Re: Disabling SSLv2 does not work as expected

2011-09-05 Thread Michael B Allen
On Mon, Sep 5, 2011 at 12:32 PM, Noel Jones wrote: > On 9/5/2011 11:19 AM, Michael B Allen wrote: >> On Mon, Sep 5, 2011 at 12:07 PM, Noel Jones wrote: >>> Or separate your mail and https servers to different IP addresses so >>> it's "not the same server". >> >> This was actually my first thought

Re: Disabling SSLv2 does not work as expected

2011-09-05 Thread Noel Jones
On 9/5/2011 11:19 AM, Michael B Allen wrote: > On Mon, Sep 5, 2011 at 12:07 PM, Noel Jones wrote: >> On 9/5/2011 10:50 AM, Michael B Allen wrote: >>> On Fri, Sep 2, 2011 at 10:19 PM, Noel Jones wrote: On 9/2/2011 2:17 PM, Michael B Allen wrote: > My objectives are not driven by or based

Re: Disabling SSLv2 does not work as expected

2011-09-05 Thread Michael B Allen
On Mon, Sep 5, 2011 at 12:07 PM, Noel Jones wrote: > On 9/5/2011 10:50 AM, Michael B Allen wrote: >> On Fri, Sep 2, 2011 at 10:19 PM, Noel Jones wrote: >>> On 9/2/2011 2:17 PM, Michael B Allen wrote: My objectives are not driven by or based on logic. They are based on the requirements o

Re: Disabling SSLv2 does not work as expected

2011-09-05 Thread Noel Jones
On 9/5/2011 10:50 AM, Michael B Allen wrote: > On Fri, Sep 2, 2011 at 10:19 PM, Noel Jones wrote: >> On 9/2/2011 2:17 PM, Michael B Allen wrote: >>> My objectives are not driven by or based on logic. They are based on >>> the requirements of a consortium of credit card companies and banks. >> >> D

Re: Disabling SSLv2 does not work as expected

2011-09-05 Thread Michael B Allen
On Fri, Sep 2, 2011 at 10:19 PM, Noel Jones wrote: > On 9/2/2011 2:17 PM, Michael B Allen wrote: >> My objectives are not driven by or based on logic. They are based on >> the requirements of a consortium of credit card companies and banks. > > Do they require you to offer STARTTLS on port 25? My

Re: Disabling SSLv2 does not work as expected

2011-09-05 Thread /dev/rob0
On Friday 02 September 2011 12:25:55 Michael B Allen wrote: > On Fri, Sep 2, 2011 at 12:41 PM, Wietse Venema wrote: > > Michael B Allen: > >> I am using postfix 2.3 on CentOS and I would like to disable > >> SSLv2. If I do the following: ... > I have to stick to the CentOS package so that I get u

Re: Disabling SSLv2 does not work as expected

2011-09-02 Thread Noel Jones
On 9/2/2011 2:17 PM, Michael B Allen wrote: > My objectives are not driven by or based on logic. They are based on > the requirements of a consortium of credit card companies and banks. Do they require you to offer STARTTLS on port 25? ISTR that they don't; I think they only require that if TLS i

Re: Disabling SSLv2 does not work as expected

2011-09-02 Thread Joe
On 09/02/2011 02:41 PM, Stan Hoeppner wrote: Red Hat is a commercial distro. They will always do things differently, things that seem strange and sometimes simply stupid to the rest of us. Which is one of the many reasons I don't use a commercial distro. Red Hat cherry picks patches from u

Re: Disabling SSLv2 does not work as expected

2011-09-02 Thread Stan Hoeppner
On 9/2/2011 3:49 PM, Wietse Venema wrote: Michael B Allen: BTW, Postfix 2.3 was developed in 2005, released in 2006, and support was terminated in 2009. This is off-topic but you may know that CentOS (which is RedHat repackaged without the branding) backports all fixes. Meaning an issue identi

Re: Disabling SSLv2 does not work as expected

2011-09-02 Thread Wietse Venema
Michael B Allen: > > BTW, Postfix 2.3 was developed in 2005, released in 2006, and support > > was terminated in 2009. > > This is off-topic but you may know that CentOS (which is RedHat > repackaged without the branding) backports all fixes. Meaning an issue > identified in 2.6 would be addressed

Re: Disabling SSLv2 does not work as expected

2011-09-02 Thread Michael B Allen
On Fri, Sep 2, 2011 at 1:51 PM, Wietse Venema wrote: > Michael B Allen: >> On Fri, Sep 2, 2011 at 12:41 PM, Wietse Venema wrote: >> > Michael B Allen: >> >> Hello, >> >> >> >> I am using postfix 2.3 on CentOS and I would like to disable SSLv2. If >> >> I do the following: >> >> >> >> smtpd_tls_ma

Re: Disabling SSLv2 does not work as expected

2011-09-02 Thread Wietse Venema
Michael B Allen: > On Fri, Sep 2, 2011 at 12:41 PM, Wietse Venema wrote: > > Michael B Allen: > >> Hello, > >> > >> I am using postfix 2.3 on CentOS and I would like to disable SSLv2. If > >> I do the following: > >> > >> smtpd_tls_mandatory_protocols = SSLv3, TLSv1 > >> smtpd_tls_mandatory_cipher

Re: Disabling SSLv2 does not work as expected

2011-09-02 Thread Brian Evans - Postfix List
On 9/2/2011 1:25 PM, Michael B Allen wrote: > Hi Wietse, > > But it seems the smtpd_tls_protocols/ciphers directives are specific to 2.6? > > Is there any way to disable SSLv2 in postfix 2.3? > > I have to stick to the CentOS package so that I get updates. There are alternative packages to the Cen

Re: Disabling SSLv2 does not work as expected

2011-09-02 Thread Michael B Allen
On Fri, Sep 2, 2011 at 12:41 PM, Wietse Venema wrote: > Michael B Allen: >> Hello, >> >> I am using postfix 2.3 on CentOS and I would like to disable SSLv2. If >> I do the following: >> >> smtpd_tls_mandatory_protocols = SSLv3, TLSv1 >> smtpd_tls_mandatory_ciphers = medium, high > > This is for ma

Re: Disabling SSLv2 does not work as expected

2011-09-02 Thread Wietse Venema
Michael B Allen: > Hello, > > I am using postfix 2.3 on CentOS and I would like to disable SSLv2. If > I do the following: > > smtpd_tls_mandatory_protocols = SSLv3, TLSv1 > smtpd_tls_mandatory_ciphers = medium, high This is for mandatory TLS. > If I add smtpd_tls_security_level = encrypt it t

Re: Disabling SSLv2 does not work as expected

2011-09-02 Thread Brian Evans - Postfix List
On 9/2/2011 12:28 PM, Michael B Allen wrote: > Hello, > > I am using postfix 2.3 on CentOS and I would like to disable SSLv2. If > I do the following: > > smtpd_tls_mandatory_protocols = SSLv3, TLSv1 > smtpd_tls_mandatory_ciphers = medium, high > > but despite the fact that this configuration has b