From 4e121413ca5c7bb3ce39aab8b7f632dd188a0569 2020-05-18 21:09:08
From: Branko Majic <branko@majic.rs>
Date: 2020-05-18 21:09:08
Subject: [PATCH] MAR-153: Use 2048-bit Diffie-Helman parameters for IMAP server in the mail_server role.

---

diff --git a/roles/mail_server/molecule/default/prepare.yml b/roles/mail_server/molecule/default/prepare.yml
index 78c30375132f1b072818b766c84f4fc9c337711f..e520de33671019b843863662ca8b28f9506735be 100644
--- a/roles/mail_server/molecule/default/prepare.yml
+++ b/roles/mail_server/molecule/default/prepare.yml
@@ -18,6 +18,11 @@
         update_cache: true
       changed_when: false
 
+    - name: Install tools for testing
+      apt:
+        name: gnutls-bin
+        state: present
+
 - hosts: stretch
   become: true
   tasks:
diff --git a/roles/mail_server/molecule/default/tests/test_default.py b/roles/mail_server/molecule/default/tests/test_default.py
index f3a2e71b5faedc4bcfdf22bd6a9f710aaa08f8e9..cabbb459739db10b0cfc2600783510b4a719d6b4 100644
--- a/roles/mail_server/molecule/default/tests/test_default.py
+++ b/roles/mail_server/molecule/default/tests/test_default.py
@@ -388,7 +388,8 @@ def test_smtp_server_uses_correct_dh_parameters(host):
     with host.sudo():
         expected_dhparam = host.file('/etc/ssl/private/%s_smtp.dh.pem' % hostname).content_string.rstrip()
 
-    connection = host.run("gnutls-cli --no-ca-verification --starttls-proto=smtp --port 25 --priority 'NONE:+VERS-TLS1.2:+CTYPE-X509:+COMP-NULL:+SIGN-RSA-SHA384:+DHE-RSA:+SHA384:+AEAD:+AES-256-GCM' --verbose localhost")
+    connection = host.run("gnutls-cli --no-ca-verification --starttls-proto=smtp --port 25 "
+                          "--priority 'NONE:+VERS-TLS1.2:+CTYPE-X509:+COMP-NULL:+SIGN-RSA-SHA384:+DHE-RSA:+SHA384:+AEAD:+AES-256-GCM' --verbose localhost")
 
     output = connection.stdout
     begin_marker = "-----BEGIN DH PARAMETERS-----"
@@ -396,3 +397,14 @@ def test_smtp_server_uses_correct_dh_parameters(host):
     used_dhparam = output[output.find(begin_marker):output.find(end_marker) + len(end_marker)]
 
     assert used_dhparam == expected_dhparam
+
+
+def test_imap_server_uses_correct_dh_parameters(host):
+    """
+    Tests if the IMAP server uses correct Diffie-Helman parameters.
+    """
+
+    connection = host.run("gnutls-cli --no-ca-verification --starttls-proto=imap --port 143 "
+                          "--priority 'NONE:+VERS-TLS1.2:+CTYPE-X509:+COMP-NULL:+SIGN-RSA-SHA384:+DHE-RSA:+SHA384:+AEAD:+AES-256-GCM' localhost")
+
+    assert " - Using prime: 2048 bits" in connection.stdout
diff --git a/roles/mail_server/templates/99-local.conf.j2 b/roles/mail_server/templates/99-local.conf.j2
index 077a7b59ee6dda1c63f4adb8cae4b57c08019ad6..6b34cb7e620c84c450a4ff602c91a376d2f2c888 100644
--- a/roles/mail_server/templates/99-local.conf.j2
+++ b/roles/mail_server/templates/99-local.conf.j2
@@ -31,6 +31,7 @@ service auth {
 # TLS configuration.
 ssl_cert = </etc/ssl/certs/{{ ansible_fqdn }}_imap.pem
 ssl_key = </etc/ssl/private/{{ ansible_fqdn }}_imap.key
+ssl_dh_parameters_length = 2048
 ssl_protocols = {{ mail_server_tls_protocols | join(' ') }}
 ssl_cipher_list = {{ mail_server_tls_ciphers }}
 ssl = required