From 14ca95d25ac0f7fc41e0fb7d329441555dc4d67a Mon Sep 17 00:00:00 2001 From: link2xt Date: Sat, 15 Nov 2025 01:31:59 +0000 Subject: [PATCH] fix(postfix): set smtpd_tls_mandatory_protocols for port 25 smtp_tls_mandatory_protocols does not affect port 25 because we require STARTTLS on port 25 since commit 8d7e1dad0e6294176abd4d48c07ddde1435ed858 We don't have any smtpd ports with opportunistic TLS. Submission ports require TLSv1.3 and starting with this commit MX port will require TLSv1.2 instead of TLSv1. I have not managed to connect using TLSv1.1 even without this fix to reproduce the problem, but I have checked that setting `-o smtpd_tls_mandatory_protocols=>=TLSv1.3` does not allow to connect using TLSv1.2 anymore using `openssl s_client -connect example.org:25 -starttls smtp -tls1_2`. `smtpd_tls_protocols` setting is removed because it does not affect anything except the internal ports and its `git blame` points to the wrong commit. --- cmdeploy/src/cmdeploy/postfix/main.cf.j2 | 1 - cmdeploy/src/cmdeploy/postfix/master.cf.j2 | 1 + 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/cmdeploy/src/cmdeploy/postfix/main.cf.j2 b/cmdeploy/src/cmdeploy/postfix/main.cf.j2 index 413cd819..2a1867cf 100644 --- a/cmdeploy/src/cmdeploy/postfix/main.cf.j2 +++ b/cmdeploy/src/cmdeploy/postfix/main.cf.j2 @@ -28,7 +28,6 @@ smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache smtp_tls_policy_maps = inline:{nauta.cu=may} smtp_tls_protocols = >=TLSv1.2 smtp_tls_mandatory_protocols = >=TLSv1.2 -smtpd_tls_protocols = >=TLSv1.2 # Disable anonymous cipher suites # and known insecure algorithms. diff --git a/cmdeploy/src/cmdeploy/postfix/master.cf.j2 b/cmdeploy/src/cmdeploy/postfix/master.cf.j2 index e298aa84..6dc03ed8 100644 --- a/cmdeploy/src/cmdeploy/postfix/master.cf.j2 +++ b/cmdeploy/src/cmdeploy/postfix/master.cf.j2 @@ -15,6 +15,7 @@ smtp inet n - y - - smtpd -v smtp inet n - y - - smtpd {%- endif %} -o smtpd_tls_security_level=encrypt + -o smtpd_tls_mandatory_protocols=>=TLSv1.2 -o smtpd_proxy_filter=127.0.0.1:{{ config.filtermail_smtp_port_incoming }} submission inet n - y - 5000 smtpd -o syslog_name=postfix/submission