Re: Is pure SSL/TLS termination viable with postfix?

2022-12-07 Thread Sam
Dear Viktor, dear readers Thank you very much for your quick reply and insight. I went ahead and disabled wrapper mode in master.cf (and there's no wrapper mode in main.cf), and I still can't telnet to port 465, even though it's in use in the container. When I try to do that, the connection is

Re: TLS config confirmation

2022-12-07 Thread Matus UHLAR - fantomas
On 07.12.22 12:28, Alex wrote: smtp_tls_security_level = may smtpd_tls_security_level = may smtp_tls_mandatory_protocols= !SSLv2,!SSLv3,!TLSv1,!TLSv1.1 smtp_tls_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1 so, you don't enforce TLS on a server-server communication (correct), but

Re: Backup MX Take 2

2022-12-07 Thread Viktor Dukhovni
On Wed, Dec 07, 2022 at 08:47:21PM -0500, Jonathan Capra wrote: > I took this to mean I should get rid of relay_domains altogether, and rely > solely on relay_recipients. But once I did that, it now rejects all > addresses. Hard to imagine how you reached that interpretation. Postfix rejects i

Re: Backup MX Take 2

2022-12-07 Thread Jonathan Capra
I took this to mean I should get rid of relay_domains altogether, and rely solely on relay_recipients. But once I did that, it now rejects all addresses. I want to make sure I am being clear about my ultimate goal: I want Postfix to accept only the addresses in /etc/postfix/relay_recipients

Re: Is pure SSL/TLS termination viable with postfix?

2022-12-07 Thread Viktor Dukhovni
On Wed, Dec 07, 2022 at 11:51:32PM +0400, Sam wrote: > I would like to run postfix in a docker container, and receive emails > through HaProxy with SSL termination. So the setup I would like to > achieve is: It is generally preferrable to let Postfix do TLS-termination, so that Postfix can be a

Is pure SSL/TLS termination viable with postfix?

2022-12-07 Thread Sam
Hello everyone I would like to run postfix in a docker container, and receive emails through HaProxy with SSL termination. So the setup I would like to achieve is: Web -> My Server -> HaProxy (SSL/TLS decryption) -> Into my server (as localhost with zero encryption) -> docker container with

Re: TLS config confirmation

2022-12-07 Thread Bill Cole
On 2022-12-07 at 12:28:49 UTC-0500 (Wed, 7 Dec 2022 12:28:49 -0500) Alex is rumored to have said: > Hi, > I have a few mail relays using Lets Encrypt certs to provide TLS. I'm > pretty sure I've configured them properly, but hope someone would confirm. > I've seen a few errors that I believe are

TLS config confirmation

2022-12-07 Thread Alex
Hi, I have a few mail relays using Lets Encrypt certs to provide TLS. I'm pretty sure I've configured them properly, but hope someone would confirm. I've seen a few errors that I believe are a result of a poorly configured client, but I wanted to be sure. Dec 7 10:27:32 armor postfix-110/smtpd[57

Re: remailer for alias lists?

2022-12-07 Thread Norton Allen
On 12/6/2022 12:56 PM, Bob Proulx wrote: # LIST: "| /opt/majordomo/wrapper resend -C /opt/majordomo/DOMAIN.cf -l LIST -h DOMAIN LIST-outgoing" # LIST-outgoing: :include:/opt/majordomo/lists/DOMAIN/LIST, If someone knows that LIST-outgoing exists then it can be abused by sending there dire