Re: SSLv2 and encryption for PCI compliance

2009-07-27 Thread Noel Jones
Bastian Blank wrote: On Mon, Jul 27, 2009 at 08:03:20AM -0400, Wietse Venema wrote: Jake Vickers: Now I know I posted the other day about disabling SSLv2, but if I add That solution was for MANDATORY TLS encryption. If TLS is not mandatory, then disabling SSLv2 is pointless: you allow plaintex

Re: SSLv2 and encryption for PCI compliance

2009-07-27 Thread Bastian Blank
On Mon, Jul 27, 2009 at 08:03:20AM -0400, Wietse Venema wrote: > Jake Vickers: > > Now I know I posted the other day about disabling SSLv2, but if I add > That solution was for MANDATORY TLS encryption. If TLS is not mandatory, > then disabling SSLv2 is pointless: you allow plaintext email. I don

Re: SSLv2 and encryption for PCI compliance

2009-07-27 Thread Wietse Venema
Jake Vickers: > Now I know I posted the other day about disabling SSLv2, but if I add That solution was for MANDATORY TLS encryption. If TLS is not mandatory, then disabling SSLv2 is pointless: you allow plaintext email. But if it gives someone warm fuzzies, you can use smtpd_tls_protocols inste

SSLv2 and encryption for PCI compliance

2009-07-27 Thread Jake Vickers
I'm pulling my hair out with this one. I need to make the server PCI compliant and we are still failing the test because we accept SSLv2 connections. I'm running Postfix 2.5.1 on a Fedora machine, and here is my postconf: $ postconf -n alias_database = hash:/etc/aliases alias_maps = hash:/etc/