Re: Enforced Outbound TLS (part deux)

2 msg	Duplicate messages with always_bcc
14 msg	[OT] Saving outgoing email Gmail style
3 msg	451 error
10 msg	Postfix 2.5 release candidate (and 2.6 snapshot...
2 msg	postfix errors when sending smtp auth via yahoo
4 msg	Documentation enhancement: Adjusting DB file pe...
11 msg	I don't want Postfix to confirm users via telnet
3 msg	Question on Earthlink and dnsbl.sorbs.net

Re: Enforced Outbound TLS (part deux)
\ Dennis Putnam (15 Jan 2008)
. \ Victor Duchovni (15 Jan 2008)
. . \ Dennis Putnam (15 Jan 2008)
. . . \ Victor Duchovni (15 Jan 2008)
. . . . \ Dennis Putnam (15 Jan 2008)
. . . . . \ Victor Duchovni (15 Jan 2008)
. . . . . . \ Dennis Putnam (15 Jan 2008)
. . . . . . . \ Victor Duchovni (15 Jan 2008)
. . . . . . . . \ Dennis Putnam (15 Jan 2008)
. . . . . . . . . \ Dennis Putnam (15 Jan 2008)
. . . . . . . . . \ (Wietse Venema) (15 Jan 2008)
. . . . . . . . . . \ Dennis Putnam (15 Jan 2008)
. . . . . . . . . . . \ Victor Duchovni (15 Jan 2008)
. . . . . . . . . . . . \ Dennis Putnam (15 Jan 2008)
. . . . . . . . . . . \ (Wietse Venema) (15 Jan 2008)
. . . . . . . . . \ Victor Duchovni (15 Jan 2008)
. . . . . . . . . . \ Dennis Putnam (15 Jan 2008)
. . . . . . . . . . . \ Victor Duchovni (15 Jan 2008)
. . . . . . . . . . . . \ Dennis Putnam (15 Jan 2008)
. . . . . . . . . . . . . \ Victor Duchovni (15 Jan 2008)
. . . . . . . . . . . . . . \ Dennis Putnam (16 Jan 2008)
. . . . . . . . . . . . . . . \ Victor Duchovni (16 Jan 2008)
. . . . . . . . . . . . . . . . \ Dennis Putnam (16 Jan 2008)
. . . . . . . . . . . . . . . . . \ Victor Duchovni (16 Jan 2008)
. . . . . . . . . . . . . . . . . . \ Mark Watts (16 Jan 2008)
. . . . . . . . . . . . . . . . . . . \ John Peach (16 Jan 2008)
. . . . . . . . . . . . . . . . . . . \ Victor Duchovni (16 Jan 2008)
. . . . . . . . . . . . . . . . . . . . \ Dennis Putnam (16 Jan 2008)
. . . . . . . . . . . . . . . . . . \ Dennis Putnam (16 Jan 2008)
. . . . . . . . . . . . . . . . . . . \ Mark Watts (16 Jan 2008)
. . . . . . . . . . . . . . . . . \ Brian Evans (16 Jan 2008)
. . . . . . . . . . . . . . . \ Noel Jones (16 Jan 2008)
. . . . . . . . . . . . . . . . \ Dennis Putnam (16 Jan 2008)
. . . . . . . . . . . . . . . . . \ Noel Jones (16 Jan 2008)
. . . . . . . . . . . . . \ (Wietse Venema) (15 Jan 2008)
. . . . . . . . . . . . . . \ Dennis Putnam (16 Jan 2008)

6 msg	smtpd_proxy_filter to unix: problem
4 msg	Again troubles with postfix and cyrus-sasl
3 msg	Exclude local host from smtpd_proxy_filter
4 msg	transport nexthop nexthop
3 msg	TLS has been selected, but TLS support is not c...
2 msg	Which documentation to read for this..
4 msg	Exchange 2003 to Postfix maildir migration
7 msg	virtual_mailbox_base & LDAP
12 msg	Enforced Outbound TLS
2 msg	postfix+maildrop error
10 msg	Outgoing IP address

Subject:	Re: Enforced Outbound TLS (part deux)
Group:	Postfix-users
From:	Dennis Putnam
Date:	15 Jan 2008

I think I have had a modicum of success in identifying my version. In
spite of the 'postconf -d' command reporting version 2.1.5, I am
fairly certain it is really 2.2. Thanks to Wietse for pointing out
that 2.1.5 had no support for TLS. Since inbound was working it was
obvious that I could not really have 2.1.5.

That being the case, I tried changing my main.cf to use 2.2 TLS
settings. Most are the same but the big one is 'smtp_tls_per_site'
instead of 'smtp_tls_policy_maps'. When I did that, I suddenly got an
error regarding the hash file. That was encouraging, since it made it
obvious it was recognizing that parameter.

However, after fixing the problem it is still not enforcing TLS
sessions per the hash file. Assuming, I really do have 2.2, here are
my settings in main.cf as a sort of reset:

smtpd_use_tls = yes
smtpd_tls_cert_file = /etc/postfix/ssl/smtp.crt
smtpd_tls_key_file = /etc/postfix/ssl/smtpunc.key
smtpd_tls_CAfile = /etc/postfix/ssl/root.crt
smtpd_tls_loglevel = 2
smtp_tls_per_site = hash:/etc/postfix/tls_policy
smtpd_tls_received_header = yes
smtp_tls_note_starttls_offer = yes

Also my hash file now looks like this:

somedomain.com MUST
someother.com MUST

Can someone now see something wrong that is preventing this from
working? Thanks.