diff --git a/dovecot/defaults/main.yml b/dovecot/defaults/main.yml index 9c147a9d19eda065d5da70e23ad87915ae8391af..f2b867cfc0cd3c676d3d541d294b4f42abd3e489 100644 --- a/dovecot/defaults/main.yml +++ b/dovecot/defaults/main.yml @@ -14,9 +14,10 @@ dovecot_max_uid: 0 dovecot_tls_cert: /etc/ssl/private/fullchain.pem dovecot_tls_key: /etc/ssl/private/privkey.pem dovecot_tls_ca_dir: /etc/ssl/certs -dovecot_tls_ciphers: "{{ tls_ciphers }}" -dovecot_tls_dh_length: 4096 -dovecot_tls_protocols: 'TLSv1.1 TLSv1.2 !SSLv3' + +# possible values: modern, intermediate, old, previous +# see also: https://ssl-config.mozilla.org/ +dovecot_tls_configuration: 'previous' dovecot_dsync: false dovecot_dsync_tls: false diff --git a/dovecot/files/ffdhe2048.txt b/dovecot/files/ffdhe2048.txt new file mode 100644 index 0000000000000000000000000000000000000000..088f9673dc88721909c0952a0986bdc2cc112bdd --- /dev/null +++ b/dovecot/files/ffdhe2048.txt @@ -0,0 +1,8 @@ +-----BEGIN DH PARAMETERS----- +MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz ++8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a +87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7 +YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi +7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD +ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg== +-----END DH PARAMETERS----- \ No newline at end of file diff --git a/dovecot/files/ffdhe4096.txt b/dovecot/files/ffdhe4096.txt new file mode 100644 index 0000000000000000000000000000000000000000..c5ebc5f55c99098e8e1fae168d956ad26be248c6 --- /dev/null +++ b/dovecot/files/ffdhe4096.txt @@ -0,0 +1,13 @@ +-----BEGIN DH PARAMETERS----- +MIICCAKCAgEA///////////JD9qiIWjCNMTGYouA3BzRKQJOCIpnzHQCC76mOxOb +IlFKCHmONATd75UZs806QxswKwpt8l8UN0/hNW1tUcJF5IW1dmJefsb0TELppjft +awv/XLb0Brft7jhr+1qJn6WunyQRfEsf5kkoZlHs5Fs9wgB8uKFjvwWY2kg2HFXT +mmkWP6j9JM9fg2VdI9yjrZYcYvNWIIVSu57VKQdwlpZtZww1Tkq8mATxdGwIyhgh +fDKQXkYuNs474553LBgOhgObJ4Oi7Aeij7XFXfBvTFLJ3ivL9pVYFxg5lUl86pVq +5RXSJhiY+gUQFXKOWoqqxC2tMxcNBFB6M6hVIavfHLpk7PuFBFjb7wqK6nFXXQYM +fbOXD4Wm4eTHq/WujNsJM9cejJTgSiVhnc7j0iYa0u5r8S/6BtmKCGTYdgJzPshq +ZFIfKxgXeyAMu+EXV3phXWx3CYjAutlG4gjiT6B05asxQ9tb/OD9EI5LgtEgqSEI +ARpyPBKnh+bXiHGaEL26WyaZwycYavTiPBqUaDS2FQvaJYPpyirUTOjbu8LbBN6O ++S6O/BQfvsqmKHxZR05rwF2ZspZPoJDDoiM7oYZRW+ftH2EpcM7i16+4G912IXBI +HNAGkSfVsFqpk7TqmI2P3cGG/7fckKbAj030Nck0BjGZ//////////8CAQI= +-----END DH PARAMETERS----- \ No newline at end of file diff --git a/dovecot/tasks/main.yml b/dovecot/tasks/main.yml index 9148c20fcb5f2256868b26504483622304783b32..0102bde55ddafc6eed05f92b4c7a2361266b7196 100644 --- a/dovecot/tasks/main.yml +++ b/dovecot/tasks/main.yml @@ -1,5 +1,12 @@ --- +- name: "include tls config vars (preset: {{ dovecot_tls_configuration }})" + include_vars: + file: "tls-{{ dovecot_tls_configuration }}.yml" + tags: + - dovecot + - mail + - name: ensure all required dovecot packages are installed apt: name: @@ -36,6 +43,20 @@ - dovecot - mail +- name: ensure dh params are available + copy: + src: "{{ dovecot_tls_dh_file }}" + dest: /etc/dovecot/dh.pem + owner: root + group: root + mode: '0644' + when: dovecot_tls_dh_file is string + notify: + - restart dovecot + tags: + - dovecot + - mail + - name: ensure there is a folder for global sieve scripts file: dest: /var/lib/dovecot/sieve.d diff --git a/dovecot/templates/conf.d/10-ssl.conf.j2 b/dovecot/templates/conf.d/10-ssl.conf.j2 index 54bfbc81f138c79f269f054d846e0d93db48611e..a46162095dd4b9774872b6305012efa02a492566 100644 --- a/dovecot/templates/conf.d/10-ssl.conf.j2 +++ b/dovecot/templates/conf.d/10-ssl.conf.j2 @@ -42,18 +42,39 @@ ssl_client_ca_dir = {{ dovecot_tls_ca_dir }} # auth_ssl_username_from_cert=yes. #ssl_cert_username_field = commonName +{% if ansible_distribution_major_version|int < 10 %} # DH parameters length to use. +{% if dovecot_tls_dh_length %} ssl_dh_parameters_length = {{ dovecot_tls_dh_length }} +{% else %} +#ssl_dh_parameters_length = +{% endif %} +{% else %} +# DH parameters to use. +{% if dovecot_tls_dh_file %} +ssl_dh = </etc/dovecot/dh.pem +{% else %} +#ssl_dh = +{% endif %} +{% endif %} +{% if ansible_distribution_major_version|int < 10 %} # SSL protocols to use ssl_protocols = {{ dovecot_tls_protocols }} +{% else %} +# Minimum TLS version to use +ssl_min_protocol = {{ dovecot_tls_min_protocol }} +{% endif %} # SSL ciphers to use -#ssl_cipher_list = HIGH:!LOW:!SSLv2:!EXP:!aNULL:!MD5:!RC4:!SHA1 +{% if dovecot_tls_ciphers %} ssl_cipher_list = {{ dovecot_tls_ciphers }} +{% else %} +#ssl_cipher_list = +{% endif %} # Prefer the server's order of ciphers over client's. -ssl_prefer_server_ciphers = yes +ssl_prefer_server_ciphers = {{ 'yes' if dovecot_tls_prefer_server_ciphers else 'no' }} # SSL crypto device to use, for valid values run "openssl engine" #ssl_crypto_device = diff --git a/dovecot/vars/tls-intermediate.yml b/dovecot/vars/tls-intermediate.yml new file mode 100644 index 0000000000000000000000000000000000000000..dcb1468abcf9e3fa43203779d4188905a0338c8a --- /dev/null +++ b/dovecot/vars/tls-intermediate.yml @@ -0,0 +1,8 @@ +--- + +dovecot_tls_protocols: 'TLSv1.2 TLSv1.3' +dovecot_tls_min_protocol: 'TLSv1.2' +dovecot_tls_ciphers: 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384' +dovecot_tls_dh_length: 4096 # 2048 +dovecot_tls_dh_file: ffdhe4096.txt # ffdhe2048.txt +dovecot_tls_prefer_server_ciphers: false diff --git a/dovecot/vars/tls-modern.yml b/dovecot/vars/tls-modern.yml new file mode 100644 index 0000000000000000000000000000000000000000..ef71bddb98777422cf9a04a18b35128955dc6bbe --- /dev/null +++ b/dovecot/vars/tls-modern.yml @@ -0,0 +1,8 @@ +--- + +dovecot_tls_protocols: 'TLSv1.3' +dovecot_tls_min_protocol: 'TLSv1.3' +dovecot_tls_ciphers: null +dovecot_tls_dh_length: null +dovecot_tls_dh_file: null +dovecot_tls_prefer_server_ciphers: false diff --git a/dovecot/vars/tls-old.yml b/dovecot/vars/tls-old.yml new file mode 100644 index 0000000000000000000000000000000000000000..936012fb4b37051210f911087cb256db0bff2841 --- /dev/null +++ b/dovecot/vars/tls-old.yml @@ -0,0 +1,8 @@ +--- + +dovecot_tls_protocols: 'TLSv1 TLSv1.1 TLSv1.2 !SSLv3' +dovecot_tls_min_protocol: 'TLSv1' +dovecot_tls_ciphers: 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA' +dovecot_tls_dh_length: 2048 # 1024 +dovecot_tls_dh_file: ffdhe2048.txt # openssl dhparam 1024 > ffdhe1024.txt +dovecot_tls_prefer_server_ciphers: true diff --git a/dovecot/vars/tls-previous.yml b/dovecot/vars/tls-previous.yml new file mode 100644 index 0000000000000000000000000000000000000000..82d3f36845aee92078fafdd7c31e257fd7efdb02 --- /dev/null +++ b/dovecot/vars/tls-previous.yml @@ -0,0 +1,8 @@ +--- + +dovecot_tls_protocols: 'TLSv1.1 TLSv1.2 !SSLv3' +dovecot_tls_min_protocol: 'TLSv1.1' +dovecot_tls_ciphers: "{{ tls_ciphers }}" +dovecot_tls_dh_length: 4096 +dovecot_tls_dh_file: ffdhe4096.txt # ffdhe2048.txt +dovecot_tls_prefer_server_ciphers: true diff --git a/postfix/defaults/main.yml b/postfix/defaults/main.yml index 416ef41d6a4d36aed31cb748e63855d3c08d89cb..bf3b04160adf364ecf54099deef7472105ad0777 100644 --- a/postfix/defaults/main.yml +++ b/postfix/defaults/main.yml @@ -6,8 +6,10 @@ postfix_virtual_domains: [] postfix_tls_cert: /etc/ssl/private/fullchain.pem postfix_tls_key: /etc/ssl/private/privkey.pem -postfix_tls_ciphers: "{{ tls_ciphers }}" -postfix_tls_protocols: '!SSLv2 !SSLv3' + +# possible values: modern, intermediate, old, previous +# see also: https://ssl-config.mozilla.org/ +postfix_tls_configuration: 'previous' postfix_prefer_lmtp: false postfix_enable_memcached: false diff --git a/postfix/files/ffdhe2048.txt b/postfix/files/ffdhe2048.txt new file mode 100644 index 0000000000000000000000000000000000000000..088f9673dc88721909c0952a0986bdc2cc112bdd --- /dev/null +++ b/postfix/files/ffdhe2048.txt @@ -0,0 +1,8 @@ +-----BEGIN DH PARAMETERS----- +MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz ++8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a +87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7 +YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi +7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD +ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg== +-----END DH PARAMETERS----- \ No newline at end of file diff --git a/postfix/files/ffdhe4096.txt b/postfix/files/ffdhe4096.txt new file mode 100644 index 0000000000000000000000000000000000000000..c5ebc5f55c99098e8e1fae168d956ad26be248c6 --- /dev/null +++ b/postfix/files/ffdhe4096.txt @@ -0,0 +1,13 @@ +-----BEGIN DH PARAMETERS----- +MIICCAKCAgEA///////////JD9qiIWjCNMTGYouA3BzRKQJOCIpnzHQCC76mOxOb +IlFKCHmONATd75UZs806QxswKwpt8l8UN0/hNW1tUcJF5IW1dmJefsb0TELppjft +awv/XLb0Brft7jhr+1qJn6WunyQRfEsf5kkoZlHs5Fs9wgB8uKFjvwWY2kg2HFXT +mmkWP6j9JM9fg2VdI9yjrZYcYvNWIIVSu57VKQdwlpZtZww1Tkq8mATxdGwIyhgh +fDKQXkYuNs474553LBgOhgObJ4Oi7Aeij7XFXfBvTFLJ3ivL9pVYFxg5lUl86pVq +5RXSJhiY+gUQFXKOWoqqxC2tMxcNBFB6M6hVIavfHLpk7PuFBFjb7wqK6nFXXQYM +fbOXD4Wm4eTHq/WujNsJM9cejJTgSiVhnc7j0iYa0u5r8S/6BtmKCGTYdgJzPshq +ZFIfKxgXeyAMu+EXV3phXWx3CYjAutlG4gjiT6B05asxQ9tb/OD9EI5LgtEgqSEI +ARpyPBKnh+bXiHGaEL26WyaZwycYavTiPBqUaDS2FQvaJYPpyirUTOjbu8LbBN6O ++S6O/BQfvsqmKHxZR05rwF2ZspZPoJDDoiM7oYZRW+ftH2EpcM7i16+4G912IXBI +HNAGkSfVsFqpk7TqmI2P3cGG/7fckKbAj030Nck0BjGZ//////////8CAQI= +-----END DH PARAMETERS----- \ No newline at end of file diff --git a/postfix/tasks/main.yml b/postfix/tasks/main.yml index 089e0dd0f079b7ac2817b60af2e65d211ce4880d..3f19f4743a5cb4983f95ae36cda871870b2da13a 100644 --- a/postfix/tasks/main.yml +++ b/postfix/tasks/main.yml @@ -1,5 +1,12 @@ --- +- name: "include tls config vars (preset: {{ postfix_tls_configuration }})" + include_vars: + file: "tls-{{ postfix_tls_configuration }}.yml" + tags: + - postfix + - mail + - name: ensure all required postfix packages are installed apt: name: @@ -35,6 +42,20 @@ - postfix - mail +- name: ensure dh params are available + copy: + src: "{{ postfix_tls_dh_file }}" + dest: /etc/postfix/dh.pem + owner: root + group: root + mode: '0644' + when: postfix_tls_dh_file is string + notify: + - restart postfix + tags: + - postfix + - mail + - name: ensure memcached config is present template: src: memcached.conf.j2 diff --git a/postfix/templates/main.cf.j2 b/postfix/templates/main.cf.j2 index b891d06cabac1898f6f96f2a3234746c09aafa44..7034c73d8f87e0f42b0dbbeb218c0c65b96ee1c4 100644 --- a/postfix/templates/main.cf.j2 +++ b/postfix/templates/main.cf.j2 @@ -38,16 +38,32 @@ smtpd_relay_restrictions = defer_unauth_destination smtpd_use_tls = yes +smtpd_tls_security_level = may smtpd_tls_auth_only = yes smtpd_tls_cert_file = {{ postfix_tls_cert }} smtpd_tls_key_file = {{ postfix_tls_key }} -smtpd_tls_eecdh_grade = ultra -smtpd_tls_mandatory_ciphers = high -smtpd_tls_mandatory_protocols = {{ postfix_tls_protocols }} -smtpd_tls_protocols = {{ postfix_tls_protocols }} smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache -tls_high_cipherlist = {{ postfix_tls_ciphers }} +smtpd_tls_protocols = {{ postfix_tls_protocols }} +smtpd_tls_mandatory_protocols = {{ postfix_tls_protocols }} +{% if postfix_tls_mandatory_ciphers %} +smtpd_tls_mandatory_ciphers = {{ postfix_tls_mandatory_ciphers }} +{% endif %} +{% if postfix_tls_preempt_cipherlist %} +tls_preempt_cipherlist = {{ 'yes' if postfix_tls_preempt_cipherlist else 'no' }} +{% endif %} +{% if postfix_tls_eecdh_grade %} +smtpd_tls_eecdh_grade = {{ postfix_tls_eecdh_grade }} +{% endif %} +{% if postfix_tls_high_cipherlist %} +tls_high_cipherlist = {{ postfix_tls_high_cipherlist }} +{% endif %} +{% if postfix_tls_medium_cipherlist %} +tls_medium_cipherlist = {{ postfix_tls_medium_cipherlist }} +{% endif %} +{% if postfix_tls_dh_file %} +smtpd_tls_dh1024_param_file = /etc/postfix/dh.pem +{% endif %} alias_maps = cdb:/etc/aliases alias_database = cdb:/etc/aliases diff --git a/postfix/vars/tls-intermediate.yml b/postfix/vars/tls-intermediate.yml new file mode 100644 index 0000000000000000000000000000000000000000..588343d93a5b0796805225e147e8af819aabdc89 --- /dev/null +++ b/postfix/vars/tls-intermediate.yml @@ -0,0 +1,9 @@ +--- + +postfix_tls_protocols: '!SSLv2, !SSLv3, !TLSv1, !TLSv1.1' +postfix_tls_mandatory_ciphers: medium +postfix_tls_preempt_cipherlist: false +postfix_tls_eecdh_grade: null +postfix_tls_high_cipherlist: null +postfix_tls_dh_file: ffdhe2048.txt # ffdhe4096.txt +postfix_tls_medium_cipherlist: 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384' diff --git a/postfix/vars/tls-modern.yml b/postfix/vars/tls-modern.yml new file mode 100644 index 0000000000000000000000000000000000000000..2a2c9e7a70eefd8698b866a13d467265e5965766 --- /dev/null +++ b/postfix/vars/tls-modern.yml @@ -0,0 +1,9 @@ +--- + +postfix_tls_protocols: '!SSLv2, !SSLv3, !TLSv1, !TLSv1.1, !TLSv1.2' +postfix_tls_mandatory_ciphers: null +postfix_tls_preempt_cipherlist: false +postfix_tls_eecdh_grade: null +postfix_tls_high_cipherlist: null +postfix_tls_medium_cipherlist: null +postfix_tls_dh_file: null diff --git a/postfix/vars/tls-old.yml b/postfix/vars/tls-old.yml new file mode 100644 index 0000000000000000000000000000000000000000..a15cdc41553ce8761694b8cc39399fd3a985acd1 --- /dev/null +++ b/postfix/vars/tls-old.yml @@ -0,0 +1,9 @@ +--- + +postfix_tls_protocols: '!SSLv2, !SSLv3' +postfix_tls_mandatory_ciphers: medium +postfix_tls_preempt_cipherlist: true +postfix_tls_eecdh_grade: null +postfix_tls_high_cipherlist: null +postfix_tls_dh_file: ffdhe2048.txt # ffdhe4096.txt +postfix_tls_medium_cipherlist: 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA' diff --git a/postfix/vars/tls-previous.yml b/postfix/vars/tls-previous.yml new file mode 100644 index 0000000000000000000000000000000000000000..959869399132c412654c435add52bc1ebf7a9afc --- /dev/null +++ b/postfix/vars/tls-previous.yml @@ -0,0 +1,9 @@ +--- + +postfix_tls_protocols: '!SSLv2 !SSLv3' +postfix_tls_mandatory_ciphers: high +postfix_tls_preempt_cipherlist: null +postfix_tls_eecdh_grade: ultra +postfix_tls_high_cipherlist: "{{ tls_ciphers }}" +postfix_tls_medium_cipherlist: null +postfix_tls_dh_file: null