How to disable SSLv2 on smtpd opportunistic TLS?

2 msg	postmap header_checks error
10 msg	mailbox_command (dovecot lda) stopped working, ...
5 msg	mynetworks via LDAP lookup
7 msg	Local recipient table in LDAP problem
2 msg	proxy_read_maps
1 msg	smtpd_restriction_class and it's lookup
8 msg	Message Rejected
12 msg	Customize to filter attachment ?
2 msg	Relay question
14 msg	unnecessary routing?
4 msg	do not use 'reject_maps_rbl'?
9 msg	Fwd: Postfix in OpenVZ.
2 msg	bypass body_checks for local mail?
4 msg	catchall with relay_recipient_maps
4 msg	'Name server failure' is output
3 msg	smtp_sasl_password_maps lookups
16 msg	Postfix Queues on a Ram Disk
15 msg	sendmail compared to smtp sending
3 msg	Postfix does not recognize remote emails

How to disable SSLv2 on smtpd opportunistic TLS?
\ Brian Wong (22 Jan 2008)
. \ Victor Duchovni (22 Jan 2008)

Subject:	How to disable SSLv2 on smtpd opportunistic TLS?
Group:	Postfix-users
From:	Brian Wong
Date:	22 Jan 2008

My users use SMTP AUTH when they are off-site to relay email. I have
Postfix version 2.4.6 listening on port 25 with opportunistic TLS. The
relevant lines of the configuration read

smtpd_tls_security_level = may
smtpd_tls_auth_only = yes

Auditors do not want SSLv2 available and I am not sure how to disable
this protocol for opportunistic TLS. I see the option is available
when the security level is mandatory but I do not see the option for
when it is opportunistic.

Have I missed something?

If this is not possible I will probably resort to making port 25
available only to those on-site and port 587 available publicly. The
smtpd daemon listening on 587 will have the following options

smtpd_tls_security_level = encrypt
smtpd_tls_auth_only = yes
smtpd_tls_mandatory_protocols = SSLv3, TLSv1 (the default)

Suggestions? Thanks.