summaryrefslogtreecommitdiff
path: root/puppet/modules/site_postfix
diff options
context:
space:
mode:
authorMicah <micah@leap.se>2016-07-05 11:50:41 -0400
committerMicah <micah@leap.se>2016-07-05 15:36:03 -0400
commitf294ddcca7fbe20de788053bfba1cc9c8417ddd8 (patch)
tree54386bd5477bc9638ad9a7510ab3c2c4407f8bcf /puppet/modules/site_postfix
parent2cfcb6d073973025f73f37183a0fa21570a922df (diff)
Use DANE/TLSA validation in postfix (#8141).
Configure DNSSEC validation for client verification, giving us a stronger form of opportunistic TLS Change-Id: Iab92d4f593c4a5a44e3b694295096b0d7f687a37
Diffstat (limited to 'puppet/modules/site_postfix')
-rw-r--r--puppet/modules/site_postfix/manifests/mx.pp33
1 files changed, 29 insertions, 4 deletions
diff --git a/puppet/modules/site_postfix/manifests/mx.pp b/puppet/modules/site_postfix/manifests/mx.pp
index 0b760eb4..2dac85f5 100644
--- a/puppet/modules/site_postfix/manifests/mx.pp
+++ b/puppet/modules/site_postfix/manifests/mx.pp
@@ -57,10 +57,6 @@ class site_postfix::mx {
value => 'sha1';
'relay_clientcerts':
value => 'tcp:localhost:2424';
- # Note: we are setting this here, instead of in site_postfix::mx::smtp_tls
- # because the satellites need to have a different value
- 'smtp_tls_security_level':
- value => 'may';
# reject inbound mail to system users
# see https://leap.se/code/issues/6829
# this blocks *only* mails to system users, that don't appear in the
@@ -90,6 +86,35 @@ class site_postfix::mx {
value => 'permit_mynetworks';
'postscreen_greet_action':
value => 'enforce';
+ # Level of DNS support in the Postfix SMTP client. Enable DNS lookups
+ # (default: empty). When empty, then the legacy "disable_dns_lookups"
+ # (default: no) parameter is used. Setting 'smtp_dns_support_level' to
+ # enabled sets the previous behavior with the new parameter. When set to
+ # 'dnssec" this enables DNSSEC lookups.
+ 'smtp_dns_support_level':
+ value => 'dnssec';
+
+ # http://www.postfix.org/TLS_README.html#client_tls_dane The "dane" level is
+ # a stronger form of opportunistic TLS that is resistant to man in the
+ # middle and downgrade attacks when the destination domain uses DNSSEC to
+ # publish DANE TLSA records for its MX hosts. If a remote SMTP server has
+ # "usable" (see RFC 6698) DANE TLSA records, the server connection will be
+ # authenticated. When DANE authentication fails, there is no fallback to
+ # unauthenticated or plaintext delivery.
+ #
+ # If TLSA records are published for a given remote SMTP server (implying TLS
+ # support), but are all "unusable" due to unsupported parameters or
+ # malformed data, the Postfix SMTP client will use mandatory unauthenticated
+ # TLS. Otherwise, when no TLSA records are published, the Postfix SMTP
+ # client behavior is the same as with may.
+ #
+ # This requires postfix to be able to send its DNS queries to a recursive
+ # DNS nameserver that is able to validate the signed records
+ #
+ # Note: we are setting this here, instead of in site_postfix::mx::smtp_tls
+ # because the satellites need to have a different value
+ 'smtp_tls_security_level':
+ value => 'dane';
}
# Make sure that the cleanup serivce is not chrooted, otherwise it cannot