版本详细信息

Question 1

使用secure级别，您要求后缀验证收件人和服务器的关系，但在安全的方式（不依赖 DNS 数据）

它正确地启动值得信赖TLS 连接（证书由您了解/信任的 CA 签名）

然后它尝试安全验证服务器/收件人，如果有任何 CN/SAN 与 fastmail.fm 匹配 - 并且它们不匹配。因此该消息在本地队列中被延迟。

证书messagesingengine.com/gslb.phosted.com不保证他们接受的其他域名。facebook.com验证了自身。

您secure通过添加matchMX 进行了修改 - 这verify实际上是这样做的。因此，您可以下拉进行验证，或者继续添加匹配项。

smtp_tls_security_level

mayTLS？很好。没有 TLS？很好。
encrypt接受任何无效的服务器证书，要求加密。
verify接受受信任的服务器证书（我信任 CA 吗？CN 是否与 MX 匹配？），要求加密。
secure如果 CN/SAN 与收件人域匹配，则仅接受受信任的证书 - 并忽略不安全的 (MX) 信息进行验证。

这postfix 文档在解释差异时有些不清楚。

Answer

使用secure级别，您要求后缀验证收件人和服务器的关系，但在安全的方式（不依赖 DNS 数据）

它正确地启动值得信赖TLS 连接（证书由您了解/信任的 CA 签名）

然后它尝试安全验证服务器/收件人，如果有任何 CN/SAN 与 fastmail.fm 匹配 - 并且它们不匹配。因此该消息在本地队列中被延迟。

证书messagesingengine.com/gslb.phosted.com不保证他们接受的其他域名。facebook.com验证了自身。

您secure通过添加matchMX 进行了修改 - 这verify实际上是这样做的。因此，您可以下拉进行验证，或者继续添加匹配项。

smtp_tls_security_level

mayTLS？很好。没有 TLS？很好。
encrypt接受任何无效的服务器证书，要求加密。
verify接受受信任的服务器证书（我信任 CA 吗？CN 是否与 MX 匹配？），要求加密。
secure如果 CN/SAN 与收件人域匹配，则仅接受受信任的证书 - 并忽略不安全的 (MX) 信息进行验证。

这postfix 文档在解释差异时有些不清楚。

Question 2

在 /etc/postfix/main.cf 文件中你可以放置此指令：

smtp_tls_secure_cert_match = hostname, nexthop, dot-nexthop

将其放入 main.cf 将允许 DNS MX 记录中的主机名匹配被允许用于安全策略级别。这实际上只是将安全策略级别转换为验证策略级别，因此您不妨将 tls 策略级别更改为验证或更低级别。要回答您关于导致其失败的原因的问题，您的原始收件人是

[电子邮件保护]

当你设置 TLS 策略来保护控制变量时

smtp_tls_secure_cert_match（默认值：nexthop，dot-nexthop）

并且 nexthop 除非在传输表中有一个覆盖，否则将按照下面发布的 man 5 postconf 页面中讨论的那样确定。

下一跳域，可以是收件人域，也可以是为域配置的传输下一跳

该电子邮件地址的安全策略中的下一跳是fastmail.fmMX 记录中唯一的域名是消息引擎网站，在安全策略下它永远不会匹配。但是查看 fastmail.fm 的 MX 记录。

[[email protected] openssl]# host -t MX fastmail.fm
fastmail.fm mail is handled by 10 in1-smtp.messagingengine.com.
fastmail.fm mail is handled by 20 in2-smtp.messagingengine.com.

如果您放宽安全证书匹配指令以包含主机名（同样与 smtp_tls_security_level = verify 完全相同）证书将根据指向的 MX 记录进行验证in1-smtp.messagingengine.com匹配通用名称 *.messagingengine.com. 这也发生在[电子邮件保护]，我相信还有很多其他人，就像他们在 postconf 的 man 5 页中说的那样

smtp_tls_security_level (default: empty)
     verify Mandatory TLS verification. At this security level, DNS MX lookups are trusted to be secure enough, and the name verified in the server certificate is usually
          obtained  indirectly  via  unauthenticated  DNS  MX  lookups.  The  smtp_tls_verify_cert_match parameter controls how the server name is verified. In practice
          explicit control over matching is more common at the "secure" level, described below. This security level is not an appropriate default for systems delivering
          mail to the Internet.

     secure Secure-channel TLS.  At this security level, DNS MX lookups, though potentially used to determine the candidate next-hop gateway IP addresses, are not trusted
          to be secure enough for TLS peername verification. Instead, the default name verified in the server certificate is obtained from the next-hop domain as speci‐
          fied in the smtp_tls_secure_cert_match configuration parameter. The default matching rule is that a server certificate matches when its name is equal to or is
          a sub-domain of the nexthop domain. This security level is not an appropriate default for systems delivering mail to the Internet.

对于向互联网传递邮件的系统来说，此安全级别不是合适的默认级别。

然后它再次表明 tls 策略验证也是如此，但这就是它总是会失败的原因。

请参阅 postconf man5 页中上面引用的两个指令：

smtp_tls_secure_cert_match (default: nexthop, dot-nexthop)
   How the Postfix SMTP client verifies the server certificate peername for the "secure" TLS security level. In a  "secure"  TLS  policy  table  ($smtp_tls_policy_maps)
   entry the optional "match" attribute overrides this main.cf setting.

   This  parameter  specifies  one  or more patterns or strategies separated by commas, whitespace or colons.  In the policy table the only valid separator is the colon
   character.

   For a description of the pattern and strategy syntax see the smtp_tls_verify_cert_match parameter. The "hostname" strategy should be avoided in this context,  as  in
   the absence of a secure global DNS, using the results of MX lookups in certificate verification is not immune to active (man-in-the-middle) attacks on DNS.

   Sample main.cf setting:

       smtp_tls_secure_cert_match = nexthop

   Sample policy table override:

       example.net     secure match=example.com:.example.com
       .example.net    secure match=example.com:.example.com

   This feature is available in Postfix 2.3 and later.

它还引用了 smtp_tls_verify_cert_match 以便更好地理解

smtp_tls_verify_cert_match (default: hostname)
   How the Postfix SMTP client verifies the server certificate peername for the "verify" TLS security level. In a  "verify"  TLS  policy  table  ($smtp_tls_policy_maps)
   entry the optional "match" attribute overrides this main.cf setting.

   This  parameter  specifies  one  or more patterns or strategies separated by commas, whitespace or colons.  In the policy table the only valid separator is the colon
   character.

   Patterns specify domain names, or domain name suffixes:

   example.com
          Match the example.com domain, i.e. one of the names the server certificate must be example.com, upper and lower case distinctions are ignored.

   .example.com
          Match subdomains of the example.com domain, i.e. match a name in the server certificate that consists of a non-zero number of  labels  followed  by  a  .exam‐
          ple.com suffix. Case distinctions are ignored.

   Strategies specify a transformation from the next-hop domain to the expected name in the server certificate:

   nexthop
          Match  against  the next-hop domain, which is either the recipient domain, or the transport next-hop configured for the domain stripped of any optional socket
          type prefix, enclosing square brackets and trailing port. When MX lookups are not suppressed, this is the original nexthop domain prior to the MX lookup,  not
          the result of the MX lookup. For LMTP delivery via UNIX-domain sockets, the verified next-hop name is $myhostname.  This strategy is suitable for use with the
          "secure" policy. Case is ignored.

   dot-nexthop
          As above, but match server certificate names that are subdomains of the next-hop domain. Case is ignored.

   hostname
          Match against the hostname of the server, often obtained via an unauthenticated DNS MX lookup. For LMTP delivery via UNIX-domain sockets, the verified name is
          $myhostname.  This  matches the verification strategy of the "MUST" keyword in the obsolete smtp_tls_per_site table, and is suitable for use with the "verify"
          security level. When the next-hop name is enclosed in square brackets to suppress MX lookups, the "hostname" strategy is the same as the  "nexthop"  strategy.
          Case is ignored.

   Sample main.cf setting:

   smtp_tls_verify_cert_match = hostname, nexthop, dot-nexthop

   Sample policy table override:

   example.com     verify  match=hostname:nexthop
   .example.com    verify  match=example.com:.example.com:hostname

Answer

在 /etc/postfix/main.cf 文件中你可以放置此指令：

smtp_tls_secure_cert_match = hostname, nexthop, dot-nexthop

将其放入 main.cf 将允许 DNS MX 记录中的主机名匹配被允许用于安全策略级别。这实际上只是将安全策略级别转换为验证策略级别，因此您不妨将 tls 策略级别更改为验证或更低级别。要回答您关于导致其失败的原因的问题，您的原始收件人是

[电子邮件保护]

当你设置 TLS 策略来保护控制变量时

smtp_tls_secure_cert_match（默认值：nexthop，dot-nexthop）

并且 nexthop 除非在传输表中有一个覆盖，否则将按照下面发布的 man 5 postconf 页面中讨论的那样确定。

下一跳域，可以是收件人域，也可以是为域配置的传输下一跳

该电子邮件地址的安全策略中的下一跳是fastmail.fmMX 记录中唯一的域名是消息引擎网站，在安全策略下它永远不会匹配。但是查看 fastmail.fm 的 MX 记录。

[[email protected] openssl]# host -t MX fastmail.fm
fastmail.fm mail is handled by 10 in1-smtp.messagingengine.com.
fastmail.fm mail is handled by 20 in2-smtp.messagingengine.com.

如果您放宽安全证书匹配指令以包含主机名（同样与 smtp_tls_security_level = verify 完全相同）证书将根据指向的 MX 记录进行验证in1-smtp.messagingengine.com匹配通用名称 *.messagingengine.com. 这也发生在[电子邮件保护]，我相信还有很多其他人，就像他们在 postconf 的 man 5 页中说的那样

smtp_tls_security_level (default: empty)
     verify Mandatory TLS verification. At this security level, DNS MX lookups are trusted to be secure enough, and the name verified in the server certificate is usually
          obtained  indirectly  via  unauthenticated  DNS  MX  lookups.  The  smtp_tls_verify_cert_match parameter controls how the server name is verified. In practice
          explicit control over matching is more common at the "secure" level, described below. This security level is not an appropriate default for systems delivering
          mail to the Internet.

     secure Secure-channel TLS.  At this security level, DNS MX lookups, though potentially used to determine the candidate next-hop gateway IP addresses, are not trusted
          to be secure enough for TLS peername verification. Instead, the default name verified in the server certificate is obtained from the next-hop domain as speci‐
          fied in the smtp_tls_secure_cert_match configuration parameter. The default matching rule is that a server certificate matches when its name is equal to or is
          a sub-domain of the nexthop domain. This security level is not an appropriate default for systems delivering mail to the Internet.

对于向互联网传递邮件的系统来说，此安全级别不是合适的默认级别。

然后它再次表明 tls 策略验证也是如此，但这就是它总是会失败的原因。

请参阅 postconf man5 页中上面引用的两个指令：

smtp_tls_secure_cert_match (default: nexthop, dot-nexthop)
   How the Postfix SMTP client verifies the server certificate peername for the "secure" TLS security level. In a  "secure"  TLS  policy  table  ($smtp_tls_policy_maps)
   entry the optional "match" attribute overrides this main.cf setting.

   This  parameter  specifies  one  or more patterns or strategies separated by commas, whitespace or colons.  In the policy table the only valid separator is the colon
   character.

   For a description of the pattern and strategy syntax see the smtp_tls_verify_cert_match parameter. The "hostname" strategy should be avoided in this context,  as  in
   the absence of a secure global DNS, using the results of MX lookups in certificate verification is not immune to active (man-in-the-middle) attacks on DNS.

   Sample main.cf setting:

       smtp_tls_secure_cert_match = nexthop

   Sample policy table override:

       example.net     secure match=example.com:.example.com
       .example.net    secure match=example.com:.example.com

   This feature is available in Postfix 2.3 and later.

它还引用了 smtp_tls_verify_cert_match 以便更好地理解

smtp_tls_verify_cert_match (default: hostname)
   How the Postfix SMTP client verifies the server certificate peername for the "verify" TLS security level. In a  "verify"  TLS  policy  table  ($smtp_tls_policy_maps)
   entry the optional "match" attribute overrides this main.cf setting.

   This  parameter  specifies  one  or more patterns or strategies separated by commas, whitespace or colons.  In the policy table the only valid separator is the colon
   character.

   Patterns specify domain names, or domain name suffixes:

   example.com
          Match the example.com domain, i.e. one of the names the server certificate must be example.com, upper and lower case distinctions are ignored.

   .example.com
          Match subdomains of the example.com domain, i.e. match a name in the server certificate that consists of a non-zero number of  labels  followed  by  a  .exam‐
          ple.com suffix. Case distinctions are ignored.

   Strategies specify a transformation from the next-hop domain to the expected name in the server certificate:

   nexthop
          Match  against  the next-hop domain, which is either the recipient domain, or the transport next-hop configured for the domain stripped of any optional socket
          type prefix, enclosing square brackets and trailing port. When MX lookups are not suppressed, this is the original nexthop domain prior to the MX lookup,  not
          the result of the MX lookup. For LMTP delivery via UNIX-domain sockets, the verified next-hop name is $myhostname.  This strategy is suitable for use with the
          "secure" policy. Case is ignored.

   dot-nexthop
          As above, but match server certificate names that are subdomains of the next-hop domain. Case is ignored.

   hostname
          Match against the hostname of the server, often obtained via an unauthenticated DNS MX lookup. For LMTP delivery via UNIX-domain sockets, the verified name is
          $myhostname.  This  matches the verification strategy of the "MUST" keyword in the obsolete smtp_tls_per_site table, and is suitable for use with the "verify"
          security level. When the next-hop name is enclosed in square brackets to suppress MX lookups, the "hostname" strategy is the same as the  "nexthop"  strategy.
          Case is ignored.

   Sample main.cf setting:

   smtp_tls_verify_cert_match = hostname, nexthop, dot-nexthop

   Sample policy table override:

   example.com     verify  match=hostname:nexthop
   .example.com    verify  match=example.com:.example.com:hostname

版本详细信息

版本详细信息

扩展日志

主配置文件

主配置文件

答案1

答案2

相关内容