[COMMITTED 1/2] Only allow modern strong protocol/ciphers for incoming STARTTLS

[Mark Wielaard]

---
 SETUP | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/SETUP b/SETUP
index 3c3295b674f8..955ef689f696 100644
--- a/SETUP
+++ b/SETUP
@@ -182,6 +182,11 @@ postconf -e 'smtp_tls_note_starttls_offer = yes'
 postconf -e 'smtpd_tls_loglevel = 1'
 postconf -e 'smtpd_tls_received_header = yes'
 
+# Only allow modern strong protocol/ciphers for incoming STARTTLS
+postconf -e 'tls_preempt_cipherlist = yes'
+postconf -e 'smtpd_tls_exclude_ciphers = aNULL, CBC'
+postconf -e 'smtpd_tls_protocols = !SSLv2,!SSLv3, !TLSv1, !TLSv1.1'
+
 # Disable the conversion of 8BITMIME format to 7BIT format.
 # Which can break domainkeys
 
-- 
2.51.0