Re: FW: PCI Compliance

2010-03-18 Thread Victor Duchovni
On Thu, Mar 18, 2010 at 04:14:31PM -, Jonathan Tripathy wrote: > > It works in practice. A few Postfix TLS proxies have been terminating TLS > > connections, making access control decisions and forwarding unencrypted > > SMTP to a non-Postfix server for many years now. > > > > These systems o

RE: FW: PCI Compliance

2010-03-18 Thread Jonathan Tripathy
It works in practice. A few Postfix TLS proxies have been terminating TLS connections, making access control decisions and forwarding unencrypted SMTP to a non-Postfix server for many years now. These systems only run "smtpd" as a proxy, and use various internal services, but otherwise there is no

Re: FW: PCI Compliance

2010-03-18 Thread Victor Duchovni
On Thu, Mar 18, 2010 at 11:00:14AM -0300, Reinaldo de Carvalho wrote: > On Thu, Mar 18, 2010 at 10:53 AM, Jonathan Tripathy > wrote: > > > > BTW, the machines in the CDE will all have anti-virus and automatic updates > > enabled. > > > > So, back to postfix, can it do such a thing? Act as a "pro

Re: FW: PCI Compliance

2010-03-18 Thread Wietse Venema
Jonathan Tripathy: > So, back to postfix, can it do such a thing? Act as a "proxy" and > not a "store and forward relay" http://www.postfix.org/SMTPD_PROXY_README.html Someone will still have to monitor the logfile, and deal with "postmaster notification" email depending on how the notify_classes

Re: FW: PCI Compliance

2010-03-18 Thread Mark Goodge
On 18/03/2010 13:53, Jonathan Tripathy wrote: So, back to postfix, can it do such a thing? Act as a "proxy" and not a "store and forward relay" In SMTP terms, a proxy is effectively the same thing as a store-and-forward relay. But yes, Postfix will do this very well. For inbound mail, you ca

Re: FW: PCI Compliance

2010-03-18 Thread Reinaldo de Carvalho
On Thu, Mar 18, 2010 at 10:53 AM, Jonathan Tripathy wrote: > > BTW, the machines in the CDE will all have anti-virus and automatic updates > enabled. > > So, back to postfix, can it do such a thing? Act as a "proxy" and not a > "store and forward relay" > > > In theory you can to use 'smtpd_proxy