ccchb/ansible
ccchb/ansible
6
1
Fork 1
Code Issues 3 Pull requests Releases Wiki Activity

Stricter TLS ciphersuites for Postfix (SMTP)

Browse source
This commit is contained in:
Fritz Grimpen 2024-09-17 16:53:39 +00:00
parent 7784501da5
commit a4f5536f12
1 changed files with 10 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
roles/postfix/vars/main.yml
View file

@ -353,6 +353,14 @@ postfix_config:
value: 'aNULL' value: 'aNULL'
state: present state: present
- name: smtpd_tls_mandatory_protocols
value: 'TLSv1.2 TLSv1.3'
state: present
- name: smtpd_tls_protocols
value: 'TLSv1.2 TLSv1.3'
state: present
- name: smtpd_tls_received_header - name: smtpd_tls_received_header
value: 'yes' value: 'yes'
state: present state: present
@ -370,7 +378,8 @@ postfix_config:
state: present state: present
- name: tls_high_cipherlist - name: tls_high_cipherlist
value: 'EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA' value: |-
'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384'
state: present state: present
- name: tls_ssl_options - name: tls_ssl_options