STARTTLS / DANE difficulties?

2018-07-10 Thread James B. Byrne
We are migrating our Postfix MX services and in the process have disrupted a setup which has been very stable for the past couple of years. One of the remaining items is this sort of message which only started very recently: Jul 10 11:55:29 mx31 postfix-p25/smtpd[70030]: connect from hr1.samba.o

RE: STARTTLS / DANE difficulties?

2018-07-10 Thread Fazzina, Angelo
When you test connecting to your servers yourself do you get any errors ? Not sure if sslv3 is ok to see if using TLS ??? Commands to try, just replace with your server name openssl s_client -connect mta5.uits.uconn.edu:465 openssl s_client -starttls smtp -connect mta5.uits.uconn.edu:587 openssl

RE: STARTTLS / DANE difficulties?

2018-07-10 Thread Fazzina, Angelo
My test of connecting to your server openssl s_client -starttls smtp -connect mx31.harte-lyne.ca:587 Start Time: 1531242804 Timeout : 300 (sec) Verify return code: 19 (self signed certificate in certificate chain) --- 250 SMTPUTF8 quit 221 2.0.0 Bye closed [root@mta5 alf02013]# MY S

Re: STARTTLS / DANE difficulties?

2018-07-10 Thread Viktor Dukhovni
On Tue, Jul 10, 2018 at 12:55:38PM -0400, James B. Byrne wrote: > We are migrating our Postfix MX services and in the process have > disrupted a setup which has been very stable for the past couple of > years. One of the remaining items is this sort of message which only > started very recently:

Re: STARTTLS / DANE difficulties?

2018-07-10 Thread James B. Byrne
On Tue, July 10, 2018 13:30, Viktor Dukhovni wrote: > On Tue, Jul 10, 2018 at 12:55:38PM -0400, James B. Byrne wrote: > >> We are migrating our Postfix MX services and in the process have >> disrupted a setup which has been very stable for the past couple of >> years. One of the remaining items

RE: STARTTLS / DANE difficulties?

2018-07-10 Thread James B. Byrne
On Tue, July 10, 2018 13:05, Fazzina, Angelo wrote: > When you test connecting to your servers yourself do you get any > errors ? > Not sure if sslv3 is ok to see if using TLS ??? > > Commands to try, just replace with your server name > openssl s_client -connect mta5.uits.uconn.edu:465 > openss

Re: STARTTLS / DANE difficulties?

2018-07-10 Thread Viktor Dukhovni
On Tue, Jul 10, 2018 at 02:26:05PM -0400, James B. Byrne wrote: > > What is the MX hostname associated with this Postfix instance? What > > domains does it serve? That has bearing on the TLSA records seen > > by the connecting SMTP client. > > mx31.harte-lyne.ca - harte-lyne.ca / .harte-lyne.ca

check_client_access not blocking /8 /16 /24 etc.

2018-07-10 Thread Philip
I'm curious to know what I've done wrong with my client checks file. I can reject a specific IP but it won't reject when I use net blocks... format is listed below in client_checks.cf Suggestions comments welcome. main.cf. smtpd_recipient_restrictions =       permit_mynetworks,       permit_

Re: check_client_access not blocking /8 /16 /24 etc.

2018-07-10 Thread Benny Pedersen
Philip skrev den 2018-07-11 04:24: check_client_access hash:/etc/postfix/client_checks.cf, change hash here to cidr 5.0.0.0/8 REJECT We have not seen your IP Address before.  Please visit https://example.com?newip=5.0.0.0/8 to unblock your IP and remember cidr does not need to be postmappe

Re: check_client_access not blocking /8 /16 /24 etc.

2018-07-10 Thread Bill Cole
On 10 Jul 2018, at 22:24 (-0400), Philip wrote: I'm curious to know what I've done wrong with my client checks file. I can reject a specific IP but it won't reject when I use net blocks... format is listed below in client_checks.cf Suggestions comments welcome. Pick a table format and use