{"action":"created","issue":{"url":"https://api.github.com/repos/freedomofpress/securedrop/issues/1081","labels_url":"https://api.github.com/repos/freedomofpress/securedrop/issues/1081/labels{/name}","comments_url":"https://api.github.com/repos/freedomofpress/securedrop/issues/1081/comments","events_url":"https://api.github.com/repos/freedomofpress/securedrop/issues/1081/events","html_url":"https://github.com/freedomofpress/securedrop/pull/1081","id":96683599,"number":1081,"title":"Remove SMTP fingerprint requirement for OSSEC Postfix config","user":{"login":"conorsch","id":657862,"avatar_url":"https://avatars.githubusercontent.com/u/657862?v=3","gravatar_id":"","url":"https://api.github.com/users/conorsch","html_url":"https://github.com/conorsch","followers_url":"https://api.github.com/users/conorsch/followers","following_url":"https://api.github.com/users/conorsch/following{/other_user}","gists_url":"https://api.github.com/users/conorsch/gists{/gist_id}","starred_url":"https://api.github.com/users/conorsch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/conorsch/subscriptions","organizations_url":"https://api.github.com/users/conorsch/orgs","repos_url":"https://api.github.com/users/conorsch/repos","events_url":"https://api.github.com/users/conorsch/events{/privacy}","received_events_url":"https://api.github.com/users/conorsch/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":16,"created_at":"2015-07-22T22:44:15Z","updated_at":"2015-07-27T21:44:59Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/freedomofpress/securedrop/pulls/1081","html_url":"https://github.com/freedomofpress/securedrop/pull/1081","diff_url":"https://github.com/freedomofpress/securedrop/pull/1081.diff","patch_url":"https://github.com/freedomofpress/securedrop/pull/1081.patch"},"body":"As discussed in #1076, requiring a fingerprint match for SMTP servers can cause OSSEC notifications to fail to send, since the fingerprint can change at any time. The solution requires admin intervention in the form of querying the new fingerprint, updating the playbook, and rerunning the playbook. \r\n\r\nA less onerous workflow is to leverage the `smtp_tls_security_level = secure` setting in the Postfix configuration, which requires a secure channel for negotiation, then trusts the lookup as long as it passes verification.\r\n\r\nThe changes in this PR update the postfix config to use the system CAs present in `/etc/ssl/certs` (and _only_ those CAs) by default. In case an admin wants to provide a custom certificate for the SMTP relay, the admin should declare the `smtp_relay_cert_override_file` var, which will cause the custom certificate to be added to `/etc/ssl/certs_local`.\r\n\r\nNo documentation changes have been made yet, pending discussion of this implementation."},"comment":{"url":"https://api.github.com/repos/freedomofpress/securedrop/issues/comments/125351102","html_url":"https://github.com/freedomofpress/securedrop/pull/1081#issuecomment-125351102","issue_url":"https://api.github.com/repos/freedomofpress/securedrop/issues/1081","id":125351102,"user":{"login":"conorsch","id":657862,"avatar_url":"https://avatars.githubusercontent.com/u/657862?v=3","gravatar_id":"","url":"https://api.github.com/users/conorsch","html_url":"https://github.com/conorsch","followers_url":"https://api.github.com/users/conorsch/followers","following_url":"https://api.github.com/users/conorsch/following{/other_user}","gists_url":"https://api.github.com/users/conorsch/gists{/gist_id}","starred_url":"https://api.github.com/users/conorsch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/conorsch/subscriptions","organizations_url":"https://api.github.com/users/conorsch/orgs","repos_url":"https://api.github.com/users/conorsch/repos","events_url":"https://api.github.com/users/conorsch/events{/privacy}","received_events_url":"https://api.github.com/users/conorsch/received_events","type":"User","site_admin":false},"created_at":"2015-07-27T21:44:59Z","updated_at":"2015-07-27T21:44:59Z","body":"To be clear, I don't oppose supporting multiple fingerprints in general, but I do oppose introducing new and untested functionality while mitigating a known issue. Should a need for multiple fingerprints arise own the road, implementation should be discussed in its own issue."}}