beenull/power-mailinabox
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

avoid mail.log warnings about untrusted certificates on outgoing mail, fixes #124

Browse source
This commit is contained in:
Joshua Tauberer 2014-08-02 15:39:47 +00:00
parent 6a512042dc
commit b86656243f
1 changed files with 15 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
setup/mail-postfix.sh
View file

@ -31,7 +31,7 @@ source /etc/mailinabox.conf # load global vars
# Install packages.
apt_install postfix postgrey postfix-pcre
apt_install postfix postgrey postfix-pcre ca-certificates
# Basic Settings
@ -75,15 +75,27 @@ tools/editconf.py /etc/postfix/main.cf \
smtpd_tls_received_header=yes
# When connecting to remote SMTP servers, prefer TLS and use DANE if available.
# Postfix queries for the TLSA record on the destination MX host. If no TLSA records are found,
#
# Prefering ("opportunistic") TLS means Postfix will accept whatever SSL certificate the remote
# end provides, if the remote end offers STARTTLS during the connection. DANE takes this a
# step further:
#
# Postfix queries DNS for the TLSA record on the destination MX host. If no TLSA records are found,
# then opportunistic TLS is used. Otherwise the server certificate must match the TLSA records
# or else the mail bounces. TLSA also requires DNSSEC on the MX host. Postfix doesn't do DNSSEC
# itself but assumes the system's nameserver does and reports DNSSEC status. Thus this also
# relies on our local bind9 server being present and smtp_dns_support_level being set to dnssec
# to use it.
#
# The smtp_tls_CAfile is superflous, but it turns warnings in the logs about untrusted certs
# into notices about trusted certs. Since in these cases Postfix is doing opportunistic TLS,
# it does not care about whether the remote certificate is trusted. But, looking at the logs,
# it's nice to be able to see that the connection was in fact encrypted for the right party.
# The CA file is provided by the package ca-certificates.
tools/editconf.py /etc/postfix/main.cf \
smtp_tls_security_level=dane \
smtp_dns_support_level=dnssec \
smtp_tls_CAfile=/etc/ssl/certs/ca-certificates.crt \
smtp_tls_loglevel=2
# Incoming Mail
@ -137,4 +149,4 @@ ufw_allow submission
# Restart services
restart_service postfix
restart_service postfix