postscreen STARTTLS support available

2011-01-02 Thread Wietse Venema
Wietse Venema: > I have built an event-driven TLS proxy for postscreen(8). This > addresses the problem that postscreen(8) could not be used when > SMTP clients require STARTTLS support. This is now a regular snapshot postfix-2.8-20110102. There are no code changes since the last non-production r

Re: Available: preliminary postscreen STARTTLS support

2010-12-31 Thread Wietse Venema
Wietse Venema: > Wietse Venema: > > I have built an event-driven TLS proxy for postscreen(8). This > > addresses the problem that postscreen(8) could not be used when > > SMTP clients require STARTTLS support. > > > > The new daemon is called starttlsd(8). When a non-whitelisted (*) > > SMTP clie

Re: Available: preliminary postscreen STARTTLS support

2010-12-31 Thread Wietse Venema
Christian Roessner: > Hi, > > > This is uploaded as postfix-2.8-20101230-nonprod. The code has had > > limited testing, so keep an eye on things if you intend to expose > > it to the network. > > Minor questions: > > postfix/tlsproxy[30864]: CONNECT [2a01:4f8:120:31e2::165]51824 Right. This is

Re: Available: preliminary postscreen STARTTLS support

2010-12-31 Thread Christian Roessner
Hi, > This is uploaded as postfix-2.8-20101230-nonprod. The code has had > limited testing, so keep an eye on things if you intend to expose > it to the network. Minor questions: postfix/tlsproxy[30864]: CONNECT [2a01:4f8:120:31e2::165]51824 It is just, because I saw it: Missing ":" between add

Available: preliminary postscreen STARTTLS support

2010-12-30 Thread Wietse Venema
Wietse Venema: > I have built an event-driven TLS proxy for postscreen(8). This > addresses the problem that postscreen(8) could not be used when > SMTP clients require STARTTLS support. > > The new daemon is called starttlsd(8). When a non-whitelisted (*) > SMTP client sends a STARTTLS command,

Re: postscreen STARTTLS support

2010-12-29 Thread Patrick Ben Koetter
* Victor Duchovni : > On Wed, Dec 29, 2010 at 10:08:15PM +0100, Patrick Ben Koetter wrote: > > > > > In mobile networks, yes. And email usage is rising again, since mobile > > > > users > > > > found out the can cram more words in a mail than in a SMS. > > > > > > Do these providers combine the

Re: postscreen STARTTLS support

2010-12-29 Thread Victor Duchovni
On Wed, Dec 29, 2010 at 10:08:15PM +0100, Patrick Ben Koetter wrote: > > > In mobile networks, yes. And email usage is rising again, since mobile > > > users > > > found out the can cram more words in a mail than in a SMS. > > > > Do these providers combine the port 25 MX host with the port 25 >

Re: postscreen STARTTLS support

2010-12-29 Thread Patrick Ben Koetter
* Victor Duchovni : > On Wed, Dec 29, 2010 at 09:46:25PM +0100, Patrick Ben Koetter wrote: > > > > The problem is very likely just ISP MUAs. Which ISPs still make money on > > > emai users? It seems that Gmail and the other 800lb free-email gorillas > > > have largely taken over the consumer email

Re: postscreen STARTTLS support

2010-12-29 Thread Victor Duchovni
On Wed, Dec 29, 2010 at 09:46:25PM +0100, Patrick Ben Koetter wrote: > > The problem is very likely just ISP MUAs. Which ISPs still make money on > > emai users? It seems that Gmail and the other 800lb free-email gorillas > > have largely taken over the consumer email market. Is there in fact > >

Re: postscreen STARTTLS support

2010-12-29 Thread Patrick Ben Koetter
* Victor Duchovni : > On Wed, Dec 29, 2010 at 09:11:41PM +0100, Patrick Ben Koetter wrote: > > > > Perhaps we can encourage better hygiene, by not offering AUTH in > > > postscreen. People who want AUTH and postscreen, can migrate their AUTH > > > users to port 587? Or is this still too much to as

Re: postscreen STARTTLS support

2010-12-29 Thread Victor Duchovni
On Wed, Dec 29, 2010 at 09:11:41PM +0100, Patrick Ben Koetter wrote: > > Perhaps we can encourage better hygiene, by not offering AUTH in > > postscreen. People who want AUTH and postscreen, can migrate their AUTH > > users to port 587? Or is this still too much to ask of potential Postfix > > use

Re: postscreen STARTTLS support

2010-12-29 Thread Patrick Ben Koetter
* Victor Duchovni : > On Tue, Dec 28, 2010 at 09:23:14PM -0500, Wietse Venema wrote: > > > I have built an event-driven TLS proxy for postscreen(8). This > > addresses the problem that postscreen(8) could not be used when > > SMTP clients require STARTTLS support. > > > > [...] > > > > Next on

Re: postscreen STARTTLS support

2010-12-29 Thread Victor Duchovni
On Wed, Dec 29, 2010 at 02:45:39PM -0500, Wietse Venema wrote: > > So, unlike the TLS proxy, the AUTH proxy (as e.g. the Cyrus saslauthd > > service) may need to be a forking multi-process service. > > As long as the postscreen side is event-driven, some latency in > AUTH support is not a problem

Re: postscreen STARTTLS support

2010-12-29 Thread Wietse Venema
Victor Duchovni: > On Tue, Dec 28, 2010 at 09:23:14PM -0500, Wietse Venema wrote: > > > I have built an event-driven TLS proxy for postscreen(8). This > > addresses the problem that postscreen(8) could not be used when > > SMTP clients require STARTTLS support. > > > > [...] > > > > Next on the

Re: postscreen STARTTLS support

2010-12-29 Thread Victor Duchovni
On Tue, Dec 28, 2010 at 09:23:14PM -0500, Wietse Venema wrote: > I have built an event-driven TLS proxy for postscreen(8). This > addresses the problem that postscreen(8) could not be used when > SMTP clients require STARTTLS support. > > [...] > > Next on the agenda is AUTH support, and that i

postscreen STARTTLS support

2010-12-28 Thread Wietse Venema
I have built an event-driven TLS proxy for postscreen(8). This addresses the problem that postscreen(8) could not be used when SMTP clients require STARTTLS support. The new daemon is called starttlsd(8). When a non-whitelisted (*) SMTP client sends a STARTTLS command, postscreen(8) will hand off