postfix enable submission port using starttls, so the client can transition to the more restrictive TLS wrapper mode

2013-08-31T12:33:53+00:00

Change-Id: I2a1728788378d9a1b79155ddb9bb4b0464b16baa

Make TLS-required smtps (465) be port for sending SMTP. This is preferred over 25 because that is typically blocked, and we cannot force TLS on that port due to other MTAs not being configured for this century. We don't use submission (568) because that uses STARTTLS, and the STARTTLS banner can easily be stripped by an adversary. (#3604)

2013-08-29T20:15:24+00:00

. enable smtps (port 465) for client submission over TLS, and require that TLS is enabled
. add 465 to the allowed open ports in the firewall
. change the smtp-service.json to use 465 instead of 25

note: I did not use the 'use_smtps' parameter that is available in the postfix
class because it added some options that we do not want/need.

Change-Id: I0040eb2dff6008a1c830d59df9963eb83dc9ea02

shorewall rules for site_mx

2013-07-25T17:45:10+00:00

leap_platform.git/puppet/modules/site_shorewall/manifests/mx.pp, branch 0.3.0rc1

postfix enable submission port using starttls, so the client can transition to the more restrictive TLS wrapper mode

shorewall rules for site_mx