PCI DSS / HIPAA / NIST Compliance adjustments

Thanks for your response.

I’m not discussing default settings or the way mailcow works actually. I pretty much understand how it works and what it does

I’m just trying to see how far I can go for security customization and compliance on inbound.

I don’t know how it goes in other countries, but France Mail providers and mainly GAFAM like ones like Google or Microsoft already shut down and don’t accept neither unencrypted, Unauthenticated TLS 1.0 + TLS 1.1.
Mails sent that way are simply rejected and it actually works pretty well in our country to reject bad mail providers.
That’s why I’m trying to replicate this.

Actually another good French Mail provider, Mailo is at least PCI DSS compiant and does replicate those conditions.

So I did understand and classify these results. I did that already and dug a lot of information from mailcow documentation (I read the link you specify in your answer).

Thing is : I want to change these inbound settings and reject what I want to be rejected and I can’t seem to find where I can change theses policies to do what I want it to do, neither in documentation, git repo or this community forum.

It does not really bother me if I keep using mailcow as a personnal mail server, since I don’t have to comply to any standard but if I want this solution to be viable for my compagny which does have to comply to at least PCI DSS, I need to be able to generate a compliance report that will be validated by ANSSI organization ( https://www.ssi.gouv.fr/

) and CNIL ( Particulier | CNIL

cnil.fr

Particulier | CNIL

).
For now reports from Immuniweb were valited successfully so I’m looking for the same settings on a self hosted solution.

Would you know of a way I could do this ?

@esackbauer Thank for your response.

I was actually tweaking this file as I found on this site : Mailcow - SMTP + SMTPD TLS 1.0 TLS1.1 deaktivieren

but I did not achieve 100% of what I stated in this mail, so I wanted to tinker with settings and see how far I could go before I share what I found with the community.

I didn’t manage to check all cases I stated but I think I went far enough and found most of what I was looking for.

I did achieve PCI DSS green mark with A+ grade on (SMTP) SSL Security Test for ${FQDN}:25 with the following settings in /opt/mailcow-dockerized/data/conf/postfix/extra.cnf :
smtp_tls_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1
smtp_tls_mandatory_protocols = !SSLv2,!SSLv3,!TLSv1
smtpd_tls_protocols = !SSLv2,!SSLv3,!TLSv1
smtpd_tls_mandatory_protocols = !SSLv2,!SSLv3,!TLSv1
lmtp_tls_protocols = !SSLv2,!SSLv3,!TLSv1
lmtp_tls_mandatory_protocols = !SSLv2,!SSLv3,!TLSv1
smtp_tls_ciphers = high
smtp_tls_mandatory_ciphers = high
smtpd_tls_ciphers = high
smtpd_tls_mandatory_ciphers = high
tls_high_cipherlist = tls_high_cipherlist = ECDHE-ECDSA-AES256-GCM-SHA384:TLS_AES_256_GCM_SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:TLS_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:TLS_AES_128_GCM_SHA256:ECDHE-RSA-AES256-GCM-SHA384:TLS_AES_256_GCM_SHA384:ECDHE-RSA-CHACHA20-POLY1305:TLS_CHACHA20_POLY1305_SHA256:ECDHE-RSA-AES128-GCM-SHA256:TLS_AES_128_GCM_SHA256
smtpd_tls_eecdh_grade = ultra
I may play a bit with cipherlist another day to add more available. Seems a little bit too restrictive even for me.

I did play with tls auth only but Immuniweb still complains. At least it’s not RED and it does not concern PCI DSS so I won’t care much more.
I used these settings in extra.cnf :
smtpd_tls_auth_only = yes
smtp_use_tls = yes
smtpd_use_tls = yes

It also seems that Postfix does not have a way to implement OCSP Stampling so I gave up on that for now. It does not break PCI DSS compliance anyway so why bother.

I use pFsense + (laboratory free licence on a mini PC) and a commercial Netgate Appliance with pFsense + at work.

We tend to try and use Open Source as much as we can and I push my direction to pay for support or donate to these projects as much as I can at my level, so I would actually rather do what I can at home and present a solution which could match my convictions.
I may be a rare case and my impact is small but I try to push Open Source usage where I can, contrary to most companies in France who go Microsoft or Google, or any other commercial solution for ease of use and brain release.