Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am failing a PCI Compliant scan. I have successfully used RC4 ciphers for Apache setup but my Postfix configuration is still not fixed. What TLS configuration should i use in my file.

my current configuration is as follows

# TLS parameters
tls_preempt_cipherlist = yes
smtpd_tls_protocols = !SSLv2
smtpd_tls_mandatory_protocols = !SSLv2, SSLv3
smtpd_tls_cipherlist = RC4-SHA:+TLSv1:!SSLv2:+SSLv3:!aNULL:!NULL
smtp_tls_cipherlist = RC4-SHA:+TLSv1:!SSLv2:+SSLv3:!aNULL:!NULL
smtpd_tls_security_level = encrypt
share|improve this question
just a note: smtpd_tls_cipherlist is obsolete since 2.3, but should work. – gertvdijk Dec 5 '12 at 12:40
Don't process email on your public facing web server, or any server which is also processing customer information. – Michael Hampton Dec 5 '12 at 14:36
up vote 3 down vote accepted

Your auditor is aware that the B in BEAST stands for BROWSER right?
It is pretty impractical (though yes, not entirely impossible) for a non-browser client like a MUA to leak enough information to compromise security.

That said, you should be able to use the various _cipherlist parameters as you did for Apache. You should make sure you do not offer any vulnerable ciphers (I believe you currently do with that cipher list, but I'm not looking at the expanded lists so I could be wrong).

You may also want to turn off tls_preempt_cypherlist in case that's causing problems with cipher negotiation.

As others have pointed out your mail server should be an isolated piece of infrastructure (and thus generally outside the scope of a PCI audit anyway.
If your auditor is poking around it's probably easier to just patch it to shut them up, but if your mail server is not an island unto itself you really need to re-architect so that it is. That's just standard security best practices.

share|improve this answer
Thanks for your elaborated explanation. The deal is that I am using EC2 instance and using postfix to relay emails to google apps account. I am not storing customer information on my server, however hosting SSL forms which post sensitive data to servers. What are my possible options? – Abdul Haseeb Dec 5 '12 at 18:09
@AbdulHaseeb In that particular case I would eliminate postfix for handling inbound mail (point your MX records directly at Google Apps). If you need postfix in the loop spin up another EC2 instance to run it on (a micro would probably be fine) -- you really shouldn't run a mail server on a system that's involved with taking customer data (even if you're just showing them a form that posts elsewhere) - I think it's technically OK for PCI standards, but it's definitely a breach of isolation and not the best way to work... – voretaq7 Dec 5 '12 at 18:27
yes, I am going with eliminating postfix for inbound mails. If I would need a mail server then I will use another EC2 instance for that. Thanks, it helped a lot :) – Abdul Haseeb Dec 5 '12 at 20:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.