![\"Byl](\"\/wp-content\/uploads\/2025\/02\/d0a8ec5a067a9d674e2b77db68d1a4f0.gif\")
<\/center> <\/p>\nHlavn\u00ed novinky: <\/p>\n
- \n
- Byla p\u0159id\u00e1na mo\u017enost pou\u017eit\u00ed kryptografick\u00fdch algoritm\u016f TLS odoln\u00fdch proti \u00fatok\u016fm na kvantov\u00fdch po\u010d\u00edta\u010d\u00edch. Pro vyu\u017eit\u00ed t\u011bchto algoritm\u016f je vy\u017eadov\u00e1no pou\u017eit\u00ed v\u011btve knihovny OpenSSL 3.5, kter\u00e1 zat\u00edm nen\u00ed dokon\u010dena. Pro v\u00fdb\u011br postkvantov\u00fdch algoritm\u016f v Postfix nebyl zaveden nov\u00fd syntax TSL skupin, ale rely na nastaven\u00ed OpenSSL, kter\u00e9 se pou\u017eij\u00ed p\u0159i instalaci parametr\u016f \u201etls_eecdh_auto_curves\u201c a \u201etls_ffdhe_auto_groups\u201c s pr\u00e1zdn\u00fdmi hodnotami.\n
- Byla p\u0159id\u00e1na podpora hlavi\u010dky zpr\u00e1v \u201eTLS-Required: no\u201c (RFC 8689), p\u0159i kter\u00e9 bude doru\u010den\u00ed provedeno i v p\u0159\u00edpad\u011b, \u017ee nen\u00ed mo\u017en\u00e9 realizovat v nastaven\u00ed nastavenou politiku bezpe\u010dnosti TLS. P\u0159i p\u0159\u00edtomnosti t\u00e9to hlavi\u010dky SMTP klient pracuje v re\u017eimu \u201esmtp_tls_security_level = may\u201c, tj. neov\u011b\u0159uje certifik\u00e1t. serveru<\/a> a m\u016f\u017ee se vr\u00e1tit k p\u0159ipojen\u00ed s p\u0159enosem dat otev\u0159en\u00fdm textem. V dal\u0161\u00ed v\u00fdznamn\u00e9 v\u011btvi Postfixu zam\u00fd\u0161l\u00edme implementovat SMTP roz\u0161\u00ed\u0159en\u00ed REQUIRETLS.\n
- Byla p\u0159id\u00e1na podpora protokolu TLS-RPT (Transport Layer Security Reporting), co\u017e umo\u017e\u0148uje sledovat selh\u00e1n\u00ed p\u0159i doru\u010dov\u00e1n\u00ed zpr\u00e1v, pokud se neda\u0159\u00ed nav\u00e1zat \u0161ifrovan\u00e9 p\u0159ipojen\u00ed, jak p\u0159edeps\u00e1no pou\u017eit\u00edm roz\u0161\u00ed\u0159en\u00ed DANE (DNS-based Authentication of Named Entities) nebo MTA-STS (MTA Strict Transport Security). Vlastn\u00edk po\u0161tovn\u00ed dom\u00e9ny definuje v DNS parametry pro TLS-RPT, po \u010dem\u017e po\u0161tovn\u00ed servery budou odes\u00edlat zpr\u00e1vy s informacemi o \u00fasp\u011b\u0161n\u00fdch a selhan\u00fdch TLS p\u0159ipojen\u00edch k MX server\u016fm obsluhuj\u00edc\u00edm dom\u00e9nu. Implementace je zalo\u017eena na knihovn\u011b libtlsrpt.\n
- Byla p\u0159id\u00e1na nastaven\u00ed \u201esmtpd_hide_client_session = yes\u201c, kter\u00e9 zak\u00e1\u017ee vkl\u00e1d\u00e1n\u00ed informac\u00ed o klientsk\u00e9 relaci p\u0159i vkl\u00e1d\u00e1n\u00ed hlavi\u010dky \u201eReceived:\u201c serverem SMTP. P\u0159\u00edklad zkr\u00e1cen\u00e9 hlavi\u010dky \u201eReceived: by mail.example.com (Postfix) id postfix-queue-id for ; Den, dd M\u011bs\u00edc yyyy hh:mm:ss tz-offset (zone)\u201c.\n
- Byla p\u0159id\u00e1na mo\u017enost MIME k\u00f3dov\u00e1n\u00ed (RFC 2047) jmen v generovan\u00fdch hlavi\u010dk\u00e1ch Postfix \u201eFrom:\u201c, kter\u00e9 obsahuj\u00ed ne-ASCII znaky. Navr\u017een\u00fd k\u00f3dovac\u00ed sch\u00e9ma umo\u017e\u0148uje obej\u00edt pou\u017eit\u00ed roz\u0161\u00ed\u0159en\u00ed SMTPUTF8 (RFC 6531), kter\u00e9 nen\u00ed podporov\u00e1no v\u0161emi aplikacemi. V\u00fdsledek MIME k\u00f3dov\u00e1n\u00ed vypad\u00e1 jako \u201e=?charset?Q?gibberish?=:\u201c. Pro ur\u010den\u00ed p\u016fvodn\u00edho k\u00f3dov\u00e1n\u00ed jmen byl p\u0159id\u00e1n parametr \u201efull_name_encoding_charset\u201c, kter\u00fd je ve v\u00fdchoz\u00edm nastaven\u00ed nastaven na hodnotu utf8.\n
- Byla zm\u011bn\u011bna logika zpracov\u00e1n\u00ed selhan\u00fdch p\u0159ipojen\u00ed, pokud je v nastaven\u00ed uveden pouze jeden server pro \u201emysql:\u201c nebo \u201epgsql:\u201c. Takov\u00fd server je nyn\u00ed vn\u00edm\u00e1n jako vyva\u017eova\u010d z\u00e1t\u011b\u017ee a v p\u0159\u00edpad\u011b jednotliv\u00e9ho selh\u00e1n\u00ed je n\u00e1sledn\u00fd po\u017eadavek odesl\u00e1n okam\u017eit\u011b, bez 60 sekundov\u00e9ho zpo\u017ed\u011bn\u00ed.\n
- V Milteru byla implementov\u00e1na reflexe v logu informac\u00ed s d\u016fvodem um\u00edst\u011bn\u00ed zpr\u00e1vy do karant\u00e9ny.\n
- Na SMTP serveru je zaji\u0161t\u011bn v\u00fdstup do logu identifik\u00e1toru fronty nebo hodnoty \u201eNOQUEUE\u201c p\u0159i ukon\u010den\u00ed p\u0159ipojen\u00ed z d\u016fvodu \u010dasov\u00e9ho limitu, p\u0159eru\u0161en\u00ed nebo p\u0159ekro\u010den\u00ed limitu na po\u010det chyb. Proces cleanup p\u0159itom zapisuje do logu \u201equeueid: canceled\u201c pro zpr\u00e1vy se spu\u0161t\u011bnou, ale nedokon\u010denou transakc\u00ed.\n
- V klientovi Dovecot SASL je p\u0159i v\u00fdstupu do logu zpr\u00e1v \u201eInvalid authentication mechanism\u201c nyn\u00ed uveden mechanismus ov\u011b\u0159ov\u00e1n\u00ed, kter\u00fd nebylo mo\u017en\u00e9 pou\u017e\u00edt. SMTP server p\u0159i v\u00fdstupu do logu z\u00e1znam\u016f \u201ereject\u201c nyn\u00ed zobrazuje hodnoty nastaven\u00ed sasl_method, sasl_username a sasl_sender.\n
- Z d\u016fvodu zm\u011bny vnit\u0159n\u00edho protokolu pou\u017e\u00edvan\u00e9ho v doru\u010dovac\u00edm agentu, po aktualizaci verze Postfix je vy\u017eadov\u00e1n restart p\u0159\u00edkazem \u201epostfix reload\u201c nebo p\u0159\u00edkazy \u201epostfix stop\u201c a \u201epostfix start\u201c. Jinak se do logu zap\u00ed\u0161e varov\u00e1n\u00ed \u201eunexpected attribute smtputf8 from xxx socket (expecting: sendopts)\u201c. <\/ul>\n