On 04/17/16 06:28, Why 42? The lists account. wrote:
Hi All,
I wanted to setup a new OpenBSD 5.9 server with Postfix 3.1, but I fell
at the first fence, well at the first TLS fence ...
root@dna59:[postfix]# postfix tls enable-client
postfix/postfix-script: error: unknown command: 'tls'
postfix/postfix-script: fatal: usage: postfix start (or stop, reload, abort,
flush, check, status, set-permissions, upgrade-configuration)
It seems that the Postfix package available for 5.9 is based on a
snapshot from the end of 2015:
The ports / package tree ships with both the stable and snapshot release
of Postfix. So you have a choice of 3.0.3 or 3.1-20151227.
root@dna59:[postfix]# type postfix
postfix is hashed (/usr/local/sbin/postfix)
root@dna59:[log]# pkg_info -E /usr/local/sbin/postfix
/usr/local/sbin/postfix: postfix-3.1.20151227-sasl2
postfix-3.1.20151227-sasl2 fast, secure sendmail replacement
And it looks like this predates the introduction of the tls command:
20160116
...
Feature: "postfix tls" commands to enable opportunistic TLS
in the Postfix SMTP client or server, or generate or replace
Postfix SMTP server TLS private keys and server certificates.
Viktor Dukhovni, Wietse. Files: conf/postfix-files,
conf/postfix-script, conf/postfix-tls-script, makedefs,
proto/INSTALL.html, proto/postconf.proto, global/mail_params.h,
postfix/postfix.c, tls/tls_misc.c.
...
What is my best option at this point? I could think of:
Carry on without the tls command, and configure "manually". Is this feasible?
E.g. is it (the tls cmd) just a helper tool, or is it required? What
documentation would be relevant for a manual configuration process?
I found a script "/usr/lib/postfix/bin/postfix-tls-script" which should
apparently do "Postfix TLS Management". Could it be useful here?
Trigger the OpenBSD team to build an package of the official 3.1 release rather
than an "obsolete" snapshot. But does anyone know if this is possible, or how
to begin that process? (The 5.9 ports tree seems to contain references to only
the same snapshot version mentioned above.)
That's not going to happen. It's a release. If you want newer then go
with -current. The 5.9 ports / packages tree contains both versions.
Build Postfix from source myself. While looking at that option I came across
this statement in INSTALL.html:
OpenBSD is partially supported. The libc resolver does not implement the
documented "internal resolver options which are [...] set by changing fields in
the _res structure" (documented in the OpenBSD 5.6 resolver(3) manpage). This
results in too many DNS queries, and false positives for queries that should
fail.
This makes me a little nervous. How serious is this issue, can anyone expand on
the possible consequences?
You're running 5.9 so its a non issue. The bug in question was fixed as
of -current around 1 year ago as has shipped with 5.8 and 5.9. The
comment really should be removed since the bug has long since been fixed
and is just scaring people in the wrong way.
