Buster Compat and Improved TLS Settings

Dovecot updated some TLS parameters in their config file. This adds the new parameters in a backward compatible manner.

Prompted by that move, I also changed dovecot and postfix to a preset-based configuration of TLS. The default preset is previous, that should get you a equivalent configuration as before, regardless of being on stretch or buster (minus OpenSSL changes). Also, there are presets modern, intermediate, old directly from the new https://ssl-config.mozilla.org. But beware, at least dovecot currently errors on TLSv1.3-only modern although OpenSSL should be able to handle it. The preset overrides all manual configuration, so you should upgrade your custom variables.

Beware, that there are two open bugs on Debian's dovecot package which may impact your setup:

• 928492: doveadm errors on listing PAM users, because of a glibc change
• 930919: dsync no longer syncs Sieve scripts

For both bugs there is a patch on the dovecot repository that is already merged. But none made it into Debian yet.

dovecot/defaults/main.yml

@@ -14,9 +14,10 @@ dovecot_max_uid: 0
 dovecot_tls_cert: /etc/ssl/private/fullchain.pem
 dovecot_tls_key: /etc/ssl/private/privkey.pem
 dovecot_tls_ca_dir: /etc/ssl/certs
-dovecot_tls_ciphers: "{{ tls_ciphers }}"
-dovecot_tls_dh_length: 4096
-dovecot_tls_protocols: 'TLSv1.1 TLSv1.2 !SSLv3'
+
+# possible values: modern, intermediate, old, previous
+# see also: https://ssl-config.mozilla.org/
+dovecot_tls_configuration: 'previous'
 
 dovecot_dsync: false
 dovecot_dsync_tls: false