Repository: Mailu/Mailu

Issue:
Feature request: Overwriting the TLS configuration on port 25
## Environment & Versions
### Environment
 - [x] docker-compose
 - [ ] kubernetes
 - [ ] docker swarm

### Versions
1.8

## Description
Feature request: Overwriting TLS settings for smtp.

while overwriting the TLS settings for https works perfectly using a volume mapping to /conf/tls.conf it doesn't work for port 25.

Somewhat logical because the TLS settings are hardcoded in the codefragment from [nginx.conf](https://github.com/Mailu/Mailu/blob/master/core/nginx/conf/nginx.conf)

```
 # SMTP is always enabled, to avoid losing emails when TLS is failing
    server {
      listen 25;
      listen [::]:25;
      {% if TLS and not TLS_ERROR %}
      ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
      ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA;
      ssl_prefer_server_ciphers on;
      starttls on;
      {% endif %}
      protocol smtp;
      smtp_auth none;
      auth_http_header Auth-Port 25;
    }
```

Would be nice to include the tls.conf, or better a separate smtptls.conf here too.



Discussion:
What's the use-case for this? surely "any" encryption beats no encryption, no?


Best practice - not use TLS 1.0 and 1.1 and specific cipher suites. The guidance for web and for mail doesn’t differ really, does it?

See e.g. the Internet.nl <http://internet.nl/> platform that issues warnings for supporting TLS1 and TLS1.1

—Olaf


> Op 24 aug. 2021, om 14:46 heeft Florent Daigniere ***@***.*** ***@***.***>> het volgende geschreven:
> 
> 
> What's the use-case for this? surely "any" encryption beats no encryption, no?
> 
> —
> You are receiving this because you authored the thread.
> Reply to this email directly, view it on GitHub <https://github.com/Mailu/Mailu/issues/1945#issuecomment-904608675>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AHFHGTFPONXWGAVRDXJQ6IDT6OICFANCNFSM5CWEXRMQ>.
> 


The current config is what's recommended as the "old" profile for maximum compatibility:
https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=old&openssl=1.1.1d&guideline=5.6

There is "ssl_prefer_server_ciphers on;" so any client that can do "better" will... "any" encryption beats no encryption
As nextgens explained this is by design. This will not change in the foreseeable future. We prefer "any" encryption over no encryption. Unfortunately there exist still many email servers that do not support TLS 1.2+.

Resolving patch:
diff --git a/core/admin/mailu/configuration.py b/core/admin/mailu/configuration.py
--- a/core/admin/mailu/configuration.py
+++ b/core/admin/mailu/configuration.py
@@ -74,6 +74,7 @@
     'PERMANENT_SESSION_LIFETIME': 30*24*3600,
     'SESSION_COOKIE_SECURE': True,
     'CREDENTIAL_ROUNDS': 12,
+    'TLS_PERMISSIVE': True,
     'TZ': 'Etc/UTC',
     # Host settings
     'HOST_IMAP': 'imap',
diff --git a/core/nginx/config.py b/core/nginx/config.py
--- a/core/nginx/config.py
+++ b/core/nginx/config.py
@@ -9,6 +9,8 @@
 
 log.basicConfig(stream=sys.stderr, level=args.get("LOG_LEVEL", "WARNING"))
 
+args['TLS_PERMISSIVE'] = str(args.get('TLS_PERMISSIVE')).lower() not in ('false', 'no')
+
 # Get the first DNS server
 with open("/etc/resolv.conf") as handle:
     content = handle.read().split()


Test patch: