TLS encryption, the Postfix
SMTP server by default disables SSLv2 and SSLv3 with Postfix releases
after the middle of 2015; older releases only disable SSLv2 for
mandatory TLS. The mandatory TLS protocol list is specified via the
<a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a> configuration parameter. The
corresponding <a href="postconf.5.html#smtpd_tls_protocols">smtpd_tls_protocols</a> parameter (Postfix &ge; 2.6)
<a href="postconf.5.html#smtpd_tls_protocols">smtpd_tls_protocols</a> parameter (Postfix &ge; 2.6)
controls the SSL/TLS protocols used with opportunistic TLS. </p>
<p> Note that the OpenSSL library only supports protocol exclusion
@ -1080,14 +1077,11 @@ is supported by the server. Otherwise, messages are sent in the clear.
Opportunistic TLS can be configured by setting "<a href="postconf.5.html#smtp_tls_security_level">smtp_tls_security_level</a> = may".
For LMTP, use the corresponding "lmtp_" parameter. </p>
<p> Since sending in the clear is acceptable, demanding stronger
than default TLS security mostly reduces inter-operability. If you
must restrict TLS protocol or cipher selection even with opportunistic
TLS, the "<a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a>" and "<a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a>" configuration
parameters (Postfix &ge; 2.6) provide control over the protocols
and cipher grade
used with opportunistic TLS. With earlier releases the opportunistic TLS
cipher grade is always "export" and no protocols are disabled. </p>
<p> The "<a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a>" and "<a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a>" configuration
parameters (Postfix &ge; 2.6) provide control over the cipher grade
and protocols used with opportunistic TLS. With earlier Postfix
releases, opportunistic TLS always uses the cipher grade "export"
and enables all protocols. </p>
<p> With opportunistic TLS, mail delivery continues even if the
server certificate is untrusted or bears the wrong name.
@ -1163,7 +1157,7 @@ table</a>, specify the "encrypt" security level.
<p> In the example below, traffic to <i>example.com</i> and its sub-domains
via the corresponding MX hosts always uses TLS. The SSLv2 protocol
will be disabled (the default setting of <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a>
excludes "SSLv2"). Only high- or medium-strength (i.e. 128 bit or
excludes SSLv2+3). Only high- or medium-strength (i.e. 128 bit or
better) ciphers will be used by default for all "encrypt" security
level sessions. </p>
@ -2143,7 +2137,7 @@ DNSSEC. If no TLSA records are found, the effective security level
used is <a href="#client_tls_may">may</a>. If TLSA records are
found, but none are usable, the effective security level is <a
href="#client_tls_encrypt">encrypt</a>. When usable TLSA records
are obtained for the remote SMTP server, SSLv2 is automatically
are obtained for the remote SMTP server, SSLv2+3 are automatically
disabled (see <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a>), and the server certificate
must match the TLSA records. <a href="http://tools.ietf.org/html/rfc6698">RFC 6698</a> (DANE) TLS authentication
and DNSSEC support is available with Postfix 2.11 and later. </dd>
@ -2152,7 +2146,7 @@ and DNSSEC support is available with Postfix 2.11 and later. </dd>
The TLS policy for the destination is obtained via TLSA records in
DNSSEC. If no TLSA records are found, or none are usable, no
connection is made to the server. When usable TLSA records are
obtained for the remote SMTP server, SSLv2 is automatically disabled
obtained for the remote SMTP server, SSLv2+3 are automatically disabled
(see <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a>), and the server certificate must
match the TLSA records. <a href="http://tools.ietf.org/html/rfc6698">RFC 6698</a> (DANE) TLS authentication and
DNSSEC support is available with Postfix 2.11 and later. </dd>
@ -2318,7 +2312,7 @@ configured to supply its intermediate CA certificate). </p>
<h3> <a name="client_cipher">Client-side cipher controls </a> </h3>
<p> The Postfix SMTP client supports 5 distinct cipher security levels
<p> The Postfix SMTP client supports 5 distinct cipher grades
as specified by the <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> configuration
parameter. This setting controls the minimum acceptable SMTP client
TLS cipher grade for use with mandatory TLS encryption. The default
@ -2339,13 +2333,15 @@ and TLS session cache space, if certificates are ignored, there is
little point in requesting them. </p>
<p> The "<a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a>" configuration parameter (Postfix &ge; 2.6)
provides control over the minimum cipher grade for opportunistic TLS. With
Postfix &lt; 2.6, the minimum opportunistic TLS cipher grade is always
"export". </p>
provides control over the minimum cipher grade for opportunistic TLS.
The default minimum cipher grade for opportunistic TLS is "medium"
for Postfix releases after the middle of 2015, and "export" for
older releases. With Postfix &lt; 2.6, the minimum opportunistic
TLS cipher grade is always "export". </p>
<p> With mandatory TLS encryption, the Postfix SMTP client will by
default disable SSLv2. SSLv2 is used only when TLS encryption
is optional. The mandatory TLS protocol list is specified via the
<p> With mandatory and opportunistic TLS encryption, the Postfix
SMTP client will by default disable SSLv2 and SSLv3. The mandatory
TLS protocol list is specified via the
<a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> configuration parameter. The corresponding
<a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a> parameter (Postfix &ge; 2.6) controls
the SSL/TLS protocols used with opportunistic TLS. </p>
@ -2363,7 +2359,7 @@ the SSL/TLS protocols used with opportunistic TLS. </p>
# Legacy form for Postfix &lt; 2.5:
<a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> = SSLv3, TLSv1
# Also available with Postfix &ge; 2.6:
<a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a> = export
<a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a> = medium
<a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a> = !SSLv2
</pre>
</blockquote>

6
postfix/html/lmtp.8.html
View File

@ -432,7 +432,7 @@ SMTP(8) SMTP(8)
policy by next-hop destination; when a non-empty value is speci-
fied, this overrides the obsolete <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> parameter.
<b><a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> (!SSLv2)</b>
<b><a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> (!SSLv2, !SSLv3)</b>
List of SSL/TLS protocols that the Postfix SMTP client will use
with mandatory TLS encryption.
@ -497,11 +497,11 @@ SMTP(8) SMTP(8)
Available in Postfix version 2.6 and later:
<b><a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a> (!SSLv2)</b>
<b><a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a> (!SSLv2, !SSLv3)</b>
List of TLS protocols that the Postfix SMTP client will exclude
or include with opportunistic TLS encryption.
<b><a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a> (export)</b>
<b><a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a> (medium)</b>
The minimum TLS cipher grade that the Postfix SMTP client will
use with opportunistic TLS encryption.

170
postfix/html/postconf.5.html
View File

@ -4727,7 +4727,7 @@ configuration parameter. See there for details. </p>
</DD>
<DT><b><a name="lmtp_tls_ciphers">lmtp_tls_ciphers</a>
(default: export)</b></DT><DD>
(default: medium)</b></DT><DD>
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a> configuration
parameter. See there for details. </p>
@ -4861,7 +4861,7 @@ configuration parameter. See there for details. </p>
</DD>
<DT><b><a name="lmtp_tls_mandatory_ciphers">lmtp_tls_mandatory_ciphers</a>
(default: empty)</b></DT><DD>
(default: medium)</b></DT><DD>
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a>
configuration parameter. See there for details. </p>
@ -4883,7 +4883,7 @@ configuration parameter. See there for details. </p>
</DD>
<DT><b><a name="lmtp_tls_mandatory_protocols">lmtp_tls_mandatory_protocols</a>
(default: !SSLv2)</b></DT><DD>
(default: !SSLv2, !SSLv3)</b></DT><DD>
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a>
configuration parameter. See there for details. </p>
@ -4927,7 +4927,7 @@ configuration parameter. See there for details. </p>
</DD>
<DT><b><a name="lmtp_tls_protocols">lmtp_tls_protocols</a>
(default: empty)</b></DT><DD>
(default: !SSLv2, !SSLv3)</b></DT><DD>
<p> The LMTP-specific version of the <a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a> configuration
parameter. See there for details. </p>
@ -10995,26 +10995,20 @@ Postfix 2.3 and later; use <a href="postconf.5.html#smtp_tls_mandatory_ciphers">
</DD>
<DT><b><a name="smtp_tls_ciphers">smtp_tls_ciphers</a>
(default: export)</b></DT><DD>
(default: medium)</b></DT><DD>
<p> The minimum TLS cipher grade that the Postfix SMTP client
will use with opportunistic TLS encryption. Cipher types listed in
<a href="postconf.5.html#smtp_tls_exclude_ciphers">smtp_tls_exclude_ciphers</a> are excluded from the base definition of
the selected cipher grade. The default value "export" ensures maximum
inter-operability. Because encryption is optional, stronger controls
are not appropriate, and this setting SHOULD NOT be changed unless the
change is essential. </p>
the selected cipher grade. The default value is "medium" for
Postfix releases after the middle of 2015, "export" for older
releases. </p>
<p> When TLS is mandatory the cipher grade is chosen via the
<a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> configuration parameter, see there for syntax
details. See <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> for information on how to configure
ciphers on a per-destination basis. </p>
<p> Example: </p>
<pre>
<a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a> = export
</pre>
<p> This feature is available in Postfix 2.6 and later. With earlier Postfix
releases only the <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> parameter is implemented,
and opportunistic TLS always uses "export" or better (i.e. all) ciphers. </p>
@ -11403,18 +11397,16 @@ on a per-destination basis. </p>
<dl>
<dt><b>export</b></dt>
<dd> Enable "EXPORT" grade or better OpenSSL
ciphers. This is the default for opportunistic encryption. It is
not recommended for mandatory encryption unless you must enforce TLS
with "crippled" peers. The underlying cipherlist is specified via the
<a href="postconf.5.html#tls_export_cipherlist">tls_export_cipherlist</a> configuration parameter, which you are strongly
encouraged to not change. </dd>
<dd> Enable "EXPORT" grade or better OpenSSL ciphers. The underlying
cipherlist is specified via the <a href="postconf.5.html#tls_export_cipherlist">tls_export_cipherlist</a> configuration
parameter, which you are strongly encouraged to not change. This
choice is insecure and SHOULD NOT be used. </dd>
<dt><b>low</b></dt>
<dd> Enable "LOW" grade or better OpenSSL ciphers. This
setting is only appropriate for internal mail servers. The underlying
<dd> Enable "LOW" grade or better OpenSSL ciphers. The underlying
cipherlist is specified via the <a href="postconf.5.html#tls_low_cipherlist">tls_low_cipherlist</a> configuration
parameter, which you are strongly encouraged to not change. </dd>
parameter, which you are strongly encouraged to not change. This
choice is insecure and SHOULD NOT be used. </dd>
<dt><b>medium</b></dt>
<dd> Enable "MEDIUM" grade or better OpenSSL ciphers.
@ -11475,14 +11467,16 @@ attribute. See <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_ma
</DD>
<DT><b><a name="smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a>
(default: !SSLv2)</b></DT><DD>
(default: !SSLv2, !SSLv3)</b></DT><DD>
<p> List of SSL/TLS protocols that the Postfix SMTP client will use with
mandatory TLS encryption. In <a href="postconf.5.html">main.cf</a> the values are separated by
whitespace, commas or colons. In the policy table "protocols" attribute
(see <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a>) the only valid separator is colon. An
empty value means allow all protocols. The valid protocol names, (see
<b>SSL_get_version(3)</b>), are "SSLv2", "SSLv3" and "TLSv1". </p>
<b>SSL_get_version(3)</b>), are "SSLv2", "SSLv3" and "TLSv1". The
default value is "!SSLv2, !SSLv3" for Postfix releases after the
middle of 2015, "!SSLv2" for older releases. </p>
<p> With Postfix &ge; 2.5 the parameter syntax was expanded to support
protocol exclusions. One can explicitly exclude "SSLv2" by setting
@ -11525,11 +11519,6 @@ SNI is required. If you use "dane" or "dane-only" do not disable
TLSv1, except perhaps via the policy table for destinations which
you are sure will support "TLSv1.1" or "TLSv1.2". </p>
<p> Since SSL version 2 has known protocol weaknesses and is now
deprecated, the default setting excludes "SSLv2". This means that by
default, SSL version 2 will not be used at the "encrypt" security level
and higher. </p>
<p> See the documentation of the <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a> parameter and
<a href="TLS_README.html">TLS_README</a> for more information about security levels. </p>
@ -11808,12 +11797,13 @@ configurations in environments where DNS security is not assured. </p>
</DD>
<DT><b><a name="smtp_tls_protocols">smtp_tls_protocols</a>
(default: !SSLv2)</b></DT><DD>
(default: !SSLv2, !SSLv3)</b></DT><DD>
<p> List of TLS protocols that the Postfix SMTP client will exclude or
include with opportunistic TLS encryption. Starting with Postfix 2.6,
the Postfix SMTP client will by default not use the obsolete SSLv2
protocol. </p>
include with opportunistic TLS encryption. The default value is
"!SSLv2, !SSLv3" for Postfix releases after the middle of 2015,
"!SSLv2" for older releases. Before Postfix 2.6, the Postfix SMTP
client would use all protocols with opportunistic TLS. </p>
<p> In <a href="postconf.5.html">main.cf</a> the values are separated by whitespace, commas or
colons. In the policy table (see <a href="postconf.5.html#smtp_tls_policy_maps">smtp_tls_policy_maps</a>) the only valid
@ -11839,7 +11829,7 @@ versions of Postfix &ge; 2.10 can explicitly disable support for
"TLSv1.1" or "TLSv1.2"</p>
<p> To include a protocol list its name, to exclude it, prefix the name
with a "!" character. To exclude SSLv2 even for opportunistic TLS set
with a "!" character. To exclude SSLv2 for opportunistic TLS set
"<a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a> = !SSLv2". To exclude both "SSLv2" and "SSLv3" set
"<a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a> = !SSLv2, !SSLv3". Explicitly listing the protocols to
include, rather than protocols to exclude, is supported, but not
@ -12046,7 +12036,7 @@ Examples:
# can be mitigated by disabling a particular protocol or raising the
# cipher grade from "export" to "low" or "medium").
<a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a> = export
<a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a> = !SSLv2
<a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a> = !SSLv2, !SSLv3
</pre>
<pre>
@ -15180,25 +15170,19 @@ Postfix 2.3 and later; use <a href="postconf.5.html#smtpd_tls_mandatory_ciphers"
</DD>
<DT><b><a name="smtpd_tls_ciphers">smtpd_tls_ciphers</a>
(default: export)</b></DT><DD>
(default: medium)</b></DT><DD>
<p> The minimum TLS cipher grade that the Postfix SMTP server
will use with opportunistic TLS encryption. Cipher types listed in
<a href="postconf.5.html#smtpd_tls_exclude_ciphers">smtpd_tls_exclude_ciphers</a> are excluded from the base definition of
the selected cipher grade. The default value "export" ensures maximum
inter-operability. Because encryption is optional, stronger controls
are not appropriate, and this setting SHOULD NOT be changed unless the
change is essential. </p>
the selected cipher grade. The default value is "medium" for Postfix
releases after the middle of 2015, "export" for older releases.
</p>
<p> When TLS is mandatory the cipher grade is chosen via the
<a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a> configuration parameter, see there for syntax
details. </p>
<p> Example: </p>
<pre>
<a href="postconf.5.html#smtpd_tls_ciphers">smtpd_tls_ciphers</a> = export
</pre>
<p> This feature is available in Postfix 2.6 and later. With earlier Postfix
releases only the <a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a> parameter is implemented,
and opportunistic TLS always uses "export" or better (i.e. all) ciphers. </p>
@ -15599,17 +15583,16 @@ one "medium" or "high" grade cipher. </p>
<dl>
<dt><b>export</b></dt>
<dd> Enable "EXPORT" grade or stronger OpenSSL ciphers.
This is the most appropriate setting for public MX hosts, and is always
used with opportunistic TLS encryption. The underlying cipherlist
is specified via the <a href="postconf.5.html#tls_export_cipherlist">tls_export_cipherlist</a> configuration parameter,
which you are strongly encouraged to not change. </dd>
<dd> Enable "EXPORT" grade or stronger OpenSSL ciphers. The
underlying cipherlist is specified via the <a href="postconf.5.html#tls_export_cipherlist">tls_export_cipherlist</a>
configuration parameter, which you are strongly encouraged to not
change. This choice is insecure and SHOULD NOT be used. </dd>
<dt><b>low</b></dt>
<dd> Enable "LOW" grade or stronger OpenSSL ciphers. The
underlying cipherlist is specified via the <a href="postconf.5.html#tls_low_cipherlist">tls_low_cipherlist</a>
configuration parameter, which you are strongly encouraged to
not change. </dd>
<dd> Enable "LOW" grade or stronger OpenSSL ciphers. The underlying
cipherlist is specified via the <a href="postconf.5.html#tls_low_cipherlist">tls_low_cipherlist</a> configuration
parameter, which you are strongly encouraged to not change. This
choice is insecure and SHOULD NOT be used. </dd>
<dt><b>medium</b></dt>
<dd> Enable "MEDIUM" grade or stronger OpenSSL ciphers. These use 128-bit
@ -15669,14 +15652,16 @@ works in addition to the exclusions listed with <a href="postconf.5.html#smtpd_t
</DD>
<DT><b><a name="smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a>
(default: !SSLv2)</b></DT><DD>
(default: !SSLv2, !SSLv3)</b></DT><DD>
<p> The SSL/TLS protocols accepted by the Postfix SMTP server with
mandatory TLS encryption. If the list is empty, the server supports
all available SSL/TLS protocol versions. A non-empty value is a
list of protocol names separated by whitespace, commas or colons.
The supported protocol names are "SSLv2", "SSLv3" and "TLSv1", and
are not case sensitive. </p>
are not case sensitive. The default value is "!SSLv2, !SSLv3" for
Postfix releases after the middle of 2015, "!SSLv2" for older
releases. </p>
<p> With Postfix &ge; 2.5 the parameter syntax was expanded to support
protocol exclusions. One can explicitly exclude "SSLv2" by setting
@ -15693,11 +15678,6 @@ disabled. The latest patch levels of Postfix &ge; 2.6, and all
versions of Postfix &ge; 2.10 can disable support for "TLSv1.1" or
"TLSv1.2". </p>
<p> Since SSL version 2 has known protocol weaknesses and is now
deprecated, the default setting excludes "SSLv2". This means that
by default, SSL version 2 will not be used at the "encrypt" security
level. </p>
<p> Example: </p>
<pre>
@ -15713,11 +15693,12 @@ level. </p>
</DD>
<DT><b><a name="smtpd_tls_protocols">smtpd_tls_protocols</a>
(default: empty)</b></DT><DD>
(default: !SSLv2, !SSLv3)</b></DT><DD>
<p> List of TLS protocols that the Postfix SMTP server will exclude
or include with opportunistic TLS encryption. This parameter SHOULD
be left at its default empty value, allowing all protocols to be
or include with opportunistic TLS encryption. The default value is
"!SSLv2, !SSLv3" for Postfix releases after the middle of 2015,
empty for older releases allowing all protocols to be
used with opportunistic TLS. A non-empty value is a list of protocol
names separated by whitespace, commas or colons. The supported
protocol names are "SSLv2", "SSLv3" and "TLSv1", and are not case
@ -15729,7 +15710,7 @@ versions of Postfix &ge; 2.10 can disable support for "TLSv1.1" or
"TLSv1.2". </p>
<p> To include a protocol list its name, to exclude it, prefix the name
with a "!" character. To exclude SSLv2 even for opportunistic TLS set
with a "!" character. To exclude SSLv2 for opportunistic TLS set
"<a href="postconf.5.html#smtpd_tls_protocols">smtpd_tls_protocols</a> = !SSLv2". To exclude both "SSLv2" and "SSLv3" set
"<a href="postconf.5.html#smtpd_tls_protocols">smtpd_tls_protocols</a> = !SSLv2, !SSLv3". Explicitly listing the protocols to
include, rather than protocols to exclude, is supported, but not
@ -15738,7 +15719,7 @@ OpenSSL interface semantics. </p>
<p> Example: </p>
<pre>
<a href="postconf.5.html#smtpd_tls_protocols">smtpd_tls_protocols</a> = !SSLv2
<a href="postconf.5.html#smtpd_tls_protocols">smtpd_tls_protocols</a> = !SSLv2, !SSLv3
</pre>
<p> This feature is available in Postfix 2.6 and later. </p>
@ -16576,15 +16557,13 @@ EC algorithms have not been disabled by the vendor. </p>
(default: ALL:+RC4:@STRENGTH)</b></DT><DD>
<p> The OpenSSL cipherlist for "EXPORT" or higher grade ciphers. This
defines the meaning of the "export" setting in <a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>,
<a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and <a href="postconf.5.html#lmtp_tls_mandatory_ciphers">lmtp_tls_mandatory_ciphers</a>. This is
the cipherlist for the opportunistic ("may") TLS client security
level and is the default cipherlist for the SMTP server. You are
strongly encouraged to not change this setting. With OpenSSL 1.0.0 and
later the cipherlist may start with an "aNULL:" prefix, which restores
the 0.9.8-compatible ordering of the aNULL ciphers to the top of the
list when they are enabled. This prefix is not needed with previous
OpenSSL releases. </p>
defines the meaning of the "export" setting in <a href="postconf.5.html#smtpd_tls_ciphers">smtpd_tls_ciphers</a>,
<a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>, <a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a>, <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a>,
<a href="postconf.5.html#lmtp_tls_ciphers">lmtp_tls_ciphers</a>, and <a href="postconf.5.html#lmtp_tls_mandatory_ciphers">lmtp_tls_mandatory_ciphers</a>. With Postfix
releases before the middle of 2015 this is the default cipherlist
for the opportunistic ("may") TLS client security level and also
the default cipherlist for the SMTP server. You are strongly
encouraged to not change this setting. </p>
<p> This feature is available in Postfix 2.3 and later. </p>
@ -16595,13 +16574,10 @@ OpenSSL releases. </p>
(default: ALL:!EXPORT:!LOW:!MEDIUM:+RC4:@STRENGTH)</b></DT><DD>
<p> The OpenSSL cipherlist for "HIGH" grade ciphers. This defines
the meaning of the "high" setting in <a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>,
<a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and <a href="postconf.5.html#lmtp_tls_mandatory_ciphers">lmtp_tls_mandatory_ciphers</a>. You are
strongly encouraged to not change this setting. With OpenSSL 1.0.0 and
later the cipherlist may start with an "aNULL:" prefix, which restores
the 0.9.8-compatible ordering of the aNULL ciphers to the top of the
list when they are enabled. This prefix is not needed with previous
OpenSSL releases. </p>
the meaning of the "high" setting in <a href="postconf.5.html#smtpd_tls_ciphers">smtpd_tls_ciphers</a>,
<a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>, <a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a>, <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a>,
<a href="postconf.5.html#lmtp_tls_ciphers">lmtp_tls_ciphers</a>, and <a href="postconf.5.html#lmtp_tls_mandatory_ciphers">lmtp_tls_mandatory_ciphers</a>. You are strongly
encouraged to not change this setting. </p>
<p> This feature is available in Postfix 2.3 and later. </p>
@ -16631,13 +16607,10 @@ certificate public-key fingerprints, see <a href="TLS_README.html">TLS_README</a
(default: ALL:!EXPORT:+RC4:@STRENGTH)</b></DT><DD>
<p> The OpenSSL cipherlist for "LOW" or higher grade ciphers. This defines
the meaning of the "low" setting in <a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>,
<a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and <a href="postconf.5.html#lmtp_tls_mandatory_ciphers">lmtp_tls_mandatory_ciphers</a>. You are
strongly encouraged to not change this setting. With OpenSSL 1.0.0 and
later the cipherlist may start with an "aNULL:" prefix, which restores
the 0.9.8-compatible ordering of the aNULL ciphers to the top of the
list when they are enabled. This prefix is not needed with previous
OpenSSL releases. </p>
the meaning of the "low" setting in <a href="postconf.5.html#smtpd_tls_ciphers">smtpd_tls_ciphers</a>,
<a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>, <a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a>, <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a>,
<a href="postconf.5.html#lmtp_tls_ciphers">lmtp_tls_ciphers</a>, and <a href="postconf.5.html#lmtp_tls_mandatory_ciphers">lmtp_tls_mandatory_ciphers</a>. You are strongly
encouraged to not change this setting. </p>
<p> This feature is available in Postfix 2.3 and later. </p>
@ -16648,15 +16621,14 @@ OpenSSL releases. </p>
(default: ALL:!EXPORT:!LOW:+RC4:@STRENGTH)</b></DT><DD>
<p> The OpenSSL cipherlist for "MEDIUM" or higher grade ciphers. This
defines the meaning of the "medium" setting in <a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>,
<a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a> and <a href="postconf.5.html#lmtp_tls_mandatory_ciphers">lmtp_tls_mandatory_ciphers</a>. This is
the default cipherlist for mandatory TLS encryption in the TLS
client (with anonymous ciphers disabled when verifying server
certificates). You are strongly encouraged to not change this
setting. With OpenSSL 1.0.0 and later the cipherlist may start with an
"aNULL:" prefix, which restores the 0.9.8-compatible ordering of the
aNULL ciphers to the top of the list when they are enabled. This prefix
is not needed with previous OpenSSL releases. </p>
defines the meaning of the "medium" setting in <a href="postconf.5.html#smtpd_tls_ciphers">smtpd_tls_ciphers</a>,
<a href="postconf.5.html#smtpd_tls_mandatory_ciphers">smtpd_tls_mandatory_ciphers</a>, <a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a>, <a href="postconf.5.html#smtp_tls_mandatory_ciphers">smtp_tls_mandatory_ciphers</a>,
<a href="postconf.5.html#lmtp_tls_ciphers">lmtp_tls_ciphers</a>, and <a href="postconf.5.html#lmtp_tls_mandatory_ciphers">lmtp_tls_mandatory_ciphers</a>. This is the
default cipherlist for mandatory TLS encryption in the TLS client
(with anonymous ciphers disabled when verifying server certificates).
This is the default cipherlist for opportunistic TLS with Postfix
releases after the middle of 2015. You are strongly encouraged to
not change this setting. </p>
<p> This feature is available in Postfix 2.3 and later. </p>

6
postfix/html/smtp.8.html
View File

@ -432,7 +432,7 @@ SMTP(8) SMTP(8)
policy by next-hop destination; when a non-empty value is speci-
fied, this overrides the obsolete <a href="postconf.5.html#smtp_tls_per_site">smtp_tls_per_site</a> parameter.
<b><a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> (!SSLv2)</b>
<b><a href="postconf.5.html#smtp_tls_mandatory_protocols">smtp_tls_mandatory_protocols</a> (!SSLv2, !SSLv3)</b>
List of SSL/TLS protocols that the Postfix SMTP client will use
with mandatory TLS encryption.
@ -497,11 +497,11 @@ SMTP(8) SMTP(8)
Available in Postfix version 2.6 and later:
<b><a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a> (!SSLv2)</b>
<b><a href="postconf.5.html#smtp_tls_protocols">smtp_tls_protocols</a> (!SSLv2, !SSLv3)</b>
List of TLS protocols that the Postfix SMTP client will exclude
or include with opportunistic TLS encryption.
<b><a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a> (export)</b>
<b><a href="postconf.5.html#smtp_tls_ciphers">smtp_tls_ciphers</a> (medium)</b>
The minimum TLS cipher grade that the Postfix SMTP client will
use with opportunistic TLS encryption.

6
postfix/html/smtpd.8.html
View File

@ -446,7 +446,7 @@ SMTPD(8) SMTPD(8)
Postfix SMTP server cipher list at mandatory TLS security lev-
els.
<b><a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a> (!SSLv2)</b>
<b><a href="postconf.5.html#smtpd_tls_mandatory_protocols">smtpd_tls_mandatory_protocols</a> (!SSLv2, !SSLv3)</b>
The SSL/TLS protocols accepted by the Postfix SMTP server with
mandatory TLS encryption.
@ -494,11 +494,11 @@ SMTPD(8) SMTPD(8)
Available in Postfix version 2.6 and later:
<b><a href="postconf.5.html#smtpd_tls_protocols">smtpd_tls_protocols</a> (empty)</b>
<b><a href="postconf.5.html#smtpd_tls_protocols">smtpd_tls_protocols</a> (!SSLv2, !SSLv3)</b>
List of TLS protocols that the Postfix SMTP server will exclude
or include with opportunistic TLS encryption.
<b><a href="postconf.5.html#smtpd_tls_ciphers">smtpd_tls_ciphers</a> (export)</b>
<b><a href="postconf.5.html#smtpd_tls_ciphers">smtpd_tls_ciphers</a> (medium)</b>
The minimum TLS cipher grade that the Postfix SMTP server will
use with opportunistic TLS encryption.

4
postfix/makedefs
View File

@ -109,6 +109,8 @@ case $# in
# Officially supported usage.
0) SYSTEM=`(uname -s) 2>/dev/null`
RELEASE=`(uname -r) 2>/dev/null`
# No ${x%%y} support in Solaris 11 /bin/sh
RELEASE_MAJOR=`expr "$RELEASE" : '\([0-9]*\)'` || exit 1
VERSION=`(uname -v) 2>/dev/null`
case "$VERSION" in
dcosx*) SYSTEM=$VERSION;;
@ -365,7 +367,7 @@ EOF
fi;;
esac
;;
Linux.3*) SYSTYPE=LINUX3
Linux.[34].*) SYSTYPE=LINUX$RELEASE_MAJOR
case "$CCARGS" in
*-DNO_DB*) ;;
*-DHAS_DB*) ;;

177
postfix/man/man5/postconf.5
View File

@ -2711,7 +2711,7 @@ The LMTP-specific version of the smtp_tls_cert_file
configuration parameter. See there for details.
.PP
This feature is available in Postfix 2.3 and later.
.SH lmtp_tls_ciphers (default: export)
.SH lmtp_tls_ciphers (default: medium)
The LMTP-specific version of the smtp_tls_ciphers configuration
parameter. See there for details.
.PP
@ -2773,7 +2773,7 @@ The LMTP-specific version of the smtp_tls_loglevel
configuration parameter. See there for details.
.PP
This feature is available in Postfix 2.3 and later.
.SH lmtp_tls_mandatory_ciphers (default: empty)
.SH lmtp_tls_mandatory_ciphers (default: medium)
The LMTP-specific version of the smtp_tls_mandatory_ciphers
configuration parameter. See there for details.
.PP
@ -2783,7 +2783,7 @@ The LMTP-specific version of the smtp_tls_mandatory_exclude_ciphers
configuration parameter. See there for details.
.PP
This feature is available in Postfix 2.3 and later.
.SH lmtp_tls_mandatory_protocols (default: !SSLv2)
.SH lmtp_tls_mandatory_protocols (default: !SSLv2, !SSLv3)
The LMTP-specific version of the smtp_tls_mandatory_protocols
configuration parameter. See there for details.
.PP
@ -2803,7 +2803,7 @@ The LMTP-specific version of the smtp_tls_policy_maps
configuration parameter. See there for details.
.PP
This feature is available in Postfix 2.3 and later.
.SH lmtp_tls_protocols (default: empty)
.SH lmtp_tls_protocols (default: !SSLv2, !SSLv3)
The LMTP-specific version of the smtp_tls_protocols configuration
parameter. See there for details.
.PP
@ -6777,29 +6777,19 @@ control over the TLS software and settings of the peer servers.
.PP
This feature is available in Postfix version 2.2. It is not used with
Postfix 2.3 and later; use smtp_tls_mandatory_ciphers instead.
.SH smtp_tls_ciphers (default: export)
.SH smtp_tls_ciphers (default: medium)
The minimum TLS cipher grade that the Postfix SMTP client
will use with opportunistic TLS encryption. Cipher types listed in
smtp_tls_exclude_ciphers are excluded from the base definition of
the selected cipher grade. The default value "export" ensures maximum
inter-operability. Because encryption is optional, stronger controls
are not appropriate, and this setting SHOULD NOT be changed unless the
change is essential.
the selected cipher grade. The default value is "medium" for
Postfix releases after the middle of 2015, "export" for older
releases.
.PP
When TLS is mandatory the cipher grade is chosen via the
smtp_tls_mandatory_ciphers configuration parameter, see there for syntax
details. See smtp_tls_policy_maps for information on how to configure
ciphers on a per-destination basis.
.PP
Example:
.nf
.na
.ft C
smtp_tls_ciphers = export
.fi
.ad
.ft R
.PP
This feature is available in Postfix 2.6 and later. With earlier Postfix
releases only the smtp_tls_mandatory_ciphers parameter is implemented,
and opportunistic TLS always uses "export" or better (i.e. all) ciphers.
@ -7157,18 +7147,16 @@ on a per-destination basis.
.PP
The following cipher grades are supported:
.IP "\fBexport\fR"
Enable "EXPORT" grade or better OpenSSL
ciphers. This is the default for opportunistic encryption. It is
not recommended for mandatory encryption unless you must enforce TLS
with "crippled" peers. The underlying cipherlist is specified via the
tls_export_cipherlist configuration parameter, which you are strongly
encouraged to not change.
Enable "EXPORT" grade or better OpenSSL ciphers. The underlying
cipherlist is specified via the tls_export_cipherlist configuration
parameter, which you are strongly encouraged to not change. This
choice is insecure and SHOULD NOT be used.
.br
.IP "\fBlow\fR"
Enable "LOW" grade or better OpenSSL ciphers. This
setting is only appropriate for internal mail servers. The underlying
Enable "LOW" grade or better OpenSSL ciphers. The underlying
cipherlist is specified via the tls_low_cipherlist configuration
parameter, which you are strongly encouraged to not change.
parameter, which you are strongly encouraged to not change. This
choice is insecure and SHOULD NOT be used.
.br
.IP "\fBmedium\fR"
Enable "MEDIUM" grade or better OpenSSL ciphers.
@ -7217,13 +7205,15 @@ specified on a per-destination basis via the TLS policy "exclude"
attribute. See smtp_tls_policy_maps for notes and examples.
.PP
This feature is available in Postfix 2.3 and later.
.SH smtp_tls_mandatory_protocols (default: !SSLv2)
.SH smtp_tls_mandatory_protocols (default: !SSLv2, !SSLv3)
List of SSL/TLS protocols that the Postfix SMTP client will use with
mandatory TLS encryption. In main.cf the values are separated by
whitespace, commas or colons. In the policy table "protocols" attribute
(see smtp_tls_policy_maps) the only valid separator is colon. An
empty value means allow all protocols. The valid protocol names, (see
\\fBfBSSL_get_version\fR(3)\fR), are "SSLv2", "SSLv3" and "TLSv1".
\\fBfBSSL_get_version\fR(3)\fR), are "SSLv2", "SSLv3" and "TLSv1". The
default value is "!SSLv2, !SSLv3" for Postfix releases after the
middle of 2015, "!SSLv2" for older releases.
.PP
With Postfix >= 2.5 the parameter syntax was expanded to support
protocol exclusions. One can explicitly exclude "SSLv2" by setting
@ -7270,11 +7260,6 @@ SNI is required. If you use "dane" or "dane-only" do not disable
TLSv1, except perhaps via the policy table for destinations which
you are sure will support "TLSv1.1" or "TLSv1.2".
.PP
Since SSL version 2 has known protocol weaknesses and is now
deprecated, the default setting excludes "SSLv2". This means that by
default, SSL version 2 will not be used at the "encrypt" security level
and higher.
.PP
See the documentation of the smtp_tls_policy_maps parameter and
TLS_README for more information about security levels.
.PP
@ -7539,11 +7524,12 @@ DNS forgery. Do not use the \fBhostname\fR strategy for secure-channel
configurations in environments where DNS security is not assured.
.PP
This feature is available in Postfix 2.3 and later.
.SH smtp_tls_protocols (default: !SSLv2)
.SH smtp_tls_protocols (default: !SSLv2, !SSLv3)
List of TLS protocols that the Postfix SMTP client will exclude or
include with opportunistic TLS encryption. Starting with Postfix 2.6,
the Postfix SMTP client will by default not use the obsolete SSLv2
protocol.
include with opportunistic TLS encryption. The default value is
"!SSLv2, !SSLv3" for Postfix releases after the middle of 2015,
"!SSLv2" for older releases. Before Postfix 2.6, the Postfix SMTP
client would use all protocols with opportunistic TLS.
.PP
In main.cf the values are separated by whitespace, commas or
colons. In the policy table (see smtp_tls_policy_maps) the only valid
@ -7574,7 +7560,7 @@ versions of Postfix >= 2.10 can explicitly disable support for
"TLSv1.1" or "TLSv1.2"
.PP
To include a protocol list its name, to exclude it, prefix the name
with a "!" character. To exclude SSLv2 even for opportunistic TLS set
with a "!" character. To exclude SSLv2 for opportunistic TLS set
"smtp_tls_protocols = !SSLv2". To exclude both "SSLv2" and "SSLv3" set
"smtp_tls_protocols = !SSLv2, !SSLv3". Explicitly listing the protocols to
include, rather than protocols to exclude, is supported, but not
@ -7770,7 +7756,7 @@ smtp_tls_security_level = may
# can be mitigated by disabling a particular protocol or raising the
# cipher grade from "export" to "low" or "medium").
smtp_tls_ciphers = export
smtp_tls_protocols = !SSLv2
smtp_tls_protocols = !SSLv2, !SSLv3
.fi
.ad
.ft R
@ -10202,28 +10188,17 @@ clients.
.PP
This feature is available with Postfix version 2.2. It is not used with
Postfix 2.3 and later; use smtpd_tls_mandatory_ciphers instead.
.SH smtpd_tls_ciphers (default: export)
.SH smtpd_tls_ciphers (default: medium)
The minimum TLS cipher grade that the Postfix SMTP server
will use with opportunistic TLS encryption. Cipher types listed in
smtpd_tls_exclude_ciphers are excluded from the base definition of
the selected cipher grade. The default value "export" ensures maximum
inter-operability. Because encryption is optional, stronger controls
are not appropriate, and this setting SHOULD NOT be changed unless the
change is essential.
the selected cipher grade. The default value is "medium" for Postfix
releases after the middle of 2015, "export" for older releases.
.PP
When TLS is mandatory the cipher grade is chosen via the
smtpd_tls_mandatory_ciphers configuration parameter, see there for syntax
details.
.PP
Example:
.nf
.na
.ft C
smtpd_tls_ciphers = export
.fi
.ad
.ft R
.PP
This feature is available in Postfix 2.6 and later. With earlier Postfix
releases only the smtpd_tls_mandatory_ciphers parameter is implemented,
and opportunistic TLS always uses "export" or better (i.e. all) ciphers.
@ -10594,17 +10569,16 @@ one "medium" or "high" grade cipher.
.PP
The following cipher grades are supported:
.IP "\fBexport\fR"
Enable "EXPORT" grade or stronger OpenSSL ciphers.
This is the most appropriate setting for public MX hosts, and is always
used with opportunistic TLS encryption. The underlying cipherlist
is specified via the tls_export_cipherlist configuration parameter,
which you are strongly encouraged to not change.
Enable "EXPORT" grade or stronger OpenSSL ciphers. The
underlying cipherlist is specified via the tls_export_cipherlist
configuration parameter, which you are strongly encouraged to not
change. This choice is insecure and SHOULD NOT be used.
.br
.IP "\fBlow\fR"
Enable "LOW" grade or stronger OpenSSL ciphers. The
underlying cipherlist is specified via the tls_low_cipherlist
configuration parameter, which you are strongly encouraged to
not change.
Enable "LOW" grade or stronger OpenSSL ciphers. The underlying
cipherlist is specified via the tls_low_cipherlist configuration
parameter, which you are strongly encouraged to not change. This
choice is insecure and SHOULD NOT be used.
.br
.IP "\fBmedium\fR"
Enable "MEDIUM" grade or stronger OpenSSL ciphers. These use 128-bit
@ -10653,13 +10627,15 @@ works in addition to the exclusions listed with smtpd_tls_exclude_ciphers
(see there for syntax details).
.PP
This feature is available in Postfix 2.3 and later.
.SH smtpd_tls_mandatory_protocols (default: !SSLv2)
.SH smtpd_tls_mandatory_protocols (default: !SSLv2, !SSLv3)
The SSL/TLS protocols accepted by the Postfix SMTP server with
mandatory TLS encryption. If the list is empty, the server supports
all available SSL/TLS protocol versions. A non-empty value is a
list of protocol names separated by whitespace, commas or colons.
The supported protocol names are "SSLv2", "SSLv3" and "TLSv1", and
are not case sensitive.
are not case sensitive. The default value is "!SSLv2, !SSLv3" for
Postfix releases after the middle of 2015, "!SSLv2" for older
releases.
.PP
With Postfix >= 2.5 the parameter syntax was expanded to support
protocol exclusions. One can explicitly exclude "SSLv2" by setting
@ -10676,11 +10652,6 @@ disabled. The latest patch levels of Postfix >= 2.6, and all
versions of Postfix >= 2.10 can disable support for "TLSv1.1" or
"TLSv1.2".
.PP
Since SSL version 2 has known protocol weaknesses and is now
deprecated, the default setting excludes "SSLv2". This means that
by default, SSL version 2 will not be used at the "encrypt" security
level.
.PP
Example:
.PP
.nf
@ -10695,10 +10666,11 @@ smtpd_tls_mandatory_protocols = TLSv1
.ft R
.PP
This feature is available in Postfix 2.3 and later.
.SH smtpd_tls_protocols (default: empty)
.SH smtpd_tls_protocols (default: !SSLv2, !SSLv3)
List of TLS protocols that the Postfix SMTP server will exclude
or include with opportunistic TLS encryption. This parameter SHOULD
be left at its default empty value, allowing all protocols to be
or include with opportunistic TLS encryption. The default value is
"!SSLv2, !SSLv3" for Postfix releases after the middle of 2015,
empty for older releases allowing all protocols to be
used with opportunistic TLS. A non-empty value is a list of protocol
names separated by whitespace, commas or colons. The supported
protocol names are "SSLv2", "SSLv3" and "TLSv1", and are not case
@ -10710,7 +10682,7 @@ versions of Postfix >= 2.10 can disable support for "TLSv1.1" or
"TLSv1.2".
.PP
To include a protocol list its name, to exclude it, prefix the name
with a "!" character. To exclude SSLv2 even for opportunistic TLS set
with a "!" character. To exclude SSLv2 for opportunistic TLS set
"smtpd_tls_protocols = !SSLv2". To exclude both "SSLv2" and "SSLv3" set
"smtpd_tls_protocols = !SSLv2, !SSLv3". Explicitly listing the protocols to
include, rather than protocols to exclude, is supported, but not
@ -10721,7 +10693,7 @@ Example:
.nf
.na
.ft C
smtpd_tls_protocols = !SSLv2
smtpd_tls_protocols = !SSLv2, !SSLv3
.fi
.ad
.ft R
@ -11329,26 +11301,21 @@ compiled and linked with OpenSSL 1.0.0 or later on platforms where
EC algorithms have not been disabled by the vendor.
.SH tls_export_cipherlist (default: ALL:+RC4:@STRENGTH)
The OpenSSL cipherlist for "EXPORT" or higher grade ciphers. This
defines the meaning of the "export" setting in smtpd_tls_mandatory_ciphers,
smtp_tls_mandatory_ciphers and lmtp_tls_mandatory_ciphers. This is
the cipherlist for the opportunistic ("may") TLS client security
level and is the default cipherlist for the SMTP server. You are
strongly encouraged to not change this setting. With OpenSSL 1.0.0 and
later the cipherlist may start with an "aNULL:" prefix, which restores
the 0.9.8-compatible ordering of the aNULL ciphers to the top of the
list when they are enabled. This prefix is not needed with previous
OpenSSL releases.
defines the meaning of the "export" setting in smtpd_tls_ciphers,
smtpd_tls_mandatory_ciphers, smtp_tls_ciphers, smtp_tls_mandatory_ciphers,
lmtp_tls_ciphers, and lmtp_tls_mandatory_ciphers. With Postfix
releases before the middle of 2015 this is the default cipherlist
for the opportunistic ("may") TLS client security level and also
the default cipherlist for the SMTP server. You are strongly
encouraged to not change this setting.
.PP
This feature is available in Postfix 2.3 and later.
.SH tls_high_cipherlist (default: ALL:!EXPORT:!LOW:!MEDIUM:+RC4:@STRENGTH)
The OpenSSL cipherlist for "HIGH" grade ciphers. This defines
the meaning of the "high" setting in smtpd_tls_mandatory_ciphers,
smtp_tls_mandatory_ciphers and lmtp_tls_mandatory_ciphers. You are
strongly encouraged to not change this setting. With OpenSSL 1.0.0 and
later the cipherlist may start with an "aNULL:" prefix, which restores
the 0.9.8-compatible ordering of the aNULL ciphers to the top of the
list when they are enabled. This prefix is not needed with previous
OpenSSL releases.
the meaning of the "high" setting in smtpd_tls_ciphers,
smtpd_tls_mandatory_ciphers, smtp_tls_ciphers, smtp_tls_mandatory_ciphers,
lmtp_tls_ciphers, and lmtp_tls_mandatory_ciphers. You are strongly
encouraged to not change this setting.
.PP
This feature is available in Postfix 2.3 and later.
.SH tls_legacy_public_key_fingerprints (default: no)
@ -11366,26 +11333,22 @@ certificate public-key fingerprints, see TLS_README.
This feature is available in Postfix 2.9.6 and later.
.SH tls_low_cipherlist (default: ALL:!EXPORT:+RC4:@STRENGTH)
The OpenSSL cipherlist for "LOW" or higher grade ciphers. This defines
the meaning of the "low" setting in smtpd_tls_mandatory_ciphers,
smtp_tls_mandatory_ciphers and lmtp_tls_mandatory_ciphers. You are
strongly encouraged to not change this setting. With OpenSSL 1.0.0 and
later the cipherlist may start with an "aNULL:" prefix, which restores
the 0.9.8-compatible ordering of the aNULL ciphers to the top of the
list when they are enabled. This prefix is not needed with previous
OpenSSL releases.
the meaning of the "low" setting in smtpd_tls_ciphers,
smtpd_tls_mandatory_ciphers, smtp_tls_ciphers, smtp_tls_mandatory_ciphers,
lmtp_tls_ciphers, and lmtp_tls_mandatory_ciphers. You are strongly
encouraged to not change this setting.
.PP
This feature is available in Postfix 2.3 and later.
.SH tls_medium_cipherlist (default: ALL:!EXPORT:!LOW:+RC4:@STRENGTH)
The OpenSSL cipherlist for "MEDIUM" or higher grade ciphers. This
defines the meaning of the "medium" setting in smtpd_tls_mandatory_ciphers,
smtp_tls_mandatory_ciphers and lmtp_tls_mandatory_ciphers. This is
the default cipherlist for mandatory TLS encryption in the TLS
client (with anonymous ciphers disabled when verifying server
certificates). You are strongly encouraged to not change this
setting. With OpenSSL 1.0.0 and later the cipherlist may start with an
"aNULL:" prefix, which restores the 0.9.8-compatible ordering of the
aNULL ciphers to the top of the list when they are enabled. This prefix
is not needed with previous OpenSSL releases.
defines the meaning of the "medium" setting in smtpd_tls_ciphers,
smtpd_tls_mandatory_ciphers, smtp_tls_ciphers, smtp_tls_mandatory_ciphers,
lmtp_tls_ciphers, and lmtp_tls_mandatory_ciphers. This is the
default cipherlist for mandatory TLS encryption in the TLS client
(with anonymous ciphers disabled when verifying server certificates).
This is the default cipherlist for opportunistic TLS with Postfix
releases after the middle of 2015. You are strongly encouraged to
not change this setting.
.PP
This feature is available in Postfix 2.3 and later.
.SH tls_null_cipherlist (default: eNULL:!aNULL)

6
postfix/man/man8/smtp.8
View File

@ -401,7 +401,7 @@ when TLS is not already enabled for that server.
Optional lookup tables with the Postfix SMTP client TLS security
policy by next-hop destination; when a non-empty value is specified,
this overrides the obsolete smtp_tls_per_site parameter.
.IP "\fBsmtp_tls_mandatory_protocols (!SSLv2)\fR"
.IP "\fBsmtp_tls_mandatory_protocols (!SSLv2, !SSLv3)\fR"
List of SSL/TLS protocols that the Postfix SMTP client will use with
mandatory TLS encryption.
.IP "\fBsmtp_tls_scert_verifydepth (9)\fR"
@ -451,10 +451,10 @@ The message digest algorithm used to construct remote SMTP server
certificate fingerprints.
.PP
Available in Postfix version 2.6 and later:
.IP "\fBsmtp_tls_protocols (!SSLv2)\fR"
.IP "\fBsmtp_tls_protocols (!SSLv2, !SSLv3)\fR"
List of TLS protocols that the Postfix SMTP client will exclude or
include with opportunistic TLS encryption.
.IP "\fBsmtp_tls_ciphers (export)\fR"
.IP "\fBsmtp_tls_ciphers (medium)\fR"
The minimum TLS cipher grade that the Postfix SMTP client
will use with opportunistic TLS encryption.
.IP "\fBsmtp_tls_eccert_file (empty)\fR"

6
postfix/man/man8/smtpd.8
View File

@ -414,7 +414,7 @@ use with mandatory TLS encryption.
.IP "\fBsmtpd_tls_mandatory_exclude_ciphers (empty)\fR"
Additional list of ciphers or cipher types to exclude from the
Postfix SMTP server cipher list at mandatory TLS security levels.
.IP "\fBsmtpd_tls_mandatory_protocols (!SSLv2)\fR"
.IP "\fBsmtpd_tls_mandatory_protocols (!SSLv2, !SSLv3)\fR"
The SSL/TLS protocols accepted by the Postfix SMTP server with
mandatory TLS encryption.
.IP "\fBsmtpd_tls_received_header (no)\fR"
@ -452,10 +452,10 @@ fingerprints or public key fingerprints (Postfix 2.9 and later)
for \fBcheck_ccert_access\fR and \fBpermit_tls_clientcerts\fR.
.PP
Available in Postfix version 2.6 and later:
.IP "\fBsmtpd_tls_protocols (empty)\fR"
.IP "\fBsmtpd_tls_protocols (!SSLv2, !SSLv3)\fR"
List of TLS protocols that the Postfix SMTP server will exclude
or include with opportunistic TLS encryption.
.IP "\fBsmtpd_tls_ciphers (export)\fR"
.IP "\fBsmtpd_tls_ciphers (medium)\fR"
The minimum TLS cipher grade that the Postfix SMTP server
will use with opportunistic TLS encryption.
.IP "\fBsmtpd_tls_eccert_file (empty)\fR"

70
postfix/proto/TLS_README.html
View File

@ -810,14 +810,16 @@ to Postfix 2.9.6 or later. </p>
<h3><a name="server_cipher">Server-side cipher controls</a> </h3>
<p> The Postfix SMTP server supports 5 distinct cipher security levels
as specified by the smtpd_tls_mandatory_ciphers configuration parameter,
which determines the cipher grade with mandatory TLS encryption. The
default value is "medium" which is essentially 128-bit encryption or better.
With opportunistic TLS encryption, the minimum accepted cipher grade is
typically "export". The corresponding smtpd_tls_ciphers parameter
(Postfix &ge; 2.6) controls the cipher grade used with opportunistic
TLS. </p>
<p> The Postfix SMTP server supports 5 distinct cipher grades as
specified by the smtpd_tls_mandatory_ciphers configuration parameter,
which determines the minimum cipher grade with mandatory TLS
encryption. The default minimum cipher grade for mandatory TLS is
"medium" which is essentially 128-bit encryption or better. The
smtpd_tls_ciphers parameter (Postfix &ge; 2.6) controls the minimum
cipher grade used with opportunistic TLS. Here, the default minimum
cipher grade is "medium" for Postfix releases after the middle of
2015, "export" for older Postfix releases. With Postfix &lt; 2.6,
the minimum opportunistic TLS cipher grade is always "export". </p>
<p> By default anonymous ciphers are enabled. They are automatically
disabled when remote SMTP client certificates are requested. If
@ -828,17 +830,12 @@ by setting "smtpd_tls_mandatory_exclude_ciphers = aNULL" or
a remote SMTP client to check the server certificate, so excluding
anonymous ciphers is generally unnecessary. </p>
<p> The "smtpd_tls_ciphers" configuration parameter (Postfix &ge;
2.6) provides control over the minimum cipher grade for opportunistic
TLS. With
Postfix &lt; 2.6, the minimum opportunistic TLS cipher grade is always
"export". </p>
<p> With mandatory TLS encryption, the Postfix SMTP server will by
default disable SSLv2. SSLv2 is used only when TLS encryption
is optional. The mandatory TLS protocol list is specified via the
<p> With mandatory and opportunistic TLS encryption, the Postfix
SMTP server by default disables SSLv2 and SSLv3 with Postfix releases
after the middle of 2015; older releases only disable SSLv2 for
mandatory TLS. The mandatory TLS protocol list is specified via the
smtpd_tls_mandatory_protocols configuration parameter. The
corresponding smtpd_tls_protocols parameter (Postfix &ge; 2.6)
smtpd_tls_protocols parameter (Postfix &ge; 2.6)
controls the SSL/TLS protocols used with opportunistic TLS. </p>
<p> Note that the OpenSSL library only supports protocol exclusion
@ -1080,14 +1077,11 @@ is supported by the server. Otherwise, messages are sent in the clear.
Opportunistic TLS can be configured by setting "smtp_tls_security_level = may".
For LMTP, use the corresponding "lmtp_" parameter. </p>
<p> Since sending in the clear is acceptable, demanding stronger
than default TLS security mostly reduces inter-operability. If you
must restrict TLS protocol or cipher selection even with opportunistic
TLS, the "smtp_tls_ciphers" and "smtp_tls_protocols" configuration
parameters (Postfix &ge; 2.6) provide control over the protocols
and cipher grade
used with opportunistic TLS. With earlier releases the opportunistic TLS
cipher grade is always "export" and no protocols are disabled. </p>
<p> The "smtp_tls_ciphers" and "smtp_tls_protocols" configuration
parameters (Postfix &ge; 2.6) provide control over the cipher grade
and protocols used with opportunistic TLS. With earlier Postfix
releases, opportunistic TLS always uses the cipher grade "export"
and enables all protocols. </p>
<p> With opportunistic TLS, mail delivery continues even if the
server certificate is untrusted or bears the wrong name.
@ -1163,7 +1157,7 @@ table</a>, specify the "encrypt" security level.
<p> In the example below, traffic to <i>example.com</i> and its sub-domains
via the corresponding MX hosts always uses TLS. The SSLv2 protocol
will be disabled (the default setting of smtp_tls_mandatory_protocols
excludes "SSLv2"). Only high- or medium-strength (i.e. 128 bit or
excludes SSLv2+3). Only high- or medium-strength (i.e. 128 bit or
better) ciphers will be used by default for all "encrypt" security
level sessions. </p>
@ -2143,7 +2137,7 @@ DNSSEC. If no TLSA records are found, the effective security level
used is <a href="#client_tls_may">may</a>. If TLSA records are
found, but none are usable, the effective security level is <a
href="#client_tls_encrypt">encrypt</a>. When usable TLSA records
are obtained for the remote SMTP server, SSLv2 is automatically
are obtained for the remote SMTP server, SSLv2+3 are automatically
disabled (see smtp_tls_mandatory_protocols), and the server certificate
must match the TLSA records. RFC 6698 (DANE) TLS authentication
and DNSSEC support is available with Postfix 2.11 and later. </dd>
@ -2152,7 +2146,7 @@ and DNSSEC support is available with Postfix 2.11 and later. </dd>
The TLS policy for the destination is obtained via TLSA records in
DNSSEC. If no TLSA records are found, or none are usable, no
connection is made to the server. When usable TLSA records are
obtained for the remote SMTP server, SSLv2 is automatically disabled
obtained for the remote SMTP server, SSLv2+3 are automatically disabled
(see smtp_tls_mandatory_protocols), and the server certificate must
match the TLSA records. RFC 6698 (DANE) TLS authentication and
DNSSEC support is available with Postfix 2.11 and later. </dd>
@ -2318,7 +2312,7 @@ configured to supply its intermediate CA certificate). </p>
<h3> <a name="client_cipher">Client-side cipher controls </a> </h3>
<p> The Postfix SMTP client supports 5 distinct cipher security levels
<p> The Postfix SMTP client supports 5 distinct cipher grades
as specified by the smtp_tls_mandatory_ciphers configuration
parameter. This setting controls the minimum acceptable SMTP client
TLS cipher grade for use with mandatory TLS encryption. The default
@ -2339,13 +2333,15 @@ and TLS session cache space, if certificates are ignored, there is
little point in requesting them. </p>
<p> The "smtp_tls_ciphers" configuration parameter (Postfix &ge; 2.6)
provides control over the minimum cipher grade for opportunistic TLS. With
Postfix &lt; 2.6, the minimum opportunistic TLS cipher grade is always
"export". </p>
provides control over the minimum cipher grade for opportunistic TLS.
The default minimum cipher grade for opportunistic TLS is "medium"
for Postfix releases after the middle of 2015, and "export" for
older releases. With Postfix &lt; 2.6, the minimum opportunistic
TLS cipher grade is always "export". </p>
<p> With mandatory TLS encryption, the Postfix SMTP client will by
default disable SSLv2. SSLv2 is used only when TLS encryption
is optional. The mandatory TLS protocol list is specified via the
<p> With mandatory and opportunistic TLS encryption, the Postfix
SMTP client will by default disable SSLv2 and SSLv3. The mandatory
TLS protocol list is specified via the
smtp_tls_mandatory_protocols configuration parameter. The corresponding
smtp_tls_protocols parameter (Postfix &ge; 2.6) controls
the SSL/TLS protocols used with opportunistic TLS. </p>
@ -2363,7 +2359,7 @@ the SSL/TLS protocols used with opportunistic TLS. </p>
# Legacy form for Postfix &lt; 2.5:
smtp_tls_mandatory_protocols = SSLv3, TLSv1
# Also available with Postfix &ge; 2.6:
smtp_tls_ciphers = export
smtp_tls_ciphers = medium
smtp_tls_protocols = !SSLv2
</pre>
</blockquote>

170
postfix/proto/postconf.proto
View File

@ -10784,14 +10784,16 @@ configurations in environments where DNS security is not assured. </p>
<p> This feature is available in Postfix 2.3 and later. </p>
%PARAM smtp_tls_mandatory_protocols !SSLv2
%PARAM smtp_tls_mandatory_protocols !SSLv2, !SSLv3
<p> List of SSL/TLS protocols that the Postfix SMTP client will use with
mandatory TLS encryption. In main.cf the values are separated by
whitespace, commas or colons. In the policy table "protocols" attribute
(see smtp_tls_policy_maps) the only valid separator is colon. An
empty value means allow all protocols. The valid protocol names, (see
<b>SSL_get_version(3)</b>), are "SSLv2", "SSLv3" and "TLSv1". </p>
<b>SSL_get_version(3)</b>), are "SSLv2", "SSLv3" and "TLSv1". The
default value is "!SSLv2, !SSLv3" for Postfix releases after the
middle of 2015, "!SSLv2" for older releases. </p>
<p> With Postfix &ge; 2.5 the parameter syntax was expanded to support
protocol exclusions. One can explicitly exclude "SSLv2" by setting
@ -10834,11 +10836,6 @@ SNI is required. If you use "dane" or "dane-only" do not disable
TLSv1, except perhaps via the policy table for destinations which
you are sure will support "TLSv1.1" or "TLSv1.2". </p>
<p> Since SSL version 2 has known protocol weaknesses and is now
deprecated, the default setting excludes "SSLv2". This means that by
default, SSL version 2 will not be used at the "encrypt" security level
and higher. </p>
<p> See the documentation of the smtp_tls_policy_maps parameter and
TLS_README for more information about security levels. </p>
@ -10977,7 +10974,7 @@ configuration parameter. See there for details. </p>
<p> This feature is available in Postfix 2.3 and later. </p>
%PARAM lmtp_tls_mandatory_protocols !SSLv2
%PARAM lmtp_tls_mandatory_protocols !SSLv2, !SSLv3
<p> The LMTP-specific version of the smtp_tls_mandatory_protocols
configuration parameter. See there for details. </p>
@ -10998,14 +10995,16 @@ configuration parameter. See there for details. </p>
<p> This feature is available in Postfix 2.3 and later. </p>
%PARAM smtpd_tls_mandatory_protocols !SSLv2
%PARAM smtpd_tls_mandatory_protocols !SSLv2, !SSLv3
<p> The SSL/TLS protocols accepted by the Postfix SMTP server with
mandatory TLS encryption. If the list is empty, the server supports
all available SSL/TLS protocol versions. A non-empty value is a
list of protocol names separated by whitespace, commas or colons.
The supported protocol names are "SSLv2", "SSLv3" and "TLSv1", and
are not case sensitive. </p>
are not case sensitive. The default value is "!SSLv2, !SSLv3" for
Postfix releases after the middle of 2015, "!SSLv2" for older
releases. </p>
<p> With Postfix &ge; 2.5 the parameter syntax was expanded to support
protocol exclusions. One can explicitly exclude "SSLv2" by setting
@ -11022,11 +11021,6 @@ disabled. The latest patch levels of Postfix &ge; 2.6, and all
versions of Postfix &ge; 2.10 can disable support for "TLSv1.1" or
"TLSv1.2". </p>
<p> Since SSL version 2 has known protocol weaknesses and is now
deprecated, the default setting excludes "SSLv2". This means that
by default, SSL version 2 will not be used at the "encrypt" security
level. </p>
<p> Example: </p>
<pre>
@ -11161,7 +11155,7 @@ smtp_tls_security_level = may
# can be mitigated by disabling a particular protocol or raising the
# cipher grade from "export" to "low" or "medium").
smtp_tls_ciphers = export
smtp_tls_protocols = !SSLv2
smtp_tls_protocols = !SSLv2, !SSLv3
</pre>
<pre>
@ -11419,17 +11413,16 @@ one "medium" or "high" grade cipher. </p>
<dl>
<dt><b>export</b></dt>
<dd> Enable "EXPORT" grade or stronger OpenSSL ciphers.
This is the most appropriate setting for public MX hosts, and is always
used with opportunistic TLS encryption. The underlying cipherlist
is specified via the tls_export_cipherlist configuration parameter,
which you are strongly encouraged to not change. </dd>
<dd> Enable "EXPORT" grade or stronger OpenSSL ciphers. The
underlying cipherlist is specified via the tls_export_cipherlist
configuration parameter, which you are strongly encouraged to not
change. This choice is insecure and SHOULD NOT be used. </dd>
<dt><b>low</b></dt>
<dd> Enable "LOW" grade or stronger OpenSSL ciphers. The
underlying cipherlist is specified via the tls_low_cipherlist
configuration parameter, which you are strongly encouraged to
not change. </dd>
<dd> Enable "LOW" grade or stronger OpenSSL ciphers. The underlying
cipherlist is specified via the tls_low_cipherlist configuration
parameter, which you are strongly encouraged to not change. This
choice is insecure and SHOULD NOT be used. </dd>
<dt><b>medium</b></dt>
<dd> Enable "MEDIUM" grade or stronger OpenSSL ciphers. These use 128-bit
@ -11526,18 +11519,16 @@ on a per-destination basis. </p>
<dl>
<dt><b>export</b></dt>
<dd> Enable "EXPORT" grade or better OpenSSL
ciphers. This is the default for opportunistic encryption. It is
not recommended for mandatory encryption unless you must enforce TLS
with "crippled" peers. The underlying cipherlist is specified via the
tls_export_cipherlist configuration parameter, which you are strongly
encouraged to not change. </dd>
<dd> Enable "EXPORT" grade or better OpenSSL ciphers. The underlying
cipherlist is specified via the tls_export_cipherlist configuration
parameter, which you are strongly encouraged to not change. This
choice is insecure and SHOULD NOT be used. </dd>
<dt><b>low</b></dt>
<dd> Enable "LOW" grade or better OpenSSL ciphers. This
setting is only appropriate for internal mail servers. The underlying
<dd> Enable "LOW" grade or better OpenSSL ciphers. The underlying
cipherlist is specified via the tls_low_cipherlist configuration
parameter, which you are strongly encouraged to not change. </dd>
parameter, which you are strongly encouraged to not change. This
choice is insecure and SHOULD NOT be used. </dd>
<dt><b>medium</b></dt>
<dd> Enable "MEDIUM" grade or better OpenSSL ciphers.
@ -11623,56 +11614,47 @@ attribute. See smtp_tls_policy_maps for notes and examples. </p>
%PARAM tls_high_cipherlist ALL:!EXPORT:!LOW:!MEDIUM:+RC4:@STRENGTH
<p> The OpenSSL cipherlist for "HIGH" grade ciphers. This defines
the meaning of the "high" setting in smtpd_tls_mandatory_ciphers,
smtp_tls_mandatory_ciphers and lmtp_tls_mandatory_ciphers. You are
strongly encouraged to not change this setting. With OpenSSL 1.0.0 and
later the cipherlist may start with an "aNULL:" prefix, which restores
the 0.9.8-compatible ordering of the aNULL ciphers to the top of the
list when they are enabled. This prefix is not needed with previous
OpenSSL releases. </p>
the meaning of the "high" setting in smtpd_tls_ciphers,
smtpd_tls_mandatory_ciphers, smtp_tls_ciphers, smtp_tls_mandatory_ciphers,
lmtp_tls_ciphers, and lmtp_tls_mandatory_ciphers. You are strongly
encouraged to not change this setting. </p>
<p> This feature is available in Postfix 2.3 and later. </p>
%PARAM tls_medium_cipherlist ALL:!EXPORT:!LOW:+RC4:@STRENGTH
<p> The OpenSSL cipherlist for "MEDIUM" or higher grade ciphers. This
defines the meaning of the "medium" setting in smtpd_tls_mandatory_ciphers,
smtp_tls_mandatory_ciphers and lmtp_tls_mandatory_ciphers. This is
the default cipherlist for mandatory TLS encryption in the TLS
client (with anonymous ciphers disabled when verifying server
certificates). You are strongly encouraged to not change this
setting. With OpenSSL 1.0.0 and later the cipherlist may start with an
"aNULL:" prefix, which restores the 0.9.8-compatible ordering of the
aNULL ciphers to the top of the list when they are enabled. This prefix
is not needed with previous OpenSSL releases. </p>
defines the meaning of the "medium" setting in smtpd_tls_ciphers,
smtpd_tls_mandatory_ciphers, smtp_tls_ciphers, smtp_tls_mandatory_ciphers,
lmtp_tls_ciphers, and lmtp_tls_mandatory_ciphers. This is the
default cipherlist for mandatory TLS encryption in the TLS client
(with anonymous ciphers disabled when verifying server certificates).
This is the default cipherlist for opportunistic TLS with Postfix
releases after the middle of 2015. You are strongly encouraged to
not change this setting. </p>
<p> This feature is available in Postfix 2.3 and later. </p>
%PARAM tls_low_cipherlist ALL:!EXPORT:+RC4:@STRENGTH
<p> The OpenSSL cipherlist for "LOW" or higher grade ciphers. This defines
the meaning of the "low" setting in smtpd_tls_mandatory_ciphers,
smtp_tls_mandatory_ciphers and lmtp_tls_mandatory_ciphers. You are
strongly encouraged to not change this setting. With OpenSSL 1.0.0 and
later the cipherlist may start with an "aNULL:" prefix, which restores
the 0.9.8-compatible ordering of the aNULL ciphers to the top of the
list when they are enabled. This prefix is not needed with previous
OpenSSL releases. </p>
the meaning of the "low" setting in smtpd_tls_ciphers,
smtpd_tls_mandatory_ciphers, smtp_tls_ciphers, smtp_tls_mandatory_ciphers,
lmtp_tls_ciphers, and lmtp_tls_mandatory_ciphers. You are strongly
encouraged to not change this setting. </p>
<p> This feature is available in Postfix 2.3 and later. </p>
%PARAM tls_export_cipherlist ALL:+RC4:@STRENGTH
<p> The OpenSSL cipherlist for "EXPORT" or higher grade ciphers. This
defines the meaning of the "export" setting in smtpd_tls_mandatory_ciphers,
smtp_tls_mandatory_ciphers and lmtp_tls_mandatory_ciphers. This is
the cipherlist for the opportunistic ("may") TLS client security
level and is the default cipherlist for the SMTP server. You are
strongly encouraged to not change this setting. With OpenSSL 1.0.0 and
later the cipherlist may start with an "aNULL:" prefix, which restores
the 0.9.8-compatible ordering of the aNULL ciphers to the top of the
list when they are enabled. This prefix is not needed with previous
OpenSSL releases. </p>
defines the meaning of the "export" setting in smtpd_tls_ciphers,
smtpd_tls_mandatory_ciphers, smtp_tls_ciphers, smtp_tls_mandatory_ciphers,
lmtp_tls_ciphers, and lmtp_tls_mandatory_ciphers. With Postfix
releases before the middle of 2015 this is the default cipherlist
for the opportunistic ("may") TLS client security level and also
the default cipherlist for the SMTP server. You are strongly
encouraged to not change this setting. </p>
<p> This feature is available in Postfix 2.3 and later. </p>
@ -11686,7 +11668,7 @@ change this setting. </p>
<p> This feature is available in Postfix 2.3 and later. </p>
%PARAM lmtp_tls_mandatory_ciphers
%PARAM lmtp_tls_mandatory_ciphers medium
<p> The LMTP-specific version of the smtp_tls_mandatory_ciphers
configuration parameter. See there for details. </p>
@ -12144,12 +12126,13 @@ the hostname and IP address. The logging format is "host[address]:port".
<p> This feature is available in Postfix 2.5 and later. </p>
%PARAM smtp_tls_protocols !SSLv2
%PARAM smtp_tls_protocols !SSLv2, !SSLv3
<p> List of TLS protocols that the Postfix SMTP client will exclude or
include with opportunistic TLS encryption. Starting with Postfix 2.6,
the Postfix SMTP client will by default not use the obsolete SSLv2
protocol. </p>
include with opportunistic TLS encryption. The default value is
"!SSLv2, !SSLv3" for Postfix releases after the middle of 2015,
"!SSLv2" for older releases. Before Postfix 2.6, the Postfix SMTP
client would use all protocols with opportunistic TLS. </p>
<p> In main.cf the values are separated by whitespace, commas or
colons. In the policy table (see smtp_tls_policy_maps) the only valid
@ -12175,7 +12158,7 @@ versions of Postfix &ge; 2.10 can explicitly disable support for
"TLSv1.1" or "TLSv1.2"</p>
<p> To include a protocol list its name, to exclude it, prefix the name
with a "!" character. To exclude SSLv2 even for opportunistic TLS set
with a "!" character. To exclude SSLv2 for opportunistic TLS set
"smtp_tls_protocols = !SSLv2". To exclude both "SSLv2" and "SSLv3" set
"smtp_tls_protocols = !SSLv2, !SSLv3". Explicitly listing the protocols to
include, rather than protocols to exclude, is supported, but not
@ -12190,11 +12173,12 @@ smtp_tls_protocols = !SSLv2, !SSLv3
<p> This feature is available in Postfix 2.6 and later. </p>
%PARAM smtpd_tls_protocols
%PARAM smtpd_tls_protocols !SSLv2, !SSLv3
<p> List of TLS protocols that the Postfix SMTP server will exclude
or include with opportunistic TLS encryption. This parameter SHOULD
be left at its default empty value, allowing all protocols to be
or include with opportunistic TLS encryption. The default value is
"!SSLv2, !SSLv3" for Postfix releases after the middle of 2015,
empty for older releases allowing all protocols to be
used with opportunistic TLS. A non-empty value is a list of protocol
names separated by whitespace, commas or colons. The supported
protocol names are "SSLv2", "SSLv3" and "TLSv1", and are not case
@ -12206,7 +12190,7 @@ versions of Postfix &ge; 2.10 can disable support for "TLSv1.1" or
"TLSv1.2". </p>
<p> To include a protocol list its name, to exclude it, prefix the name
with a "!" character. To exclude SSLv2 even for opportunistic TLS set
with a "!" character. To exclude SSLv2 for opportunistic TLS set
"smtpd_tls_protocols = !SSLv2". To exclude both "SSLv2" and "SSLv3" set
"smtpd_tls_protocols = !SSLv2, !SSLv3". Explicitly listing the protocols to
include, rather than protocols to exclude, is supported, but not
@ -12215,66 +12199,54 @@ OpenSSL interface semantics. </p>
<p> Example: </p>
<pre>
smtpd_tls_protocols = !SSLv2
smtpd_tls_protocols = !SSLv2, !SSLv3
</pre>
<p> This feature is available in Postfix 2.6 and later. </p>
%PARAM lmtp_tls_protocols
%PARAM lmtp_tls_protocols !SSLv2, !SSLv3
<p> The LMTP-specific version of the smtp_tls_protocols configuration
parameter. See there for details. </p>
<p> This feature is available in Postfix 2.6 and later. </p>
%PARAM smtp_tls_ciphers export
%PARAM smtp_tls_ciphers medium
<p> The minimum TLS cipher grade that the Postfix SMTP client
will use with opportunistic TLS encryption. Cipher types listed in
smtp_tls_exclude_ciphers are excluded from the base definition of
the selected cipher grade. The default value "export" ensures maximum
inter-operability. Because encryption is optional, stronger controls
are not appropriate, and this setting SHOULD NOT be changed unless the
change is essential. </p>
the selected cipher grade. The default value is "medium" for
Postfix releases after the middle of 2015, "export" for older
releases. </p>
<p> When TLS is mandatory the cipher grade is chosen via the
smtp_tls_mandatory_ciphers configuration parameter, see there for syntax
details. See smtp_tls_policy_maps for information on how to configure
ciphers on a per-destination basis. </p>
<p> Example: </p>
<pre>
smtp_tls_ciphers = export
</pre>
<p> This feature is available in Postfix 2.6 and later. With earlier Postfix
releases only the smtp_tls_mandatory_ciphers parameter is implemented,
and opportunistic TLS always uses "export" or better (i.e. all) ciphers. </p>
%PARAM smtpd_tls_ciphers export
%PARAM smtpd_tls_ciphers medium
<p> The minimum TLS cipher grade that the Postfix SMTP server
will use with opportunistic TLS encryption. Cipher types listed in
smtpd_tls_exclude_ciphers are excluded from the base definition of
the selected cipher grade. The default value "export" ensures maximum
inter-operability. Because encryption is optional, stronger controls
are not appropriate, and this setting SHOULD NOT be changed unless the
change is essential. </p>
the selected cipher grade. The default value is "medium" for Postfix
releases after the middle of 2015, "export" for older releases.
</p>
<p> When TLS is mandatory the cipher grade is chosen via the
smtpd_tls_mandatory_ciphers configuration parameter, see there for syntax
details. </p>
<p> Example: </p>
<pre>
smtpd_tls_ciphers = export
</pre>
<p> This feature is available in Postfix 2.6 and later. With earlier Postfix
releases only the smtpd_tls_mandatory_ciphers parameter is implemented,
and opportunistic TLS always uses "export" or better (i.e. all) ciphers. </p>
%PARAM lmtp_tls_ciphers export
%PARAM lmtp_tls_ciphers medium
<p> The LMTP-specific version of the smtp_tls_ciphers configuration
parameter. See there for details. </p>

18
postfix/src/global/mail_params.h
View File

@ -1276,15 +1276,15 @@ extern char *var_smtpd_tls_CAfile;
extern char *var_smtpd_tls_CApath;
#define VAR_SMTPD_TLS_PROTO "smtpd_tls_protocols"
#define DEF_SMTPD_TLS_PROTO ""
#define DEF_SMTPD_TLS_PROTO "!SSLv2, !SSLv3"
extern char *var_smtpd_tls_proto;
#define VAR_SMTPD_TLS_MAND_PROTO "smtpd_tls_mandatory_protocols"
#define DEF_SMTPD_TLS_MAND_PROTO "!SSLv2"
#define DEF_SMTPD_TLS_MAND_PROTO "!SSLv2, !SSLv3"
extern char *var_smtpd_tls_mand_proto;
#define VAR_SMTPD_TLS_CIPH "smtpd_tls_ciphers"
#define DEF_SMTPD_TLS_CIPH "export"
#define DEF_SMTPD_TLS_CIPH "medium"
extern char *var_smtpd_tls_ciph;
#define VAR_SMTPD_TLS_MAND_CIPH "smtpd_tls_mandatory_ciphers"
@ -1425,9 +1425,9 @@ extern char *var_smtp_tls_CAfile;
extern char *var_smtp_tls_CApath;
#define VAR_SMTP_TLS_CIPH "smtp_tls_ciphers"
#define DEF_SMTP_TLS_CIPH "export"
#define DEF_SMTP_TLS_CIPH "medium"
#define VAR_LMTP_TLS_CIPH "lmtp_tls_ciphers"
#define DEF_LMTP_TLS_CIPH "export"
#define DEF_LMTP_TLS_CIPH "medium"
extern char *var_smtp_tls_ciph;
#define VAR_SMTP_TLS_MAND_CIPH "smtp_tls_mandatory_ciphers"
@ -1496,15 +1496,15 @@ extern int var_lmtp_tls_scache_timeout;
extern char *var_smtp_tls_policy;
#define VAR_SMTP_TLS_PROTO "smtp_tls_protocols"
#define DEF_SMTP_TLS_PROTO "!SSLv2"
#define DEF_SMTP_TLS_PROTO "!SSLv2, !SSLv3"
#define VAR_LMTP_TLS_PROTO "lmtp_tls_protocols"
#define DEF_LMTP_TLS_PROTO "!SSLv2"
#define DEF_LMTP_TLS_PROTO "!SSLv2, !SSLv3"
extern char *var_smtp_tls_proto;
#define VAR_SMTP_TLS_MAND_PROTO "smtp_tls_mandatory_protocols"
#define DEF_SMTP_TLS_MAND_PROTO "!SSLv2"
#define DEF_SMTP_TLS_MAND_PROTO "!SSLv2, !SSLv3"
#define VAR_LMTP_TLS_MAND_PROTO "lmtp_tls_mandatory_protocols"
#define DEF_LMTP_TLS_MAND_PROTO "!SSLv2"
#define DEF_LMTP_TLS_MAND_PROTO "!SSLv2, !SSLv3"
extern char *var_smtp_tls_mand_proto;
#define VAR_SMTP_TLS_VFY_CMATCH "smtp_tls_verify_cert_match"

4
postfix/src/global/mail_version.h
View File

@ -20,8 +20,8 @@
* Patches change both the patchlevel and the release date. Snapshots have no
* patchlevel; they change the release date only.
*/
#define MAIL_RELEASE_DATE "20150412"
#define MAIL_VERSION_NUMBER "2.11.5"
#define MAIL_RELEASE_DATE "20150720"
#define MAIL_VERSION_NUMBER "2.11.6"
#ifdef SNAPSHOT
#define MAIL_VERSION_DATE "-" MAIL_RELEASE_DATE

6
postfix/src/smtp/smtp.c
View File

@ -371,7 +371,7 @@
/* Optional lookup tables with the Postfix SMTP client TLS security
/* policy by next-hop destination; when a non-empty value is specified,
/* this overrides the obsolete smtp_tls_per_site parameter.
/* .IP "\fBsmtp_tls_mandatory_protocols (!SSLv2)\fR"
/* .IP "\fBsmtp_tls_mandatory_protocols (!SSLv2, !SSLv3)\fR"
/* List of SSL/TLS protocols that the Postfix SMTP client will use with
/* mandatory TLS encryption.
/* .IP "\fBsmtp_tls_scert_verifydepth (9)\fR"
@ -421,10 +421,10 @@
/* certificate fingerprints.
/* .PP
/* Available in Postfix version 2.6 and later:
/* .IP "\fBsmtp_tls_protocols (!SSLv2)\fR"
/* .IP "\fBsmtp_tls_protocols (!SSLv2, !SSLv3)\fR"
/* List of TLS protocols that the Postfix SMTP client will exclude or
/* include with opportunistic TLS encryption.
/* .IP "\fBsmtp_tls_ciphers (export)\fR"
/* .IP "\fBsmtp_tls_ciphers (medium)\fR"
/* The minimum TLS cipher grade that the Postfix SMTP client
/* will use with opportunistic TLS encryption.
/* .IP "\fBsmtp_tls_eccert_file (empty)\fR"

6
postfix/src/smtpd/smtpd.c
View File

@ -380,7 +380,7 @@
/* .IP "\fBsmtpd_tls_mandatory_exclude_ciphers (empty)\fR"
/* Additional list of ciphers or cipher types to exclude from the
/* Postfix SMTP server cipher list at mandatory TLS security levels.
/* .IP "\fBsmtpd_tls_mandatory_protocols (!SSLv2)\fR"
/* .IP "\fBsmtpd_tls_mandatory_protocols (!SSLv2, !SSLv3)\fR"
/* The SSL/TLS protocols accepted by the Postfix SMTP server with
/* mandatory TLS encryption.
/* .IP "\fBsmtpd_tls_received_header (no)\fR"
@ -418,10 +418,10 @@
/* for \fBcheck_ccert_access\fR and \fBpermit_tls_clientcerts\fR.
/* .PP
/* Available in Postfix version 2.6 and later:
/* .IP "\fBsmtpd_tls_protocols (empty)\fR"
/* .IP "\fBsmtpd_tls_protocols (!SSLv2, !SSLv3)\fR"
/* List of TLS protocols that the Postfix SMTP server will exclude
/* or include with opportunistic TLS encryption.
/* .IP "\fBsmtpd_tls_ciphers (export)\fR"
/* .IP "\fBsmtpd_tls_ciphers (medium)\fR"
/* The minimum TLS cipher grade that the Postfix SMTP server
/* will use with opportunistic TLS encryption.
/* .IP "\fBsmtpd_tls_eccert_file (empty)\fR"

2
postfix/src/util/sys_defs.h
View File

@ -755,7 +755,7 @@ extern int initgroups(const char *, int);
/*
* LINUX.
*/
#if defined(LINUX2) || defined(LINUX3)
#if defined(LINUX2) || defined(LINUX3) || defined(LINUX4)
#define SUPPORTED
#include <sys/types.h>
#define UINT32_TYPE unsigned int