Correct use of smtpd_tls_security_level

7 msg	Invalid Sender Address syntax
2 msg	high availability
2 msg	BFD (Brute Force Detection) & Postfix
5 msg	relay domain and forwarding
2 msg	dk-milter - emal size issues
5 msg	Mail sent from local machine shows undisclosed-...
16 msg	Sorting incoming mails according to rules

Correct use of smtpd_tls_security_level
\ M. Fioretti (16 Jun 2007)
. \ M. Fioretti (16 Jun 2007)
. \ Ralf Hildebrandt (16 Jun 2007)
. . \ M. Fioretti (16 Jun 2007)
. . . \ Ralf Hildebrandt (16 Jun 2007)

1 msg	graph queue sizes
6 msg	large deferred queue ('too many connections')
3 msg	To see IP's
5 msg	How Can I Block certain IP's Within Range of my...
8 msg	Question about adding a special header to emails
3 msg	rcpt count mismatch and corrupt queue file ?
2 msg	too many connections
11 msg	Whitelist broken email servers?
4 msg	Write failed in network_biopair_interop with er...
2 msg	Pattern-matching in HELO
3 msg	header_checks du jour
3 msg	Good Resource for additional Spam Blocking

Subject:	Correct use of smtpd_tls_security_level
Group:	Postfix-users
From:	M. Fioretti
Date:	16 Jun 2007

Hello,

I want to accept inbound email only for the existing addresses of my
virtual domains and this part is OK. Then I want to relay outbound
email only for:

1) messages originated on the server itself (cron jobs, webmail...)

2) the home clients of my users, but only if they are both
SASL-authenticated _and_ use TLS encryption.

I have just read the Postfix configuration page
(http://www.postfix.org/postconf.5.html), but honestly I'm still a bit
confused about point 2 above. Are these SASL/TLS settings the correct
ones for my case:

#####################################################################

smtpd_sasl_auth_enable = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = /var/spool/postfix/private/auth

smtpd_recipient_restrictions = permit_sasl_authenticated,
permit_mynetworks, reject_unauth_destination
...other restrictions, still studying them...
smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks
...other restrictions, still studying them...

smtpd_tls_security_level = may
smtpd_tls_auth_only = yes
smtpd_tls_key_file = /location/of/certificate_and_key.pem
smtpd_tls_cert_file = $smtpd_tls_key_file
smtpd_tls_loglevel = 1

##############################################################

The part of postconf.5.html which I'm least sure about is if I'm
giving the correct value to smtpd_tls_security_level, but of course
every comment on errors or missing settings is very welcome.

(I will start to configure the server the next week, that's why I
haven't a postconf -n output yet, I'm trying to study as much as
possible _before_ fiddling with the server)

TIA,
Marco