Re: Disabling Anonymous Diffie Hellman

2014-05-21 Thread Viktor Dukhovni
On Wed, May 21, 2014 at 08:51:48AM +0200, David Schweikert wrote: > Hi Viktor, > > On Tue, May 20, 2014 at 14:21:22 +, Viktor Dukhovni wrote: > > Facebook made the same mistakes you did: > > > > http://www.metzdowd.com/pipermail/cryptography/2014-May/021344.html > > In that thread you s

Re: Disabling Anonymous Diffie Hellman

2014-05-21 Thread David Schweikert
Hi Viktor, On Wed, May 21, 2014 at 14:09:16 +, Viktor Dukhovni wrote: > The unstated context is "at Internet scale". I know about the > "secure" level, after all I developed that feature for Postfix, > while also serving as postmaster for a large company with many SMTP > secure TLS peering re

Re: Disabling Anonymous Diffie Hellman

2014-05-21 Thread Viktor Dukhovni
On Wed, May 21, 2014 at 05:16:54PM +0200, David Schweikert wrote: > > The problem with "secure" is that it requires bilateral coordination. > > Thus O(n^2) effort for a network of size n. This cannot and will > > not secure SMTP by default. > > I was wondering about the scalability of DANE, when

Re: Disabling Anonymous Diffie Hellman

2014-05-21 Thread David Schweikert
Hi Viktor, On Wed, May 21, 2014 at 15:31:20 +, Viktor Dukhovni wrote: > Yes, you benefit from "herd immunity". When one sending site defers > mail to a destination, it is that sending site's problem. When > everyone defers mail to a destination, it is the destination site's > problem. Break

Re: Disabling Anonymous Diffie Hellman

2014-05-21 Thread Viktor Dukhovni
On Wed, May 21, 2014 at 05:44:10PM +0200, David Schweikert wrote: > > You can use "dane" or "dane-only" per-destination if you like to > > simplify the configuration management, no matching rules to define. > > However, I would encourage senders en-masse to enable DANE, and > > expect receiving sy

[no subject]

2014-05-21 Thread Wesley Witt
I need some help getting a transport map setup for the purpose of an auto responder. I'm certain that the problem is caused by something I've done wrong, but I just don't see what the problem is. I have set things up according to the O'Rielly Postfix book. I have done the following: 1: add t

Transport Not Working

2014-05-21 Thread Wesley Witt
I need some help getting a transport map setup for the purpose of an auto responder. I'm certain that the problem is caused by something I've done wrong, but I just don't see what the problem is. I have set things up according to the O'Rielly Postfix book. I have done the following: 1: add t

Re: Transport Not Working

2014-05-21 Thread Viktor Dukhovni
On Thu, May 22, 2014 at 02:12:59AM +, Wesley Witt wrote: > 4: add the entry to the virtual alias file What entry? Why? > What I'm seeing is an entry in syslog saying "User unknown in > virtual alias table". It is looking for the address that is defined > in the transport file. It appears