{"action":"created","comment":{"url":"https://api.github.com/repos/freedomofpress/securedrop/pulls/comments/35437438","id":35437438,"diff_hunk":"@@ -40,7 +41,6 @@ These are the values you must specify in `prod-specific.yml`:\n  * Email username to authenticate to the SMTP relay: `sasl_username`\n  * Domain name of the email used to send OSSEC alerts: `sasl_domain`\n  * Password of the email used to send OSSEC alerts: `sasl_password`\n- * The fingerprint of your SMTP relay: `smtp_relay_fingerprint`","path":"docs/ossec_alerts.md","position":21,"original_position":21,"commit_id":"5b965c604e5a7a663d6846d855eb5f1a49b418b8","original_commit_id":"5b965c604e5a7a663d6846d855eb5f1a49b418b8","user":{"login":"garrettr","id":407302,"avatar_url":"https://avatars.githubusercontent.com/u/407302?v=3","gravatar_id":"","url":"https://api.github.com/users/garrettr","html_url":"https://github.com/garrettr","followers_url":"https://api.github.com/users/garrettr/followers","following_url":"https://api.github.com/users/garrettr/following{/other_user}","gists_url":"https://api.github.com/users/garrettr/gists{/gist_id}","starred_url":"https://api.github.com/users/garrettr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/garrettr/subscriptions","organizations_url":"https://api.github.com/users/garrettr/orgs","repos_url":"https://api.github.com/users/garrettr/repos","events_url":"https://api.github.com/users/garrettr/events{/privacy}","received_events_url":"https://api.github.com/users/garrettr/received_events","type":"User","site_admin":false},"body":"You should document the three supported tiers of TLS connection security here. Maybe re-include this line but add \"(Optional)\" at the beginning, add a line for the smtp cafile override, and add a paragraph somewhere explaining how to choose between the three options.","created_at":"2015-07-24T16:06:49Z","updated_at":"2015-07-24T16:06:49Z","html_url":"https://github.com/freedomofpress/securedrop/pull/1081#discussion_r35437438","pull_request_url":"https://api.github.com/repos/freedomofpress/securedrop/pulls/1081","_links":{"self":{"href":"https://api.github.com/repos/freedomofpress/securedrop/pulls/comments/35437438"},"html":{"href":"https://github.com/freedomofpress/securedrop/pull/1081#discussion_r35437438"},"pull_request":{"href":"https://api.github.com/repos/freedomofpress/securedrop/pulls/1081"}}},"pull_request":{"url":"https://api.github.com/repos/freedomofpress/securedrop/pulls/1081","id":40620287,"html_url":"https://github.com/freedomofpress/securedrop/pull/1081","diff_url":"https://github.com/freedomofpress/securedrop/pull/1081.diff","patch_url":"https://github.com/freedomofpress/securedrop/pull/1081.patch","issue_url":"https://api.github.com/repos/freedomofpress/securedrop/issues/1081","number":1081,"state":"open","locked":false,"title":"Remove SMTP fingerprint requirement for OSSEC Postfix config","user":{"login":"conorsch","id":657862,"avatar_url":"https://avatars.githubusercontent.com/u/657862?v=3","gravatar_id":"","url":"https://api.github.com/users/conorsch","html_url":"https://github.com/conorsch","followers_url":"https://api.github.com/users/conorsch/followers","following_url":"https://api.github.com/users/conorsch/following{/other_user}","gists_url":"https://api.github.com/users/conorsch/gists{/gist_id}","starred_url":"https://api.github.com/users/conorsch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/conorsch/subscriptions","organizations_url":"https://api.github.com/users/conorsch/orgs","repos_url":"https://api.github.com/users/conorsch/repos","events_url":"https://api.github.com/users/conorsch/events{/privacy}","received_events_url":"https://api.github.com/users/conorsch/received_events","type":"User","site_admin":false},"body":"As discussed in #1076, requiring a fingerprint match for SMTP servers can cause OSSEC notifications to fail to send, since the fingerprint can change at any time. The solution requires admin intervention in the form of querying the new fingerprint, updating the playbook, and rerunning the playbook. \r\n\r\nA less onerous workflow is to leverage the `smtp_tls_security_level = secure` setting in the Postfix configuration, which requires a secure channel for negotiation, then trusts the lookup as long as it passes verification.\r\n\r\nThe changes in this PR update the postfix config to use the system CAs present in `/etc/ssl/certs` (and _only_ those CAs) by default. In case an admin wants to provide a custom certificate for the SMTP relay, the admin should declare the `smtp_relay_cert_override_file` var, which will cause the custom certificate to be added to `/etc/ssl/certs_local`.\r\n\r\nNo documentation changes have been made yet, pending discussion of this implementation.","created_at":"2015-07-22T22:44:15Z","updated_at":"2015-07-24T16:06:49Z","closed_at":null,"merged_at":null,"merge_commit_sha":"25a3720b2d8d14c2072680232f8123c1818eae3c","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/freedomofpress/securedrop/pulls/1081/commits","review_comments_url":"https://api.github.com/repos/freedomofpress/securedrop/pulls/1081/comments","review_comment_url":"https://api.github.com/repos/freedomofpress/securedrop/pulls/comments{/number}","comments_url":"https://api.github.com/repos/freedomofpress/securedrop/issues/1081/comments","statuses_url":"https://api.github.com/repos/freedomofpress/securedrop/statuses/5b965c604e5a7a663d6846d855eb5f1a49b418b8","head":{"label":"conorsch:remove-smtp-fingerprint-requirement","ref":"remove-smtp-fingerprint-requirement","sha":"5b965c604e5a7a663d6846d855eb5f1a49b418b8","user":{"login":"conorsch","id":657862,"avatar_url":"https://avatars.githubusercontent.com/u/657862?v=3","gravatar_id":"","url":"https://api.github.com/users/conorsch","html_url":"https://github.com/conorsch","followers_url":"https://api.github.com/users/conorsch/followers","following_url":"https://api.github.com/users/conorsch/following{/other_user}","gists_url":"https://api.github.com/users/conorsch/gists{/gist_id}","starred_url":"https://api.github.com/users/conorsch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/conorsch/subscriptions","organizations_url":"https://api.github.com/users/conorsch/orgs","repos_url":"https://api.github.com/users/conorsch/repos","events_url":"https://api.github.com/users/conorsch/events{/privacy}","received_events_url":"https://api.github.com/users/conorsch/received_events","type":"User","site_admin":false},"repo":{"id":32643414,"name":"securedrop","full_name":"conorsch/securedrop","owner":{"login":"conorsch","id":657862,"avatar_url":"https://avatars.githubusercontent.com/u/657862?v=3","gravatar_id":"","url":"https://api.github.com/users/conorsch","html_url":"https://github.com/conorsch","followers_url":"https://api.github.com/users/conorsch/followers","following_url":"https://api.github.com/users/conorsch/following{/other_user}","gists_url":"https://api.github.com/users/conorsch/gists{/gist_id}","starred_url":"https://api.github.com/users/conorsch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/conorsch/subscriptions","organizations_url":"https://api.github.com/users/conorsch/orgs","repos_url":"https://api.github.com/users/conorsch/repos","events_url":"https://api.github.com/users/conorsch/events{/privacy}","received_events_url":"https://api.github.com/users/conorsch/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/conorsch/securedrop","description":"GitHub repository for the SecureDrop whistleblower platform. Do not submit tips here!","fork":true,"url":"https://api.github.com/repos/conorsch/securedrop","forks_url":"https://api.github.com/repos/conorsch/securedrop/forks","keys_url":"https://api.github.com/repos/conorsch/securedrop/keys{/key_id}","collaborators_url":"https://api.github.com/repos/conorsch/securedrop/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/conorsch/securedrop/teams","hooks_url":"https://api.github.com/repos/conorsch/securedrop/hooks","issue_events_url":"https://api.github.com/repos/conorsch/securedrop/issues/events{/number}","events_url":"https://api.github.com/repos/conorsch/securedrop/events","assignees_url":"https://api.github.com/repos/conorsch/securedrop/assignees{/user}","branches_url":"https://api.github.com/repos/conorsch/securedrop/branches{/branch}","tags_url":"https://api.github.com/repos/conorsch/securedrop/tags","blobs_url":"https://api.github.com/repos/conorsch/securedrop/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/conorsch/securedrop/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/conorsch/securedrop/git/refs{/sha}","trees_url":"https://api.github.com/repos/conorsch/securedrop/git/trees{/sha}","statuses_url":"https://api.github.com/repos/conorsch/securedrop/statuses/{sha}","languages_url":"https://api.github.com/repos/conorsch/securedrop/languages","stargazers_url":"https://api.github.com/repos/conorsch/securedrop/stargazers","contributors_url":"https://api.github.com/repos/conorsch/securedrop/contributors","subscribers_url":"https://api.github.com/repos/conorsch/securedrop/subscribers","subscription_url":"https://api.github.com/repos/conorsch/securedrop/subscription","commits_url":"https://api.github.com/repos/conorsch/securedrop/commits{/sha}","git_commits_url":"https://api.github.com/repos/conorsch/securedrop/git/commits{/sha}","comments_url":"https://api.github.com/repos/conorsch/securedrop/comments{/number}","issue_comment_url":"https://api.github.com/repos/conorsch/securedrop/issues/comments{/number}","contents_url":"https://api.github.com/repos/conorsch/securedrop/contents/{+path}","compare_url":"https://api.github.com/repos/conorsch/securedrop/compare/{base}...{head}","merges_url":"https://api.github.com/repos/conorsch/securedrop/merges","archive_url":"https://api.github.com/repos/conorsch/securedrop/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/conorsch/securedrop/downloads","issues_url":"https://api.github.com/repos/conorsch/securedrop/issues{/number}","pulls_url":"https://api.github.com/repos/conorsch/securedrop/pulls{/number}","milestones_url":"https://api.github.com/repos/conorsch/securedrop/milestones{/number}","notifications_url":"https://api.github.com/repos/conorsch/securedrop/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/conorsch/securedrop/labels{/name}","releases_url":"https://api.github.com/repos/conorsch/securedrop/releases{/id}","created_at":"2015-03-21T17:59:44Z","updated_at":"2015-03-21T17:59:46Z","pushed_at":"2015-07-24T00:24:54Z","git_url":"git://github.com/conorsch/securedrop.git","ssh_url":"git@github.com:conorsch/securedrop.git","clone_url":"https://github.com/conorsch/securedrop.git","svn_url":"https://github.com/conorsch/securedrop","homepage":"https://freedom.press/securedrop","size":30520,"stargazers_count":0,"watchers_count":0,"language":"Python","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":1,"forks":0,"open_issues":1,"watchers":0,"default_branch":"develop"}},"base":{"label":"freedomofpress:develop","ref":"develop","sha":"0600ac2619dc62555afb5bbeae9d09c9b4ea7511","user":{"login":"freedomofpress","id":5388147,"avatar_url":"https://avatars.githubusercontent.com/u/5388147?v=3","gravatar_id":"","url":"https://api.github.com/users/freedomofpress","html_url":"https://github.com/freedomofpress","followers_url":"https://api.github.com/users/freedomofpress/followers","following_url":"https://api.github.com/users/freedomofpress/following{/other_user}","gists_url":"https://api.github.com/users/freedomofpress/gists{/gist_id}","starred_url":"https://api.github.com/users/freedomofpress/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/freedomofpress/subscriptions","organizations_url":"https://api.github.com/users/freedomofpress/orgs","repos_url":"https://api.github.com/users/freedomofpress/repos","events_url":"https://api.github.com/users/freedomofpress/events{/privacy}","received_events_url":"https://api.github.com/users/freedomofpress/received_events","type":"Organization","site_admin":false},"repo":{"id":3156820,"name":"securedrop","full_name":"freedomofpress/securedrop","owner":{"login":"freedomofpress","id":5388147,"avatar_url":"https://avatars.githubusercontent.com/u/5388147?v=3","gravatar_id":"","url":"https://api.github.com/users/freedomofpress","html_url":"https://github.com/freedomofpress","followers_url":"https://api.github.com/users/freedomofpress/followers","following_url":"https://api.github.com/users/freedomofpress/following{/other_user}","gists_url":"https://api.github.com/users/freedomofpress/gists{/gist_id}","starred_url":"https://api.github.com/users/freedomofpress/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/freedomofpress/subscriptions","organizations_url":"https://api.github.com/users/freedomofpress/orgs","repos_url":"https://api.github.com/users/freedomofpress/repos","events_url":"https://api.github.com/users/freedomofpress/events{/privacy}","received_events_url":"https://api.github.com/users/freedomofpress/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/freedomofpress/securedrop","description":"GitHub repository for the SecureDrop whistleblower platform. Do not submit tips here!","fork":false,"url":"https://api.github.com/repos/freedomofpress/securedrop","forks_url":"https://api.github.com/repos/freedomofpress/securedrop/forks","keys_url":"https://api.github.com/repos/freedomofpress/securedrop/keys{/key_id}","collaborators_url":"https://api.github.com/repos/freedomofpress/securedrop/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/freedomofpress/securedrop/teams","hooks_url":"https://api.github.com/repos/freedomofpress/securedrop/hooks","issue_events_url":"https://api.github.com/repos/freedomofpress/securedrop/issues/events{/number}","events_url":"https://api.github.com/repos/freedomofpress/securedrop/events","assignees_url":"https://api.github.com/repos/freedomofpress/securedrop/assignees{/user}","branches_url":"https://api.github.com/repos/freedomofpress/securedrop/branches{/branch}","tags_url":"https://api.github.com/repos/freedomofpress/securedrop/tags","blobs_url":"https://api.github.com/repos/freedomofpress/securedrop/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/freedomofpress/securedrop/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/freedomofpress/securedrop/git/refs{/sha}","trees_url":"https://api.github.com/repos/freedomofpress/securedrop/git/trees{/sha}","statuses_url":"https://api.github.com/repos/freedomofpress/securedrop/statuses/{sha}","languages_url":"https://api.github.com/repos/freedomofpress/securedrop/languages","stargazers_url":"https://api.github.com/repos/freedomofpress/securedrop/stargazers","contributors_url":"https://api.github.com/repos/freedomofpress/securedrop/contributors","subscribers_url":"https://api.github.com/repos/freedomofpress/securedrop/subscribers","subscription_url":"https://api.github.com/repos/freedomofpress/securedrop/subscription","commits_url":"https://api.github.com/repos/freedomofpress/securedrop/commits{/sha}","git_commits_url":"https://api.github.com/repos/freedomofpress/securedrop/git/commits{/sha}","comments_url":"https://api.github.com/repos/freedomofpress/securedrop/comments{/number}","issue_comment_url":"https://api.github.com/repos/freedomofpress/securedrop/issues/comments{/number}","contents_url":"https://api.github.com/repos/freedomofpress/securedrop/contents/{+path}","compare_url":"https://api.github.com/repos/freedomofpress/securedrop/compare/{base}...{head}","merges_url":"https://api.github.com/repos/freedomofpress/securedrop/merges","archive_url":"https://api.github.com/repos/freedomofpress/securedrop/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/freedomofpress/securedrop/downloads","issues_url":"https://api.github.com/repos/freedomofpress/securedrop/issues{/number}","pulls_url":"https://api.github.com/repos/freedomofpress/securedrop/pulls{/number}","milestones_url":"https://api.github.com/repos/freedomofpress/securedrop/milestones{/number}","notifications_url":"https://api.github.com/repos/freedomofpress/securedrop/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/freedomofpress/securedrop/labels{/name}","releases_url":"https://api.github.com/repos/freedomofpress/securedrop/releases{/id}","created_at":"2012-01-11T19:57:55Z","updated_at":"2015-07-24T03:09:26Z","pushed_at":"2015-07-24T00:43:18Z","git_url":"git://github.com/freedomofpress/securedrop.git","ssh_url":"git@github.com:freedomofpress/securedrop.git","clone_url":"https://github.com/freedomofpress/securedrop.git","svn_url":"https://github.com/freedomofpress/securedrop","homepage":"https://freedom.press/securedrop","size":41699,"stargazers_count":1490,"watchers_count":1490,"language":"Python","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":237,"mirror_url":null,"open_issues_count":164,"forks":237,"open_issues":164,"watchers":1490,"default_branch":"develop"}},"_links":{"self":{"href":"https://api.github.com/repos/freedomofpress/securedrop/pulls/1081"},"html":{"href":"https://github.com/freedomofpress/securedrop/pull/1081"},"issue":{"href":"https://api.github.com/repos/freedomofpress/securedrop/issues/1081"},"comments":{"href":"https://api.github.com/repos/freedomofpress/securedrop/issues/1081/comments"},"review_comments":{"href":"https://api.github.com/repos/freedomofpress/securedrop/pulls/1081/comments"},"review_comment":{"href":"https://api.github.com/repos/freedomofpress/securedrop/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/freedomofpress/securedrop/pulls/1081/commits"},"statuses":{"href":"https://api.github.com/repos/freedomofpress/securedrop/statuses/5b965c604e5a7a663d6846d855eb5f1a49b418b8"}}}}