Re: Using TLS for certain domains

2013-06-13 Thread polloxx
We wanted to test TLS and we've found this one: http://www.checktls.com/ Thanks to the list for all the help. On Wed, Jun 12, 2013 at 8:05 PM, Noel Jones njo...@megan.vbhcs.org wrote: On 6/12/2013 10:53 AM, polloxx wrote: Thanks Wietse. Can we test this setup? If you're asking how to

Re: Using TLS for certain domains

2013-06-12 Thread polloxx
I use vim to edit the Postfix config. What should I use? On Tue, Jun 11, 2013 at 10:28 PM, Viktor Dukhovni postfix-us...@dukhovni.org wrote: On Tue, Jun 11, 2013 at 09:34:38PM +0200, polloxx wrote: no luck yet. local_header_rewrite_clients = static:all smtp_tls_CAfile =

Re: Using TLS for certain domains

2013-06-12 Thread Wietse Venema
polloxx: local_header_rewrite_clients = static:all smtp_tls_CAfile = /etc/postfix/cacert.pemsmtp_tls_session_cache_database = btree:/mailout/var/spool/postfix/smtp_tls_session_cache smtp_tls_security_level = maysmtp_use_tls = yessmtpd_tls_CAfile = /etc/postfix/cacert.pem

Re: Using TLS for certain domains

2013-06-12 Thread polloxx
Thanks to all of you. Now it works, although set nowrap in vim did not solve the issue. I had to add the parameters using postconf -e. Is this normal? Now I see 250-STARTTLS when I telnet to the server on port 25. Is there another way to test if the setup works? On Wed, Jun 12, 2013 at 2:46 PM,

Re: Using TLS for certain domains

2013-06-12 Thread Wietse Venema
polloxx: Thanks to all of you. Now it works, although set nowrap in vim did not solve the issue. I had to add the parameters using postconf -e. Is this normal? set nowrap has no effect after the text is already wrapped. Wietse

Re: Using TLS for certain domains

2013-06-12 Thread polloxx
Thanks Wietse. Can we test this setup? On Wed, Jun 12, 2013 at 5:29 PM, Wietse Venema wie...@porcupine.org wrote: polloxx: Thanks to all of you. Now it works, although set nowrap in vim did not solve the issue. I had to add the parameters using postconf -e. Is this normal? set nowrap

Re: Using TLS for certain domains

2013-06-12 Thread Wietse Venema
polloxx: Thanks to all of you. Now it works, although set nowrap in vim did not solve the issue. I had to add the parameters using postconf -e. Is this normal? Wietse: set nowrap has no effect after the text is already wrapped. polloxx: Thanks Wietse. Can we test this setup? If you mean

Re: Using TLS for certain domains

2013-06-12 Thread Ansgar Wiechers
On 2013-06-12 Wietse Venema wrote: If you mean that set nowrap in vim did not put the line breaks back, then that is to be expected. If you mean that set nowrap in vim removes line breaks, then that is a question for vim users/faqs/maintainers. FTR: set wrap or set nowrap don't add or

Re: Using TLS for certain domains

2013-06-12 Thread Noel Jones
On 6/12/2013 10:53 AM, polloxx wrote: Thanks Wietse. Can we test this setup? If you're asking how to test your TLS, use the openssl s_client. openssl s_client -connect se.rv.er.ip:port -starttls smtp If it's working, you'll get several screens full of connection info and certificate

Re: Using TLS for certain domains

2013-06-11 Thread polloxx
Thanks for the answers. Till now with no success. One of the things: In http://www.postfix.org/TLS_README.html#quick-start there is smtp_tls_session_cache_database = btree:/mailin/var/spool/postfix/smtp_tls_session_cache (/mailin/var/spool/postfix/ is my inbound queue directotory)

Re: Using TLS for certain domains

2013-06-11 Thread Viktor Dukhovni
On Tue, Jun 11, 2013 at 05:01:42PM +0200, polloxx wrote: Thanks for the answers. Till now with no success. One of the things: In http://www.postfix.org/TLS_README.html#quick-start there is smtp_tls_session_cache_database = btree:/mailin/var/spool/postfix/smtp_tls_session_cache

Re: Using TLS for certain domains

2013-06-11 Thread polloxx
no luck yet. alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases alternate_config_directories = /etc/postfix-out append_dot_mydomain = no biff = no body_checks = regexp:/etc/postfix/body_checks bounce_queue_lifetime = 1d config_directory = /etc/postfix disable_vrfy_command =

Re: Using TLS for certain domains

2013-06-11 Thread Viktor Dukhovni
On Tue, Jun 11, 2013 at 09:34:38PM +0200, polloxx wrote: no luck yet. local_header_rewrite_clients = static:all smtp_tls_CAfile = /etc/postfix/cacert.pemsmtp_tls_session_cache_database = btree:/mailout/var/spool/postfix/smtp_tls_session_cache smtp_tls_security_level = may

Re: Using TLS for certain domains

2013-06-08 Thread LuKreme
On 07 Jun 2013, at 21:17 , Nikolas Kallis n...@nikolaskallis.com wrote: Its not true that there is no benefit using a SSL certificate from a CA. Some MTA's will reject connecting to a remote host if it cannot validate its security credentials from a CA. Are you sure about that? I've *never*

Re: Using TLS for certain domains

2013-06-07 Thread Noel Jones
On 6/7/2013 1:40 PM, polloxx wrote: Dear list, We need to implement TLS for one of our customers using our Postfix infrastructure (serving multiple domains) for inbound mail. The final delivery for that domain is a Exchange server, but we have a anti-virus server in front of that Exchange:

Re: Using TLS for certain domains

2013-06-07 Thread Nikolas Kallis
On 08/06/13 05:29, Noel Jones wrote: On 6/7/2013 1:40 PM, polloxx wrote: Dear list, We need to implement TLS for one of our customers using our Postfix infrastructure (serving multiple domains) for inbound mail. The final delivery for that domain is a Exchange server, but we have a anti-virus

Re: Using TLS for certain domains

2013-06-07 Thread Viktor Dukhovni
On Sat, Jun 08, 2013 at 01:17:22PM +1000, Nikolas Kallis wrote: For the general use case, just enable TLS as described in http://www.postfix.org/TLS_README.html#quick-start then set both smtp_tls_security_level and smtpd_tls_security_level to may and TLS will just start working. Its not