fix(config): add missing ciphers in smtpd_tls_mandatory_exclude_ciphers, to be consistent with smtpd_tls_mandatory_ciphers = high

Author: javierbertoli

postfix/files/main.cf

@@ -83,7 +83,7 @@
 {%- endif %}
 {{ set_parameter('smtpd_tls_session_cache_database', 'btree:${data_directory}/smtpd_scache') }}
 {{ set_parameter('smtpd_tls_mandatory_ciphers', 'high') }}
-{{ set_parameter('smtpd_tls_mandatory_exclude_ciphers', ['aNULL', 'MD5']) }}
+{{ set_parameter('smtpd_tls_mandatory_exclude_ciphers', ['aNULL', 'eNULL', 'EXPORT', 'DES', '3DES', 'MD5', 'RC4', 'PSK', 'SRP', 'CAMELLIA', 'SEED']) }}
 {{ set_parameter('smtpd_tls_mandatory_protocols', ['!SSLv2', '!SSLv3']) }}
 {{ set_parameter('tls_preempt_cipherlist', 'yes') }}
 # Relay/Sender settings

test/integration/default/controls/postfix_spec.rb

@@ -25,6 +25,9 @@
       should cmp 'btree:${data_directory}/smtpd_scache'
     end
     its('smtpd_tls_mandatory_ciphers') { should cmp 'high' }
+    its('smtpd_tls_mandatory_exclude_ciphers') do
+      should cmp 'aNULL, eNULL, EXPORT, DES, 3DES, MD5, RC4, PSK, SRP, CAMELLIA, SEED'
+    end
     its('tls_preempt_cipherlist') { should cmp 'yes' }
     its('smtp_tls_loglevel') { should cmp '1' }
     its('smtp_tls_security_level') { should cmp 'may' }