Tag Info

Hot answers tagged

9

There is no difference in the security between the two options. SSL/TLS opens an SSL/TLS connection first, then begins the SMTP transaction. This must occur on a port that does not have a non-SSL/TLS SMTP server already running; it is impossible to configure a single port to handle both plain text and encrypted connections due to the nature of the ...


7

Don't bother with sniffing the network connection; as @voretaq7 explained, you can't. Instead, have postfix log the connection by adding the IP address of the remote SMTP server to debug_peer_list. And if that doesn't get you enough detail to understand what's going on, you can set smtp_tls_loglevel 4 to get a complete dump of everything that went over the ...


6

Check your logs. (Or run the OpenLDAP clients in Verbose mode and they will tell you if they're using SSL.) Don't trust your logs/clients. (Run wireshark or something similar and verify the traffic.)


4

Allow me to rephrase your question: I want to stick something in the middle of an TLS-encrypted connection that shows me the cleartext that's being sent. . . . Well it wouldn't be very secure now, would it? I mean the whole point of TLS is to prevent exactly what you're trying to do! -- So no, what you're asking for is NOT possible, nor is it ...


4

Is it so that once this certificate is accepted, it is impossible to do a man in the middle attack. For somebody to make use of this public self signed SSL certificate they also need a private key that the mail server keeps? That is correct. An attacker cannot fake being the remote server unless they have the private key that matches what the client is ...


3

Not feasible. HTTP and HTTPS are two distinct services which behave in markedly different ways (despite the naming and payload being similar). Unique services must bind to unique ports to enable client and server to communicate in a language both understand. To accomplish this you would need to have a client that would connect to the port, negotiate which ...


3

You should strongly consider getting a free SSL Cert if you control the domain. There are a couple provides of free certs. The "accepted" cert in Thunderbird pairs the hostname by which you referenced the server with the thumbprint of the certificate. So a MITM attack would be nigh impossible without solving the DL Problem. This assumes you picked a ...


2

The recipe mentions smtp_use_tls but you have set smtpd_use_tls. http://mhawthorne.net/posts/postfix-configuring-gmail-as-relay.html Troubleshooting / 1. No TLS


2

At the bottom of your config file, you have smtpd_tls_security_level = encrypt, this requires all inbound SMTP clients to use TLS. If the inbound client doesn't support TLS, then the connection will fail. (This seems likely to be the case for gmx.net, given the error message.) If you set smtpd_tls_security_level = may, then you should be able to get email ...


2

What you're wishing for is STARTTLS for HTTP. This is actually proposed by RFC 2817, which was written in what is now Ye Olden Days of Yon Internete. I found some quick references that suggested that both Apache and lighthttpd support this, but further research is disappointing for lighttpd — sorry about that. Here's the documentation for setting it up with ...


2

Perhaps the rails app doesn't trust the postfix certificate?


2

From: http://www.postfix.org/TLS_README.html ... Server-side TLS activity logging ... Use log level 3 only in case of problems. more... To get additional information about Postfix SMTP server TLS activity you can increase the log level from 0..4. Each logging level also includes the information that is logged at a lower logging level. Level Postfix ...


2

Google Mail's SMTP server is requiring you to connect with TLS, but you have configured fetchmail to never use TLS. Check your fetchmail command line and configuration file for sslproto and make sure it is set to TLS1. On the command line: --sslproto TLS1 In the conf file: sslproto TLS1 See the fetchmail documentation for more on configuring SSL/TLS. ...


2

You have declared that all tls connections must have a strength of 256. You have not declared anything about other types of connections. Perhaps you wanted security minssf=256? man slapd.conf sections sasl-secprops and security for more information.


2

Short version: Use TLS_Rcpt access table entries. to specify per recipient's domain requirements. TLS_Rcpt:fooexample.com ENCR:112` Full version: 0) TLS_Clt is for incoming connections. Use TLS_Srv for outgoing connections 1) Sendmail looks for TLS_Srv access table entries based on $&{server_name} first and $&{server_addr} later. 2) ...


1

I figured out that the problem has been, that I've been cn=config-style configuration format (I've been aware of that), but I thought /etc/ldap/slapd.conf would be used too. With the additional entry olcSecurity: tls=128 in /etc/ldap/slapd.d/cn=config.ldif everything works like expected.


1

TLS is very safe and in some ways more "flexible" then SSL since the standard application ports can be used in duel-mode (with and/or without TLS) in a lot of configurations. The first thing that takes place after the initial application port connect is the TLS negotiation where both sides figure out if they are both TLS capable, if so TLS negotiation ...


1

Assuming you already have a cert installed, Create an additional Send Connector specify the domains that require TLS in the Address Space section of the send connector check the "Enable Domain Security (Mutual Auth TLS)" checkbox in the Network section of the new Send Connector That checkbox ensures that TLS must be supported on the remote end, or ...


1

Your test is wrong. You have not given openssl any trusted CAs. Your CApath may vary, but you'll need to issue something like this: openssl s_client -showcerts -connect smtp.domain.tld:465 -CApath /etc/ssl/certs Edit: I gather from your comment that you don't get it, so let's try this again without even bothering with smtp shall we? This will ensure ...



Only top voted, non community-wiki answers of a minimum length are eligible