Hi All, I wanted to setup a new OpenBSD 5.9 server with Postfix 3.1, but I fell at the first fence, well at the first TLS fence ... > root@dna59:[postfix]# postfix tls enable-client > postfix/postfix-script: error: unknown command: 'tls' > postfix/postfix-script: fatal: usage: postfix start (or stop, reload, abort, > flush, check, status, set-permissions, upgrade-configuration)
It seems that the Postfix package available for 5.9 is based on a snapshot from the end of 2015: > root@dna59:[postfix]# type postfix > postfix is hashed (/usr/local/sbin/postfix) > root@dna59:[log]# pkg_info -E /usr/local/sbin/postfix > /usr/local/sbin/postfix: postfix-3.1.20151227-sasl2 > postfix-3.1.20151227-sasl2 fast, secure sendmail replacement And it looks like this predates the introduction of the tls command: > 20160116 > ... > Feature: "postfix tls" commands to enable opportunistic TLS > in the Postfix SMTP client or server, or generate or replace > Postfix SMTP server TLS private keys and server certificates. > Viktor Dukhovni, Wietse. Files: conf/postfix-files, > conf/postfix-script, conf/postfix-tls-script, makedefs, > proto/INSTALL.html, proto/postconf.proto, global/mail_params.h, > postfix/postfix.c, tls/tls_misc.c. > ... What is my best option at this point? I could think of: Carry on without the tls command, and configure "manually". Is this feasible? E.g. is it (the tls cmd) just a helper tool, or is it required? What documentation would be relevant for a manual configuration process? I found a script "/usr/lib/postfix/bin/postfix-tls-script" which should apparently do "Postfix TLS Management". Could it be useful here? Trigger the OpenBSD team to build an package of the official 3.1 release rather than an "obsolete" snapshot. But does anyone know if this is possible, or how to begin that process? (The 5.9 ports tree seems to contain references to only the same snapshot version mentioned above.) Build Postfix from source myself. While looking at that option I came across this statement in INSTALL.html: > OpenBSD is partially supported. The libc resolver does not implement the > documented "internal resolver options which are [...] set by changing fields > in > the _res structure" (documented in the OpenBSD 5.6 resolver(3) manpage). This > results in too many DNS queries, and false positives for queries that should > fail. This makes me a little nervous. How serious is this issue, can anyone expand on the possible consequences? I am open to other suggestions :) Thanks in advance! Cheers, Robb.
