Reputation
486
Top tag
Next privilege 500 Rep.
Access review queues
Badges
4 18
Impact
~28k people reached

May
12
awarded  Notable Question
Apr
24
comment Do you need separate ipv4 and ipv6 listen directives in nginx?
Yes, that's the same as I mentioned about deferred, and other per-protocol directives. It would be useful if they could be specified separately from the listen directive for the reason you say.
Feb
26
comment Postfix - Host or domain not found
It's not the connection that fails, but the DNS lookup that precedes it. When I have inet_protocols = all it does not attempt an A lookup if an AAAA lookup fails, which seems pointless. Also, if you change this value, you must restart postfix, not just reload.
Feb
7
awarded  Popular Question
Jan
26
comment Can OpenSSL be used to debug an SSL connection to a MySQL server?
This is the same as how SMTP works when you use STARTTLS, and it also permits you to use encrypted and unencrypted connectiosn on the same port.
Jan
22
comment Prevent postfix appending search domain
@localyodel that sounds like a great idea, you should probably post that as an answer!
Dec
30
accepted Perfect Forward Secrecy (PFS) for mail servers
Dec
30
comment Perfect Forward Secrecy (PFS) for mail servers
Great stats, nice article too, thanks! The "Don't restrict yourself unnecessarily" is the problem - just as with browsers, you can't just disable everything that's considered bad because you might find that you've cut off something critical, but it's hard to tell what that something is. For the German legal example, requiring PFS would mean cutting off 15% of the 60% of servers that support TLS. One key stat from your article is that SSLv3 be disabled without any major deliverability impact.
Dec
19
revised
added 88 characters in body
Dec
19
awarded  Tag Editor
Dec
19
revised
added 67 characters in body
Dec
19
wiki
Dec
19
wiki
Dec
19
suggested approved edit on
Dec
19
suggested approved edit on
Dec
19
comment Perfect Forward Secrecy (PFS) for mail servers
I know that, and it's what I'm doing, but I don't want to harden it to the point that popular clients can't connect. Where that point is is currently unknown, hence the question.
Dec
19
comment Perfect Forward Secrecy (PFS) for mail servers
I know it is in servers, but it's generally not in clients, and it's still interesting to know for default server configs since that's what most will be using.
Dec
19
revised Perfect Forward Secrecy (PFS) for mail servers
added 520 characters in body
Dec
19
comment Perfect Forward Secrecy (PFS) for mail servers
That's useful info, but it's sort of the wrong way around. I'm not looking to interrogate a specific server, but to assess support for all these ciphers across many different servers and clients, i.e. find someone that has applied these tests to a large number of different servers.
Dec
19
awarded  Yearling