On 08/24/2013 04:35 AM, David Hulsebus wrote:
Why shouldn't I require TLS to encrypt all sessions for any clients who
authenticates to send mail out. Isn't that what following parameter
accomplishes ?
smtpd_tls_security_level = encrypt
The manual says "Encrypt - MUST NOT be applied in case of a
publicly-referenced SMTP server."
You should require TLS. Using 'smtpd_tls_auth_only = yes' achieves to
not accept SASL authentication over unencrypted connections [1] without
effecting your security level globally.
I would recommend to use 'smtpd_tls_security_level = may' on port 25.
However, i prefer to use port 587 for authenticated mail submission and
'smtpd_tls_security_level = encrypt' might be suitable in this case.
So any passing of plain text passwords over an unencrypted session is not
wise.
Right.
[1]: http://www.postfix.org/postconf.5.html#smtpd_tls_auth_only
--
GPG Key: B0CD87E2 (1C46 4291 FD7A A695 795F 537C BAD0 8AEB B0CD 87E2)
--Manuel Bieling
