Re: SSL/TLS

2015-07-27 Thread Denis Fondras
Are you really sure you want to open-relay your server to .JP ? If not, remove this line : > accept from source for any relay -- You received this mail because you are subscribed to misc@opensmtpd.org To unsubscribe, send a mail to: misc+unsubscr...@opensmtpd.org

Re: SSL/TLS

2015-07-27 Thread Seth
On Mon, 27 Jul 2015 19:40:39 -0700, SSL wrote: i am afraid of being attacked . so i want to limit PCs in japan only (if japanese PC is hacked , this setting in not safe ) . It would probably be more appropriate and effective to use a firewall such as OpenBSD's pf to accomplish this goal. O

SSL/TLS

2015-07-27 Thread SSL
hi all . i am afraid of being attacked . so i want to limit PCs in japan only (if japanese PC is hacked , this setting in not safe ) . i look at https://ipv4.fetus.jp/ and download as jp.txt tr '\n' ' ' jp3 cat jp3 1.0.16.0/20 1.0.64.0/18 1.1.64.0/18 1.5.0.0/16 1.21.0.0/16 1.33.0.0/16 1.66

Re: Revisiting Issue #359 - Allow OpenSSL options to be specified

2015-07-27 Thread Seth
On Mon, 27 Jul 2015 12:53:19 -0700, Török Edwin wrote: Would this be for incoming or outgoing connections? It's the incoming that I'm primarily concerned with, but that's a good point to raise. Should the setting effect both directions or be applied independently? For incoming connection

Re: Revisiting Issue #359 - Allow OpenSSL options to be specified

2015-07-27 Thread Török Edwin
On 07/27/2015 10:14 PM, Seth wrote: > Copying my comment on this ticket[1] to the list for discussion > --- > > I would like to re-open discussion on this issue for a different use case: In > light of more vulnerabilities discovered in the TLSv1.0 protocol since Dec > 2013, I no longer feel it p

Revisiting Issue #359 - Allow OpenSSL options to be specified

2015-07-27 Thread Seth
Copying my comment on this ticket[1] to the list for discussion --- I would like to re-open discussion on this issue for a different use case: In light of more vulnerabilities discovered in the TLSv1.0 protocol since Dec 2013, I no longer feel it provides acceptable security and would like