On Oct 11, 2019, at 7:21 AM, Gerard E. Seibert <[email protected]>
wrote:
> I am running Postfix mail_version = 3.5-20190922, with OpenSSL 1.1.1d
> on a FreeBSD 11 machine. I am just wondering what the recommended
> settings are for the following items:
>
> smtp_tls_mandatory_protocols=
> smtpd_tls_mandatory_protocols=
> smtp_tls_protocols=
> smtpd_tls_protocols=
There are the default settings:
postconf -d | egrep "^smtpd?_tls.*protocol"
[19:35] [/var/log]
smtp_tls_mandatory_protocols = !SSLv2, !SSLv3
smtp_tls_protocols = !SSLv2, !SSLv3
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
smtpd_tls_protocols = !SSLv2, !SSLv3
They are fine
I use:
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
But it’s definitely not needed nor necessary (nor recommended), I do it
specifically as a little resistance to servers still using deprecated security,
but I also saw very little TLSV1 or TLSV1.1
For reasons I can’t recall I haven’t done this on smtp_tls*
--
'My strength is like the strength of ten because my heart is pure,' said
Carrot. 'Really? Well, there's eleven of them.' —Jingo
