# Postfix  Mailversand über  TLS 1.2

**URL:** <https://discourse.suseforum.de/t/postfix-mailversand-ueber-tls-1-2/3658>\
**Category:** Linux-Server\
**Created:** [4. Mai 2023 um 14:01 UTC](https://discourse.suseforum.de/t/postfix-mailversand-ueber-tls-1-2/3658 "2023-05-04T14:01:49Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![amiga1200](https://discourse.suseforum.de/letter_avatar_proxy/v4/letter/a/90db22/32.png) [@amiga1200](https://discourse.suseforum.de/u/amiga1200)\
**Post date:** [4. Mai 2023 um 14:01 UTC](https://discourse.suseforum.de/t/postfix-mailversand-ueber-tls-1-2/3658/1 "2023-05-04T14:01:49Z")

</div>

Über PHP werden Mails an Kunden verschickt z.B. neues Passwort u.s.w.

Dazu wurde einfach eine Versand Mailadresse beim Provider eingerichtet,  
und Postfix hat darüber versendet, wie es jedes Windows Mailprogramm wohl auch mach.

Dabei in der sasl\_passwd Provider Mailadresse:Passwort eingetragen.

Nun lässt der Provider nur noch verschlüsselte Mails zu, er schreibt: TLS 1.2 oder höher unterstützen.  
Bei meinem Windows Mailprogramm musste ich nur SSL einschalten.

Was muss unter Suse/Postfix konfiguriert werden, damit wieder Mails verschickt werden?

In die main.cf habe ich smtp\_use\_tls schon auf yes gestellt.

Wie kann ich eine verkürzte Version von main.conf ausgeben?

main.conf:

compatibility\_level = 2

queue\_directory = /var/spool/postfix

command\_directory = /usr/sbin

daemon\_directory = /usr/lib/postfix/bin/

data\_directory = /var/lib/postfix

mail\_owner = postfix

# You can also specify the absolute pathname of a pattern file instead

# of listing the patterns here. Specify type:table for table-based lookups

# (the value on the table right-hand side is not used).

# 

#mynetworks = 168.100.189.0/28, 127.0.0.0/8  
#mynetworks = $config\_directory/mynetworks  
#mynetworks = lmdb:/etc/postfix/network\_table

# The relay\_domains parameter restricts what destinations this system will

# relay mail to. See the smtpd\_recipient\_restrictions description in

# postconf(5) for detailed information.

# 

# By default, Postfix relays mail

# - from „trusted“ clients (IP address matches $mynetworks) to any destination,

# - from „untrusted“ clients to destinations that match $relay\_domains or

# subdomains thereof, except addresses with sender-specified routing.

# The default relay\_domains value is $mydestination.

# 

# In addition to the above, the Postfix SMTP server by default accepts mail

# that Postfix is final destination for:

# - destinations that match $inet\_interfaces or $proxy\_interfaces,

# - destinations that match $mydestination

# - destinations that match $virtual\_alias\_domains,

# - destinations that match $virtual\_mailbox\_domains.

# These destinations do not need to be listed in $relay\_domains.

# 

# Specify a list of hosts or domains, /file/name patterns or type:name

# lookup tables, separated by commas and/or whitespace. Continue

# long lines by starting the next line with whitespace. A file name

# is replaced by its contents; a type:name table is matched when a

# (parent) domain appears as lookup key.

# 

# NOTE: Postfix will not automatically forward mail for domains that

# list this system as their primary or backup MX host. See the

# permit\_mx\_backup restriction description in postconf(5).

# 

#relay\_domains = $mydestination

# INTERNET OR INTRANET

debug\_peer\_level = 2

debugger\_command =  
PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin  
ddd $daemon\_directory/$process\_name $process\_id & sleep 5

# 

sendmail\_path = /usr/sbin/sendmail

# newaliases\_path: The full pathname of the Postfix newaliases command.

# This is the Sendmail-compatible command to build alias databases.

# 

newaliases\_path = /usr/bin/newaliases

# mailq\_path: The full pathname of the Postfix mailq command. This

# is the Sendmail-compatible mail queue listing command.

# 

mailq\_path = /usr/bin/mailq

# setgid\_group: The group for mail submission and queue management

# commands. This must be a group name with a numerical group ID that

# is not shared with other accounts, not even with the Postfix account.

# 

setgid\_group = maildrop

# html\_directory: The location of the Postfix HTML documentation.

# 

html\_directory = /usr/share/doc/packages/postfix-doc/html

biff = no  
content\_filter =  
delay\_warning\_time = 1h  
disable\_dns\_lookups = no  
disable\_mime\_output\_conversion = no  
disable\_vrfy\_command = yes  
inet\_interfaces = localhost  
inet\_protocols = all  
masquerade\_classes = envelope\_sender, header\_sender, header\_recipient  
masquerade\_domains =  
masquerade\_exceptions = root  
mydestination = $myhostname, localhost.$mydomain, localhost  
myhostname = [massagen.org](http://massagen.org)  
mynetworks\_style = subnet  
relayhost = [smtp.1und1.de](http://smtp.1und1.de)

alias\_maps = lmdb:/etc/aliases  
canonical\_maps = lmdb:/etc/postfix/canonical  
relocated\_maps = lmdb:/etc/postfix/relocated  
sender\_canonical\_maps = lmdb:/etc/postfix/sender\_canonical  
transport\_maps = lmdb:/etc/postfix/transport  
mail\_spool\_directory = /var/mail  
message\_strip\_characters = \0  
defer\_transports =  
mailbox\_command =  
mailbox\_transport =  
mailbox\_size\_limit = 0  
message\_size\_limit = 0  
strict\_8bitmime = no  
strict\_rfc821\_envelopes = no  
smtpd\_delay\_reject = yes  
smtpd\_helo\_required = no

smtpd\_client\_restrictions =

smtpd\_helo\_restrictions =

smtpd\_sender\_restrictions = lmdb:/etc/postfix/access

smtpd\_recipient\_restrictions = permit\_mynetworks,reject\_unauth\_destination

############################################################

# SASL stuff

############################################################  
smtp\_sasl\_auth\_enable = yes  
smtp\_sasl\_security\_options = noanonymous

#smtp\_sasl\_password\_maps = hash:/etc/postfix/sasl\_passwd  
smtp\_sasl\_password\_maps = lmdb:/etc/postfix/sasl\_passwd  
smtpd\_sasl\_auth\_enable = yes

# cyrus : smtpd\_sasl\_type = cyrus

smtpd\_sasl\_type = cyrus  
smtpd\_sasl\_path = smtpd  
############################################################

# TLS stuff

############################################################  
#tls\_append\_default\_CA = no  
relay\_clientcerts =  
#tls\_random\_source = dev:/dev/urandom

smtp\_use\_tls = yes #no  
#smtp\_tls\_loglevel = 0  
smtp\_enforce\_tls = no  
smtp\_tls\_CAfile =  
smtp\_tls\_CApath =  
smtp\_tls\_cert\_file =  
smtp\_tls\_key\_file =  
#smtp\_tls\_policy\_maps = lmdb:/etc/postfix/tls\_policy  
#smtp\_tls\_session\_cache\_timeout = 3600s  
smtp\_tls\_session\_cache\_database =

smtpd\_use\_tls = no  
#smtpd\_tls\_loglevel = 0  
smtpd\_tls\_CAfile =  
smtpd\_tls\_CApath =  
smtpd\_tls\_cert\_file =  
smtpd\_tls\_key\_file =  
smtpd\_tls\_ask\_ccert = no  
smtpd\_tls\_exclude\_ciphers = RC4  
smtpd\_tls\_received\_header = no  
############################################################

# Start MySQL from [postfixwiki.org](http://postfixwiki.org)

############################################################  
relay\_domains = $mydestination lmdb:/etc/postfix/relay  
#virtual\_alias\_domains =  
virtual\_alias\_maps = lmdb:/etc/postfix/virtual  
#virtual\_uid\_maps = static:303  
#virtual\_gid\_maps = static:303  
#virtual\_minimum\_uid = 303  
#virtual\_mailbox\_base = /srv/maildirs  
#virtual\_mailbox\_domains = mysql:/etc/postfix/mysql\_virtual\_domains\_maps.cf  
#virtual\_mailbox\_limit = 0  
#virtual\_mailbox\_limit\_inbox = no  
#virtual\_mailbox\_maps = mysql:/etc/postfix/mysql\_virtual\_mailbox\_maps.cf

## For dovecot LMTP replace ‚virtual‘ with ‚lmtp:unix:private/dovecot-lmtp‘

#virtual\_transport = virtual

## Additional for quota support

#virtual\_mailbox\_limit\_maps = mysql:/etc/postfix/mysql\_virtual\_mailbox\_limit\_maps.cf  
#virtual\_mailbox\_limit\_override = yes

### Needs Maildir++ compatible IMAP servers, like Courier-IMAP

#virtual\_maildir\_filter = yes  
#virtual\_maildir\_filter\_maps = lmdb:/etc/postfix/vfilter  
#virtual\_maildir\_limit\_message = Sorry, the user’s maildir has overdrawn his diskspace quota, please try again later.  
#virtual\_maildir\_limit\_message\_maps = lmdb:/etc/postfix/vmsg  
#virtual\_overquota\_bounce = yes  
#virtual\_trash\_count = yes  
#virtual\_trash\_name = „.Trash“  
############################################################

# End MySQL from [postfixwiki.org](http://postfixwiki.org)

############################################################

# Rewrite reject codes

############################################################  
#unknown\_address\_reject\_code = 550  
#unknown\_client\_reject\_code = 550  
#unknown\_hostname\_reject\_code = 550  
#unverified\_recipient\_reject\_code = 550  
#soft\_bounce = yes  
############################################################  
#debug\_peer\_list = [example.com](http://example.com)  
#debug\_peer\_level = 3