1 |
> SMTPS is deprecated. You probably don't need it at all, unless you do. Some |
2 |
> older (Microsoft...) clients can't use anything else for encryption. |
3 |
> |
4 |
> These days, the "proper" way to secure your users' connections is with TLS |
5 |
> on the submission port, 587. You should also have a commented-out |
6 |
> 'submission' line in your master.cf; that's what it's for. |
7 |
> |
8 |
> The idea is that you can force encryption on port 587, and have your users |
9 |
> connect there instead of port 25. Then, the only restriction you need for |
10 |
> those connections is that the username/password be correct. The rest of the |
11 |
> mail comes in on port 25, unencrypted, as usual, and is subjected to your |
12 |
> anti-spam checks. |
13 |
> |
14 |
> If you're using either SMTPS or the submission service, you don't need to |
15 |
> change them. Your users will continue to connect to port 465 (smtps) or 587 |
16 |
> (submission), bypassing postscreen entirely. |
17 |
> |
18 |
> If you're not using the submission service, i.e. both external and |
19 |
> user-submitted mail come in on port 25, then you'll probably want to exempt |
20 |
> your users from the postscreen restrictions: |
21 |
> |
22 |
> http://www.postfix.org/postconf.5.html#postscreen_access_list |
23 |
> |
24 |
> but you should really be using the submission port! |
25 |
|
26 |
Aye aye. Should I make the change like this: |
27 |
|
28 |
#smtps inet n - n - - smtpd |
29 |
# -o smtpd_tls_wrappermode=yes |
30 |
submission inet n - n - - smtpd |
31 |
-o smtpd_tls_security_level=encrypt |
32 |
# -o smtpd_sasl_auth_enable=yes |
33 |
# -o smtpd_client_restrictions=permit_sasl_authenticated,reject |
34 |
# -o milter_macro_daemon_name=ORIGINATING |
35 |
|
36 |
And then switch my clients from port 465 to 587? |
37 |
|
38 |
- Grant |