Recommended Protocols?

[Nikolai Lusan]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On Tue, 2020-11-10 at 14:05 +0800, Jeremy Ardley wrote:
> I also use STARTTLS, though I expose that on both IMAP and IMAPS
> ports, 
> which is consistent with a number of major imap providers.

Yeah, the choice to use only STARTTLS over IMAP only (no IMAPS) was
mine. I do force TLS though, generally it makes it easier for me to
handout instructions for people to connect to the server (I host email
for a few different organisations).


> Selection of ciphers is important. I researched this recently and
> use 
> this stanza in the configuration
> 
> ssl = required
> ssl_min_protocol = TLSv1.2
> ssl_cipher_list = EECDH+AESGCM:EDH+AESGCM
> ssl_prefer_server_ciphers = yes

I agree that cipher settings are important, and the only other thing I
am going to say is that compared to your settings mine are severly
stricter (if not anally retentive) :)


> The defaults in dovecot are shown commented in conf.d/10-ssl.conf.
> They 
> are not best practice for security.

I find that no default setting is "best practice" and that anyone
configuring any kind of service should look at all the configuration
directives and consider what they should be set to - this is why we
have sysadmins, because some has to do more than "apt install" or "wget
foo.sh | sudo ./foo.sh --install".

- -- 
Nikolai Lusan <nikolai at lusan.id.au>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEVfd4GW6z4nsBxdLo4ZaDRV2VL6QFAl+qSbUACgkQ4ZaDRV2V
L6TVbA//aXFgdiutnBlNS0oZwFMWqRZAhlBzDC0VvSLhn/i2k5SdilUGnOgxZMoM
iW3/5fQ9gQuqf+SKJ7gse2j/WQnEJyMa1eJNAx4iwoq1MzbofmfEeNDipTkhW/Hq
CecM85OeTG7GcMFkwVVSqdc3y/cJawaSBSJ1gdKiOqVMcH/ea89RSbHnGL1S4PD0
yaJoIJP/LlgM06tc+9BziSTpk1zSmD3extozRyLzLFY1aLUIEbWf7sEZRvo3Pe6u
11STjrUYEDJbeiEkTHK8i4HhVH9dw8eoDGEqXJCzKOntdeGv7V6Kanqb9y1xmmfb
OlVHb543wYJJbT6kqqTsttmLiU2qo8lj1+kIAIu6Ydq7ANZksQ7bcFF/wEBcd8KF
LO8RFDWlVgLk1CKNB6qgV5sWLcgEbrhG4AmPA0HyPDnJxAE8DMN1O1a8J+MSzFF8
XBmKIlTd51H/dJs+FYeek4C6O6ayNNr1uRzOuxV2gJ4zG3Dk0j5cBi0S4qK+W3dz
GFvP5WFNvEWS3ZtQPqS5Z7/IUAiK2zT4ZoltLW7xhV4gXfnwwp0bNdWV5JZ6Tc7c
M0epXpU1r6Hf62utJik6ewpNjpR9E4/F7KIvnCahX57Zb88Zl0UgS9euHwtR6M9H
IBtkPa042DJNsF7gt/NwNK2jRoXBK0qg00Mrn6mKdqKEPXK6nQ0=
=zNl0
-----END PGP SIGNATURE-----