Re: TLS enforcement options?

2022-01-10 Thread Łukasz Wąsikowski
oslaw Rafa pointed that destination IP address is known to ISP - this is the same as DNS query - not as sensitive as whole URL. IMHO encryption (with some metadata leaking) is better than no encryption at all. -- Best regards, Łukasz Wąsikowski

Re: TLS enforcement options?

2022-01-10 Thread Łukasz Wąsikowski
ting sites about mental health issues? Do you want others to know your preferences about politic, religion, sex, health or whatever? This kind of sensitive data can be collected just by looking on sites you are visiting. So yeah, encryption is important, even for public stuff. -- Best regar

Re: How to check for upcoming certificate expiration...

2017-09-14 Thread Łukasz Wąsikowski
W dniu 2017-09-13 o 22:11, Viktor Dukhovni pisze: >> On Sep 13, 2017, at 3:43 PM, Łukasz Wąsikowski wrote: >> >>> See below for OpenSSL 1.0.2 or later. Earlier versions don't >>> have the "-verify_hostname" option, you can delete it if you >>

Re: How to check for upcoming certificate expiration...

2017-09-13 Thread Łukasz Wąsikowski
W dniu 2017-09-11 o 18:25, Viktor Dukhovni pisze: > >> On Sep 11, 2017, at 5:21 AM, Dominic Raferd wrote: >> >> Does anyone know a way to detect if the certificate currently being used by >> Postfix and/or Dovecot is nearing expiry (esp. in case they haven't picked >> up the updated letsencrypt

Re: Postfix update on Freebsd

2016-08-24 Thread Łukasz Wąsikowski
W dniu 2016-08-25 o 08:09, li...@lazygranch.com pisze: > ‎I'm running Postfix 3.1.1 on Freebsd 10.2. After running portsnap, I see > there is an update. Well sort of. Checking the postfix website, there is no > update, and as you can see, the output from > pkg version -v | grep postfix > > pos

Re: Postfix / OpenSSL signal 11 on delivery from ebay

2015-03-22 Thread Łukasz Wąsikowski
W dniu 2015-03-22 o 07:18, Viktor Dukhovni pisze: > On Sun, Mar 22, 2015 at 12:21:21AM +, Viktor Dukhovni wrote: > >> On Sat, Mar 21, 2015 at 08:00:55PM -0400, Wietse Venema wrote: >> >>> >>> /usr/local/bin/openssl s_client -no_ssl2 -cipher aNULL -connect >>> localhost:25 -starttls smtp >>>

Re: Postfix / OpenSSL signal 11 on delivery from ebay

2015-03-21 Thread Łukasz Wąsikowski
W dniu 2015-03-22 o 00:35, Wietse Venema pisze: > Wietse Venema: >> Wietse Venema: >>> As with the OP, Postfix when built with MySQL client has zlib >>> explicitly linked in (my earlier test was done on a system where >>> MySQL by mistake wasn't included in the build). >>> >>> Next step is to repr

Re: Postfix / OpenSSL signal 11 on delivery from ebay

2015-03-21 Thread Łukasz Wąsikowski
W dniu 2015-03-21 o 22:51, Wietse Venema pisze: > ?ukasz W?sikowski: >> W dniu 2015-03-21 o 21:35, Viktor Dukhovni pisze: >> >>> Showing no compile-time zlib dependencies, because zlib is dynamically >>> loaded. I've never tested OpenSSL's zlib-dynamic support. Have >>> you tried (in separate wi

Re: Postfix / OpenSSL signal 11 on delivery from ebay

2015-03-21 Thread Łukasz Wąsikowski
W dniu 2015-03-21 o 21:58, Viktor Dukhovni pisze: > On Sat, Mar 21, 2015 at 09:50:03PM +0100, ?ukasz W?sikowski wrote: > >>> $ openssl s_server -nocert -cipher aNULL -accept 12345 >>> >>> $ openssl s_client -cipher aNULL -connect localhost:12345 >> >> That didn't crashed. >> > > Did you

Re: Postfix / OpenSSL signal 11 on delivery from ebay

2015-03-21 Thread Łukasz Wąsikowski
W dniu 2015-03-21 o 21:35, Viktor Dukhovni pisze: > Showing no compile-time zlib dependencies, because zlib is dynamically > loaded. I've never tested OpenSSL's zlib-dynamic support. Have > you tried (in separate windows or otherwise concurrent, with the > server started first): > > $

Re: Postfix / OpenSSL signal 11 on delivery from ebay

2015-03-21 Thread Łukasz Wąsikowski
W dniu 2015-03-21 o 21:35, Viktor Dukhovni pisze: > Showing no compile-time zlib dependencies, because zlib is dynamically > loaded. I've never tested OpenSSL's zlib-dynamic support. Have > you tried (in separate windows or otherwise concurrent, with the > server started first): > > $

Re: Postfix / OpenSSL signal 11 on delivery from ebay

2015-03-21 Thread Łukasz Wąsikowski
W dniu 2015-03-21 o 11:06, Matthias Andree pisze: > Am 21.03.2015 um 00:13 schrieb Wietse Venema: >> Viktor Dukhovni: >>> I am curious what: >>> >>> ldd /usr/local/lib/libssl.so.8 >>> >>> reports and whether there are headers and or shared objects for >>> libz in ports? >> >> In a FreeBSD 10.1

Re: Postfix / OpenSSL signal 11 on delivery from ebay

2015-03-21 Thread Łukasz Wąsikowski
W dniu 2015-03-21 o 11:06, Matthias Andree pisze: > Am 21.03.2015 um 00:13 schrieb Wietse Venema: >> Viktor Dukhovni: >>> I am curious what: >>> >>> ldd /usr/local/lib/libssl.so.8 >>> >>> reports and whether there are headers and or shared objects for >>> libz in ports? >> >> In a FreeBSD 10.1

Re: Postfix / OpenSSL signal 11 on delivery from ebay

2015-03-20 Thread Łukasz Wąsikowski
W dniu 2015-03-20 o 20:45, Wietse Venema pisze: > Viktor Dukhovni: >> On Fri, Mar 20, 2015 at 04:36:09PM +0100, ?ukasz W?sikowski wrote: >> Please avoid pastebin in the future. There's a bug in your SSL library. It crashes in zlib's deflate() called via SSL_accept(). >>> >>> If not pas

Re: Postfix / OpenSSL signal 11 on delivery from ebay

2015-03-20 Thread Łukasz Wąsikowski
W dniu 2015-03-19 o 23:18, Viktor Dukhovni pisze: > On Thu, Mar 19, 2015 at 10:10:13AM +0100, ?ukasz W?sikowski wrote: > >> postfix-2.11.4,1 with DOVECOT2, MYSQL, PCRE and TLS. >> ... >> Postfix config: http://pastebin.com/EimdRvyf >> Postfix debug log: http://pastebin.com/imN0ud9X >> GDB backtra

Postfix / OpenSSL signal 11 on delivery from ebay

2015-03-19 Thread Łukasz Wąsikowski
Hi, I'm getting segfaults from postfix smtpd. The same postfix configuration worked fine on FreeBSD 9.3 i386, on fresh FreeBSD 10.1 amd64 it's segfaulting. postfix-2.11.4,1 with DOVECOT2, MYSQL, PCRE and TLS. openssl-1.0.1_18 with ASM, EC, MD2, SCTP, SHARED, SSE2, THREADS and ZLIB segfault is al