mix/selfpost
1
0
Fork 0
Code Issues Pull Requests Actions 10 Packages Projects Releases Wiki Activity

postfix: ETRN discarded from EHLO silently

Browse Source 
After the 2.14.4 rollout the test server's mail.log held "discarding EHLO
keywords: ETRN" for every connection on every port: smtpd logs a discard
unless the mask has EHLO_MASK_SILENT (Postfix 3.10.13, src/smtpd/smtpd.c:2016;
src/global/ehlo_mask.c:88 "SILENT-DISCARD"; postconf(5)
smtpd_discard_ehlo_keywords, "Specify the silent-discard pseudo keyword to
prevent this action from being logged"). smtpd_discard_ehlo_keywords is now
silent-discard,etrn; ETRN is still refused (smtpd_etrn_restrictions=reject)
and still not offered.

make e2e (64 passed; checkPostfixHardening reads the value back,
testInboundRelay still sees no ETRN in EHLO and 554) and go vet + go test
(26 packages) on the test server for this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
mix
2026-10-18 01:01:41 +03:00
co-authored by Claude Opus 5.5
parent 58356fb4d4
commit 8eec6728d4
4 changed files with 14 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
build/postfix-config.sh
+5 -2
View File
@@ -327,14 +327,17 @@ postconf -e \
# client flush the queue toward an inbound domain's upstream
# (fast_flush_domains = $relay_domains), and nothing here needs it (security
# audit 2026-10-17, S6; Postfix 3.10.13, src/smtpd/smtpd.c, etrn_cmd() asks
# smtpd_check_etrn(), whose "reject" answers reject_code, 554).
# smtpd_check_etrn(), whose "reject" answers reject_code, 554). The discard is
# silent: without the pseudo keyword smtpd logs "discarding EHLO keywords:
# ETRN" for every connection (src/smtpd/smtpd.c:2016, EHLO_MASK_SILENT;
# src/global/ehlo_mask.c:88; seen on the test server after 2.14.4).
postconf -e \
"smtpd_tls_protocols=>=TLSv1.2" \
"smtpd_tls_mandatory_protocols=>=TLSv1.2" \
"smtp_tls_mandatory_protocols=>=TLSv1.2" \
"disable_vrfy_command=yes" \
"smtpd_etrn_restrictions=reject" \
"smtpd_discard_ehlo_keywords=etrn" \
"smtpd_discard_ehlo_keywords=silent-discard,etrn" \
'smtpd_banner=$myhostname ESMTP'
# SASL: Cyrus with the local sasldb2 the panel maintains. The realm is left