From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from pigeon.gentoo.org ([208.92.234.80] helo=lists.gentoo.org) by finch.gentoo.org with esmtp (Exim 4.60) (envelope-from ) id 1RY5vy-0000lW-QI for garchives@archives.gentoo.org; Wed, 07 Dec 2011 01:04:31 +0000 Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id D720221C0F8; Wed, 7 Dec 2011 01:04:21 +0000 (UTC) Received: from mail-ee0-f53.google.com (mail-ee0-f53.google.com [74.125.83.53]) by pigeon.gentoo.org (Postfix) with ESMTP id E87A621C0F3 for ; Wed, 7 Dec 2011 01:02:38 +0000 (UTC) Received: by eekb57 with SMTP id b57so10797eek.40 for ; Tue, 06 Dec 2011 17:02:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type:content-transfer-encoding; bh=bXFxuu71CKIbh/0CU8LOuLuoceoVDDJb9DzzHed/lO8=; b=xQkx+PCgaw8jXKSYnbvuIOkJfEsrbgaOz6Y2miBv48H9T1bFDjQW842rM49NVRI4cU wS1R7MCUPeUPso8vXH0eMwms7ojHohzk4AJbQ0R5AwSLc233M2YFrVf7AQgEzykpfIjj syoeMC3NyfsURul6oGexMq022q09L4xsBaauQ= Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-user@lists.gentoo.org Reply-to: gentoo-user@lists.gentoo.org MIME-Version: 1.0 Received: by 10.14.12.78 with SMTP id 54mr3048377eey.150.1323219758130; Tue, 06 Dec 2011 17:02:38 -0800 (PST) Received: by 10.213.33.133 with HTTP; Tue, 6 Dec 2011 17:02:38 -0800 (PST) In-Reply-To: <4EDE952C.4080202@orlitzky.com> References: <4EDAA89F.3090308@orlitzky.com> <4EDAD845.4010402@orlitzky.com> <4EDD6749.8030301@orlitzky.com> <4EDD9D88.7080407@orlitzky.com> <4EDE4CC1.1000808@orlitzky.com> <4EDE952C.4080202@orlitzky.com> Date: Tue, 6 Dec 2011 17:02:38 -0800 Message-ID: Subject: Re: [gentoo-user] clamav and spamassassin From: Grant To: gentoo-user@lists.gentoo.org Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable X-Archives-Salt: 86d6ded5-7007-44f1-8b23-7cea70fcac51 X-Archives-Hash: a06e46dafab6215c6713f592a86cda73 > SMTPS is deprecated. You probably don't need it at all, unless you do. So= me > older (Microsoft...) clients can't use anything else for encryption. > > These days, the "proper" way to secure your users' connections is with TL= S > on the submission port, 587. You should also have a commented-out > 'submission' line in your master.cf; that's what it's for. > > The idea is that you can force encryption on port 587, and have your user= s > connect there instead of port 25. Then, the only restriction you need for > those connections is that the username/password be correct. The rest of t= he > mail comes in on port 25, unencrypted, as usual, and is subjected to your > anti-spam checks. > > If you're using either SMTPS or the submission service, you don't need to > change them. Your users will continue to connect to port 465 (smtps) or 5= 87 > (submission), bypassing postscreen entirely. > > If you're not using the submission service, i.e. both external and > user-submitted mail come in on port 25, then you'll probably want to exem= pt > your users from the postscreen restrictions: > > =A0http://www.postfix.org/postconf.5.html#postscreen_access_list > > but you should really be using the submission port! Aye aye. Should I make the change like this: #smtps inet n - n - - smtpd # -o smtpd_tls_wrappermode=3Dyes submission inet n - n - - smtpd -o smtpd_tls_security_level=3Dencrypt # -o smtpd_sasl_auth_enable=3Dyes # -o smtpd_client_restrictions=3Dpermit_sasl_authenticated,reject # -o milter_macro_daemon_name=3DORIGINATING And then switch my clients from port 465 to 587? - Grant