Re: Postfix TLS: SSL3_GET_CLIENT_HELLO:no shared cipher

2011-09-05 Thread whizz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Mon, 05 Sep 2011 19:21:27 +0700 Wietse Venema wrote: >>wh...@hushmail.com: >> Aug 31 21:38:14 johndoe postfix/smtpd[16200]: >> s097.networking4all.com[213.249.64.242]: TLS cipher list >> "ALL:!EXPORT:!LOW:!MEDIUM:+RC4:@STRENGTH" >... >> smtpd_tls_s

Re: Disabling SSLv2 does not work as expected

2011-09-05 Thread Michael B Allen
On Mon, Sep 5, 2011 at 12:32 PM, Noel Jones wrote: > On 9/5/2011 11:19 AM, Michael B Allen wrote: >> On Mon, Sep 5, 2011 at 12:07 PM, Noel Jones wrote: >>> Or separate your mail and https servers to different IP addresses so >>> it's "not the same server". >> >> This was actually my first thought

Re: Issue integrating with Cyrus-SASL

2011-09-05 Thread Patrick Ben Koetter
* Crazedfred : > > If you use the pass above, change it now that you have sent it to public. > > I am substituting in fake accounts and passwords to show what's going on, > these do not match what I am actually using :) > > > Where did you put smtpd.conf? On Debian it should be in > > /etc/postf

Re: Disabling SSLv2 does not work as expected

2011-09-05 Thread Noel Jones
On 9/5/2011 11:19 AM, Michael B Allen wrote: > On Mon, Sep 5, 2011 at 12:07 PM, Noel Jones wrote: >> On 9/5/2011 10:50 AM, Michael B Allen wrote: >>> On Fri, Sep 2, 2011 at 10:19 PM, Noel Jones wrote: On 9/2/2011 2:17 PM, Michael B Allen wrote: > My objectives are not driven by or based

Re: Issue integrating with Cyrus-SASL

2011-09-05 Thread Crazedfred
> If you use the pass above, change it now that you have sent it to public. I am substituting in fake accounts and passwords to show what's going on, these do not match what I am actually using :) > Where did you put smtpd.conf? On Debian it should be in > /etc/postfix/sasl/smtpd.conf. On my sy

Re: Disabling SSLv2 does not work as expected

2011-09-05 Thread Michael B Allen
On Mon, Sep 5, 2011 at 12:07 PM, Noel Jones wrote: > On 9/5/2011 10:50 AM, Michael B Allen wrote: >> On Fri, Sep 2, 2011 at 10:19 PM, Noel Jones wrote: >>> On 9/2/2011 2:17 PM, Michael B Allen wrote: My objectives are not driven by or based on logic. They are based on the requirements o

Re: Configuring a mail gateway

2011-09-05 Thread Noel Jones
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 9/5/2011 7:26 AM, Nikolaos Milas wrote: > On 3/9/2011 11:09 μμ, Noel Jones wrote: So, in order to > implement such a solution, would it be sufficient to do > something like the following, on the *gateway* mail server: > > smtpd_recipient_restrictio

Re: Disabling SSLv2 does not work as expected

2011-09-05 Thread Noel Jones
On 9/5/2011 10:50 AM, Michael B Allen wrote: > On Fri, Sep 2, 2011 at 10:19 PM, Noel Jones wrote: >> On 9/2/2011 2:17 PM, Michael B Allen wrote: >>> My objectives are not driven by or based on logic. They are based on >>> the requirements of a consortium of credit card companies and banks. >> >> D

Re: Disabling SSLv2 does not work as expected

2011-09-05 Thread Michael B Allen
On Fri, Sep 2, 2011 at 10:19 PM, Noel Jones wrote: > On 9/2/2011 2:17 PM, Michael B Allen wrote: >> My objectives are not driven by or based on logic. They are based on >> the requirements of a consortium of credit card companies and banks. > > Do they require you to offer STARTTLS on port 25? My

Re: Disabling SSLv2 does not work as expected

2011-09-05 Thread /dev/rob0
On Friday 02 September 2011 12:25:55 Michael B Allen wrote: > On Fri, Sep 2, 2011 at 12:41 PM, Wietse Venema wrote: > > Michael B Allen: > >> I am using postfix 2.3 on CentOS and I would like to disable > >> SSLv2. If I do the following: ... > I have to stick to the CentOS package so that I get u

Re: Configuring a mail gateway

2011-09-05 Thread Nikolaos Milas
On 5/9/2011 3:26 μμ, Nikolaos Milas wrote: So, in order to implement such a solution, would it be sufficient to do something like the following, on the *gateway* mail server: smtpd_recipient_restrictions = permit_mynetworks, reject_unverified_recipient, reject_unauth_destina

Re: Postfix TLS: SSL3_GET_CLIENT_HELLO:no shared cipher

2011-09-05 Thread Greg Hackney
wh...@hushmail.com wrote: The thing is I'm trying to check my SSL configuration using this tool: http://www.networking4all.com/en/support/tools/site+check/report/ and while it can validate mt certificate just fine, it says that it can't establish a secure connection. Be aware that test site

Re: Configuring a mail gateway

2011-09-05 Thread Nikolaos Milas
On 3/9/2011 11:09 μμ, Noel Jones wrote: If we use: relay_recipient_maps = (that is, empty) then *all* recipients for the hosted domains (those listed in relay_domains) are accepted/forwarded? Yes. That turns you into a backscatter source, clogging your queue with undeliverable mail and ev

Re: Building from source on CentOS

2011-09-05 Thread Wietse Venema
Nikolaos Milas: > Hello, > > To build on CentOS from source and get an installation with standard > features (as provided in CentOS standard Postfix RPMs) we use: > > make makefiles \ > CCARGS='-fPIC -DUSE_TLS -DUSE_SSL -DUSE_SASL_AUTH \ > -DUSE_CYRUS_SASL -DPREFIX=\"/usr\" \ > -DHAS_LDAP -DLDAP

Re: Postfix TLS: SSL3_GET_CLIENT_HELLO:no shared cipher

2011-09-05 Thread Wietse Venema
wh...@hushmail.com: > Aug 31 21:38:14 johndoe postfix/smtpd[16200]: > s097.networking4all.com[213.249.64.242]: TLS cipher list > "ALL:!EXPORT:!LOW:!MEDIUM:+RC4:@STRENGTH" ... > smtpd_tls_security_level = may > smtpd_tls_mandatory_ciphers = medium > smtp_tls_protocols = !SSLv2, !SSLv3 Comment out a

Building from source on CentOS

2011-09-05 Thread Nikolaos Milas
Hello, To build on CentOS from source and get an installation with standard features (as provided in CentOS standard Postfix RPMs) we use: make makefiles \ CCARGS='-fPIC -DUSE_TLS -DUSE_SSL -DUSE_SASL_AUTH \ -DUSE_CYRUS_SASL -DPREFIX=\"/usr\" \ -DHAS_LDAP -DLDAP_DEPRECATED=1 \ -DHAS_PCRE -I/us

Postfix TLS: SSL3_GET_CLIENT_HELLO:no shared cipher

2011-09-05 Thread whizz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, I have a postfix set-up with TLS activated. Outlook 2010 and Thunderbird can send any e-mail just fine. Openssl -connect -starttls smtp returned no error either. The thing is I'm trying to check my SSL configuration using this tool: http://www.