From 3828b00deac1713117e8bbd0bf31b3ffbfe7e2a5 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Fri, 13 Jun 2025 03:02:26 +0200 Subject: [PATCH] postfix: configure preferred curves and disable FFDHE This aligns with the intermediate configuration recommended by Mozilla. --- mail-server/postfix.nix | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/mail-server/postfix.nix b/mail-server/postfix.nix index 9f25971..0c52d7c 100644 --- a/mail-server/postfix.nix +++ b/mail-server/postfix.nix @@ -296,6 +296,20 @@ in smtp_tls_exclude_ciphers = "eNULL, aNULL"; smtp_tls_mandatory_exclude_ciphers = "eNULL, aNULL"; + # Restrict and prioritize the following curves in the given order + # Excludes curves that have no widespread support, so we don't bloat the handshake needlessly. + # https://www.postfix.org/postconf.5.html#tls_eecdh_auto_curves + # https://ssl-config.mozilla.org/#server=postfix&version=3.10&config=intermediate&openssl=3.4.1&guideline=5.7 + tls_eecdh_auto_curves = [ + "X25519" + "prime256v1" + "secp384r1" + ]; + + # Disable FFDHE on TLSv1.3 because it is slower than elliptic curves + # https://www.postfix.org/postconf.5.html#tls_ffdhe_auto_groups + tls_ffdhe_auto_groups = [ ]; + # As long as all cipher suites are considered safe, let the client use its preferred cipher tls_preempt_cipherlist = false;