remove nginx tls cbc suites

Author: unattributed

docs/07-tls-and-certificate-automation.md

@@ -33,6 +33,11 @@ In that model:
 - hosted domains can still be `example.com`, `example.net`, and `example.org`
 - MX records for each domain can point to the same mail host
 
+The nginx public-edge TLS template is intentionally bounded to `TLSv1.2` and
+`TLSv1.3`. TLS 1.2 ciphers are listed explicitly as AEAD-only ECDHE suites
+using AES-GCM or ChaCha20-Poly1305. CBC-capable broad cipher aliases, including
+`AES256+EECDH`, are not part of the rendered baseline.
+
 ## Why this matters
 
 This keeps the public project easier to deploy and document because it avoids:
@@ -94,6 +99,8 @@ The verify script checks:
 - hostname and certificate settings are valid
 - required commands exist
 - generated helper files exist when expected
+- the tracked nginx TLS template keeps TLS 1.2/1.3 only and does not include
+  CBC-capable cipher aliases
 
 ## Recommended usage
 

scripts/verify/verify-rendered-config-integrity.ksh

@@ -28,6 +28,8 @@ FAIL=0
 pass() { print -- "PASS $*"; }
 fail() { print -- "FAIL $*"; FAIL=1; }
 
+TLS12_AEAD_CIPHERS='ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256'
+
 check_file() {
   _file="$1"
   _label="$2"
@@ -53,6 +55,21 @@ check_regex() {
   fi
 }
 
+check_no_regex() {
+  _file="$1"
+  _regex="$2"
+  _label="$3"
+  if [ ! -f "${_file}" ]; then
+    fail "${_label} missing: ${_file}"
+    return 0
+  fi
+  if grep -Eiq "${_regex}" "${_file}"; then
+    fail "${_label} forbidden pattern found in ${_file}"
+  else
+    pass "${_label}"
+  fi
+}
+
 check_no_upper_placeholders() {
   _file="$1"
   _label="$2"
@@ -67,6 +84,16 @@ check_no_upper_placeholders() {
   fi
 }
 
+check_nginx_tls_policy() {
+  _root="$1"
+  _label="$2"
+  _ssl_template="${_root}/etc/nginx/templates/ssl.tmpl"
+
+  check_regex "${_ssl_template}" '^ssl_protocols TLSv1\.2 TLSv1\.3;$' "${_label} nginx TLS protocols limited to TLS 1.2 and TLS 1.3"
+  check_regex "${_ssl_template}" "^ssl_ciphers ${TLS12_AEAD_CIPHERS};$" "${_label} nginx TLS 1.2 ciphers are explicit AEAD-only suites"
+  check_no_regex "${_ssl_template}" '(^|[^A-Z0-9])CBC([^A-Z0-9]|$)|AES[0-9]*-SHA($|:)|AES256\+EECDH|EECDH\+AES|EDH\+AES' "${_label} nginx TLS template has no CBC-capable broad cipher tokens"
+}
+
 check_mail_root() {
   _root="$1"
   _label="$2"
@@ -81,6 +108,7 @@ check_mail_root() {
   check_regex "${_root}/etc/dovecot/dovecot.conf" 'protocols *= *imap lmtp' "${_label} dovecot protocol set"
   check_regex "${_root}/etc/dovecot/local.conf" 'mail_location *= *maildir:' "${_label} dovecot maildir location"
   check_regex "${_root}/etc/nginx/sites-available/main-ssl.conf" 'include /etc/nginx/templates/ssl\.tmpl;' "${_label} nginx ssl template include"
+  check_nginx_tls_policy "${_root}" "${_label}"
   check_regex "${_root}/etc/rspamd/local.d/worker-proxy.inc" 'milter *= *yes;' "${_label} rspamd proxy milter enabled"
   check_regex "${_root}/etc/rspamd/local.d/worker-controller.inc" 'bind_socket *= *"' "${_label} rspamd controller bind configured"
   check_regex "${_root}/var/www/postfixadmin/config.local.php" "\$CONF\['configured'\] = true;" "${_label} postfixadmin configured flag"

services/generated/rootfs/etc/nginx/templates/ssl.tmpl

@@ -1,5 +1,7 @@
 ssl_protocols TLSv1.2 TLSv1.3;
-ssl_ciphers EECDH+CHACHA20:EECDH+AESGCM:EDH+AESGCM:AES256+EECDH;
+# TLS 1.3 ciphers are negotiated by the TLS library. Keep TLS 1.2 explicit
+# and AEAD-only so legacy block-mode suites cannot be selected at the public edge.
+ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
 ssl_prefer_server_ciphers on;
 
 # Generate once if it does not exist:

services/nginx/etc/nginx/templates/ssl.tmpl.template

@@ -1,5 +1,7 @@
 ssl_protocols TLSv1.2 TLSv1.3;
-ssl_ciphers EECDH+CHACHA20:EECDH+AESGCM:EDH+AESGCM:AES256+EECDH;
+# TLS 1.3 ciphers are negotiated by the TLS library. Keep TLS 1.2 explicit
+# and AEAD-only so legacy block-mode suites cannot be selected at the public edge.
+ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
 ssl_prefer_server_ciphers on;
 
 # Generate once if it does not exist: