-1

I have setup my personal self hosted mail server. I use Postfix, Dovecot and rspamd. My question is about cipher suites, this topic is more discussion that specific answer seeking. I have setup all My services connections to use SSL whit AES 128bit cipher suites and TLS 1.2> protocol. For WEB, SSH I have no issues as clients that connect will use up to date browsers, program clients to get resources they need. Problem is mail. Far as I know a lot of mail servers still have old software and they might not support TLS 1.2 whit AES 128bit cipher suites and that could lead to lost mail. I have setup Posfix to use AES128+EECDH, AES128+EDH suites for now. I have tested mail delivery and receiving from major mail providers like Gmail, Outlook, Yahoo and bunch of local services and some private servers that I have access to - so far do good. I can send and receive mail just fine.

What experience do You have whit this? Am I going over board whit this or those cipher suites are fine?

closed as too broad by Ward Feb 22 at 2:13

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • I'm not sure if it is useful to answer what ciphers are generally supported right now, as these ciphers change constantly. It could be outdated in a matter of weeks. – Gerald Schneider Feb 20 at 11:01
  • Thats why I'm trying to follow this so I can change them accordingly. – Maigonis Feb 20 at 12:36
2

Remember that SMTP is not a secure protocol by itself, and you should never expect that only the sender and the recipient knows about the contents of a mail even if the contact between the "last hop" MTA and your own mail server was made over the most current protocols.

The secure way of sending mail is to encrypt the information you want to transmit and add it as an attachment to an email.

With that out of the way: What you do by enabling TLS on various listeners on your mail server, is of course to allow for more secure transfer of mail, but first and foremost also to allow for secure transfer of credentials when logging on to mail accounts hosted on your server. For SMTP, if you enable the newest protocols but allow older protocols too, a sane mail transfer agent will use the newest security protocols available to it, while outdated MTAs will not lose their ability to send you mail.

This means that your SMTP listeners should probably use the may clause in the postfix configuration, and accept as wide a spectrum of connections as possible, so you don't unintentionally lose mail on the way.

When it comes to the security of your mail client protocols (probably IMAP), and possible webmail HTTPS listener, on the other hand, you can almost surely decide that you simply don't accept severely outdated clients, and your client security will be better off for it.

  • Yes, I know that encrypting message is some way, PGP for example, is a way to go in you need a secure mail. In reality that is too much for average person. Issue whit idea to allow older protocols and cipher suites is that it can open server to attacks. I have scanned whit multiple tools My previous configuration and someone can use that to gain access to mails or server in general. Thats why I'm willing to use only new protocols and suites. I have setup postfix to use "may" on incoming mail, but not sure it will do much in My strict configuration. – Maigonis Feb 20 at 12:35
  • 1
    If you set "may" on incoming SMTP connections but demand that TLS connections be made using only modern security protocols and ciphers, the end result will be that only modern MTAs will be allowed to establish encrypted communications with your server - all others will be able to connect, and do so in plaintext. And again: You're only securing the last hop. Someone sending you an email from Gmail will still have it read by Google before it's encrypted by their MTA and sent to your server. – Mikael H Feb 20 at 13:47
  • Yes, that do sound stupid. Will research and test more about this. – Maigonis Feb 21 at 8:56

Not the answer you're looking for? Browse other questions tagged or ask your own question.