After 14 months of development, the release of the new stable branch of the Postfix mail server — 3.8.0 has occurred. At the same time, support for the Postfix 3.4 branch, released in early 2019, has been discontinued. Postfix is one of the few projects that combines high security, reliability, and performance, achieved through thoughtful architecture and a strict code and patch auditing policy. The project code is distributed under the EPL 2.0 (Eclipse Public License) and IPL 1.0 (IBM Public License).
According to a January automated survey of approximately 400,000 mail servers, servers, Postfix is used on 33.18% (down from 34.08% a year ago) of mail servers, Exim holds 60.27% (up from 58.95%), Sendmail — 3.62% (up from 3.58%), MailEnable — 1.86% (down from 1.99%), MDaemon — 0.39% (down from 0.52%), Microsoft Exchange — 0.19% (down from 0.26%), OpenSMTPD — 0.06% (unchanged).
Key innovations:
- The SMTP/LMTP client has implemented the ability to check SRV DNS records to determine the host and port of the mail server, which will be used for message transmission. For example, when specifying in the settings 'use_srv_lookup = submission' and 'relayhost = example.com:submission', the SMTP client will request the SRV record of the host _submission._tcp.example.com to determine the host and port of the mail gateway. This feature can be utilized in infrastructures where mail services use dynamically assigned network port numbers for message delivery.
- Cipher algorithms SEED, IDEA, 3DES, RC2, RC4, and RC5, as well as the MD5 hash and key exchange algorithms DH and ECDH, are excluded from the default TLS settings due to being classified as obsolete or unused. When specifying the 'export' and 'low' cipher types in the settings, they will effectively default to 'medium' as support for 'export' and 'low' has been discontinued in OpenSSL 1.1.1.
- A new setting 'tls_ffdhe_auto_groups' has been added to enable the FFDHE (Finite-Field Diffie-Hellman Ephemeral) group negotiation protocol in TLS 1.3 when built with OpenSSL 3.0.
- To protect against memory exhaustion attacks, the aggregation of the statistics 'smtpd_client_*_rate' and 'smtpd_client_*_count' has been ensured across network blocks, the size of which is specified by the directives 'smtpd_client_ipv4_prefix_length' and 'smtpd_client_ipv6_prefix_length' (default values are /32 and /84).
- Protection against attacks that exploit the renegotiation request of the TLS connection within an already established SMTP connection to create excessive CPU load has been added.
- The postconf command has been enhanced to output warnings for comments made immediately after parameter values in the Postfix configuration file.
- A client encoding configuration for PostgreSQL can now be set by specifying the 'encoding' attribute in the configuration file (the default value is now set to 'UTF8', whereas 'LATIN1' was previously used).
- In the postfix and postlog commands, log output to stderr is now produced independently of the stderr stream being connected to the terminal.
- In the source tree, the files 'global/mkmap*.[hc]' have been moved to the 'util' directory, leaving only the files 'global/mkmap_proxy.*' in the main directory.
Source: opennet.ru
