Re: Disabling SSLv2 does not work as expected

2011-09-05 Thread /dev/rob0
On Friday 02 September 2011 12:25:55 Michael B Allen wrote: On Fri, Sep 2, 2011 at 12:41 PM, Wietse Venema wie...@porcupine.org wrote: Michael B Allen: I am using postfix 2.3 on CentOS and I would like to disable SSLv2. If I do the following: ... I have to stick to the CentOS package so

Re: Disabling SSLv2 does not work as expected

2011-09-05 Thread Michael B Allen
On Fri, Sep 2, 2011 at 10:19 PM, Noel Jones njo...@megan.vbhcs.org wrote: On 9/2/2011 2:17 PM, Michael B Allen wrote: My objectives are not driven by or based on logic. They are based on the requirements of a consortium of credit card companies and banks. Do they require you to offer STARTTLS

Re: Disabling SSLv2 does not work as expected

2011-09-05 Thread Noel Jones
On 9/5/2011 10:50 AM, Michael B Allen wrote: On Fri, Sep 2, 2011 at 10:19 PM, Noel Jones njo...@megan.vbhcs.org wrote: On 9/2/2011 2:17 PM, Michael B Allen wrote: My objectives are not driven by or based on logic. They are based on the requirements of a consortium of credit card companies and

Re: Disabling SSLv2 does not work as expected

2011-09-05 Thread Michael B Allen
On Mon, Sep 5, 2011 at 12:07 PM, Noel Jones njo...@megan.vbhcs.org wrote: On 9/5/2011 10:50 AM, Michael B Allen wrote: On Fri, Sep 2, 2011 at 10:19 PM, Noel Jones njo...@megan.vbhcs.org wrote: On 9/2/2011 2:17 PM, Michael B Allen wrote: My objectives are not driven by or based on logic. They

Re: Disabling SSLv2 does not work as expected

2011-09-05 Thread Noel Jones
On 9/5/2011 11:19 AM, Michael B Allen wrote: On Mon, Sep 5, 2011 at 12:07 PM, Noel Jones njo...@megan.vbhcs.org wrote: On 9/5/2011 10:50 AM, Michael B Allen wrote: On Fri, Sep 2, 2011 at 10:19 PM, Noel Jones njo...@megan.vbhcs.org wrote: On 9/2/2011 2:17 PM, Michael B Allen wrote: My

Re: Disabling SSLv2 does not work as expected

2011-09-05 Thread Michael B Allen
On Mon, Sep 5, 2011 at 12:32 PM, Noel Jones njo...@megan.vbhcs.org wrote: On 9/5/2011 11:19 AM, Michael B Allen wrote: On Mon, Sep 5, 2011 at 12:07 PM, Noel Jones njo...@megan.vbhcs.org wrote: Or separate your mail and https servers to different IP addresses so it's not the same server. This

Disabling SSLv2 does not work as expected

2011-09-02 Thread Michael B Allen
Hello, I am using postfix 2.3 on CentOS and I would like to disable SSLv2. If I do the following: smtpd_tls_mandatory_protocols = SSLv3, TLSv1 smtpd_tls_mandatory_ciphers = medium, high but despite the fact that this configuration has been posted and reposted about the WWW, it does not actually

Re: Disabling SSLv2 does not work as expected

2011-09-02 Thread Brian Evans - Postfix List
On 9/2/2011 12:28 PM, Michael B Allen wrote: Hello, I am using postfix 2.3 on CentOS and I would like to disable SSLv2. If I do the following: smtpd_tls_mandatory_protocols = SSLv3, TLSv1 smtpd_tls_mandatory_ciphers = medium, high but despite the fact that this configuration has been

Re: Disabling SSLv2 does not work as expected

2011-09-02 Thread Wietse Venema
Michael B Allen: Hello, I am using postfix 2.3 on CentOS and I would like to disable SSLv2. If I do the following: smtpd_tls_mandatory_protocols = SSLv3, TLSv1 smtpd_tls_mandatory_ciphers = medium, high This is for mandatory TLS. If I add smtpd_tls_security_level = encrypt it then

Re: Disabling SSLv2 does not work as expected

2011-09-02 Thread Michael B Allen
On Fri, Sep 2, 2011 at 12:41 PM, Wietse Venema wie...@porcupine.org wrote: Michael B Allen: Hello, I am using postfix 2.3 on CentOS and I would like to disable SSLv2. If I do the following: smtpd_tls_mandatory_protocols = SSLv3, TLSv1 smtpd_tls_mandatory_ciphers = medium, high This is

Re: Disabling SSLv2 does not work as expected

2011-09-02 Thread Brian Evans - Postfix List
On 9/2/2011 1:25 PM, Michael B Allen wrote: Hi Wietse, But it seems the smtpd_tls_protocols/ciphers directives are specific to 2.6? Is there any way to disable SSLv2 in postfix 2.3? I have to stick to the CentOS package so that I get updates. There are alternative packages to the CentOS 5

Re: Disabling SSLv2 does not work as expected

2011-09-02 Thread Wietse Venema
Michael B Allen: On Fri, Sep 2, 2011 at 12:41 PM, Wietse Venema wie...@porcupine.org wrote: Michael B Allen: Hello, I am using postfix 2.3 on CentOS and I would like to disable SSLv2. If I do the following: smtpd_tls_mandatory_protocols = SSLv3, TLSv1 smtpd_tls_mandatory_ciphers =

Re: Disabling SSLv2 does not work as expected

2011-09-02 Thread Michael B Allen
On Fri, Sep 2, 2011 at 1:51 PM, Wietse Venema wie...@porcupine.org wrote: Michael B Allen: On Fri, Sep 2, 2011 at 12:41 PM, Wietse Venema wie...@porcupine.org wrote: Michael B Allen: Hello, I am using postfix 2.3 on CentOS and I would like to disable SSLv2. If I do the following:

Re: Disabling SSLv2 does not work as expected

2011-09-02 Thread Wietse Venema
Michael B Allen: BTW, Postfix 2.3 was developed in 2005, released in 2006, and support was terminated in 2009. This is off-topic but you may know that CentOS (which is RedHat repackaged without the branding) backports all fixes. Meaning an issue identified in 2.6 would be addressed as a

Re: Disabling SSLv2 does not work as expected

2011-09-02 Thread Stan Hoeppner
On 9/2/2011 3:49 PM, Wietse Venema wrote: Michael B Allen: BTW, Postfix 2.3 was developed in 2005, released in 2006, and support was terminated in 2009. This is off-topic but you may know that CentOS (which is RedHat repackaged without the branding) backports all fixes. Meaning an issue

Re: Disabling SSLv2 does not work as expected

2011-09-02 Thread Joe
On 09/02/2011 02:41 PM, Stan Hoeppner wrote: Red Hat is a commercial distro. They will always do things differently, things that seem strange and sometimes simply stupid to the rest of us. Which is one of the many reasons I don't use a commercial distro. Red Hat cherry picks patches from

Re: Disabling SSLv2 does not work as expected

2011-09-02 Thread Noel Jones
On 9/2/2011 2:17 PM, Michael B Allen wrote: My objectives are not driven by or based on logic. They are based on the requirements of a consortium of credit card companies and banks. Do they require you to offer STARTTLS on port 25? ISTR that they don't; I think they only require that if TLS is