573c71e7fe- update to 3.10.1 * Bugfix (defect introduced: 20250210): a recent 'fix' for the default smtp_tls_dane_insecure_mx_policy setting resulted in unnecessary 'dnssec_probe' warnings, on systems that disable DNSSEC lookups (which is the default). - update to 3.10.0 * Internal protocol change: Postfix needs "postfix reload" (or "postfix stop" and "postfix start") after upgrade, because of a change in the delivery agent protocol. If this step is skipped, Postfix delivery agents will log a warning: unexpected attribute smtputf8 from xxx socket (expecting: sendopts) where xxx is the delivery agent service name. * Forward compatibility: Support for OpenSSL 3.5 post-quantum cryptography. To manage algorithm selection, OpenSSL introduces new TLS group syntax that Postfix will not attempt to imitate. Instead, Postfix now allows the tls_eecdh_auto_curves and tls_ffdhe_auto_groups parameter values to have an empty value. When both are set empty, the algorithm selection can be managed through OpenSSL configuration. For more, look for "Post-quantum" in the postconf(5) manpage. * Support for the RFC 8689 "TLS-Required: no" message header to request delivery of messages (such as TLSRPT summaries) even if the preferred TLS security policy cannot be enforced. This limits the Postfix SMTP client to "smtp_tls_security_level = may" which does not authenticate server certificates and which allows falling back to plaintext. * Support for the REQUIRETLS SMTP service extension will evolve in Postfix 3.11. * Support for the TLSRPT protocol (defined in RFC 8460). With this, a domain can publish a policy in DNS that requests daily summary reports for successful and failed SMTP-over-TLS connections to that domain's MX hosts. This supports both DANE (built-in) and MTA-STS (via an smtp_tls_policy_maps plugin). The implementation uses a TLSRPT library and reporting infrastructure that are maintained by sys4. For details, see TLSRPT_README. * Privacy: With "smtpd_hide_client_session = yes", the Postfix SMTP server generates a Received: header without client session info. This setting may be used with the MUA submission services (port 465 and 587). * Support for RFC 2047 encoding of non-ASCII "full name" information in Postfix-generated From: message headers. Encoding non-ASCII full names can avoid the need to use SMTPUTF8, and therefore can avoid incompatibility with sites that do not support SMTPUTF8. See the full_name_encoding_charset parameter description for details. * Database performance: When mysql: or pgsql: configuration specifies a single host, assume that it is a load balancer and reconnect immediately after a single failure, instead of failing all requests for 60s. * The Postfix Milter implementation now logs the reason for a 'quarantine' action, instead of "milter triggers HOLD action". * The SMTP server now logs the queue ID (or "NOQUEUE") when a connection ends abnormally (timeout, lost connection, or too many errors), and the cleanup server now logs "queueid: canceled" when a message transaction is started but not completed. These changes simplify logfile analysis. * Dovecot SASL client logging for "Invalid authentication mechanism" now includes the name of that mechanism. * Postfix SMTP server 'reject' logging now shows the sasl_method, sasl_username, and sasl_sender if available. - update to 3.10.1 * Bugfix (defect introduced: 20250210): a recent 'fix' for the default smtp_tls_dane_insecure_mx_policy setting resulted in unnecessary 'dnssec_probe' warnings, on systems that disable DNSSEC lookups (which is the default). - update to 3.10.0 * Internal protocol change: Postfix needs "postfix reload" (or "postfix stop" and "postfix start") after upgrade, because of a change in the delivery agent protocol. If this step is skipped, Postfix delivery agents will log a warning: unexpected attribute smtputf8 from xxx socket (expecting: sendopts) where xxx is the delivery agent service name. * Forward compatibility: Support for OpenSSL 3.5 post-quantum cryptography. To manage algorithm selection, OpenSSL introduces new TLS group syntax that Postfix will not attempt to imitate. Instead, Postfix now allows the tls_eecdh_auto_curves and tls_ffdhe_auto_groups parameter values to have an empty value. When both are set empty, the algorithm selection can be managed through OpenSSL configuration. For more, look for "Post-quantum" in the postconf(5) manpage. * Support for the RFC 8689 "TLS-Required: no" message header to request delivery of messages (such as TLSRPT summaries) even if the preferred TLS security policy cannot be enforced. This limits the Postfix SMTP client to "smtp_tls_security_level = may" which does not authenticate server certificates and which allows falling back to plaintext. * Support for the REQUIRETLS SMTP service extension will evolve in Postfix 3.11. * Support for the TLSRPT protocol (defined in RFC 8460). With this, a domain can publish a policy in DNS that requests daily summary reports for successful and failed SMTP-over-TLS connections to that domain's MX hosts. This supports both DANE (built-in) and MTA-STS (via an smtp_tls_policy_maps plugin). The implementation uses a TLSRPT library and reporting infrastructure that are maintained by sys4. For details, see TLSRPT_README. * Privacy: With "smtpd_hide_client_session = yes", the Postfix SMTP server generates a Received: header without client session info. This setting may be used with the MUA submission services (port 465 and 587). * Support for RFC 2047 encoding of non-ASCII "full name" information in Postfix-generated From: message headers. Encoding non-ASCII full names can avoid the need to use SMTPUTF8, and therefore can avoid incompatibility with sites that do not support SMTPUTF8. See the full_name_encoding_charset parameter description for details. * Database performance: When mysql: or pgsql: configuration specifies a single host, assume that it is a load balancer and reconnect immediately after a single failure, instead of failing all requests for 60s. * The Postfix Milter implementation now logs the reason for a 'quarantine' action, instead of "milter triggers HOLD action". * The SMTP server now logs the queue ID (or "NOQUEUE") when a connection ends abnormally (timeout, lost connection, or too many errors), and the cleanup server now logs "queueid: canceled" when a message transaction is started but not completed. These changes simplify logfile analysis. * Dovecot SASL client logging for "Invalid authentication mechanism" now includes the name of that mechanism. * Postfix SMTP server 'reject' logging now shows the sasl_method, sasl_username, and sasl_sender if available.
devel
Peter Varkoly
2025-02-26 06:19:37 +00:00
bed1de1905Accepting request 1232867 from server:mail
Ana Guerrero
2024-12-22 16:58:59 +00:00
def8724640- update to 3.9.1 * The mail_version configuration parameter did not have a three-number value (3.9 instead of 3.9.0; it still had the two-number version from the development releases postfix-3.9-yyyymmdd). This broke pathnames derived from the mail_version value, such as shlib_directory. * Bugfix (defect introduced: Postfix 2.9, date 20111218): with "smtpd_sasl_auth_enable = no", the permit_sasl_authenticated feature ignored information that was received with the XCLIENT LOGIN command, so that the client was treated as unauthenticated. This was fixed by removing an unnecessary test. * Bugfix (defect introduced: postfix 3.0): the default master.cf syslog_name setting for the relay service did not preserve multi-instance information, which complicated logfile analysis. * Bugfix (defect introduced: Postfix 2.3, date 20051222): file descriptor leak after failure to connect to a Dovecot auth server. The impact is limited because Dovecot auth failures are rare, there are limits on the number of retries (one), on the number of errors per SMTP session (smtpd_hard_error_limit), on the number of sessions per SMTP server process (max_use), and on the number of file handles per process (managed with sysctl). * Bugfix (defect introduced: Postfix 3.4, date 20190121): the postsuper command failed with "open logfile '/path/to/file': Permission denied" when the maillog_file parameter specified a filename and Postfix was not running. This was fixed by opening the maillog_file before dropping root privileges. * Bugfix (defect introduced Postfix 3.0). No autodetection of UTF8 text when missing message headers were automatically added by Postfix (for example, a From: header with UTF8 full name information from the password file). This caused Postfix to send UTF8 in message headers without using the SMTPUTF8 protocol. - update to 3.9.1 * The mail_version configuration parameter did not have a three-number value (3.9 instead of 3.9.0; it still had the two-number version from the development releases postfix-3.9-yyyymmdd). This broke pathnames derived from the mail_version value, such as shlib_directory. * Bugfix (defect introduced: Postfix 2.9, date 20111218): with "smtpd_sasl_auth_enable = no", the permit_sasl_authenticated feature ignored information that was received with the XCLIENT LOGIN command, so that the client was treated as unauthenticated. This was fixed by removing an unnecessary test. * Bugfix (defect introduced: postfix 3.0): the default master.cf syslog_name setting for the relay service did not preserve multi-instance information, which complicated logfile analysis. * Bugfix (defect introduced: Postfix 2.3, date 20051222): file descriptor leak after failure to connect to a Dovecot auth server. The impact is limited because Dovecot auth failures are rare, there are limits on the number of retries (one), on the number of errors per SMTP session (smtpd_hard_error_limit), on the number of sessions per SMTP server process (max_use), and on the number of file handles per process (managed with sysctl). * Bugfix (defect introduced: Postfix 3.4, date 20190121): the postsuper command failed with "open logfile '/path/to/file': Permission denied" when the maillog_file parameter specified a filename and Postfix was not running. This was fixed by opening the maillog_file before dropping root privileges. * Bugfix (defect introduced Postfix 3.0). No autodetection of UTF8 text when missing message headers were automatically added by Postfix (for example, a From: header with UTF8 full name information from the password file). This caused Postfix to send UTF8 in message headers without using the SMTPUTF8 protocol.
Peter Varkoly
2024-12-20 16:01:24 +00:00
20d0bdbb40Accepting request 1202891 from server:mail
Ana Guerrero
2024-09-25 19:52:35 +00:00
1037c6b27bAdapt spec
Peter Varkoly
2024-09-24 10:03:08 +00:00
fee3f5190a- Missing posttls-finger in postfix though changes mention it (bsc#1221501)
Peter Varkoly
2024-09-24 08:48:37 +00:00
27c5fadd5eAccepting request 1194618 from server:mail
Ana Guerrero
2024-08-20 14:12:35 +00:00
b102dd3c5f- Remove rcpostfix symlink [jsc#PED-266]
Peter Varkoly
2024-08-19 05:01:05 +00:00
f095145828Adapt tarball. Remove bad content
Peter Varkoly
2024-08-01 10:07:33 +00:00
007aee8fe4- postfix gives warnings about deprecated parameters (bsc#1225397)
Peter Varkoly
2024-08-01 08:38:17 +00:00
5e44cd1a28Accepting request 1181563 from server:mail
Ana Guerrero
2024-06-19 14:36:49 +00:00
022da9e4a8Fix for Invalid cross-device link (etc/localtime)
Christian Wittmer
2024-06-18 18:57:02 +00:00
ab10e397c0Accepting request 1180049 from server:mail
Ana Guerrero
2024-06-12 13:37:44 +00:00
f8d0931c2cAccepting request 1180009 from home:adamm:branches:server:mail
Peter Varkoly
2024-06-11 16:38:27 +00:00
f99e41ccacAccepting request 1175398 from server:mail
Ana Guerrero
2024-05-21 16:33:12 +00:00
ea53e42589Accepting request 1175397 from home:computersalat:devel:mail
Christian Wittmer
2024-05-20 21:14:13 +00:00
bb1494b9b1Accepting request 1174920 from server:mail
Ana Guerrero
2024-05-20 16:09:43 +00:00
0c726e5bd8- config.postfix needs updating (bsc#1224207) * chkconfig -> systemctl * Link Cyrus lmtp only if this exsists * /usr/lib64/sasl2 does not need to exist * Fetch timezone via readlink from /etc/localtime
Peter Varkoly
2024-05-17 15:50:58 +00:00
f86eea3b6aAccepting request 1173989 from server:mail
Ana Guerrero
2024-05-16 15:12:37 +00:00
113e4ff966Accepting request 1156371 from home:adkorte:branches:server:mail
Dirk Stoecker
2024-05-14 13:19:15 +00:00
598d743825Accepting request 1166904 from server:mail
Ana Guerrero
2024-04-12 15:33:52 +00:00
b15c7168cbAccepting request 1165385 from home:crameleon:branches:server:mail
Dirk Stoecker
2024-04-11 15:37:21 +00:00
3beb1cfdfa- update to 3.8.4 (bsc#1218304, CVE-2023-51764): - Syntax error in update_postmaps script (bsc#1216061) (bsc#1215372) (bsc#1192314) Adapt proposed change: using "cp -afL" by copying. Define HAS_CLOSEFROM (bsc#1189101) (bsc#1188477) (bsc#1066854) For more see /usr/share/doc/packages/postfix/RELEASE_NOTES (bsc#1181381) [Build 130.3] openQA test fails in mta, mutt - postfix broken: "queue file write error" and "error: unsupported - bsc#1176650 L3: What is regularly triggering the "fillup" o add patch for main.cf for postfix-bdb package - Delete postfix-SUSE/README.SuSE, company name spelled wrong, - bsc#1162891 server:mail/postfix: cond_slp bug on TW after - bsc#1160413 postfix fails with -fno-common - bsc#1142881 - mkpostfixcert from Postfix still uses md o Major changes Postfix 3.4.4 fixes both. o Removing setting smtpd_sasl_path and smtpd_sasl_type to empty - Replace references to /var/adm/fillup-templates with new - bnc#1059512 L3: Postfix Problem seems to be obsolete) * recover lost (with 3.2.0 update) submission, smtps sections - update to 3.1.4 - bnc#981097 config.postfix creates broken main.cf for tls client configuration (no "mailq" equivalent). smtp_transport_rate_delay = 20s missed opportunities to block new spambots.Dirk Mueller2023-12-28 07:51:56 +00:00
c3f137b035Accepting request 1134744 from server:mail
Ana Guerrero
2023-12-25 18:04:37 +00:00
f5d59b2e1aAccepting request 1134660 from home:adkorte:branches:server:mail
Dirk Stoecker
2023-12-23 12:46:31 +00:00
ee36226d59Accepting request 1125117 from server:mail
Ana Guerrero
2023-11-13 21:15:44 +00:00
8589a4f33cAccepting request 1123266 from home:adkorte:branches:server:mail
Christian Wittmer
2023-11-10 20:26:00 +00:00
047f46a5b0Accepting request 1119557 from home:varkoly:branches:server:mail
Christian Wittmer
2023-11-10 20:23:39 +00:00
7b1093f46bAccepting request 1105486 from server:mail
Ana Guerrero
2023-08-30 08:17:39 +00:00
8bc4ea53a3Accepting request 1104009 from home:varkoly:branches:server:mail
Christian Wittmer
2023-08-23 13:13:01 +00:00
Dominique Leuenberger
Peter Varkoly
Ana Guerrero
Christian Wittmer
Dirk Stoecker
Dirk Mueller
Michael Ströder