how to use specific version of tls/ssl in postfix

2012-05-07 Thread Agnello George
Hi I have heard of the vulnerability that exists in SSL 3.0 and TLS 1.0 that could allow information disclosure if an attacker intercepts encrypted traffic served from an affected system. TLS 1.1, TLS 1.2, and all cipher suites that do not use CBC mode are not affected. How do i use specific

Re: sender_dependent_default_transport_maps

2012-05-07 Thread Viktor Dukhovni
On Mon, May 07, 2012 at 10:04:21PM -0500, Noel Jones wrote: > > We have some fairly involved routing requirements, and have been > > using a script that creates a transport table from a number of > > source files. It's been working well for some years, but now we have > > a need for sender-depende

Re: TLS SNI support?

2012-05-07 Thread Viktor Dukhovni
On Mon, May 07, 2012 at 06:52:44AM -0700, Fiona Hines wrote: > I understand now what you are referring to but you were assuming > that I was using STARTTLS, which was my mistake for not mentioning > it.? I'm not using STARTTLS.? The connection is encrypted from the > beginning of the transaction.?

Re: sender_dependent_default_transport_maps

2012-05-07 Thread Noel Jones
On 5/7/2012 8:58 PM, Joe wrote: > Hello list - > > We have some fairly involved routing requirements, and have been > using a script that creates a transport table from a number of > source files. It's been working well for some years, but now we have > a need for sender-dependent transport rules.

sender_dependent_default_transport_maps

2012-05-07 Thread Joe
Hello list - We have some fairly involved routing requirements, and have been using a script that creates a transport table from a number of source files. It's been working well for some years, but now we have a need for sender-dependent transport rules. We periodically creates the sender_dep

Re: Mixed TLS/SSL and unencrypted environments

2012-05-07 Thread Mark Homoky
On 7 May 2012, at 15:46, Wietse Venema wrote: > Jean-Fran?ois Stenuit: >> Hi List, >> >> I'd like to configure my hub mail server to listen for connections on >> port 465 SMTPs SSL - wrapper mode while still accepting standard >> unencrypted SMTP coming from the scripts running on the machine. >

Re: TLS SNI support?

2012-05-07 Thread Bernhard Schmidt
Am 07.05.2012 16:17, schrieb Bernhard Schmidt: > It is in use, but not very broadly. I don't have that many users on this > postfix instance, maybe someone with some more traffic can run a statistic. Oops, I have to exclude our monitoring connection, then almost all MUAs send SNI. The only remain

Re: Mixed TLS/SSL and unencrypted environments

2012-05-07 Thread Wietse Venema
Jean-Fran?ois Stenuit: > Hi List, > > I'd like to configure my hub mail server to listen for connections on > port 465 SMTPs SSL - wrapper mode while still accepting standard > unencrypted SMTP coming from the scripts running on the machine. > > Intuitively, I configure my master.cf like this : >

Mixed TLS/SSL and unencrypted environments

2012-05-07 Thread Jean-François Stenuit
Hi List, I'd like to configure my hub mail server to listen for connections on port 465 SMTPs SSL - wrapper mode while still accepting standard unencrypted SMTP coming from the scripts running on the machine. Intuitively, I configure my master.cf like this : smtp inet n - n

Re: TLS SNI support?

2012-05-07 Thread Bernhard Schmidt
Am 07.05.2012 12:52, schrieb Wietse Venema: > Fiona Hines: >> How do I get TLS SNI support in Postfix?? I can't find any >> documentation on the subject except a few discussions that are >> several years old.? I've got TLS working with one domain but I >> want to expand it to an unknown number of d

Re: TLS SNI support?

2012-05-07 Thread Jona - DTNX Postmaster
On May 7, 2012, at 15:52, Fiona Hines wrote: > I understand now what you are referring to but you were assuming that I was > using STARTTLS, which was my mistake for not mentioning it. I'm not using > STARTTLS. The connection is encrypted from the beginning of the transaction. > STARTTLS was

Re: TLS SNI support?

2012-05-07 Thread Wietse Venema
Fiona Hines: > I understand now what you are referring to but you were assuming > that I was using STARTTLS, which was my mistake for not mentioning > it.? I'm not using STARTTLS.? The connection is encrypted from the > beginning of the transaction.? Let's do one step back. Web clients/servers i

Graph postfix/postscreen with mailgraph 1.14 patch

2012-05-07 Thread Birta Levente
Hi all, I made a patch for mailgraph to visualize postscreen rejects on the graphs separately, not cumulated with rejects or spam. Based on http://www.networkmonkey.de/mailgraph-und-postscreen/ Maybe someone find it useful ... Example: http://store.birkosan.com/img/img_2012_05_07.png http://

Re: TLS SNI support?

2012-05-07 Thread Fiona Hines
I understand now what you are referring to but you were assuming that I was using STARTTLS, which was my mistake for not mentioning it.  I'm not using STARTTLS.  The connection is encrypted from the beginning of the transaction.  STARTTLS was created as part of the standards for e-mail because S

Re: TLS SNI support?

2012-05-07 Thread Fiona Hines
"Postfix has no SNI support. Effort >> benefit." Dovecot implemented SNI support.  Dovecot implements a different set of protocols, but they implemented SNI for 50% of e-mail (the receiving end).  If the receiving end of e-mail has SNI, the sending end should probably implement it too if, for n

Re: TLS SNI support?

2012-05-07 Thread Wietse Venema
Fiona Hines: > How do I get TLS SNI support in Postfix?? I can't find any > documentation on the subject except a few discussions that are > several years old.? I've got TLS working with one domain but I > want to expand it to an unknown number of domains and I don't care > if the mail client lacks

Re: TLS SNI support?

2012-05-07 Thread Viktor Dukhovni
On Sun, May 06, 2012 at 11:46:45PM -0700, Fiona Hines wrote: > That won't work for me.? SNI support is the only solution for my > scenario since I can't use just one SSL certificate. I haven't used > Google Apps to know what you are talking about. Postfix has no SNI support. Effort >> benefit. W

Re: TLS SNI support?

2012-05-07 Thread Peter
On 07/05/12 18:46, Fiona Hines wrote: > That won't work for me. SNI support is the only solution for my > scenario sinceI can't use just one SSL certificate. I haven't used > Google Apps to know what you are talking about. I used google apps as an example of a provider that services what probabl