postfix-master/postscreen.8.html

   1 <!doctype html public "-//W3C//DTD HTML 4.01 Transitional//EN"
   2         "http://www.w3.org/TR/html4/loose.dtd">
   3 <html> <head>
   4 <meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
   5 <title> Postfix manual - postscreen(8) </title>
   6 </head> <body> <pre>
   7 POSTSCREEN(8)                                                    POSTSCREEN(8)
   8
   9 <b>NAME</b>
  10        postscreen - Postfix zombie blocker
  11
  12 <b>SYNOPSIS</b>
  13        <b>postscreen</b> [generic Postfix daemon options]
  14
  15 <b>DESCRIPTION</b>
  16        The Postfix <a href="postscreen.8.html"><b>postscreen</b>(8)</a> server performs triage on multi-
  17        ple inbound SMTP connections at the  same  time.  While  a
  18        single  <a href="postscreen.8.html"><b>postscreen</b>(8)</a>  process  keeps  spambots  away from
  19        Postfix SMTP server processes, more  Postfix  SMTP  server
  20        processes remain available for legitimate clients.
  21
  22        This program should not be used on SMTP ports that receive
  23        mail from end-user clients (MUAs). In  a  typical  deploy-
  24        ment,  <a href="postscreen.8.html"><b>postscreen</b>(8)</a>  is  used  on  the "port 25" service,
  25        while MUA clients submit mail via the <b>submission</b>  service.
  26
  27        <a href="postscreen.8.html"><b>postscreen</b>(8)</a>  maintains a temporary whitelist for clients
  28        that have passed a number of tests.  When an  SMTP  client
  29        IP  address  is  whitelisted,  <a href="postscreen.8.html"><b>postscreen</b>(8)</a> hands off the
  30        connection immediately to a Postfix SMTP  server  process.
  31        This minimizes the overhead for legitimate mail.
  32
  33        By  default,  <a href="postscreen.8.html"><b>postscreen</b>(8)</a>  logs statistics and hands off
  34        every connection to a Postfix SMTP server  process,  while
  35        excluding clients in <a href="postconf.5.html#mynetworks">mynetworks</a> from all tests (primarily,
  36        to avoid problems with non-standard  SMTP  implementations
  37        in  network  appliances).   This  mode  is useful for non-
  38        destructive testing.
  39
  40        In a typical production setting, <a href="postscreen.8.html"><b>postscreen</b>(8)</a> is  config-
  41        ured  to  reject  mail  from clients that fail one or more
  42        tests. <a href="postscreen.8.html"><b>postscreen</b>(8)</a> logs rejected mail  with  the  client
  43        address, helo, sender and recipient information.
  44
  45        <a href="postscreen.8.html"><b>postscreen</b>(8)</a>  is  not an SMTP proxy; this is intentional.
  46        The purpose is to keep spambots  away  from  Postfix  SMTP
  47        server processes, while minimizing overhead for legitimate
  48        traffic.
  49
  50 <b>SECURITY</b>
  51        The <a href="postscreen.8.html"><b>postscreen</b>(8)</a> server is moderately security-sensitive.
  52        It  talks to untrusted clients on the network. The process
  53        can be run chrooted at fixed low privilege.
  54
  55 <b>STANDARDS</b>
  56        <a href="http://tools.ietf.org/html/rfc821">RFC 821</a> (SMTP protocol)
  57        <a href="http://tools.ietf.org/html/rfc1123">RFC 1123</a> (Host requirements)
  58        <a href="http://tools.ietf.org/html/rfc1652">RFC 1652</a> (8bit-MIME transport)
  59        <a href="http://tools.ietf.org/html/rfc1869">RFC 1869</a> (SMTP service extensions)
  60        <a href="http://tools.ietf.org/html/rfc1870">RFC 1870</a> (Message Size Declaration)
  61        <a href="http://tools.ietf.org/html/rfc1985">RFC 1985</a> (ETRN command)
  62        <a href="http://tools.ietf.org/html/rfc2034">RFC 2034</a> (SMTP Enhanced Status Codes)
  63        <a href="http://tools.ietf.org/html/rfc2821">RFC 2821</a> (SMTP protocol)
  64        Not: <a href="http://tools.ietf.org/html/rfc2920">RFC 2920</a> (SMTP Pipelining)
  65        <a href="http://tools.ietf.org/html/rfc3207">RFC 3207</a> (STARTTLS command)
  66        <a href="http://tools.ietf.org/html/rfc3461">RFC 3461</a> (SMTP DSN Extension)
  67        <a href="http://tools.ietf.org/html/rfc3463">RFC 3463</a> (Enhanced Status Codes)
  68        <a href="http://tools.ietf.org/html/rfc5321">RFC 5321</a> (SMTP protocol, including multi-line 220 banners)
  69
  70 <b>DIAGNOSTICS</b>
  71        Problems and transactions are logged to <b>syslogd</b>(8).
  72
  73 <b>BUGS</b>
  74        The <a href="postscreen.8.html"><b>postscreen</b>(8)</a> built-in SMTP protocol engine  currently
  75        does  not  announce support for AUTH, XCLIENT or XFORWARD.
  76        Support for AUTH may be added in the future.  In the  mean
  77        time, if you need to make these services available on port
  78        25, then do not enable  the  optional  "after  220  server
  79        greeting" tests, and do not use DNSBLs that reject traffic
  80        from dial-up and residential networks.
  81
  82        The optional "after 220  server  greeting"  tests  involve
  83        <a href="postscreen.8.html"><b>postscreen</b>(8)</a>'s  built-in SMTP protocol engine. When these
  84        tests succeed, <a href="postscreen.8.html"><b>postscreen</b>(8)</a> adds the client to the tempo-
  85        rary  whitelist but it cannot not hand off the "live" con-
  86        nection to a Postfix SMTP server process in the middle  of
  87        a  session.   Instead,  <a href="postscreen.8.html"><b>postscreen</b>(8)</a>  defers  attempts to
  88        deliver mail with a 4XX status, and waits for  the  client
  89        to  disconnect.   The next time a good client connects, it
  90        will be allowed to talk to a Postfix SMTP  server  process
  91        to  deliver  mail.  <a href="postscreen.8.html"><b>postscreen</b>(8)</a>  mitigates the impact of
  92        this limitation by giving such  tests  a  long  expiration
  93        time.
  94
  95 <b>CONFIGURATION PARAMETERS</b>
  96        Changes  to  <a href="postconf.5.html">main.cf</a>  are  not picked up automatically, as
  97        <a href="postscreen.8.html"><b>postscreen</b>(8)</a> processes may run for  several  hours.   Use
  98        the command "postfix reload" after a configuration change.
  99
 100        The text below provides  only  a  parameter  summary.  See
 101        <a href="postconf.5.html"><b>postconf</b>(5)</a> for more details including examples.
 102
 103        NOTE:  Some  <a href="postscreen.8.html"><b>postscreen</b>(8)</a>  parameters  implement  stress-
 104        dependent behavior.   This  is  supported  only  when  the
 105        default  parameter  value is stress-dependent (that is, it
 106        looks like ${stress?X}${stress:Y}, or it is the  $<i>name</i>  of
 107        an  smtpd  parameter  with  a  stress-dependent  default).
 108        Other parameters always evaluate as if the <b>stress</b>  parame-
 109        ter value is the empty string.
 110
 111 <b>COMPATIBILITY CONTROLS</b>
 112        <b><a href="postconf.5.html#postscreen_command_filter">postscreen_command_filter</a> ($<a href="postconf.5.html#smtpd_command_filter">smtpd_command_filter</a>)</b>
 113               A  mechanism to transform commands from remote SMTP
 114               clients.
 115
 116        <b><a href="postconf.5.html#postscreen_discard_ehlo_keyword_address_maps">postscreen_discard_ehlo_keyword_address_maps</a>  ($<a href="postconf.5.html#smtpd_discard_ehlo_keyword_address_maps">smtpd_dis</a>-</b>
 117        <b><a href="postconf.5.html#smtpd_discard_ehlo_keyword_address_maps">card_ehlo_keyword_address_maps</a>)</b>
 118               Lookup tables, indexed by the  remote  SMTP  client
 119               address,  with  case insensitive lists of EHLO key-
 120               words (pipelining, starttls, auth, etc.)  that  the
 121               <a href="postscreen.8.html"><b>postscreen</b>(8)</a>  server  will  not  send  in the EHLO
 122               response to a remote SMTP client.
 123
 124        <b><a href="postconf.5.html#postscreen_discard_ehlo_keywords">postscreen_discard_ehlo_keywords</a> ($<a href="postconf.5.html#smtpd_discard_ehlo_keywords">smtpd_discard_ehlo_key</a>-</b>
 125        <b><a href="postconf.5.html#smtpd_discard_ehlo_keywords">words</a>)</b>
 126               A case insensitive list of EHLO keywords  (pipelin-
 127               ing,  starttls,  auth, etc.) that the <a href="postscreen.8.html"><b>postscreen</b>(8)</a>
 128               server will not send in  the  EHLO  response  to  a
 129               remote SMTP client.
 130
 131 <b>TROUBLE SHOOTING CONTROLS</b>
 132        <b><a href="postconf.5.html#postscreen_expansion_filter">postscreen_expansion_filter</a> (see 'postconf -d' output)</b>
 133               List   of   characters   that   are   permitted  in
 134               <a href="postconf.5.html#postscreen_reject_footer">postscreen_reject_footer</a> attribute expansions.
 135
 136        <b><a href="postconf.5.html#postscreen_reject_footer">postscreen_reject_footer</a> ($<a href="postconf.5.html#smtpd_reject_footer">smtpd_reject_footer</a>)</b>
 137               Optional information that is appended after  a  4XX
 138               or 5XX server response.
 139
 140        <b><a href="postconf.5.html#soft_bounce">soft_bounce</a> (no)</b>
 141               Safety net to keep mail queued that would otherwise
 142               be returned to the sender.
 143
 144 <b>PERMANENT WHITE/BLACKLIST TEST</b>
 145        This test is executed  immediately  after  a  remote  SMTP
 146        client  connects.  If a client is permanently whitelisted,
 147        the client will be handed off  immediately  to  a  Postfix
 148        SMTP server process.
 149
 150        <b><a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> (<a href="postconf.5.html#permit_mynetworks">permit_mynetworks</a>)</b>
 151               Permanent white/blacklist for remote SMTP client IP
 152               addresses.
 153
 154        <b><a href="postconf.5.html#postscreen_blacklist_action">postscreen_blacklist_action</a> (ignore)</b>
 155               The action that <a href="postscreen.8.html"><b>postscreen</b>(8)</a> takes  when  an  SMTP
 156               client   is   permanently   blacklisted   with  the
 157               <a href="postconf.5.html#postscreen_access_list">postscreen_access_list</a> parameter.
 158
 159 <b>MAIL EXCHANGER POLICY TESTS</b>
 160        When a remote SMTP client is not on the  permanent  access
 161        list,  <a href="postscreen.8.html"><b>postscreen</b>(8)</a>  can  implement a number of whitelist
 162        tests before it grants the client  a  temporary  whitelist
 163        status to talk to a Postfix SMTP server process.
 164
 165        By  listening  on  both  primary  and backup MX addresses,
 166        <a href="postscreen.8.html"><b>postscreen</b>(8)</a> can deny the temporary whitelist  status  to
 167        clients that connect only to backup MX hosts.
 168
 169        <b><a href="postconf.5.html#postscreen_whitelist_interfaces">postscreen_whitelist_interfaces</a> (<a href="DATABASE_README.html#types">static</a>:all)</b>
 170               A  list  of local <a href="postscreen.8.html"><b>postscreen</b>(8)</a> server IP addresses
 171               where a  non-whitelisted  SMTP  client  can  obtain
 172               <a href="postscreen.8.html"><b>postscreen</b>(8)</a>'s  temporary whitelist status to talk
 173               to a Postfix SMTP server process.
 174
 175 <b>BEFORE-GREETING TESTS</b>
 176        These tests are executed before  the  remote  SMTP  client
 177        receives the "220 servername" greeting. If no tests remain
 178        after the successful completion of this phase, the  client
 179        will  be  handed  off immediately to a Postfix SMTP server
 180        process.
 181
 182        <b><a href="postconf.5.html#dnsblog_service_name">dnsblog_service_name</a> (dnsblog)</b>
 183               The name of the <a href="dnsblog.8.html"><b>dnsblog</b>(8)</a> service  entry  in  mas-
 184               ter.cf.
 185
 186        <b><a href="postconf.5.html#postscreen_dnsbl_action">postscreen_dnsbl_action</a> (ignore)</b>
 187               The  action  that  <a href="postscreen.8.html"><b>postscreen</b>(8)</a> takes when an SMTP
 188               client's  combined  DNSBL  score  is  equal  to  or
 189               greater  than  a  threshold  (as  defined  with the
 190               <a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a> and <a href="postconf.5.html#postscreen_dnsbl_threshold">postscreen_dnsbl_thresh</a>-
 191               <a href="postconf.5.html#postscreen_dnsbl_threshold">old</a> parameters).
 192
 193        <b><a href="postconf.5.html#postscreen_dnsbl_reply_map">postscreen_dnsbl_reply_map</a> (empty)</b>
 194               A  mapping  from  actual  DNSBL  domain  name which
 195               includes a secret password,  to  the  DNSBL  domain
 196               name  that  postscreen  will  reply  with  when  it
 197               rejects mail.
 198
 199        <b><a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a> (empty)</b>
 200               Optional list of DNS white/blacklist domains,  fil-
 201               ters and weight factors.
 202
 203        <b><a href="postconf.5.html#postscreen_dnsbl_threshold">postscreen_dnsbl_threshold</a> (1)</b>
 204               The  inclusive  lower  bound  for  blocking an SMTP
 205               client,  based  on  its  combined  DNSBL  score  as
 206               defined  with the <a href="postconf.5.html#postscreen_dnsbl_sites">postscreen_dnsbl_sites</a> parameter.
 207
 208        <b><a href="postconf.5.html#postscreen_greet_action">postscreen_greet_action</a> (ignore)</b>
 209               The action that <a href="postscreen.8.html"><b>postscreen</b>(8)</a> takes  when  an  SMTP
 210               client speaks before its turn within the time spec-
 211               ified with the <a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> parameter.
 212
 213        <b><a href="postconf.5.html#postscreen_greet_banner">postscreen_greet_banner</a> ($<a href="postconf.5.html#smtpd_banner">smtpd_banner</a>)</b>
 214               The  <i>text</i>  in  the  optional  "220-<i>text</i>..."  server
 215               response that <a href="postscreen.8.html"><b>postscreen</b>(8)</a> sends ahead of the real
 216               Postfix SMTP server's "220 text..." response, in an
 217               attempt  to  confuse  bad SMTP clients so that they
 218               speak before their turn (pre-greet).
 219
 220        <b><a href="postconf.5.html#postscreen_greet_wait">postscreen_greet_wait</a> (${stress?2}${stress:6}s)</b>
 221               The amount of time that <a href="postscreen.8.html"><b>postscreen</b>(8)</a> will wait for
 222               an  SMTP  client to send a command before its turn,
 223               and for DNS  blocklist  lookup  results  to  arrive
 224               (default:  up  to  2  seconds under stress, up to 6
 225               seconds otherwise).
 226
 227        <b><a href="postconf.5.html#smtpd_service_name">smtpd_service_name</a> (smtpd)</b>
 228               The internal service that <a href="postscreen.8.html"><b>postscreen</b>(8)</a>  hands  off
 229               allowed connections to.
 230
 231 <b>AFTER-GREETING TESTS</b>
 232        These  tests  are  executed  after  the remote SMTP client
 233        receives the "220 servername" greeting. If a client passes
 234        all  tests  during  this  phase,  it  will  receive  a 4XX
 235        response to RCPT TO commands until the  client  hangs  up.
 236        After this, the client will be allowed to talk directly to
 237        a Postfix SMTP server process.
 238
 239        <b><a href="postconf.5.html#postscreen_bare_newline_action">postscreen_bare_newline_action</a> (ignore)</b>
 240               The action that <a href="postscreen.8.html"><b>postscreen</b>(8)</a> takes  when  an  SMTP
 241               client  sends  a bare newline character, that is, a
 242               newline not preceded by carriage return.
 243
 244        <b><a href="postconf.5.html#postscreen_bare_newline_enable">postscreen_bare_newline_enable</a> (no)</b>
 245               Enable "bare newline" SMTP protocol  tests  in  the
 246               <a href="postscreen.8.html"><b>postscreen</b>(8)</a> server.
 247
 248        <b><a href="postconf.5.html#postscreen_disable_vrfy_command">postscreen_disable_vrfy_command</a> ($<a href="postconf.5.html#disable_vrfy_command">disable_vrfy_command</a>)</b>
 249               Disable  the SMTP VRFY command in the <a href="postscreen.8.html"><b>postscreen</b>(8)</a>
 250               daemon.
 251
 252        <b><a href="postconf.5.html#postscreen_forbidden_commands">postscreen_forbidden_commands</a> ($<a href="postconf.5.html#smtpd_forbidden_commands">smtpd_forbidden_commands</a>)</b>
 253               List of commands that the <a href="postscreen.8.html"><b>postscreen</b>(8)</a> server con-
 254               siders in violation of the SMTP protocol.
 255
 256        <b><a href="postconf.5.html#postscreen_helo_required">postscreen_helo_required</a> ($<a href="postconf.5.html#smtpd_helo_required">smtpd_helo_required</a>)</b>
 257               Require  that  a  remote  SMTP client sends HELO or
 258               EHLO before commencing a MAIL transaction.
 259
 260        <b><a href="postconf.5.html#postscreen_non_smtp_command_action">postscreen_non_smtp_command_action</a> (drop)</b>
 261               The action that <a href="postscreen.8.html"><b>postscreen</b>(8)</a> takes  when  an  SMTP
 262               client  sends  non-SMTP  commands as specified with
 263               the <a href="postconf.5.html#postscreen_forbidden_commands">postscreen_forbidden_commands</a> parameter.
 264
 265        <b><a href="postconf.5.html#postscreen_non_smtp_command_enable">postscreen_non_smtp_command_enable</a> (no)</b>
 266               Enable   "non-SMTP   command"    tests    in    the
 267               <a href="postscreen.8.html"><b>postscreen</b>(8)</a> server.
 268
 269        <b><a href="postconf.5.html#postscreen_pipelining_action">postscreen_pipelining_action</a> (enforce)</b>
 270               The  action  that  <a href="postscreen.8.html"><b>postscreen</b>(8)</a> takes when an SMTP
 271               client sends multiple commands instead  of  sending
 272               one  command and waiting for the server to respond.
 273
 274        <b><a href="postconf.5.html#postscreen_pipelining_enable">postscreen_pipelining_enable</a> (no)</b>
 275               Enable "pipelining"  SMTP  protocol  tests  in  the
 276               <a href="postscreen.8.html"><b>postscreen</b>(8)</a> server.
 277
 278 <b>CACHE CONTROLS</b>
 279        <b><a href="postconf.5.html#postscreen_cache_cleanup_interval">postscreen_cache_cleanup_interval</a> (12h)</b>
 280               The  amount  of  time  between  <a href="postscreen.8.html"><b>postscreen</b>(8)</a> cache
 281               cleanup runs.
 282
 283        <b><a href="postconf.5.html#postscreen_cache_map">postscreen_cache_map</a>                   (btree:$data_direc-</b>
 284        <b>tory/postscreen_cache)</b>
 285               Persistent storage  for  the  <a href="postscreen.8.html"><b>postscreen</b>(8)</a>  server
 286               decisions.
 287
 288        <b><a href="postconf.5.html#postscreen_cache_retention_time">postscreen_cache_retention_time</a> (7d)</b>
 289               The amount of time that <a href="postscreen.8.html"><b>postscreen</b>(8)</a> will cache an
 290               expired temporary  whitelist  entry  before  it  is
 291               removed.
 292
 293        <b><a href="postconf.5.html#postscreen_bare_newline_ttl">postscreen_bare_newline_ttl</a> (30d)</b>
 294               The  amount of time that <a href="postscreen.8.html"><b>postscreen</b>(8)</a> will use the
 295               result from a successful "bare newline" SMTP proto-
 296               col test.
 297
 298        <b><a href="postconf.5.html#postscreen_dnsbl_ttl">postscreen_dnsbl_ttl</a> (1h)</b>
 299               The  amount of time that <a href="postscreen.8.html"><b>postscreen</b>(8)</a> will use the
 300               result from a successful DNS blocklist test.
 301
 302        <b><a href="postconf.5.html#postscreen_greet_ttl">postscreen_greet_ttl</a> (1d)</b>
 303               The amount of time that <a href="postscreen.8.html"><b>postscreen</b>(8)</a> will use  the
 304               result from a successful PREGREET test.
 305
 306        <b><a href="postconf.5.html#postscreen_non_smtp_command_ttl">postscreen_non_smtp_command_ttl</a> (30d)</b>
 307               The  amount of time that <a href="postscreen.8.html"><b>postscreen</b>(8)</a> will use the
 308               result from a  successful  "non_smtp_command"  SMTP
 309               protocol test.
 310
 311        <b><a href="postconf.5.html#postscreen_pipelining_ttl">postscreen_pipelining_ttl</a> (30d)</b>
 312               The  amount of time that <a href="postscreen.8.html"><b>postscreen</b>(8)</a> will use the
 313               result from a successful "pipelining" SMTP protocol
 314               test.
 315
 316 <b>RESOURCE CONTROLS</b>
 317        <b><a href="postconf.5.html#line_length_limit">line_length_limit</a> (2048)</b>
 318               Upon  input,  long lines are chopped up into pieces
 319               of at most this length; upon delivery,  long  lines
 320               are reconstructed.
 321
 322        <b><a href="postconf.5.html#postscreen_client_connection_count_limit">postscreen_client_connection_count_limit</a></b>
 323        <b>($<a href="postconf.5.html#smtpd_client_connection_count_limit">smtpd_client_connection_count_limit</a>)</b>
 324               How  many  simultaneous  connections  any client is
 325               allowed to have with the <a href="postscreen.8.html"><b>postscreen</b>(8)</a> daemon.
 326
 327        <b><a href="postconf.5.html#postscreen_command_count_limit">postscreen_command_count_limit</a> (20)</b>
 328               The limit on the total number of commands per  SMTP
 329               session  for <a href="postscreen.8.html"><b>postscreen</b>(8)</a>'s built-in SMTP protocol
 330               engine.
 331
 332        <b><a href="postconf.5.html#postscreen_command_time_limit">postscreen_command_time_limit</a> (${stress?10}${stress:300}s)</b>
 333               The time limit to read an entire command line  with
 334               <a href="postscreen.8.html"><b>postscreen</b>(8)</a>'s built-in SMTP protocol engine.
 335
 336        <b><a href="postconf.5.html#postscreen_post_queue_limit">postscreen_post_queue_limit</a> ($<a href="postconf.5.html#default_process_limit">default_process_limit</a>)</b>
 337               The  number of clients that can be waiting for ser-
 338               vice from a real SMTP server process.
 339
 340        <b><a href="postconf.5.html#postscreen_pre_queue_limit">postscreen_pre_queue_limit</a> ($<a href="postconf.5.html#default_process_limit">default_process_limit</a>)</b>
 341               The number of non-whitelisted clients that  can  be
 342               waiting  for  a  decision whether they will receive
 343               service from a real SMTP server process.
 344
 345        <b><a href="postconf.5.html#postscreen_watchdog_timeout">postscreen_watchdog_timeout</a> (10s)</b>
 346               How much time a <a href="postscreen.8.html"><b>postscreen</b>(8)</a> process may  take  to
 347               respond  to  an SMTP client command or to perform a
 348               cache operation before it is terminated by a built-
 349               in watchdog timer.
 350
 351 <b>STARTTLS CONTROLS</b>
 352        <b><a href="postconf.5.html#postscreen_tls_security_level">postscreen_tls_security_level</a> ($<a href="postconf.5.html#smtpd_tls_security_level">smtpd_tls_security_level</a>)</b>
 353               The  SMTP  TLS security level for the <a href="postscreen.8.html"><b>postscreen</b>(8)</a>
 354               server; when a non-empty value is  specified,  this
 355               overrides       the       obsolete       parameters
 356               <a href="postconf.5.html#postscreen_use_tls">postscreen_use_tls</a> and <a href="postconf.5.html#postscreen_enforce_tls">postscreen_enforce_tls</a>.
 357
 358        <b><a href="postconf.5.html#tlsproxy_service_name">tlsproxy_service_name</a> (tlsproxy)</b>
 359               The name of the <a href="tlsproxy.8.html"><b>tlsproxy</b>(8)</a> service entry  in  mas-
 360               ter.cf.
 361
 362 <b>OBSOLETE STARTTLS SUPPORT CONTROLS</b>
 363        These  parameters  are  supported  for  compatibility with
 364        <a href="smtpd.8.html"><b>smtpd</b>(8)</a> legacy parameters.
 365
 366        <b><a href="postconf.5.html#postscreen_use_tls">postscreen_use_tls</a> ($<a href="postconf.5.html#smtpd_use_tls">smtpd_use_tls</a>)</b>
 367               Opportunistic TLS:  announce  STARTTLS  support  to
 368               SMTP  clients,  but do not require that clients use
 369               TLS encryption.
 370
 371        <b><a href="postconf.5.html#postscreen_enforce_tls">postscreen_enforce_tls</a> ($<a href="postconf.5.html#smtpd_enforce_tls">smtpd_enforce_tls</a>)</b>
 372               Mandatory TLS: announce STARTTLS  support  to  SMTP
 373               clients,  and  require that clients use TLS encryp-
 374               tion.
 375
 376 <b>MISCELLANEOUS CONTROLS</b>
 377        <b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b>
 378               The default location of  the  Postfix  <a href="postconf.5.html">main.cf</a>  and
 379               <a href="master.5.html">master.cf</a> configuration files.
 380
 381        <b><a href="postconf.5.html#delay_logging_resolution_limit">delay_logging_resolution_limit</a> (2)</b>
 382               The  maximal  number  of  digits  after the decimal
 383               point when logging sub-second delay values.
 384
 385        <b><a href="postconf.5.html#command_directory">command_directory</a> (see 'postconf -d' output)</b>
 386               The location of  all  postfix  administrative  com-
 387               mands.
 388
 389        <b><a href="postconf.5.html#max_idle">max_idle</a> (100s)</b>
 390               The  maximum  amount  of  time that an idle Postfix
 391               daemon process waits  for  an  incoming  connection
 392               before terminating voluntarily.
 393
 394        <b><a href="postconf.5.html#process_id">process_id</a> (read-only)</b>
 395               The  process  ID  of  a  Postfix  command or daemon
 396               process.
 397
 398        <b><a href="postconf.5.html#process_name">process_name</a> (read-only)</b>
 399               The process name of a  Postfix  command  or  daemon
 400               process.
 401
 402        <b><a href="postconf.5.html#syslog_facility">syslog_facility</a> (mail)</b>
 403               The syslog facility of Postfix logging.
 404
 405        <b><a href="postconf.5.html#syslog_name">syslog_name</a> (see 'postconf -d' output)</b>
 406               The  mail  system  name  that  is  prepended to the
 407               process name in syslog  records,  so  that  "smtpd"
 408               becomes, for example, "postfix/smtpd".
 409
 410 <b>SEE ALSO</b>
 411        <a href="smtpd.8.html">smtpd(8)</a>, Postfix SMTP server
 412        <a href="tlsproxy.8.html">tlsproxy(8)</a>, Postfix TLS proxy server
 413        <a href="dnsblog.8.html">dnsblog(8)</a>, DNS black/whitelist logger
 414        syslogd(8), system logging
 415
 416 <b>README FILES</b>
 417        <a href="POSTSCREEN_README.html">POSTSCREEN_README</a>, Postfix Postscreen Howto
 418
 419 <b>LICENSE</b>
 420        The Secure Mailer license must be  distributed  with  this
 421        software.
 422
 423 <b>HISTORY</b>
 424        This service was introduced with Postfix version 2.8.
 425
 426        Many  ideas in <a href="postscreen.8.html"><b>postscreen</b>(8)</a> were explored in earlier work
 427        by Michael Tokarev, in OpenBSD spamd, and in  MailChannels
 428        Traffic Control.
 429
 430 <b>AUTHOR(S)</b>
 431        Wietse Venema
 432        IBM T.J. Watson Research
 433        P.O. Box 704
 434        Yorktown Heights, NY 10598, USA
 435
 436                                                                  POSTSCREEN(8)
 437 </pre> </body> </html>