Configuring strong ciphers for Dovecot (#776)

Co-authored-by: Hailer, Christian <[email protected]>
mailcow · Oct 22, 2024 · b0ef0ff · b0ef0ff
1 parent 4ea5f9c
commit b0ef0ff
Show file tree

Hide file tree

Showing 5 changed files with 24 additions and 2 deletions.
diff --git a/docs/manual-guides/Dovecot/u_e-dovecot-harden_ciphers.de.md b/docs/manual-guides/Dovecot/u_e-dovecot-harden_ciphers.de.md
@@ -0,0 +1,8 @@
+Wenn Sie die Standard-Cipher und TLS-Versionen, die in Dovecot akzeptiert werden, entsprechend der aktuellen Version auf stärkere Einstellungen ändern möchten, können Sie Folgendes zu Dovecots [extra.conf](u_e-dovecot-extra_conf.de.md) hinzufügen:
+
+```bash
+ssl_min_protocol = TLSv1.2
+ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
+```
+
+Falls Sie auch die Cipher für Postfix anpassen wollen finden Sie [hier](../Postfix/u_e-postfix-harden_ciphers.de.md) eine entsprechende Anleitung.
diff --git a/docs/manual-guides/Dovecot/u_e-dovecot-harden_ciphers.en.md b/docs/manual-guides/Dovecot/u_e-dovecot-harden_ciphers.en.md
@@ -0,0 +1,8 @@
+If you want to change the default ciphers and TLS versions accepted in Dovecot as per it's current release to something stronger, you could add following to Dovecot's [extra.conf](u_e-dovecot-extra_conf.en.md):
+
+```bash
+ssl_min_protocol = TLSv1.2
+ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
+```
+
+If you want to adjust the ciphers for Postfix as well you can find the corresponding tutorial [here](../Postfix/u_e-postfix-harden_ciphers.en.md).
diff --git a/docs/manual-guides/Postfix/u_e-postfix-harden_ciphers.de.md b/docs/manual-guides/Postfix/u_e-postfix-harden_ciphers.de.md
@@ -13,4 +13,6 @@ smtpd_tls_ciphers = high
 smtpd_tls_mandatory_ciphers = high
 ```
 
-Eine solche Konfiguration wird die aktuellen (2024-10-21) Konfigurationsprüfungen bei Diensten wie Internet.nl bestehen.
+Eine solche Konfiguration wird die aktuellen (2024-10-21) Konfigurationsprüfungen bei Diensten wie Internet.nl bestehen.
+
+Falls Sie auch die Cipher für Dovecot anpassen wollen finden Sie [hier](../Dovecot/u_e-dovecot-harden_ciphers.de.md) eine entsprechende Anleitung.
diff --git a/docs/manual-guides/Postfix/u_e-postfix-harden_ciphers.en.md b/docs/manual-guides/Postfix/u_e-postfix-harden_ciphers.en.md
@@ -13,4 +13,6 @@ smtpd_tls_ciphers = high
 smtpd_tls_mandatory_ciphers = high
 ```
 
-Such a configuration will pass current (2024-10-21) configuration checks against services like Internet.nl.
+Such a configuration will pass current (2024-10-21) configuration checks against services like Internet.nl.
+
+If you want to adjust the ciphers for Dovecot as well you can find the corresponding tutorial [here](../Dovecot/u_e-dovecot-harden_ciphers.en.md).
diff --git a/mkdocs.yml b/mkdocs.yml
@@ -152,6 +152,7 @@ nav:
       - 'Enable "any" ACL settings': 'manual-guides/Dovecot/u_e-dovecot-any_acl.md'
       - 'Expunge a Users mails': 'manual-guides/Dovecot/u_e-dovecot-expunge.md'
       - 'Full-Text Search': 'manual-guides/Dovecot/u_e-dovecot-fts.md'
+      - 'Hardening Ciphers': 'manual-guides/Dovecot/u_e-dovecot-harden_ciphers.md'
       - 'IMAP IDLE interval': 'manual-guides/Dovecot/u_e-dovecot-idle_interval.md'
       - 'Mail crypt': 'manual-guides/Dovecot/u_e-dovecot-mail-crypt.md'
       - 'More Examples with DOVEADM': 'manual-guides/Dovecot/u_e-dovecot-more.md'
@@ -296,6 +297,7 @@ plugins:
                 ### Dovecot Subsection
               'Customize/Expand dovecot.conf': 'Anpassen/Erweitern von dovecot.conf'
               'Enable "any" ACL settings': 'Aktivierung von "any" ACL-Einstellungen'
+              'Hardening Ciphers': "Ciphers verstärken"
               'Expunge a Users mails': 'Löschen der Mails eines Benutzers'
               'Full-Text Search': 'Volltext Suche (FTS)'
               'IMAP IDLE interval': 'IMAP IDLE-Intervall'