On Fri, Jul 15, 2016 at 10:25:43PM -0700, Michael Fox wrote: > I'd like to be able to reject mail that contains encrypted content. > This is to satisfy US FCC rules against encrypted content on > amateur radio frequencies. Some of our clients may connect via > amateur radio.
I think you're taking it too far. Consider that the regulation was written by someone, and then ratified by a group, not one of whom had ever heard of GPG. For that matter, the regulation probably did not anticipate packet radio use for IP traffic. Surely they were only thinking about scrambled radio voice traffic. You have already discarded STARTTLS from your EHLO reply for packet radio clients, and I think even that is going a bit too far. If your interpretation of these FCC rules is accurate, you really can't offer any kind of connection to the Internet in any way, even indirect. You can't possibly anticipate all kinds of cryptography and steganography. Israel's then-future-king David, and his friend, then Prince Jonathan, cooked up and employed an encryption scheme in the Old Testament. If your interpretation stands, you cannot allow anyone to say in email, "... is not the arrow beyond thee?" (KJV, 1 Samuel 20:37.) That could contain a hidden message. Don't let them push you down this slippery slope. If you are really worried about it, call the FCC or a private attorney and get a solid interpretation. > I'd like to be able to restrict it only for certain clients. But, > as I understand it, header checks can only be applied globally, to > all mail. [OOTC: obligatory on-topic content] Yes, but you can use an alternate cleanup service on an alternate smtpd instance, see postconf.5.html#cleanup_service_name and also cleanup.8.html . > Sorry if this is a dumb question. But, unfortunately, I don't > have any experience with encrypted mail. From what I've read, > I'm thinking I need: > > main.cf: > > mime_header_checks = pcre:${config_directory}/mime_header_checks.pcre > > > mime_header_checks.pcre: > > # Block encrypted mail > /^Content-Type\:.*multipart\/encrypted/ REJECT Encrypted > content not allowed > > > > Is that sufficient? No. What about inline PGP/GPG messages? What about encrypted messages hidden inside image or audio files? [/OOTC] > Any better ideas or other issues to consider? Don't do it. See above. -- http://rob0.nodns4.us/ Offlist GMX mail is seen only if "/dev/rob0" is in the Subject: