I have TLS / SASL working on my email server. My question is in my
main.cf on Postfix, I have the following parameter for TLS:

smtpd_tls_security_level = may

In my VIM editor, every parameter except the one listed above is in
color. The above parameter is just in white. I assumed that this was
because the parameter was not being properly recognized via Postfix. I
removed it and broke Postfix so I then knew this parameter was
significant and being utilized via my Postfix server:

[r...@mail ~]# postconf | grep smtpd_tls_security_level
smtpd_tls_security_level = may

My question is why is it not in color like all the other Postfix
parameters in VIM? And lastly, do I need this parameter in my main.cf:

smtp_use_tls = yes

or is the above the old parameter that is no longer used via Postfix
2.3+? I am thinking the later is a redundant entry for the first
parameter I listed above.

Below is my Postconf -n:

[r...@mail ~]# postconf -n
address_verify_sender = $double_bounce_sender
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases, hash:/etc/mailman/aliases
broken_sasl_auth_clients = yes
command_directory = /usr/sbin
config_directory = /etc/postfix
content_filter = amavisfeed:[127.0.0.1]:10024
daemon_directory = /usr/libexec/postfix
home_mailbox = Maildir/
html_directory = no
inet_interfaces = all
mail_owner = postfix
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
message_size_limit = 20480000
mydestination = $myhostname, $mydomain, mail.$mydomain
mydomain = mydomain.tld
myhostname = mail.mydomain.tld
mynetworks = $config_directory/mynetworks
myorigin = $mydomain
newaliases_path = /usr/bin/newaliases.postfix
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix-2.3.3/README_FILES
recipient_delimiter = +
relay_domains =
sample_directory = /usr/share/doc/postfix-2.3.3/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtp_use_tls = yes
smtpd_banner = $myhostname ESMTP
smtpd_delay_reject = yes
smtpd_helo_required = yes
smtpd_helo_restrictions = permit_mynetworks,
permit_sasl_authenticated,    reject_non_fqdn_helo_hostname,
reject_invalid_helo_hostname,    permit
smtpd_recipient_restrictions = permit_mynetworks,
permit_sasl_authenticated,   reject_unauth_pipelining,
reject_non_fqdn_recipient,   reject_unknown_recipient_domain,
reject_unauth_destination,   reject_unlisted_recipient,
check_policy_service unix:postgrey/socket,   check_sender_access
  hash:/etc/postfix/sender_access,   reject_rbl_client
zen.spamhaus.org,   reject_rbl_client bl.spamcop.net,   permit
smtpd_sasl_auth_enable = yes
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_sender_restrictions = permit_mynetworks,
permit_sasl_authenticated,    reject_non_fqdn_sender,
reject_unknown_sender_domain,
reject_unknown_reverse_client_hostname,     permit
smtpd_tls_CAfile = /path/to/my/intermediate.crt
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /path/to/.crt
smtpd_tls_key_file = /path/to/.key
smtpd_tls_loglevel = 1
smtpd_tls_security_level = may
smtpd_tls_session_cache_database = btree:/var/spool/postfix/smtpd_tls_cache
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom
unknown_local_recipient_reject_code = 550

Reply via email to