TLS Configuration on Postfix
in [Postfix]
|
From: Carlos Williams on 21 Dec 2009 10:58 I have TLS / SASL working on my email server. My question is in my main.cf on Postfix, I have the following parameter for TLS: smtpd_tls_security_level = may In my VIM editor, every parameter except the one listed above is in color. The above parameter is just in white. I assumed that this was because the parameter was not being properly recognized via Postfix. I removed it and broke Postfix so I then knew this parameter was significant and being utilized via my Postfix server: [root(a)mail ~]# postconf | grep smtpd_tls_security_level smtpd_tls_security_level = may My question is why is it not in color like all the other Postfix parameters in VIM? And lastly, do I need this parameter in my main.cf: smtp_use_tls = yes or is the above the old parameter that is no longer used via Postfix 2.3+? I am thinking the later is a redundant entry for the first parameter I listed above. Below is my Postconf -n: [root(a)mail ~]# postconf -n address_verify_sender = $double_bounce_sender alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases, hash:/etc/mailman/aliases broken_sasl_auth_clients = yes command_directory = /usr/sbin config_directory = /etc/postfix content_filter = amavisfeed:[127.0.0.1]:10024 daemon_directory = /usr/libexec/postfix home_mailbox = Maildir/ html_directory = no inet_interfaces = all mail_owner = postfix mailq_path = /usr/bin/mailq.postfix manpage_directory = /usr/share/man message_size_limit = 20480000 mydestination = $myhostname, $mydomain, mail.$mydomain mydomain = mydomain.tld myhostname = mail.mydomain.tld mynetworks = $config_directory/mynetworks myorigin = $mydomain newaliases_path = /usr/bin/newaliases.postfix queue_directory = /var/spool/postfix readme_directory = /usr/share/doc/postfix-2.3.3/README_FILES recipient_delimiter = + relay_domains = sample_directory = /usr/share/doc/postfix-2.3.3/samples sendmail_path = /usr/sbin/sendmail.postfix setgid_group = postdrop smtp_use_tls = yes smtpd_banner = $myhostname ESMTP smtpd_delay_reject = yes smtpd_helo_required = yes smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, permit smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_pipelining, reject_non_fqdn_recipient, reject_unknown_recipient_domain, reject_unauth_destination, reject_unlisted_recipient, check_policy_service unix:postgrey/socket, check_sender_access hash:/etc/postfix/sender_access, reject_rbl_client zen.spamhaus.org, reject_rbl_client bl.spamcop.net, permit smtpd_sasl_auth_enable = yes smtpd_sasl_path = private/auth smtpd_sasl_security_options = noanonymous smtpd_sasl_type = dovecot smtpd_sender_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_sender, reject_unknown_sender_domain, reject_unknown_reverse_client_hostname, permit smtpd_tls_CAfile = /path/to/my/intermediate.crt smtpd_tls_auth_only = yes smtpd_tls_cert_file = /path/to/.crt smtpd_tls_key_file = /path/to/.key smtpd_tls_loglevel = 1 smtpd_tls_security_level = may smtpd_tls_session_cache_database = btree:/var/spool/postfix/smtpd_tls_cache smtpd_tls_session_cache_timeout = 3600s tls_random_source = dev:/dev/urandom unknown_local_recipient_reject_code = 550
From: Brian Evans - Postfix List on 21 Dec 2009 11:03 On 12/21/2009 10:58 AM, Carlos Williams wrote: > smtpd_tls_security_level = may > > In my VIM editor, every parameter except the one listed above is in > color. The above parameter is just in white. I assumed that this was > because the parameter was not being properly recognized via Postfix. I > removed it and broke Postfix so I then knew this parameter was > significant and being utilized via my Postfix server: > > [root(a)mail ~]# postconf | grep smtpd_tls_security_level > smtpd_tls_security_level = may > > or is the above the old parameter that is no longer used via Postfix > 2.3+? I am thinking the later is a redundant entry for the first > parameter I listed above. > > Your VIM syntax highlighter is out of date. Trust postconf.
From: Victor Duchovni on 21 Dec 2009 11:09 On Mon, Dec 21, 2009 at 10:58:40AM -0500, Carlos Williams wrote: > I have TLS / SASL working on my email server. My question is in my > main.cf on Postfix, I have the following parameter for TLS: > > smtpd_tls_security_level = may > > In my VIM editor, every parameter except the one listed above is in > color. The above parameter is just in white. To fix this problem, disable syntax coloring in VIM. Monochrome ASCII text works equally well in main.cf. > I assumed that this was > because the parameter was not being properly recognized via Postfix. No, it is because VIM syntax highlighting does not recognize it. VIM is not Postfix. > My question is why is it not in color like all the other Postfix > parameters in VIM? Ask on the VIM list. > And lastly, do I need this parameter in my main.cf: > > smtp_use_tls = yes No, you should stop setting it. It is obsolete, and superceded by smtpd_tls_security_level. > smtpd_tls_CAfile = /path/to/my/intermediate.crt Not needed, if you *append* the intermediate certificate to the server certificate file. > smtpd_tls_cert_file = /path/to/.crt > smtpd_tls_key_file = /path/to/.key > smtpd_tls_loglevel = 1 > smtpd_tls_security_level = may > smtpd_tls_session_cache_database = btree:/var/spool/postfix/smtpd_tls_cache > smtpd_tls_session_cache_timeout = 3600s > tls_random_source = dev:/dev/urandom Looks good. The key file should be owned by "root", mode 0600 or 0400. -- Viktor. Disclaimer: off-list followups get on-list replies or get ignored. Please do not ignore the "Reply-To" header. To unsubscribe from the postfix-users list, visit http://www.postfix.org/lists.html or click the link below: <mailto:majordomo(a)postfix.org?body=unsubscribe%20postfix-users> If my response solves your problem, the best way to thank me is to not send an "it worked, thanks" follow-up. If you must respond, please put "It worked, thanks" in the "Subject" so I can delete these quickly.
From: /dev/rob0 on 21 Dec 2009 11:53 On Mon, Dec 21, 2009 at 11:09:47AM -0500, Victor Duchovni wrote: > On Mon, Dec 21, 2009 at 10:58:40AM -0500, Carlos Williams wrote: > > And lastly, do I need this parameter in my main.cf: > > > > smtp_use_tls = yes > > No, you should stop setting it. It is obsolete, and superceded by > smtpd_tls_security_level. Oops, perhaps the OP needed smtp_tls_security_level to replace this? -- Offlist mail to this address is discarded unless "/dev/rob0" or "not-spam" is in Subject: header
From: Victor Duchovni on 21 Dec 2009 12:05
On Mon, Dec 21, 2009 at 10:53:57AM -0600, /dev/rob0 wrote: > On Mon, Dec 21, 2009 at 11:09:47AM -0500, Victor Duchovni wrote: > > On Mon, Dec 21, 2009 at 10:58:40AM -0500, Carlos Williams wrote: > > > And lastly, do I need this parameter in my main.cf: > > > > > > smtp_use_tls = yes > > > > No, you should stop setting it. It is obsolete, and superceded by > > smtpd_tls_security_level. > > Oops, perhaps the OP needed smtp_tls_security_level to replace this? Yes, sorry, the rest of OP's message was about smtpd(8), failed to notice this was smtp(8). Yes: smtp_tls_security_level = may -- Viktor. Disclaimer: off-list followups get on-list replies or get ignored. Please do not ignore the "Reply-To" header. To unsubscribe from the postfix-users list, visit http://www.postfix.org/lists.html or click the link below: <mailto:majordomo(a)postfix.org?body=unsubscribe%20postfix-users> If my response solves your problem, the best way to thank me is to not send an "it worked, thanks" follow-up. If you must respond, please put "It worked, thanks" in the "Subject" so I can delete these quickly. |