On Tue, Apr 29, 2014 at 04:49:48PM -0400, btb wrote:
> for the moment, i've done
>
> smtpd_tls_security_level = may
> smtpd_tls_auth_only = yes
>
> which suffices, but not quite in the manner that i'd prefer.
The alternative to "smtpd_tls_security_level = encrypt" is:
main.cf:
cidr = cidr:${config_directory}/
mua_relay_restrictions =
check_client_access ${cidr}submission_access.cidr,
reject_plaintext_session,
permit_sasl_authenticated,
reject
submission_access.cidr:
192.0.2.1/32 OK non-TLS non-SASL client
master.cf:
submission inet n - n - - smtpd
-o syslog_name=postfix/submission
# --
# As strong as mandatory TLS required for SASL AUTH, but not
# otherwise enforced for some clients
#
-o smtpd_tls_security_level=may
-o smtpd_sasl_auth_enable=yes
-o smtpd_tls_auth_only=yes
-o smtpd_tls_ciphers=$smtpd_tls_mandatory_ciphers
-o smtpd_tls_protocols=$smtpd_tls_mandatory_protocols
# --
-o smtpd_reject_unlisted_recipient=no
-o smtpd_client_restrictions=$mua_client_restrictions
-o smtpd_helo_restrictions=$mua_helo_restrictions
-o smtpd_sender_restrictions=$mua_sender_restrictions
-o smtpd_recipient_restrictions=
-o smtpd_relay_restrictions=$mua_relay_restrictions
-o milter_macro_daemon_name=ORIGINATING
With Postfix versions older than 2.10 (IIRC) that don't have
smtpd_relay_restrictions, use smtpd_recipient_restrictions instead.
--
Viktor.
