We have a few people using programs (mostly MS crap) that insist on
older versions of SSL rather than tls.
Internally this works okay but externally ssl gets bounced by my grey
listing. This seems to indicate that it is not actually authenticating
right but allowing it to pass internally because its on the network and
the port is open.
Does anyone know what I might be missing here?
smtpd_use_tls = yes
smtpd_tls_cert_file = /etc/postfix/certs/smtp.marlboro.edu.pem
smtpd_tls_key_file = /etc/postfix/certs/smtp.marlboro.edu.key
smtpd_sasl_auth_enable = yes
broken_sasl_auth_clients = yes
smtpd_tls_auth_only = yes
# Some basic UCE stuff
smtpd_helo_restrictions =
permit_mynetworks,
# warn_if_reject,
reject_non_fqdn_hostname,
# warn_if_reject,
reject_invalid_hostname,
permit
smtpd_sender_restrictions =
permit_sasl_authenticated,
permit_mynetworks,
# warn_if_reject,
reject_non_fqdn_sender,
# warn_if_reject,
reject_unknown_sender_domain,
permit
smtpd_recipient_restrictions =
check_recipient_access regexp:/etc/postfix/recipient_access,
permit_mynetworks,
permit_sasl_authenticated,
reject_unauth_destination,
check_helo_access hash:/etc/postfix/helo_checks,
# uncommenting the following _hostname check --iank 92006
reject_non_fqdn_hostname,
reject_non_fqdn_sender,
reject_unknown_sender_domain,
reject_unlisted_recipient
check_policy_service inet:127.0.0.1:10031
permit
smtpd_data_restrictions =
reject_unauth_pipelining,
permit
--
John Baker
Network Systems Administrator
Marlboro College
Phone: 451-7551 off campus; 551 on campus
