Changeset - 24120c68c6b4
Parent rev.
Child rev.
[Not reviewed]
0 8 0
Branko Majic (branko) - 3 months ago 2024-02-18 20:37:53
branko@majic.rs
MAR-196: Simplify allowed TLS protocol configuration for mail_server role:

- Accept minimum version allowed instead of arbitrary list.
- Fixes deprecation warnings in Dovecot logs (ssl_protocols ->
ssl_min_protocol transition).
8 files changed with 44 insertions and 16 deletions:
docs/releasenotes.rst
7
docs/rolereference.rst
5
6
roles/mail_server/defaults/main.yml
14
2
roles/mail_server/molecule/default/group_vars/parameters-optional.yml
1
3
roles/mail_server/molecule/default/tests/test_default.py
14
roles/mail_server/templates/99-local.conf.j2
1
1
roles/mail_server/templates/master.cf.j2
1
1
testsite/group_vars/mail.yml
1
3
0 comments (0 inline, 0 general)
docs/releasenotes.rst
➞
Show inline comments
 
@@ -39,12 +39,19 @@ Dropped support for Debian 10 (Buster).
 

			




	
	
	
		
 
  * Parameter ``maintenance_allowed_hosts`` has been dropped and

			




	
	
	
		
 
    replaced with parameter ``maintenance_allowed_sources``. The new

			




	
	
	
		
 
    parameter expects a list of IPv4 and IPv6 addresses (or

			




	
	
	
		
 
    subnets). Resolvable names can no longer be specified.

			




	
	
	
		
 

			




	
	
	
		
 
* ``mail_server`` role

			




	
	
	
		
 

			




	
	
	
		
 
  * Parameter ``mail_server_tls_protocols`` has been dropped and

			




	
	
	
		
 
    replaced with parameter ``mail_server_minimum_tls_protocol``. Full

			




	
	
	
		
 
    list of TLS protocols can no longer be specified, only the minimum

			




	
	
	
		
 
    one.

			




	
	
	
		
 

			




	
	
	
		
 
* ``wsgi_website`` role

			




	
	
	
		
 

			




	
	
	
		
 
  * Dropped support for Python 2.7. Only Python 3 is supported now.

			




	
	
	
		
 

			




	
	
	
		
 
    The ``python_version`` role parameter has been dropped. The

			




	
	
	
		
 
    ``python_interpreter`` parameter is still available, but it

			




        

    


    
    

    

        

                

                    docs/rolereference.rst
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -1162,23 +1162,22 @@ Parameters

			




	
	
	
		
 
  Maximum size of message in bytes that the SMTP server should accept

			




	
	
	
		
 
  for incoming mails. If the mail message size exceeds the listed

			




	
	
	
		
 
  value, it will be rejected by the server. The size is also

			




	
	
	
		
 
  advertised as part of SMTP server capabilities (in response to the

			




	
	
	
		
 
  ``ehlo`` SMTP command).

			




	
	
	
		
 

			




	
	
	
		
 
**mail_server_minimum_tls_protocol** (string, optional, ``"TLSv1.2"``)

			




	
	
	
		
 
  Minimum version of TLS protocol to allow when connecting to SMTP

			




	
	
	
		
 
  submission port or IMAP. Value should be compatible with Dovecot's

			




	
	
	
		
 
  ``ssl_protocols`` configuration option.

			




	
	
	
		
 

			




	
	
	
		
 
**mail_server_smtp_additional_configuration** (string, optional, ``""``))

			




	
	
	
		
 
  Additional configuration directives to include in SMTP server main

			




	
	
	
		
 
  configuration file. Directives must be specifically compatible with

			




	
	
	
		
 
  Postfix, and are treated verbatim (multi-line string will suffice).

			




	
	
	
		
 

			




	
	
	
		
 
**mail_server_tls_protocols** (list, optional, ``[ "TLSv1.2" ]``)

			




	
	
	
		
 
  List of TLS protocols the mail server should support. Each value specified

			




	
	
	
		
 
  should be compatible with Postfix configuration option

			




	
	
	
		
 
  ``smtpd_tls_mandatory_protocols`` and Dovecot configuration option

			




	
	
	
		
 
  ``ssl_protocols``.

			




	
	
	
		
 

			




	
	
	
		
 
**mail_server_tls_ciphers** (string, optional ``DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:!aNULL:!MD5:!EXPORT``)

			




	
	
	
		
 
  TLS ciphers to enable on the mail server (for IMAP and SMTP submission). This

			




	
	
	
		
 
  should be an OpenSSL-compatible cipher specification. Value should be

			




	
	
	
		
 
  compatible with Postfix configuration option ``tls_high_cipherlist`` and

			




	
	
	
		
 
  Dovecot configuration option ``ssl_cipher_list``. Default value allows only

			




	
	
	
		
 
  TLSv1.2 and strong PFS ciphers.

			




        

    


    
    

    

        

                

                    roles/mail_server/defaults/main.yml
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -5,18 +5,30 @@ mail_user: vmail

			




	
	
	
		
 
imap_folder_separator: "/"

			




	
	
	
		
 
smtp_rbl: []

			




	
	
	
		
 
mail_postmaster: "postmaster@{{ ansible_domain }}"

			




	
	
	
		
 
smtp_allow_relay_from: []

			




	
	
	
		
 
local_mail_aliases: {}

			




	
	
	
		
 
imap_max_user_connections_per_ip: 10

			




	
	
	
		
 
mail_server_tls_protocols:

			




	
	
	
		
 
  - "TLSv1.2"

			




	
	
	
		
 
mail_server_minimum_tls_protocol: "TLSv1.2"

			




	
	
	
		
 
mail_server_tls_ciphers: "\

			




	
	
	
		
 
DHE-RSA-AES128-GCM-SHA256:\

			




	
	
	
		
 
DHE-RSA-AES256-GCM-SHA384:\

			




	
	
	
		
 
DHE-RSA-CHACHA20-POLY1305:\

			




	
	
	
		
 
ECDHE-RSA-AES128-GCM-SHA256:\

			




	
	
	
		
 
ECDHE-RSA-AES256-GCM-SHA384:\

			




	
	
	
		
 
ECDHE-RSA-CHACHA20-POLY1305:\

			




	
	
	
		
 
!aNULL:!MD5:!EXPORT"

			




	
	
	
		
 
mail_message_size_limit: 10240000

			




	
	
	
		
 
mail_server_smtp_additional_configuration: ""

			




	
	
	
		
 

			




	
	
	
		
 
# Internal use only.

			




	
	
	
		
 

			




	
	
	
		
 
# Map Postfix smtpd allowed protocols based on minimum protocol

			




	
	
	
		
 
# specified (for use with submission port smtpd instance). A bit

			




	
	
	
		
 
# repetative, but easy to understand.

			




	
	
	
		
 
mail_server_smtpd_submission_protocols:

			




	
	
	
		
 
  SSLv2: ["SSLv2", "SSLv3", "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3"]

			




	
	
	
		
 
  SSLv3: ["SSLv3", "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3"]

			




	
	
	
		
 
  TLSv1: ["TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3"]

			




	
	
	
		
 
  TLSv1.1: ["TLSv1.1", "TLSv1.2", "TLSv1.3"]

			




	
	
	
		
 
  TLSv1.2: ["TLSv1.2", "TLSv1.3"]

			




	
	
	
		
 
  TLSv1.3: ["TLSv1.3"]

			




        

    


    
    

    

        

                

                    roles/mail_server/molecule/default/group_vars/parameters-optional.yml
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -2,15 +2,13 @@

			




	
	
	
		
 

			




	
	
	
		
 
mail_ldap_base_dn: dc=local

			




	
	
	
		
 
mail_ldap_url: ldap://ldap-server/

			




	
	
	
		
 
mail_ldap_tls_truststore: "{{ lookup('file', 'tests/data/x509/ca/chain-full.cert.pem') }}"

			




	
	
	
		
 
mail_ldap_postfix_password: postfixpassword

			




	
	
	
		
 
mail_ldap_dovecot_password: dovecotpassword

			




	
	
	
		
 
mail_server_tls_protocols:

			




	
	
	
		
 
  - TLSv1.2

			




	
	
	
		
 
  - TLSv1.1

			




	
	
	
		
 
mail_server_minimum_tls_protocol: TLSv1.1

			




	
	
	
		
 
mail_server_tls_ciphers: "DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-GCM-SHA384:\

			




	
	
	
		
 
DHE-RSA-AES256-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-GCM-SHA384:\

			




	
	
	
		
 
ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:!aNULL:!MD5:!EXPORT"

			




	
	
	
		
 
mail_user: virtmail

			




	
	
	
		
 
mail_user_uid: 5000

			




	
	
	
		
 
mail_user_gid: 5000

			




        

    


    
    

    

        

                

                    roles/mail_server/molecule/default/tests/test_default.py
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -702,6 +702,20 @@ def test_smtp_default_port_tls_version_and_ciphers(host):

			




	
	
	
		
 

			




	
	
	
		
 
    tls_versions.sort()

			




	
	
	
		
 
    tls_ciphers = sorted(list(tls_ciphers))

			




	
	
	
		
 

			




	
	
	
		
 
    assert tls_versions == expected_tls_versions

			




	
	
	
		
 
    assert tls_ciphers == expected_tls_ciphers[distribution_release]

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
def test_dovecot_warnings(host):

			




	
	
	
		
 
    """

			




	
	
	
		
 
    Tests if Dovecot is reporting any warnings.

			




	
	
	
		
 
    """

			




	
	
	
		
 

			




	
	
	
		
 
    with host.sudo():

			




	
	
	
		
 

			




	
	
	
		
 
        # Use invocation ID to get service logs since last restart.

			




	
	
	
		
 
        invocation_id = host.run("systemctl show -p InvocationID --value dovecot").stdout.strip()

			




	
	
	
		
 
        invocation_logs = host.run("journalctl INVOCATION_ID=%s + _SYSTEMD_INVOCATION_ID=%s", invocation_id, invocation_id)

			




	
	
	
		
 

			




	
	
	
		
 
        assert "doveconf: Warning" not in invocation_logs.stdout

			




        

    


    
    

    

        

                

                    roles/mail_server/templates/99-local.conf.j2
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -29,13 +29,13 @@ service auth {

			




	
	
	
		
 
}

			




	
	
	
		
 

			




	
	
	
		
 
# TLS configuration.

			




	
	
	
		
 
ssl_cert = </etc/ssl/certs/{{ ansible_fqdn }}_imap.pem

			




	
	
	
		
 
ssl_key = </etc/ssl/private/{{ ansible_fqdn }}_imap.key

			




	
	
	
		
 
ssl_dh=</etc/ssl/private/{{ inventory_hostname }}_imap.dh.pem

			




	
	
	
		
 
ssl_protocols = {{ mail_server_tls_protocols | join(' ') }}

			




	
	
	
		
 
ssl_min_protocol = {{ mail_server_minimum_tls_protocol }}

			




	
	
	
		
 
ssl_cipher_list = {{ mail_server_tls_ciphers }}

			




	
	
	
		
 
ssl = required

			




	
	
	
		
 

			




	
	
	
		
 
# Mail delivery.

			




	
	
	
		
 
protocol lda {

			




	
	
	
		
 
  mail_plugins = $mail_plugins sieve

			




        

    


    
    

    

        

                

                    roles/mail_server/templates/master.cf.j2
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -130,9 +130,9 @@ submission inet n       -       y       -       -       smtpd

			




	
	
	
		
 
  -o syslog_name=postfix/submission

			




	
	
	
		
 
  -o smtpd_tls_security_level=encrypt

			




	
	
	
		
 
  -o smtpd_sasl_auth_enable=yes

			




	
	
	
		
 
  -o smtpd_tls_auth_only=yes

			




	
	
	
		
 
  -o smtpd_recipient_restrictions=

			




	
	
	
		
 
  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject

			




	
	
	
		
 
  -o smtpd_tls_mandatory_protocols={{ mail_server_tls_protocols | join(',') }}

			




	
	
	
		
 
  -o smtpd_tls_mandatory_protocols={{ mail_server_smtpd_submission_protocols[mail_server_minimum_tls_protocol] | join(',') }}

			




	
	
	
		
 
  -o smtpd_tls_mandatory_ciphers=high

			




	
	
	
		
 
  -o tls_high_cipherlist={{ mail_server_tls_ciphers }}

			




        

    


    
    

    

        

                

                    testsite/group_vars/mail.yml
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -29,13 +29,11 @@ smtp_allow_relay_from:

			




	
	
	
		
 
  - xmpp.{{ testsite_domain }}

			




	
	
	
		
 
  - web.{{ testsite_domain }}

			




	
	
	
		
 
  - ws01.{{ testsite_domain }}

			




	
	
	
		
 

			




	
	
	
		
 
imap_max_user_connections_per_ip: 50

			




	
	
	
		
 

			




	
	
	
		
 
mail_server_tls_protocols:

			




	
	
	
		
 
  - TLSv1.2

			




	
	
	
		
 
  - TLSv1.1

			




	
	
	
		
 
mail_server_minimum_tls_protocol: TLSv1.1

			




	
	
	
		
 

			




	
	
	
		
 
mail_server_tls_ciphers: "DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-GCM-SHA384:\

			




	
	
	
		
 
DHE-RSA-AES256-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-GCM-SHA384:\

			




	
	
	
		
 
ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA:!aNULL:!MD5:!EXPORT"

			




        

    



    


    



    



      

      





    
    0 comments (0 inline, 0 general)
    





    


  

  







  


    




    








    
        
    
    
        This site is powered by
            Kallithea 0.7.0,
        which is
        © 2010–2023 by various authors & licensed under GPLv3.