Re: detecting encryption for outgoing mail

2015-02-16 Thread Ansgar Wiechers
On 2015-02-15 John wrote: > A couple of the servers I support are medical offices, and for > patient confidentiality reasons they need to send email out > encrypted. > After a lot of discussion they have come to the conclusion that in > order to avoid accidentally sending confidential data unencry

Re: detecting encryption for outgoing mail

2015-02-16 Thread lst_hoe02
Zitat von John : A couple of the servers I support are medical offices, and for patient confidentiality reasons they need to send email out encrypted. After a lot of discussion they have come to the conclusion that in order to avoid accidentally sending confidential data unencrypted, all

Re: detecting encryption for outgoing mail

2015-02-16 Thread Mike Cardwell
* on the Mon, Feb 16, 2015 at 11:39:22AM +0100, lst_ho...@kwsoft.de wrote: >> A couple of the servers I support are medical offices, and for patient >> confidentiality reasons they need to send email out encrypted. >> After a lot of discussion they have come to the conclusion that in order >> to

Re: detecting encryption for outgoing mail

2015-02-16 Thread Michael Ströder
LuKreme wrote: > I’d assume there would be something in the headers to indicate the message > was encrypted. Probably some sort of milter running on your submission port > would be able to check this? I'd implement a milter or similar which looks at the Content-Type header. Typically it looks lik

Re: detecting encryption for outgoing mail

2015-02-16 Thread Wietse Venema
Mike Cardwell: > On an old Exim box, I used to do something similar to this with the following > two line bit of config: > > deny condition = ${if !match{$message_body}{-BEGIN PGP MESSAGE-}} > message = Unencrypted message. Encrypt then retry. > > Is there really no equivalent way

Re: detecting encryption for outgoing mail

2015-02-16 Thread Viktor Dukhovni
On Mon, Feb 16, 2015 at 12:57:26PM +, Mike Cardwell wrote: > On an old Exim box, I used to do something similar to this with the following > two line bit of config: > > deny condition = ${if !match{$message_body}{-BEGIN PGP MESSAGE-}} > message = Unencrypted message. Encrypt th

Re: detecting encryption for outgoing mail

2015-02-16 Thread Mike Cardwell
* on the Mon, Feb 16, 2015 at 03:50:24PM +, Viktor Dukhovni wrote: > On Mon, Feb 16, 2015 at 12:57:26PM +, Mike Cardwell wrote: >> On an old Exim box, I used to do something similar to this with the following >> two line bit of config: >> >> deny condition = ${if !match{$message_body}{--

Re: detecting encryption for outgoing mail

2015-02-16 Thread Erwan David
Le 16/02/2015 14:09, Michael Ströder a écrit : > LuKreme wrote: >> I’d assume there would be something in the headers to indicate the message >> was encrypted. Probably some sort of milter running on your submission port >> would be able to check this? > I'd implement a milter or similar which look

Re: detecting encryption for outgoing mail

2015-02-16 Thread Michael Ströder
Erwan David wrote: > Le 16/02/2015 14:09, Michael Ströder a écrit : >> LuKreme wrote: >>> I’d assume there would be something in the headers to indicate the message >>> was encrypted. Probably some sort of milter running on your submission port >>> would be able to check this? >> I'd implement a mi

smtpd_recipient_restrictions to restrict outbound email to selected domains

2015-02-16 Thread Steve Zeng
Greetings! I am running postfix 2.3.3 on Redhat RHEL 5 for a local SMTP MTA. For security purpose, we need to restrict its outbound emails to selected destination domains only. http://www.postfix.org/postconf.5.html#smtpd_recipient_restrictions The default is: smtpd_recipient_restrictions = pe

Re: smtpd_recipient_restrictions to restrict outbound email to selected domains

2015-02-16 Thread Viktor Dukhovni
On Tue, Feb 17, 2015 at 12:48:45AM +, Steve Zeng wrote: > I am running postfix 2.3.3 on Redhat RHEL 5 for a local SMTP MTA. For > security purpose, we need to restrict its outbound emails to selected > destination domains only. > > http://www.postfix.org/postconf.5.html#smtpd_recipient_restri

Sanity check

2015-02-16 Thread John Allen
Would somebody take a look at my config. I am a little concerned about the security on submission (587). This is the family server which I use for experimenting. Thanks John A config_directory = /etc/postfix biff = no append_dot_mydomain = no mydomain = klam.ca myorigin = $mydomain myhostname

Re: detecting encryption for outgoing mail

2015-02-16 Thread John Allen
My thanks everybody for their input. It looks as though trying to reliably determine if effective encryption is being will be difficult. Plus, as somebody pointed out there is the additional problem of acquiring the correspondents encryption keys, assuming they have one. Having discussed this wi

Re: Sanity check

2015-02-16 Thread Viktor Dukhovni
On Mon, Feb 16, 2015 at 09:46:17PM -0500, John Allen wrote: > smtp_dns_support_level = dnssec > smtp_tls_security_level = dane Givent he above, the following are pointless: > smtp_tls_enforce_peername = no A Postfix 2.2 parameter Obsoleted by smtp security levels. Remove from main.cf.