Ns8-mail: enforce TLS on submission ports (465/587) and allow a stricter TLS policy there, disable VRFY by default

Feature
,
1

With ns8-mail 1.9.1 defaults, the submission ports 465 and 587 negotiate TLS 1.0/1.1 and offer 24 anonymous cipher suites (DH_anon/ECDH_anon). nmap ssl-enum-ciphers rates them F. VRFY is enabled and allows recipient enumeration (252 vs 554).

Measured on a fresh 1.9.1 install:

  • 25: TLSv1.0-1.3, anonymous suites (acceptable, opportunistic)
  • 465/587: TLSv1.0-1.3, 24 anonymous suites, grade F
  • 110/143/993/995 (Dovecot): TLSv1.2/1.3 only, grade A (POP3 shows USER in CAPA but rejects plaintext auth before TLS)

Root cause: master.cf (regenerated from the template at every reload) does not set smtpd_tls_security_level=encrypt for submission/submissions, so all services use the global “may”. The smtpd_tls_mandatory_* parameters never take effect. The only override path, main.cf.d, is global, so hardening submission also hardens port 25, where a TLS floor risks silent non-delivery (MTA-to-MTA).

Possible solution - implemented here on my productive private node

  1. In the master.cf template, add -o smtpd_tls_security_level=encrypt to submission and submissions. 587 already requires TLS before AUTH (smtpd_tls_auth_only = yes), so clients see no change, and smtpd_tls_mandatory_* then applies to the submission ports only.
  2. Ship safer mandatory defaults, which only affect 465/587 after (1):
    smtpd_tls_mandatory_protocols = >=TLSv1.2
    smtpd_tls_mandatory_ciphers = high
    smtpd_tls_mandatory_exclude_ciphers = aNULL, eNULL, RC4, MD5, 3DES
    Port 25 stays opportunistic (smtpd_tls_protocols = >=TLSv1).
  3. disable_vrfy_command = yes by default.
  4. Optional: a “TLS policy” selector like NethServer 7 had (#6170, #5421), and POP3 as opt-in.
  5. Docs: a new file in main.cf.d is applied after a restart of the postfix container. A postfix reload is not enough.

Alternatives considered
Global overrides in main.cf.d (TLS 1.2+, exclude aNULL/eNULL/RC4/MD5/3DES) plus dovecot local.conf.d (ssl_min_protocol = TLSv1.2, POP3 off). This works (all ports TLS 1.2/1.3, grade A, delivery fine), but it also raises the floor on port 25.

Additional context
Forum thread: “ns8-mail defaults more permissive than NS7” (link). NS7 history: NethServer/dev#6170, NethServer/dev#5421.