Commit a31c2e42 authored by Paul Cammish's avatar Paul Cammish

Merge branch 'buster-testing' into 'buster'

buster testing -> buster

Closes #275 and #271

See merge request !163
parents 719e2e67 4d9fe21a
Pipeline #828 passed with stages
in 37 minutes and 32 seconds
CHANGELOG
---------
2020-01-27
sympl-webmail
* Fixed importing contacts
2019-12-31
sympl-core
* Fixed inconsistency with 'disable-filesystem-security' switch.
2019-12-27
sympl-mail
* Improves default PCI Compliance by disabling TLS1.0
* Fixes dhparam issue with Dovecot
2019-12-16
sympl-core
* Add sympl user to relevant groups on each install.
......
sympl-core (10.0.191231.0) stable; urgency=medium
* Fixed inconsistency with disable-filesystem-security switches.
-- Paul Cammish <sympl@kelduum.net> Tue, 31 Dec 2019 08:19:04 +0000
sympl-core (10.0.191216.0) stable; urgency=medium
* Add sympl user to relevant groups on each install.
......
......@@ -8,7 +8,7 @@
set -e
if [ -f /etc/sympl/do-not-secure ]; then exit 0; fi
if [ -f /etc/sympl/do-not-secure ] || [ -f /etc/sympl/disable-filesystem-security ] ; then exit 0; fi
function secure_domain_dir()
{
......@@ -136,7 +136,7 @@ if [ -d /etc/sympl ]; then
fi
for domain in $( find /srv -maxdepth 1 -mindepth 1 ! -type l -type d -print | grep -v '^/srv/\.' | grep '\.' ); do
if [ ! -f ${domain}/config/do-not-secure ]; then
if [ ! -f ${domain}/config/do-not-secure ] || [ -f /etc/sympl/disable-filesystem-security ] ; then
secure_domain_dir ${domain}
fi
done
......
sympl-mail (10.0.191227.0) stable; urgency=medium
* Improves default PCI Compliance by disabling TLS1.0
* Fixes dhparam issue with Dovecot
-- Paul Cammish <sympl@kelduum.net> Fri, 27 Dec 2019 17:14:17 +0000
sympl-mail (10.0.191004.0) stable; urgency=medium
* Fixes permissions issue with configs
......
......@@ -22,6 +22,16 @@ if [ ! -f /etc/ssl/private/exim4-dhparams.pem ] ; then
/etc/cron.weekly/sympl-mail --verbose
fi
if [ ! -f /etc/ssl/private/dovecot-dhparams.pem ] ; then
#
# generate dhparams for Dovecot
#
openssl dhparam -dsaparam -out /etc/ssl/private/dovecot-dhparams.pem 4096
chown dovecot:dovecot /etc/ssl/private/dovecot-dhparams.pem
chmod 600 /etc/ssl/private/dovecot-dhparams.pem
fi
#
# Configure supplementary groups for clamav and freshclam
#
......
#
# Allow sensible ciphers.
# Allow sensible ciphers
#
ssl_cipher_list = ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
#
# Ban ancient protocols too.
# Allow only safe protocols
#
ssl_min_protocol = TLSv1
ssl_min_protocol = TLSv1.1
#
# Prefer our ciphers
#
ssl_prefer_server_ciphers = yes
#
# Use generated phparam file
#
ssl_dh = </etc/ssl/private/dovecot-dhparams.pem
......@@ -56,8 +56,9 @@ tls_on_connect_ports = 465
# removed unless the connecting port is 25, so ancient remote mail servers
# don't break too badly.
#
tls_require_ciphers = %SERVER_PRECEDENCE:%LATEST_RECORD_VERSION:%COMPAT:PFS:NORMAL:-VERS-SSL3.0:-MD5:-CURVE-SECP192R1:-CURVE-SECP224R1:\
-CAMELLIA-256-CBC:-CAMELLIA-192-CBC:-CAMELLIA-128-CBC:-CAMELLIA-128-GCM:-CAMELLIA-256-GCM\
tls_require_ciphers = %SERVER_PRECEDENCE:%LATEST_RECORD_VERSION:%COMPAT:PFS:NORMAL:-VERS-SSL3.0:-VERS-TLS1.0:-MD5:\
-CURVE-SECP192R1:-CURVE-SECP224R1:-CAMELLIA-256-CBC:-CAMELLIA-192-CBC:-CAMELLIA-128-CBC:\
-CAMELLIA-128-GCM:-CAMELLIA-256-GCM\
${if !eq{$received_port}{25}{:-ARCFOUR-128}}
#
......
......@@ -23,6 +23,8 @@ class TestEximLive < Test::Unit::TestCase
@mailbox_crypt.password = @mailbox_crypt_password
@ssl_ctx = OpenSSL::SSL::SSLContext.new("TLSv1_client")
@ssl_ctx.min_version = OpenSSL::SSL::TLS1_1_VERSION
@ssl_ctx.max_version = OpenSSL::SSL::TLS1_3_VERSION
@ssl_ctx.verify_mode = OpenSSL::SSL::VERIFY_NONE
end
......
......@@ -5,4 +5,5 @@ Alias /webmail /var/www/webmail
<Directory /var/www/webmail >
php_admin_value open_basedir /var/www/webmail:/usr/share/roundcube:/var/lib/roundcube/:/usr/share/php:/etc/roundcube/:/var/log/roundcube
php_admin_value upload_tmp_dir /var/lib/roundcube/temp
</Directory>
sympl-webmail (10.0.200127.0) stable; urgency=medium
* Fixed importing contacts
-- Paul Cammish <sympl@kelduum.net> Mon, 27 Jan 2020 23:32:01 +0000
sympl-webmail (10.0.190621.0) stable; urgency=medium
* Created Sympl v10.0 (Debian Buster)
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment