RE: auth/tls combinations sanity check

2016-07-13 Thread Michael Fox
> > I can make up any variable name I want and assign a value to > > it main.cf, and then reference its value in main.cf and master.cf? > > Yes. > > -- > Viktor. Ah. That is indeed powerful. And now I understand your suggested solution, Viktor. It even solves a problem I didn't mentio

Re: auth/tls combinations sanity check

2016-07-13 Thread Benny Pedersen
On 2016-07-13 19:47, Michael Fox wrote: Are you saying I can make up any variable name I want and assign a value to it main.cf, and then reference its value in main.cf and master.cf? indeed yes

Re: auth/tls combinations sanity check

2016-07-13 Thread Viktor Dukhovni
On Wed, Jul 13, 2016 at 10:47:37AM -0700, Michael Fox wrote: > I can make up any variable name I want and assign a value to > it main.cf, and then reference its value in main.cf and master.cf? Yes. -- Viktor.

RE: auth/tls combinations sanity check

2016-07-13 Thread Michael Fox
> > But looking at http://www.postfix.org/postconf.5.html, I don't find > > mua_discard_ehlo_keyword_address_maps or mua_sender_restrictions. Are > > those > > literal names? Where can I find documentation? > > trick here is that we only ask for postconf -n, this will not display > postconf -Mf

Re: auth/tls combinations sanity check

2016-07-13 Thread Benny Pedersen
On 2016-07-13 18:45, Michael Fox wrote: But looking at http://www.postfix.org/postconf.5.html, I don't find mua_discard_ehlo_keyword_address_maps or mua_sender_restrictions. Are those literal names? Where can I find documentation? trick here is that we only ask for postconf -n, this will n

RE: auth/tls combinations sanity check

2016-07-13 Thread Michael Fox
> > So, I'm thinking I need three submission ports: > > * one for AUTH but no TLS > > * one for AUTH with opportunistic TLS > > * one for AUTH with enforced TLS > > You can combine these into just one service by using: > > main.cf: > mua_discard_ehlo_keyword_address_maps = > cidr:${conf

Re: auth/tls combinations sanity check

2016-07-13 Thread Viktor Dukhovni
> On Jul 13, 2016, at 10:33 AM, Viktor Dukhovni > wrote: > >tlsclient.cidr: > 192.0.2.0/24 DUNNO > 0.0.0.0 reject_plaintext_session That would be 0.0.0.0/0 of course. -- Viktor.

Re: auth/tls combinations sanity check

2016-07-13 Thread Viktor Dukhovni
> On Jul 13, 2016, at 2:27 AM, Michael Fox wrote: > > So, I'm thinking I need three submission ports: > * one for AUTH but no TLS > * one for AUTH with opportunistic TLS > * one for AUTH with enforced TLS You can combine these into just one service by using: main.cf: mua_di

auth/tls combinations sanity check

2016-07-12 Thread Michael Fox
I have a possibly unusual AUTH/TLS combination requirement. As a newbie, I could use a sanity check. Requirements: * All virtual mail clients will use SASL AUTH * Virtual mail clients on specific internal networks MUST NOT be offered TLS. This is to satisfy FCC requirements prohibiting the use o