From 3524b055db305f6320ba1b015a9e588bffca0618 Mon Sep 17 00:00:00 2001 From: link2xt Date: Sat, 15 Nov 2025 01:04:10 +0000 Subject: [PATCH] fix(postfix): set smtp_tls_mandatory_protocols to require TLSv1.2 for outgoing connections According to for outgoing connections with smtp_tls_security_level `encrypt` and higher (such as `verify` that we currently use) the setting `smtp_tls_mandatory_protocols` is used instead of `smtp_tls_protocols`. According to `postconf -d` (and `postconf` because the default is not changed) current setting value is `smtp_tls_mandatory_protocols = >=TLSv1`. But we only want to connect outside with TLS 1.2 and TLS 1.3. `smtp_tls_protocols` which was already set to `>= TLSv1.2` in commit 0155f32df62e2c7e07e771688a5846cb7e7dc880 only affected outgoing connections with the `may` level exception set for nauta.cu domain via `smtp_tls_policy_maps` which does not support STARTTLS at all. --- cmdeploy/src/cmdeploy/postfix/main.cf.j2 | 1 + 1 file changed, 1 insertion(+) diff --git a/cmdeploy/src/cmdeploy/postfix/main.cf.j2 b/cmdeploy/src/cmdeploy/postfix/main.cf.j2 index 11af9d3d..413cd819 100644 --- a/cmdeploy/src/cmdeploy/postfix/main.cf.j2 +++ b/cmdeploy/src/cmdeploy/postfix/main.cf.j2 @@ -27,6 +27,7 @@ smtp_tls_servername = hostname smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache smtp_tls_policy_maps = inline:{nauta.cu=may} smtp_tls_protocols = >=TLSv1.2 +smtp_tls_mandatory_protocols = >=TLSv1.2 smtpd_tls_protocols = >=TLSv1.2 # Disable anonymous cipher suites