Re: TLS library problem: no shared cipher

2020-09-22 Thread Markus E.
On Tue, 22 Sep 2020, Viktor Dukhovni wrote: On Tue, Sep 22, 2020 at 04:37:55PM +0200, Markus E. wrote: You might find another one in your logs now. :-) You're welcome! :) $ posttls-finger -g HIGH -o tls_high_cipherlist='DEFAULT:!aECDSA' -p '!TLSv1.3' mars.unx.se posttls-finger:

Re: TLS library problem: no shared cipher

2020-09-22 Thread Markus E.
On Tue, 22 Sep 2020, Herbert J. Skuhra wrote: On Tue, Sep 22, 2020 at 04:37:55PM +0200, Markus E. wrote: Is it possible to not announce STARTTLS to some clients? http://www.postfix.org/postconf.5.html#smtpd_discard_ehlo_keyword_address_maps Thank you! Problem circumvented but not solved

Re: Very selective relay

2020-09-22 Thread Antonio Leding
Hi Viktor, I never used this but am now curious — in reading the docs on this, it looks like the proper content in the “{ }” fields would be the IP or FQDN to\from one wishes to restrict traffic — do I have this correct? On 18 Sep 2020, at 9:09, Viktor Dukhovni wrote: On Fri, Sep 18,

Re: Very selective relay

2020-09-22 Thread Viktor Dukhovni
On Tue, Sep 22, 2020 at 04:19:41PM +0200, Marek Kozlowski wrote: > On 9/18/20 6:09 PM, Viktor Dukhovni wrote: > >> I've been asked a very strange question. According to the best of my > >> knowledge there is no setting but maybe I'm wrong: > >> > >> Is it possible the define a very selective

Re: TLS library problem: no shared cipher

2020-09-22 Thread Viktor Dukhovni
On Tue, Sep 22, 2020 at 04:37:55PM +0200, Markus E. wrote: > What's your suggestion to avoid the following problem? > > Sep 22 13:11:22 postfix/smtpd[21000]: connect from > dragon.trusteddomain.org[208.69.40.156] > Sep 22 13:11:25 postfix/smtpd[21000]: SSL_accept error from >

Re: TLS library problem: no shared cipher

2020-09-22 Thread Herbert J. Skuhra
On Tue, Sep 22, 2020 at 04:37:55PM +0200, Markus E. wrote: > > Is it possible to not announce STARTTLS to some clients? http://www.postfix.org/postconf.5.html#smtpd_discard_ehlo_keyword_address_maps -- Herbert

Disabling delivery to local users

2020-09-22 Thread Marek Kozlowski
:-) Well... Let's imagine that my SMTP server is an MX for 'mydomain.tld' (and some other ones). I've defined LDAP query for 'virtual_alias_maps', something like: virtual_alias_maps = ldap:/etc/postfix/ldap-aliases.cf The query file in some very simplified form can be expressed as:

TLS library problem: no shared cipher

2020-09-22 Thread Markus E.
Hi! What's your suggestion to avoid the following problem? Sep 22 13:11:22 postfix/smtpd[21000]: connect from dragon.trusteddomain.org[208.69.40.156] Sep 22 13:11:25 postfix/smtpd[21000]: SSL_accept error from dragon.trusteddomain.org[208.69.40.156]: -1 Sep 22 13:11:25 postfix/smtpd[21000]:

Re: Very selective relay

2020-09-22 Thread Marek Kozlowski
:-) On 9/18/20 6:09 PM, Viktor Dukhovni wrote: On Fri, Sep 18, 2020 at 11:50:02AM +0200, Marek Kozlowski wrote: I've been asked a very strange question. According to the best of my knowledge there is no setting but maybe I'm wrong: Is it possible the define a very selective relay according

Re: Piping mail logs to another process fails

2020-09-22 Thread Wietse Venema
Jonathan Hammer: > Hi, > > We are running Postfix on macOS and making use of `maillog_file = > /dev/stdout` and `postfix start-fg` to send our logs to stdout. > Not using Docker. "postfix start-fg" ands "maillog_file = /dev/stdout" are for use with containers. I am surprised that it works at all

Re: postfix and MX

2020-09-22 Thread natan maciej milaszewski
Hi I found a solutions about MX filter in http://rmxf.comm.pl/ On 18.09.2020 01:30, @lbutlr wrote: > On 17 Sep 2020, at 17:03, Fred Morris wrote: >> On Thu, 17 Sep 2020, Antonio Leding wrote: >>> TILT: MX records are not required for email to work — WOOT… >> Not required for SPF either. You can

Re: get client auth certificate from incoming e-mail messages

2020-09-22 Thread Viktor Dukhovni
[ "Bcc": Shumon Huque ] On Tue, Sep 22, 2020 at 07:17:40AM +, Christian Renner wrote: > I am looking for a way to get the mutual client authentication > certificate from incoming e-mail messages (in particular with > TLSv1.3+). 1. Postfix does not provide a mechanism for this. 2. A

get client auth certificate from incoming e-mail messages

2020-09-22 Thread Christian Renner
Hi, I am looking for a way to get the mutual client authentication certificate from incoming e-mail messages (in particular with TLSv1.3+). With a policy server I am able to get ccert_subject, ccert_issuer and ccert_fingerprint (http://www.postfix.org/SMTPD_POLICY_README.html#protocol), but I