external
/
mailinabox
mirror of https://github.com/mail-in-a-box/mailinabox.git
1
0
Fork 0
Code Issues Releases Wiki Activity
mailinabox/conf/nginx-ssl.conf

25 lines
921 B
Plaintext
Raw Normal View History

minimal changeset to get things working on 18.04 @joshdata squashed pull request #1398, removed some comments, and added these notes: * The old init.d script for the management daemon is replaced with a systemd service. * A systemd service configuration is added to configure permissions for munin on startup. * nginx SSL settings are updated because nginx's options and defaults have changed, and we now enable http2. * Automatic SSHFP record generation is updated to know that 22 is the default SSH daemon port, since it is no longer explicit in sshd_config. * The dovecot-lucene package is dropped because the Mail-in-a-Box PPA where we built the package has not been updated for Ubuntu 18.04. * The stock postgrey package is installed instead of the one from our PPA (which we no longer support), which loses the automatic whitelisting of DNSWL.org-whitelisted senders. * Drop memcached and the status check for memcached, which we used to use with ownCloud long ago but are no longer installing. * Other minor changes.
2018-07-07 18:41:41 +00:00
# We track the Mozilla "intermediate" compatibility TLS recommendations.
# Note that these settings are repeated in the SMTP and IMAP configuration.
fixes nginx warning about duplicate ssl configuration (#1460)
2018-10-25 19:18:21 +00:00
# ssl_protocols has moved to nginx.conf in bionic, check there for enabled protocols.
Reviewed again the Mozilla recommendations and fixed some cipher recommendations as well as updated a few settings
2022-09-15 18:19:10 +00:00
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
removing value duplicated with ubuntu-shipped nginx
2022-09-15 19:37:32 +00:00
Reviewed again the Mozilla recommendations and fixed some cipher recommendations as well as updated a few settings
2022-09-15 18:19:10 +00:00
ssl_session_tickets off;
updated dovecot to allow DH and updated ciphers in nginx and postfix as well
2022-09-05 23:25:20 +00:00
Updated DH parameters to 4096 bit RFC7919 values.
2022-09-14 20:50:23 +00:00
ssl_dhparam STORAGE_ROOT/ssl/ffdhe4096.pem;
update to @konklone's latest nginx SSL configuration recommendations
2014-04-18 00:27:52 +00:00
# as recommended by http://nginx.org/en/docs/http/configuring_https_servers.html
Reviewed again the Mozilla recommendations and fixed some cipher recommendations as well as updated a few settings
2022-09-15 18:19:10 +00:00
ssl_session_cache shared:MozSSL:10m;
update nginx cipher list to Mozilla's current intermediate ciphers and update HSTS header to be six months * The Mozilla recommendations must have been updated in the last few years. * The HSTS header must have >=6 months to get an A+ at ssllabs.com/ssltest.
2017-10-03 15:44:01 +00:00
ssl_session_timeout 1d;
update to @konklone's latest nginx SSL configuration recommendations
2014-04-18 00:27:52 +00:00
update nginx SSL options, fixes #61
2014-06-03 14:06:02 +00:00
# Buffer size of 1400 bytes fits in one MTU.
update to @konklone's latest nginx SSL configuration recommendations
2014-04-18 00:27:52 +00:00
# nginx 1.5.9+ ONLY
minimal changeset to get things working on 18.04 @joshdata squashed pull request #1398, removed some comments, and added these notes: * The old init.d script for the management daemon is replaced with a systemd service. * A systemd service configuration is added to configure permissions for munin on startup. * nginx SSL settings are updated because nginx's options and defaults have changed, and we now enable http2. * Automatic SSHFP record generation is updated to know that 22 is the default SSH daemon port, since it is no longer explicit in sshd_config. * The dovecot-lucene package is dropped because the Mail-in-a-Box PPA where we built the package has not been updated for Ubuntu 18.04. * The stock postgrey package is installed instead of the one from our PPA (which we no longer support), which loses the automatic whitelisting of DNSWL.org-whitelisted senders. * Drop memcached and the status check for memcached, which we used to use with ownCloud long ago but are no longer installing. * Other minor changes.
2018-07-07 18:41:41 +00:00
ssl_buffer_size 1400;
update to @konklone's latest nginx SSL configuration recommendations
2014-04-18 00:27:52 +00:00
ssl_stapling on;
set ssl_stapling_verify back to on, reverts part of 47de93961e88d3790120caeece0648ed6ab2c44c The sslmate guidance changed. See #458.
2015-06-27 11:14:16 +00:00
ssl_stapling_verify on;
OCSP improvements * Set ssl_stapling_verify to off per https://sslmate.com/blog/post/ocsp_stapling_in_apache_and_nginx ('on' has no security benefits). * Set resolver to 127.0.0.1, instead of Google Public DNS, because we might as well use our local nameserver anyway. * Remove the commented line which per the link above would never be necessary anyway. OCSP seems to work just fine after these changes.
2015-06-06 23:24:09 +00:00
resolver 127.0.0.1 valid=86400;
update nginx SSL options, fixes #61
2014-06-03 14:06:02 +00:00
resolver_timeout 10;
minimal changeset to get things working on 18.04 @joshdata squashed pull request #1398, removed some comments, and added these notes: * The old init.d script for the management daemon is replaced with a systemd service. * A systemd service configuration is added to configure permissions for munin on startup. * nginx SSL settings are updated because nginx's options and defaults have changed, and we now enable http2. * Automatic SSHFP record generation is updated to know that 22 is the default SSH daemon port, since it is no longer explicit in sshd_config. * The dovecot-lucene package is dropped because the Mail-in-a-Box PPA where we built the package has not been updated for Ubuntu 18.04. * The stock postgrey package is installed instead of the one from our PPA (which we no longer support), which loses the automatic whitelisting of DNSWL.org-whitelisted senders. * Drop memcached and the status check for memcached, which we used to use with ownCloud long ago but are no longer installing. * Other minor changes.
2018-07-07 18:41:41 +00:00
# h/t https://gist.github.com/konklone/6532544