[Ach] Applied Crypto PDF - postfix config

[szebi]

Hi Thorsten,

yes, I encountered this also yesterday evening.

Additionally, I think we should give advice which options one should to
/add/// to the smtps and submission lines. There are usually good
defaults in master.cf (smtpd_tls_security_level=encrypt is default for
submission in 2.9.6).
Furthermore I think it is better readable if we replace '587' by
'submission' in the conf for master.cf.

@Thorsten, which OS and OpenSSL-Version did you use to test the
settings? I'd like to integrate this in the 'tested with versions' section.

regards,
Sebastian

On 02/12/2014 03:54 PM, crypto at la-system.com wrote:
>
> Dear list,
>
> in chapter 2.3.4 Postfix is may be a false option for the MSA config
> written.
>
> It states this line:
> "587 inet n - - - - smtpd
> -o smtpd_tls_security_level=encrypt -o tls_preempt_cipherlist = yes"
>
> In an old postfix version 2.7.0 I get this error:
>
> Feb 12 11:58:04 localhost postfix/master[17751]: daemon started --
> version 2.7.0, configuration /etc/postfix
> Feb 12 11:58:40 localhost postfix/smtpd[17774]: fatal: invalid "-o
> tls_preempt_cipherlist" option value: missing '=' after attribute name
>
>
> Removing the spaces before and after "=" will fix this in that
> version. (-o tls_preempt_cipherlist=yes) will work instead.
>
> Best Regards,
> Thorsten
>
>
> _______________________________________________
> Ach mailing list
> Ach at lists.cert.at
> http://lists.cert.at/cgi-bin/mailman/listinfo/ach

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 901 bytes
Desc: OpenPGP digital signature
URL: <http://lists.cert.at/pipermail/ach/attachments/20140212/e7edb900/attachment.sig>