Skip to content

Remove MTA-STS daemon#488

Merged
link2xt merged 1 commit intomainfrom
link2xt/remove-mta-sts-daemon
Feb 16, 2025
Merged

Remove MTA-STS daemon#488
link2xt merged 1 commit intomainfrom
link2xt/remove-mta-sts-daemon

Conversation

@link2xt
Copy link
Copy Markdown
Contributor

@link2xt link2xt commented Feb 16, 2025

Closes #202

Outgoing connections now default to verify level. See http://www.postfix.org/postconf.5.html#smtp_tls_security_level for possible levels and check that I selected the correct level.

For incoming connections we do not enforce anything as it does not increase security.

smtp_tls_security_level=verify
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtp_tls_policy_maps = socketmap:inet:127.0.0.1:8461:postfix
smtp_tls_policy_maps = inline:{ nauta.cu = may }
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nauta.cu has no STARTTLS, but we still want to support communicating with it

@link2xt link2xt force-pushed the link2xt/remove-mta-sts-daemon branch from 76f8c34 to efdd6d7 Compare February 16, 2025 18:47
@link2xt link2xt marked this pull request as ready for review February 16, 2025 18:59
@link2xt link2xt requested review from hpk42 and missytake February 16, 2025 19:09
@link2xt
Copy link
Copy Markdown
Contributor Author

link2xt commented Feb 16, 2025

Tested by deploying to CI server, it works.

Copy link
Copy Markdown
Contributor

@missytake missytake left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great :)

@link2xt link2xt merged commit 667a987 into main Feb 16, 2025
@link2xt link2xt deleted the link2xt/remove-mta-sts-daemon branch February 16, 2025 20:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Replace MTA-STS checking with strict TLS policy

2 participants