xref: /netbsd-src/external/ibm-public/postfix/dist/RELEASE_NOTES-2.10 (revision 16d67a18c4cbb2d3cb426b01120f4938ca6dbbf9)
1The stable Postfix release is called postfix-2.10.x where 2=major
2release number, 10=minor release number, x=patchlevel.  The stable
3release never changes except for patches that address bugs or
4emergencies. Patches change the patchlevel and the release date.
5
6New features are developed in snapshot releases. These are called
7postfix-2.11-yyyymmdd where yyyymmdd is the release date (yyyy=year,
8mm=month, dd=day).  Patches are never issued for snapshot releases;
9instead, a new snapshot is released.
10
11The mail_release_date configuration parameter (format: yyyymmdd)
12specifies the release date of a stable release or snapshot release.
13
14If you upgrade from Postfix 2.8 or earlier, read RELEASE_NOTES-2.9
15before proceeding.
16
17Major changes - laptop-friendliness
18-----------------------------------
19
20[Incompat 20120924] Postfix no longer uses FIFOs to emulate UNIX-domain
21sockets on Solaris 9 (Vintage 2002!) and later. If you install
22Postfix for the first time on an older Solaris system, edit the
23master.cf file and replace "unix" with "fifo" for the pickup and
24qmgr services.
25
26[Feature 20120924] the default master.cf file now uses "unix" instead
27of "fifo" for the pickup and qmgr services. This avoids periodic
28disk drive spin-up.
29
30Major changes - permit logging
31------------------------------
32
33[Feature 20120303] [Feature 20120303] New control for "permit"
34logging in smtpd_mumble_restrictions (by default, the SMTP server
35logs "reject" actions but not "permit" actions).  Specify
36"smtpd_log_access_permit_actions = static:all" to log all "permit"-style
37actions, or specify a list of explicit action names.  More details
38are in the postconf(5) manpage.
39
40Major changes - postconf
41------------------------
42
43[Incompat 20121224] The postconf command produces more warnings:
44
45- An attempt to modify a read-only parameter (process_name, process_id)
46  in main.cf or master.cf.
47
48- An undefined $name in a parameter value in main.cf or master.cf
49  (except for backwards-compatibility parameters such as $virtual_maps).
50
51[Feature 20121224] The postconf command has been updated to make
52trouble-shooting (and support) easier. In summary, use "postconf
53-Mxf" and "postconf -nxf" to review master.cf and main.cf parameter
54settings with expanded parameter values.
55
56- "postconf -x" now expands $name in main.cf and master.cf parameter
57  values.
58
59- postconf warns about attempts to modify a read-only parameter
60  (process_name, process_id) in main.cf or master.cf.
61
62- postconf warns about an undefined $name in a parameter value in
63  main.cf or master.cf (except for backwards-compatibility parameters
64  such as $virtual_maps).
65
66[Feature 20121227]
67
68- "postconf -o name=value" overrides main.cf parameter settings.
69  This can be used, for example, to examine stress-dependent settings
70  with "postconf -x -o stress=yes".
71
72Major changes - postscreen
73--------------------------
74
75[Incompat 20121123] The postscreen deep protocol tests now log the
76last command before a protocol error ("UNIMPLEMENTED" when the last
77command is not implemented, "CONNECT" when there was no prior
78command). The changed logfile messages are:
79
80NON-SMTP COMMAND from [address]:port after command: text
81BARE NEWLINE from [address]:port after command
82COMMAND TIME LIMIT from [address]:port after command
83COMMAND COUNT LIMIT from [address]:port after command
84COMMAND LENGTH LIMIT from [address]:port after command
85
86Major changes - load-balancer support
87-------------------------------------
88
89[Incompat 20120625] The postscreen(8)-to-smtpd(8) protocol has
90changed.  To avoid "cannot receive connection attributes" warnings
91and dropped connections, execute the command "postfix reload". No
92mail will be lost as long as the remote SMTP client tries again
93later.
94
95[Feature 20120625] Support for upstream proxy agent in the postscreen(8)
96and smtpd(8) daemons.  To enable the haproxy protocol, specify one
97of the following:
98
99    postscreen_upstream_proxy_protocol = haproxy
100    smtpd_upstream_proxy_protocol = haproxy
101
102Note 1: smtpd_upstream_proxy_protocol can't be used in smtpd processes
103that are behind postscreen. Configure postscreen_upstream_proxy_protocol
104instead.
105
106Note 2: To use the nginx proxy with smtpd(8), enable the XCLIENT
107protocol with smtpd_authorized_xclient_hosts. This supports SASL
108authentication in the proxy agent (Postfix 2.9 and later).
109
110Major changes - relay safety
111----------------------------
112
113[Incompat 20130613] New smtpd_relay_restrictions parameter built-in
114default settings:
115
116    smtpd_relay_restrictions =
117	permit_mynetworks
118	permit_sasl_authenticated
119	defer_unauth_destination
120
121This safety net prevents open relay problems due to mistakes
122with spam filter rules in smtpd_recipient_restrictions.
123
124If your site has a complex mail relay policy configured under
125smtpd_recipient_restrictions, this safety net may defer mail that
126Postfix should accept.
127
128To fix this safety net, take one of the following actions:
129
130- Set smtpd_relay_restrictions empty, and keep using the existing
131  mail relay authorization policy in smtpd_recipient_restrictions.
132
133- Copy the existing mail relay authorization policy from
134  smtpd_recipient_restrictions to smtpd_relay_restrictions.
135
136There is no need to change the value of smtpd_recipient_restrictions.
137
138[Feature 20130613] This version introduces the smtpd_relay_restrictions
139feature for mail relay control. The new built-in default settings
140are:
141
142    smtpd_relay_restrictions =
143	permit_mynetworks
144 	permit_sasl_authenticated
145	defer_unauth_destination
146
147    smtpd_recipient_restrictions =
148	( optional spam blocking rules would go here )
149
150For comparison, this is the Postfix before 2.10 default:
151
152    smtpd_recipient_restrictions =
153	permit_mynetworks
154	reject_unauth_destination
155	( optional spam blocking rules would go here )
156
157With Postfix versions before 2.10, the mail relay policy and spam
158blocking policy were combined under smtpd_recipient_restrictions,
159resulting in error-prone configuration.
160
161As of Postfix 2.10, the mail relay policy is preferably implemented
162with smtpd_relay_restrictions, so that a permissive spam blocking
163policy under smtpd_recipient_restrictions will not unexpectedly
164result in a permissive mail relay policy.
165
166As of Postfix 2.10.0 the smtpd_relay_restrictions parameter built-in
167default settings are:
168
169    smtpd_relay_restrictions =
170        permit_mynetworks
171        permit_sasl_authenticated
172        defer_unauth_destination
173
174If your site has a complex mail relay policy configured under
175smtpd_recipient_restrictions, this safety net may defer mail that
176Postfix should accept.
177
178To migrate from an earlier Postfix release with the least amount
179of pain:
180
181- Set smtpd_relay_restrictions empty, and keep using the existing
182  mail relay authorization policy in smtpd_recipient_restrictions.
183
184- There is no need to change the value of smtpd_recipient_restrictions.
185
186To take advantage of the new smtpd_relay_restrictions feature:
187
188- Copy the existing mail relay authorization policy from
189  smtpd_recipient_restrictions to smtpd_relay_restrictions.
190
191- There is no need to change the value of smtpd_recipient_restrictions.
192
193Major changes - start-up
194------------------------
195
196[Feature 20120306] New master "-w" option, to wait for master daemon
197process initialization to complete. This feature returns an error
198exit status if master daemon initialization fails, or if it does
199not complete in a reasonable amount of time. The exit status is
200used by "postfix start" to provide more accurate information to
201system start-up scripts.
202
203Major changes - tls
204-------------------
205
206[Incompat 20130203] Thanks to OpenSSL documentation, the Postfix
2072.9.0..2.9.5 SMTP client and server server used an incorrect procedure
208to compute TLS certificate PUBLIC-KEY fingerprints (these may be
209used in the check_ccert_access and in smtp_tls_policy_maps features).
210Support for certificate PUBLIC-KEY finger prints was introduced
211with Postfix 2.9; there is no known problem with the certificate
212fingerprint algorithms available since Postfix 2.2.
213
214Certificate PUBLIC-KEY finger prints may be used in the Postfix
215SMTP server (with "check_ccert_access") and in the Postfix SMTP
216client (with the "fingerprint" security level).
217
218Specify "tls_legacy_public_key_fingerprints = yes" temporarily,
219pending a migration from configuration files with incorrect Postfix
2202.9.0..2.9.5 certificate PUBLIC-KEY finger prints, to the correct
221fingerprints used by Postfix 2.9.6 and later.
222
223To compute the correct PUBLIC-KEY finger prints:
224
225# OpenSSL 1.0 with all certificates and SHA-1 fingerprints.
226$ openssl x509 -in cert.pem -noout -pubkey | \
227    openssl pkey -pubin -outform DER | \
228    openssl dgst -sha1 -c
229
230# OpenSSL 0.9.8 with RSA certificates and MD5 fingerprints.
231$ openssl x509 -in cert.pem -noout -pubkey | \
232    openssl rsa -pubin -outform DER | \
233    openssl dgst -md5 -c
234
235[Feature 20120422] This release adds support to turn off the TLSv1.1
236and TLSv1.2 protocols.  Introduced with OpenSSL version 1.0.1, these
237are known to cause inter-operability problems with for example
238hotmail.
239
240The radical workaround is to temporarily turn off problematic
241protocols globally:
242
243/etc/postfix/main.cf:
244    smtp_tls_protocols = !SSLv2, !TLSv1.1, !TLSv1.2
245    smtp_tls_mandatory_protocols = !SSLv2, !TLSv1.1, !TLSv1.2
246
247    smtpd_tls_protocols = !SSLv2, !TLSv1.1, !TLSv1.2
248    smtpd_tls_mandatory_protocols = !SSLv2, !TLSv1.1, !TLSv1.2
249
250However, it may be better to temporarily turn off problematic
251protocols for broken sites only:
252
253/etc/postfix/main.cf:
254    smtp_tls_policy_maps = hash:/etc/postfix/tls_policy
255
256/etc/postfix/tls_policy:
257    example.com         may protocols=!SSLv2:!TLSv1.1:!TLSv1.2
258
259Important:
260
261- Note the use of ":" instead of comma or space. Also, note that
262  there is NO space around the "=" in "protocols=".
263
264- The smtp_tls_policy_maps lookup key must match the "next-hop"
265  destination that is given to the Postfix SMTP client. If you
266  override the next-hop destination with transport_maps, relayhost,
267  sender_dependent_relayhost_maps, or otherwise, you need to specify
268  the same destination for the smtp_tls_policy_maps lookup key.
269