Welcome! Log In Create A New Profile

Advanced

Re: SMTP proxy with "STARTTLS only" accepts unencrypted mail

Maxim Dounin
June 04, 2019 09:50AM
Hello!

On Mon, Jun 03, 2019 at 10:16:20PM +0200, Marcus wrote:

> I try to use NGiNX 1.10.3-1+deb9u2 (Debian 9 version) as SMTP proxy in
> front of a postfix server. I defined one server that should accept
> encrypted connections only. Therefore I set "starttls only".
>
> But this server accepts plaintext mails also. If I use telnet to test
> the proxy it provides STARTTLS but I can relay a mail without using it.

Currently, "starttls" is only enforced for authentication, but not
for non-authenticated mail delivery, as with "smtp_auth none" in
your config. If you want to reject all non-encrypted
non-authenticated mail delivery, you can do so using an auth_http
script.

Recently discussed here:

http://mailman.nginx.org/pipermail/nginx-devel/2019-March/011970.html

--
Maxim Dounin
http://mdounin.ru/
_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx
Subject Author Posted

SMTP proxy with "STARTTLS only" accepts unencrypted mail

Marcus June 03, 2019 04:18PM

Re: SMTP proxy with "STARTTLS only" accepts unencrypted mail

Maxim Dounin June 04, 2019 09:50AM

Re: SMTP proxy with "STARTTLS only" accepts unencrypted mail

Marcus June 05, 2019 03:08PM

Re: SMTP proxy with "STARTTLS only" accepts unencrypted mail

itpp2012 June 05, 2019 04:37PM



Sorry, only registered users may post in this forum.

Click here to login

Online Users

Guests: 75
Record Number of Users: 6 on February 13, 2018
Record Number of Guests: 421 on December 02, 2018
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready