-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Adrian von Bidder wrote: > tags 320487 +wontfix > tags 320487 +upstream > thanks > > >>to store the IPs and emails in the >>greylisting database using a one-way SHA1 hash function, instead of in >>clear-text. > > > Since the sysadmin has access to the mail logs anyway and thus can easily > get all data on his users mail behaviour, I don't exactly see the > advantage. In situations where you would use this functionality you typically have also either encrypted/anonymized your mail logs, or send them off-site. This is part of a larger suite of privacy enhancement tools, this is by no means should be used in isolation. Typically an organization has a log-retention policy and must implement it site-wide. If the policy mandates that this data is not kept, then it must not be kept in either the mail logs, the apache access logs, or the greylisting database (or anywhere else on the system). To implement this policy you must apply it to each of the elements, not only to one. So, yes you are right that if you use this option to greylisting and do not bother with implementing your log-retention policies on the rest of your machine, then this option is somewhat pointless, but if you need to implement these policies site-wide and you cannot do it in greylisting because there is no such feature, then you have another problem. That is what this solves. > Additionally, I don't want to deviate from upstream postgrey any more than > necessary, so I really don't think that I should apply this patch. Please > discuss on the postgrey mailing list whether the patch should be included > in the official postgrey version. I understand this concern, it is being brought upstream. micah -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (GNU/Linux) iD8DBQFC956z9n4qXRzy1ioRAkt4AKCUMRgU/KaCWTlYm3UjqaMj/m2CiwCff0wV LNNNxJ/ido3lp3glOjNWS5k= =ek9C -----END PGP SIGNATURE----- -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
