Re: [OpenSMTPD] portable snapshot opensmtpd-201505121836p1 available

2015-05-15 Thread Ashish SHUKLA
On Tue, 12 May 2015 18:36:42 +0200 (CEST), gilles chehade gil...@poolp.org said: | A new opensmtpd portable snapshot is available at: | http://www.opensmtpd.org/archives/opensmtpd-201505121836p1.tar.gz | Checksum: | SHA256 (opensmtpd-201505121836p1.tar.gz) = |

Re: IO Error: tlsv1 alert decode error

2015-05-15 Thread Gilles Chehade
On Wed, May 13, 2015 at 01:27:44PM +0200, Eric Ripa wrote: Okay. So I've looked further into this, the destination MX record contains 6 addresses. The first 5 generates the below TLS IO Error, but the 6th doesn't seem to be up to respond on SMTP queries. So what I believe is happening is

Re: [OpenSMTPD] portable snapshot opensmtpd-201505121836p1 available

2015-05-15 Thread Seth
On Fri, 15 May 2015 13:22:40 -0700, Gilles Chehade gil...@poolp.org wrote: This is now fixed in git, will be part of next snapshot to be published this week-end That did the trick, thanks. BTW, if you're running FreeBSD and installing over a packaged version, you probably need to remove

TLS Policy Database and the 'relay tls verify' option....like peas and carrots?

2015-05-15 Thread Seth
There's been some discussion on the list recently about using the 'relay tls verify' to mitigate STARTTLS downgrade attacks. [1] Gilles suggested using something like this in smtpd.conf as a protective measure: table validcrt file:/etc/mail/hosts-with-valid-certs accept for domain validcrt

Re: IO Error: tlsv1 alert decode error

2015-05-15 Thread Eric Ripa
Hi Gilles, I don’t know how far you got with this. I have resolved the issue, cause unknown. First, I actually had 5.4.3 and not 5.4.4. I was certain that I had upgraded. Anyway… so I simply shutdown smtpd, upgraded to 5.4.5 and booted it up again. Then rescheduling the emails worked fine