Home / server / Questions / 669847
Accepted
burnersk
Asked: 2015-02-20 04:08:17 +0800 CST

How to disable SSLv3 in Postfix 2.11?

  • 772

I just noticed (by some online check tools) that my mailserver may allow SSLv3 and updated my configuration.

My current config in Postfix 2.11.2:

# inbound
smtpd_tls_security_level = may
smtpd_tls_mandatory_protocols = !SSLv2 !SSLv3
# outbound
smtp_tls_security_level = may
smtp_tls_mandatory_protocols = !SSLv2 !SSLv3

Unfortunately the tools keep saying SSLv3 is accepted.

How to convert the desired (nginx) configuration into Postfix (inbound and outbound) one?

Using Debian/7, Postfix/2.11.2, OpenSSL/1.0.1e

ssl

1 Answers

  1. Best Answer

    The tools were not lying!

    The solution have to look this way:

    # inbound
smtpd_tls_security_level = may
smtpd_tls_protocols=!SSLv2,!SSLv3
smtpd_tls_mandatory_protocols=!SSLv2,!SSLv3
# outbound
smtp_tls_security_level = may
smtp_tls_protocols=!SSLv2,!SSLv3
smtp_tls_mandatory_protocols=!SSLv2,!SSLv3
    • smtp[d]_tls_security_level == "may": smtp[d]_tls_protocols is used
    • smtp[d]_tls_security_level == "encrypt": smtp[d]_tls_mandatory_protocols is used
    • smtp[d]_tls_security_level == "none": none of these two parameters is used
    • 9