From: Silvio Rhatto <rhatto@riseup.net>
Date: Mon, 20 Oct 2014 15:33:55 +0000 (-0200)
Subject: Disabling SSLv3 in postfix
X-Git-Url: https://gitweb.fluxo.info/?a=commitdiff_plain;h=ccdbd41de5b996c8cbd2476bfc7054affb1d0625;p=puppet-mail.git

Disabling SSLv3 in postfix
---

diff --git a/manifests/tls/hardened.pp b/manifests/tls/hardened.pp
index 67f68da..63306f5 100644
--- a/manifests/tls/hardened.pp
+++ b/manifests/tls/hardened.pp
@@ -1,10 +1,12 @@
 class mail::tls::hardened inherits mail::tls {
   # Hardened config
   postfix::config { "smtpd_tls_ciphers":                value => 'high' }
-  postfix::config { "smtp_tls_protocols":               value => '!SSLv2, SSLv3, TLSv1' }
+  postfix::config { "smtp_tls_protocols":               value => '!SSLv2, !SSLv3' }
+  postfix::config { "smtp_tls_mandatory_protocols"      value => '!SSLv2, !SSLv3' }
   postfix::config { "smtp_tls_note_starttls_offer":     value => 'yes' }
   postfix::config { "smtpd_tls_received_header":        value => 'yes' }
-  postfix::config { "smtpd_tls_mandatory_protocols":    value => 'TLSv1' }
+  postfix::config { "smtpd_tls_protocols":              value => '!SSLv2, !SSLv3' }
+  postfix::config { "smtpd_tls_mandatory_protocols":    value => '!SSLv2, !SSLv3' }
   postfix::config { "smtpd_tls_session_cache_database": value => 'btree:${data_directory}/smtpd_scache' }
   postfix::config { "smtp_tls_session_cache_database":  value => 'btree:${data_directory}/smtp_scache' }