Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am failing a PCI Compliant scan. I have successfully used RC4 ciphers for Apache setup but my Postfix configuration is still not fixed. What TLS configuration should i use in my main.cf file.

my current configuration is as follows

# TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_use_tls=yes
tls_preempt_cipherlist = yes
smtpd_tls_protocols = !SSLv2
smtpd_tls_mandatory_protocols = !SSLv2, SSLv3
smtpd_tls_cipherlist = RC4-SHA:+TLSv1:!SSLv2:+SSLv3:!aNULL:!NULL
smtp_tls_cipherlist = RC4-SHA:+TLSv1:!SSLv2:+SSLv3:!aNULL:!NULL
smtpd_tls_security_level = encrypt
share|improve this question
1  
just a note: smtpd_tls_cipherlist is obsolete since 2.3, but should work. –  gertvdijk Dec 5 '12 at 12:40
1  
Don't process email on your public facing web server, or any server which is also processing customer information. –  Michael Hampton Dec 5 '12 at 14:36
add comment

1 Answer

up vote 2 down vote accepted

Your auditor is aware that the B in BEAST stands for BROWSER right?
It is pretty impractical (though yes, not entirely impossible) for a non-browser client like a MUA to leak enough information to compromise security.

That said, you should be able to use the various _cipherlist parameters as you did for Apache. You should make sure you do not offer any vulnerable ciphers (I believe you currently do with that cipher list, but I'm not looking at the expanded lists so I could be wrong).

You may also want to turn off tls_preempt_cypherlist in case that's causing problems with cipher negotiation.


As others have pointed out your mail server should be an isolated piece of infrastructure (and thus generally outside the scope of a PCI audit anyway.
If your auditor is poking around it's probably easier to just patch it to shut them up, but if your mail server is not an island unto itself you really need to re-architect so that it is. That's just standard security best practices.

share|improve this answer
    
Thanks for your elaborated explanation. The deal is that I am using EC2 instance and using postfix to relay emails to google apps account. I am not storing customer information on my server, however hosting SSL forms which post sensitive data to authorize.net servers. What are my possible options? –  Abdul Haseeb Dec 5 '12 at 18:09
    
@AbdulHaseeb In that particular case I would eliminate postfix for handling inbound mail (point your MX records directly at Google Apps). If you need postfix in the loop spin up another EC2 instance to run it on (a micro would probably be fine) -- you really shouldn't run a mail server on a system that's involved with taking customer data (even if you're just showing them a form that posts elsewhere) - I think it's technically OK for PCI standards, but it's definitely a breach of isolation and not the best way to work... –  voretaq7 Dec 5 '12 at 18:27
    
yes, I am going with eliminating postfix for inbound mails. If I would need a mail server then I will use another EC2 instance for that. Thanks, it helped a lot :) –  Abdul Haseeb Dec 5 '12 at 20:16
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.