From: Grant <emailgrant@gmail.com>
To: gentoo-user@lists.gentoo.org
Subject: Re: [gentoo-user] clamav and spamassassin
Date: Tue, 6 Dec 2011 17:02:38 -0800 [thread overview]
Message-ID: <CAN0CFw08bQ-x3fB1+XhNMKgiuMt5v0N1Mycze8-yPbi3scAr+Q@mail.gmail.com> (raw)
In-Reply-To: <4EDE952C.4080202@orlitzky.com>
> SMTPS is deprecated. You probably don't need it at all, unless you do. Some
> older (Microsoft...) clients can't use anything else for encryption.
>
> These days, the "proper" way to secure your users' connections is with TLS
> on the submission port, 587. You should also have a commented-out
> 'submission' line in your master.cf; that's what it's for.
>
> The idea is that you can force encryption on port 587, and have your users
> connect there instead of port 25. Then, the only restriction you need for
> those connections is that the username/password be correct. The rest of the
> mail comes in on port 25, unencrypted, as usual, and is subjected to your
> anti-spam checks.
>
> If you're using either SMTPS or the submission service, you don't need to
> change them. Your users will continue to connect to port 465 (smtps) or 587
> (submission), bypassing postscreen entirely.
>
> If you're not using the submission service, i.e. both external and
> user-submitted mail come in on port 25, then you'll probably want to exempt
> your users from the postscreen restrictions:
>
> http://www.postfix.org/postconf.5.html#postscreen_access_list
>
> but you should really be using the submission port!
Aye aye. Should I make the change like this:
#smtps inet n - n - - smtpd
# -o smtpd_tls_wrappermode=yes
submission inet n - n - - smtpd
-o smtpd_tls_security_level=encrypt
# -o smtpd_sasl_auth_enable=yes
# -o smtpd_client_restrictions=permit_sasl_authenticated,reject
# -o milter_macro_daemon_name=ORIGINATING
And then switch my clients from port 465 to 587?
- Grant
next prev parent reply other threads:[~2011-12-07 1:04 UTC|newest]
Thread overview: 37+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-12-03 19:52 [gentoo-user] clamav and spamassassin Grant
2011-12-03 22:54 ` Michael Orlitzky
2011-12-04 0:59 ` Grant
2011-12-04 1:35 ` Michael Orlitzky
2011-12-04 1:57 ` Grant
2011-12-04 2:10 ` Michael Orlitzky
2011-12-04 1:59 ` Pandu Poluan
2011-12-04 2:17 ` Michael Orlitzky
2011-12-04 2:48 ` Pandu Poluan
2011-12-04 3:06 ` Michael Orlitzky
2011-12-04 8:27 ` Pandu Poluan
2011-12-06 0:15 ` Grant
2011-12-06 0:45 ` Pandu Poluan
2011-12-06 0:52 ` Michael Orlitzky
2011-12-06 1:01 ` Pandu Poluan
2011-12-06 1:14 ` Michael Orlitzky
2011-12-06 3:24 ` Grant
2011-12-06 4:43 ` Michael Orlitzky
2011-12-06 16:32 ` Grant
2011-12-06 17:11 ` Michael Orlitzky
2011-12-06 19:17 ` Paul Hartman
2011-12-07 0:16 ` Pandu Poluan
2011-12-06 21:34 ` Grant
2011-12-06 22:20 ` Michael Orlitzky
2011-12-07 1:02 ` Grant [this message]
2011-12-07 16:38 ` Michael Orlitzky
2011-12-07 18:16 ` Grant
2011-12-07 18:56 ` Michael Orlitzky
2011-12-07 19:00 ` Michael Orlitzky
2011-12-08 0:49 ` Grant
2011-12-07 9:15 ` Pandu Poluan
2011-12-07 16:01 ` Grant
2011-12-07 16:47 ` Pandu Poluan
2011-12-07 0:57 ` Grant
2011-12-07 1:11 ` Pandu Poluan
2011-12-07 16:34 ` Michael Orlitzky
2011-12-07 18:08 ` Grant
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAN0CFw08bQ-x3fB1+XhNMKgiuMt5v0N1Mycze8-yPbi3scAr+Q@mail.gmail.com \
--to=emailgrant@gmail.com \
--cc=gentoo-user@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox