[dovecot] Secure connections with TLS.

TLS connections need to be secured with SSL certificates. `dovecot`
generates self-signed SSL certificates. This commit switches `dovecot`
and `postfix` to SSL certificates signed by Let's Encrypt CA.

diff --git a/dovecot/10-ssl.conf b/dovecot/10-ssl.conf
index fff8bf84080965ac5ebc10e768abdddcbe13f9f0..4dc0566b531e1d7a07c265ea715cd7a51d192570 100644 (file)
--- a/dovecot/10-ssl.conf
+++ b/dovecot/10-ssl.conf
@@ -3,14 +3,14 @@
 ##
 
 # SSL/TLS support: yes, no, required. <doc/wiki/SSL.txt>
-ssl = yes
+ssl = required
 
 # PEM encoded X.509 SSL/TLS certificate and private key. They're opened before
 # dropping root privileges, so keep the key file unreadable by anyone but
 # root. Included doc/mkcert.sh can be used to easily generate self-signed
 # certificate, just make sure to update the domains in dovecot-openssl.cnf
-ssl_cert = </etc/dovecot/private/dovecot.pem
-ssl_key = </etc/dovecot/private/dovecot.key
+ssl_cert = <${mail_ssl_cert_dir}/fullchain.pem
+ssl_key = <${mail_ssl_cert_dir}/privkey.pem
 
 # If key file is password protected, give the password here. Alternatively
 # give it when starting dovecot with -p parameter. Since this file is often

diff --git a/dovecot/README b/dovecot/README
index 59a39df3f03b873fdceaa34b60a7439c720c0dbd..5e6f54498494d7f9cc27b60ad14060e0468ee535 100644 (file)
--- a/dovecot/README
+++ b/dovecot/README
@@ -42,6 +42,32 @@ dovecot
 |-> auth-static.conf.ext        -- /etc/dovecot/conf.d/
 `-> auth-system.conf.ext        -- /etc/dovecot/conf.d/
 
+SSL
+---
+
+Add DNS records. If no MX record is present, mail servers fall back to the A
+record (see https://serverfault.com/a/470651).
+
+```
+example.com.      0 A       <ipv4_address>
+example.com.      0 AAAA    <ipv6_address>
+example.com.      0 MX    0 mail.example.com
+mail.example.com. 0 CNAME   example.com.
+```
+
+Install `certbot`.
+
+```
+$ apt install certbot
+```
+
+Create a certificate with a generic name and add all domains under it.
+
+```
+$ certbot certonly --manual --preferred-challenges dns --cert-name mail \
+    -d mail.<domain1> -d mail.<domain2>
+```
+
 Install
 -------
 

diff --git a/postfix/main.cf b/postfix/main.cf
index 449a3bfa66248297dc0810259e3e021295117f56..0e7c03dc6dc4977f77d95998f414a80b1a1e79d1 100644 (file)
--- a/postfix/main.cf
+++ b/postfix/main.cf
@@ -14,3 +14,13 @@ readme_directory = no
 # See http://www.postfix.org/COMPATIBILITY_README.html -- default to 2 on
 # fresh installs.
 compatibility_level = 2
+
+# TLS
+smtp_tls_cert_file = ${mail_ssl_cert_dir}/fullchain.pem
+smtp_tls_key_file = ${mail_ssl_cert_dir}/privkey.pem
+smtp_tls_security_level = encrypt
+smtpd_tls_auth_only = yes
+smtpd_tls_cert_file = ${mail_ssl_cert_dir}/fullchain.pem
+smtpd_tls_key_file = ${mail_ssl_cert_dir}/privkey.pem
+smtpd_tls_mandatory_ciphers = high
+smtpd_tls_security_level = encrypt