Re: DSA-361-2

2003-08-11 Thread Gian Piero Carrubba
Il lun, 2003-08-11 alle 02:58, Matt Zimmerman ha scritto: > > I haven't found 2.2.2-6woody2 in the changelog, however 2.2.2-6 has been > > released in december 2001 > > 2.2.2-6woody2 is a later version than 2.2.2-6. 2.2.2-6 has the bugs, > 2.2.2-6woody2 has the fixes. 2.2.2-6 has been released

Re: postfix security configuration

2003-08-11 Thread Tomasz Papszun
On Sun, 10 Aug 2003 at 10:26:16 +, Fallen Angel wrote: > > my config: > debian stable 3.0r1 > postfix > qpopper > > I have a small problem: > > my smtp after pop3 configuration works fine, no open relay possible, but > the authentificated users can fake their own e-mail address. > > How

Re: postfix security configuration

2003-08-11 Thread Marcel Weber
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Am Montag, 11.08.03, um 12:59 Uhr (Europe/Zurich) schrieb Tomasz Papszun: If you want to prevent them from using non existing sender addresses from your domain, you can do it by creating a file (lookup table) for postmap(1), containing all allow

Re: DSA-361-2

2003-08-11 Thread Gian Piero Carrubba
Il lun, 2003-08-11 alle 12:22, Gian Piero Carrubba ha scritto: > DSA-361-1 states that the vulnerabilities reported have been fixed in > 2.2.2-13.woody.8 (and this is the version you can find in the > repository)... DSA-361-2 is the same advisory, except that it states > that the vulnerabilities ha

Re: DSA-361-2

2003-08-11 Thread Matt Zimmerman
On Mon, Aug 11, 2003 at 12:22:13PM +0200, Gian Piero Carrubba wrote: > Il lun, 2003-08-11 alle 02:58, Matt Zimmerman ha scritto: > > > > I haven't found 2.2.2-6woody2 in the changelog, however 2.2.2-6 has been > > > released in december 2001 > > > > 2.2.2-6woody2 is a later version than 2.2.2-6.

Re: postfix security configuration

2003-08-11 Thread Tarjei Huse
This might help: http://jimsun.linxnet.com/misc/postfix-anti-UCE.txt On Mon, 2003-08-11 at 13:37, Marcel Weber wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > > Am Montag, 11.08.03, um 12:59 Uhr (Europe/Zurich) schrieb Tomasz > Papszun: > >> > > > > If you want to prevent them fr

Re: postfix security configuration

2003-08-11 Thread Wilfried Essig
Am Son, 2003-08-10 um 12.26 schrieb Fallen Angel: > hi, > > my config: > debian stable 3.0r1 > postfix > qpopper > > I have a small problem: > > my smtp after pop3 configuration works fine, no open relay possible, but > the authentificated users can fake their own e-mail address. > > How can

Re: postfix security configuration

2003-08-11 Thread Marcel Weber
Tarjei Huse wrote: This might help: http://jimsun.linxnet.com/misc/postfix-anti-UCE.txt On Mon, 2003-08-11 at 13:37, Marcel Weber wrote: Another good thing is the postfix ([EMAIL PROTECTED]) mailing list. It is quite a high traffic mailing list, but there are very expirienced people readi

Re: Passwordless Authentication (was Re: How to reduce sid security)

2003-08-11 Thread AnĂ­bal Monsalve Salazar
On Fri, Aug 01, 2003 at 01:03:46PM +0200, [EMAIL PROTECTED] wrote: > If you can read Dutch you can use my pages right now [1]. They explain > all this in excruciating detail. OpenSSH and SSH.com interoperability > and setting up ssh-agent are explained too. Some scripts are provided to > automate a

Re: postfix security configuration

2003-08-11 Thread Marcel Weber
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Am Montag, 11.08.03, um 12:59 Uhr (Europe/Zurich) schrieb Tomasz Papszun: If you want to prevent them from using non existing sender addresses from your domain, you can do it by creating a file (lookup table) for postmap(1), containing all allowed add

Re: DSA-361-2

2003-08-11 Thread Gian Piero Carrubba
Il lun, 2003-08-11 alle 12:22, Gian Piero Carrubba ha scritto: > DSA-361-1 states that the vulnerabilities reported have been fixed in > 2.2.2-13.woody.8 (and this is the version you can find in the > repository)... DSA-361-2 is the same advisory, except that it states > that the vulnerabilities ha

postfix security configuration

2003-08-11 Thread Fallen Angel
hi, my config: debian stable 3.0r1 postfix qpopper I have a small problem: my smtp after pop3 configuration works fine, no open relay possible, but the authentificated users can fake their own e-mail address. How can I stop it, so they can only use the adress which were set up for them. th