Re: more detail in diagnosing verify "conversation ... timed out while receiving the initial server greeting" error?

2020-07-20 Thread Viktor Dukhovni
On Mon, Jul 20, 2020 at 08:32:48PM -0700, PGNet Dev wrote: > Jul 20 14:32:30 frontend postfix/verify[20106]: dict_cache_lookup: > key=testus...@example.net value=1:0:1595290292:conversation with > internal.backend.example.com[10.0.0.21] timed out while receiving the initial > server greeting T

more detail in diagnosing verify "conversation ... timed out while receiving the initial server greeting" error?

2020-07-20 Thread PGNet Dev
i'm setting up 2 postfix instances on 2 separate boxes, 'frontend' & 'backend', to use address verification probes from front- to back-end testing @ 'frontend', I can see the VRFY offered by the backend openssl s_client \ -4 \ -bind 10.0.0.11 \ -connect interna

Re: postfix 3.5.4 centos 8 hardcoded crypto settings?

2020-07-20 Thread Xavier Belanger
Hi, >     I'm setting up a new postfix 3.5.4 server on a Centos 8 box and, > no matter what config i make, i can't get TLSv1 (yes, sorry, need to > support some old clients until the end of the year) support to work. I have been working with Red Hat Enterprise Linux 8 and very likely CentOS is

Re: postfix 3.5.4 centos 8 hardcoded crypto settings?

2020-07-20 Thread Viktor Dukhovni
On Mon, Jul 20, 2020 at 09:51:38PM -0300, Leonardo Rodrigues wrote: > I have already tweaked smtpd_tls_mandatory_protocols and > smtpd_tls_protocols to "!SSLv2, !SSLv3" but TLSv1 simply doesn't work. Postfix does not set a minimum TLS protocol version, it just disables the versions specified wit

postfix 3.5.4 centos 8 hardcoded crypto settings?

2020-07-20 Thread Leonardo Rodrigues
    Hello Everyone,     I'm setting up a new postfix 3.5.4 server on a Centos 8 box and, no matter what config i make, i can't get TLSv1 (yes, sorry, need to support some old clients until the end of the year) support to work.     I have already tweaked smtpd_tls_mandatory_protocols and sm

Re: how to map per-smtp-transport ssl certs/keys ?

2020-07-20 Thread PGNet Dev
On 7/20/20 2:45 PM, Viktor Dukhovni wrote: > Perhaps you meant per-nexthop? That's not presently supported, Well that'll certainly make it harder to find! Noted. > instead you can configure a second transport, with a different set of keys, > and > use that transport for the destinations in que

Re: how to map per-smtp-transport ssl certs/keys ?

2020-07-20 Thread Viktor Dukhovni
On Mon, Jul 20, 2020 at 02:36:08PM -0700, PGNet Dev wrote: > i'm modifying a relay config. atm, i've > > master.cf > ... > [127.0.0.1]:10001 inet n - n - - smtpd > ... > -o content_filter=lmdb:/etc/postfix/relay_transports > >

how to map per-smtp-transport ssl certs/keys ?

2020-07-20 Thread PGNet Dev
i'm modifying a relay config. atm, i've master.cf ... [127.0.0.1]:10001 inet n - n - - smtpd ... -o content_filter=lmdb:/etc/postfix/relay_transports relay-out unix - - n - - smtp

Re: permit_tls_clientcerts usage in multiple restrictions?

2020-07-20 Thread Wietse Venema
PGNet Dev: > smtpd_client_restrictions=permit_tls_clientcerts,reject > smtpd_relay_restrictions=permit_tls_clientcerts,reject permit_tls_clientcerts is evaluated twice. Wietse

permit_tls_clientcerts usage in multiple restrictions?

2020-07-20 Thread PGNet Dev
i'd like to clarify mumble restrictions' checking in the case of tls clientcerts. with settings of relay_clientcerts=lmdb:/etc/postfix/relay_clientcerts smtp_tls_session_cache_database = lmdb:/var/lib/postfix/smtp_cache smtp_tls_session_cache_database = lmdb:/var/lib/postfix/smtpd_cache if i

Re: norig_rcpt logs

2020-07-20 Thread Wietse Venema
Marco: [ Charset ISO-8859-15 converted... ] > Hello, > > Postfix logs to syslog the number of recipients in the "nrctp" field. > > The nrcpt field reports the number of recipient after the expansion (ie: > by virtual table). > > A field reporting the number of recipients written by the client

Re: After decryption virus check

2020-07-20 Thread Wietse Venema
Alex Bruce: > Hello > > Correct me if I'm wrong but If I want to check an email for viruses (eg > ClamAV milter) after a content filter (SMIME Decryption) then I should be > using the "non_smtpd_milters" parameter to specify the milter? That depends on how the content fiter delivers the message

Re: problem connecting with android device

2020-07-20 Thread ratatouille
Viktor Dukhovni schrieb am 19.07.20 um 17:05:02 Uhr: > > Jul 19 22:41:37 dualbit1 postfix/smtpd[834008]: Anonymous TLS connection > > established from p57b62c8e.dip0.t-ipconnect.de[87.182.44.142]: TLSv1.2 with > > cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits) > > Your server supports TL

norig_rcpt logs

2020-07-20 Thread Marco
Hello, Postfix logs to syslog the number of recipients in the "nrctp" field. The nrcpt field reports the number of recipient after the expansion (ie: by virtual table). A field reporting the number of recipients written by the client (number of "RCTP TO") could be very useful too, to perfor