[pfx] Re: Brainpool support

2025-01-21 Thread Viktor Dukhovni via Postfix-users
On Tue, Jan 21, 2025 at 02:32:05PM +0100, Damian via Postfix-users wrote: > Does Postfix support Brainpool curves? OpenSSL supports or does not support curves, Postfix just uses OpenSSL, but the *default* list of curves passed to OpenSSL: tls_eecdh_auto_curves = X25519 X448 prime256v1 secp38

[pfx] Brainpool support

2025-01-21 Thread Damian via Postfix-users
Does Postfix support Brainpool curves? The Forward Secrecy Readme mentions X25519 and X448 explicitly, P-256 implicitly, while Brainpool curves don't come up anywhere. I still tried with Postfix 3.9.1 and OpenSSL 3.4.0 but failed to establish a TLS connection between `openssl s_client` and Po

[pfx] Re: [mailop] FYI: nixspam RBL has shutdown

2025-01-21 Thread Danjel Jungersen via Postfix-users
On 20-01-2025 23:28, Gerald Galster via Postfix-users wrote: It's not difficult to remove it, a patch has already been accepted: https://github.com/crpb/rspamd/commit/1bfa26296e65514c00e18f856ef3297e7fefdd1c And it might not have gone for good. I have commented it out THX -- Med venlig hilsen

[pfx] Re: Log TLS Error Clarification

2025-01-21 Thread Wietse Venema via Postfix-users
postfix--- via Postfix-users: > > You may want to comment out protocol or cipher tweaks' these can > > reduce interoperability: > > > > postconf -n | grep tls > > > I do not think I am using any tweaks and try to keep things as default as > possible. Or maybe I'm misunderstanding. > >[root

[pfx] Re: "Recipient address rejected: Access denied" when send email to Postfix server. Why? How fix? Thanks.

2025-01-21 Thread Christian Seberino via Postfix-users
Disregard. I got it to work. Thanks again for your kind help. Must appreciated. cs On Tue, Jan 21, 2025 at 3:21 PM Christian Seberino wrote: > > Viktor > > Can I ask you a follow up? I read up on smtpd_recipient_restrictions > and believe I did it right now... https://bpa.st/UB3Q > > I a

[pfx] Re: Log TLS Error Clarification

2025-01-21 Thread postfix--- via Postfix-users
You may want to comment out protocol or cipher tweaks' these can reduce interoperability: postconf -n | grep tls I do not think I am using any tweaks and try to keep things as default as possible. Or maybe I'm misunderstanding. [root@host /]# postconf -n | grep tls milter_rcpt_macros =

[pfx] Re: Log TLS Error Clarification

2025-01-21 Thread Wietse Venema via Postfix-users
postfix--- via Postfix-users: > My distro package manager gives me postfix 3.5.25 with openssl 3.2.2 which > causes SSL version mismatch warnings I was previously told I could ignore. > > I got a failed transaction: > >Jan 21 09:15:21 host postfix/smtpd[79286]: warning: run-time library vs.

[pfx] Log TLS Error Clarification

2025-01-21 Thread postfix--- via Postfix-users
My distro package manager gives me postfix 3.5.25 with openssl 3.2.2 which causes SSL version mismatch warnings I was previously told I could ignore. I got a failed transaction: Jan 21 09:15:21 host postfix/smtpd[79286]: warning: run-time library vs. compile-time header version mismatch: Ope

[pfx] Re: Log TLS Error Clarification

2025-01-21 Thread Viktor Dukhovni via Postfix-users
On Tue, Jan 21, 2025 at 05:16:29PM -0500, Wietse Venema via Postfix-users wrote: > >[root@host /]# postconf -n | grep tls > >milter_rcpt_macros = i {rcpt_addr} {rcpt_host} {rcpt_mailer} > > {tls_version} > >smtp_tls_CAfile = /etc/pki/tls/certs/ca-bundle.crt > >smtp_tls_CApath = /e

[pfx] update on: Moving from postfix 2.10.1 to postfix 3.9

2025-01-21 Thread Marco Fioretti via Postfix-users
Wietse wrote: > from your answer I understand that it would be > OK/safe to do this: > > 1, copy all the old configuration files into the new server, and just add > compatibility_level = 0 to main.cf > > 2, regenerate all hashes and btree files > > 3, start postfix, see which warnings it generates

[pfx] Re: "Recipient address rejected: Access denied" when send email to Postfix server. Why? How fix? Thanks.

2025-01-21 Thread Christian Seberino via Postfix-users
Viktor Can I ask you a follow up? I read up on smtpd_recipient_restrictions and believe I did it right now... https://bpa.st/UB3Q I also verified I can do "telnet autoprog.org 25" so can't figure out why I *still* get access denied when I try to send email to " c...@autoprog.org". cs On Mon,