Re: "Dunce Moment" as regards to spoofing email headers (spam)

2008-12-01 Thread postfix
Ronald MacDonald wrote: Nov 30 10:51:07 de003221 amavis[28871]: (28871-10) wbl: whitelisted sender <[EMAIL PROTECTED]> Nov 30 10:51:07 de003221 amavis[28871]: (28871-10) Passed CLEAN, [83.7.120.131] [83.7.120.131] <[EMAIL PROTECTED]> -> <[EMAIL PROTECTED]>, Message-ID: <[EMAIL PROTECTED]>, Hit

Re: Avoiding (trivial) spoofed "mail from"

2008-12-01 Thread DJ Lucas
DJ Lucas wrote: ehlo [EMAIL PROTECTED] Coincidently, I just corrected a mis-configuration in my server as a result of that example. Commented out helo restrictions a really long time ago...they must not have been doing too much. :-) -- DJ Lucas -- This message has been scanned for viruses

Re: Avoiding (trivial) spoofed "mail from"

2008-12-01 Thread DJ Lucas
Roman Medina-Heigl Hernandez wrote: Yes, you're right (I trust you! :-)). I did a quick search in my inbox and found an example: notices from Ubuntu bug tracking system ("Launchpad" at canonical.com) use that (poor) technique. But I'm wondering: 1) How often could you find this "nasty errors" (ye

Re: remote smtp auth clients - header rewrite question

2008-12-01 Thread Victor Duchovni
On Mon, Dec 01, 2008 at 09:35:18PM -0500, Dan Langille wrote: > >Did you see header_checks documented as a supported parameter in > >http://www.postfix.org/smtpd.8.html (rhetorical question, the answer > >is no). A closer look at the documentation shows this ia feature of > >the cleanup service: >

Re: DKIM message forwarding, body altered

2008-12-01 Thread Wietse Venema
David Jonas: > We provide forwarding to external accounts (e.g. gmail.com) and it > appears that in some cases postfix is invalidating the DKIM signatures. > The most prominent and obvious case is eBay and PayPal where gmail is > now bouncing/dropping messages where the signature doesn't match. >

Re: What is table='t'

2008-12-01 Thread Stephen Liu
--- mouss <[EMAIL PROTECTED]> wrote: > Stephen Liu a écrit : > > Hi folks, > > > > > > I have a /etc/postfix/mysql_*.cf file with following content; > > user=mail > > password=mypasswd > > dbname=maildb > > table='t' > > select_field=domains > > where_field=domains > > hosts=127.0.0.1 > > addit

Re: DKIM message forwarding, body altered

2008-12-01 Thread Victor Duchovni
On Mon, Dec 01, 2008 at 05:55:28PM -0800, David Jonas wrote: > We provide forwarding to external accounts (e.g. gmail.com) and it > appears that in some cases postfix is invalidating the DKIM signatures. > The most prominent and obvious case is eBay and PayPal where gmail is > now bouncing/droppin

Re: remote smtp auth clients - header rewrite question

2008-12-01 Thread Dan Langille
On Dec 1, 2008, at 12:17 AM, Victor Duchovni wrote: On Sun, Nov 30, 2008 at 06:40:18PM -0500, Dan Langille wrote: I tried it like this: 10.0.0.1:smtps inet n - n - - smtpd -o smtpd_sasl_auth_enable=yes -o smtpd_recipient_restrictions =permit_sasl_authenticated

Re: What is table='t'

2008-12-01 Thread mouss
Stephen Liu a écrit : > Hi folks, > > > I have a /etc/postfix/mysql_*.cf file with following content; > user=mail > password=mypasswd > dbname=maildb > table='t' > select_field=domains > where_field=domains > hosts=127.0.0.1 > additional_conditions = and enabled = 1 > > > Please help me to unde

DKIM message forwarding, body altered

2008-12-01 Thread David Jonas
We provide forwarding to external accounts (e.g. gmail.com) and it appears that in some cases postfix is invalidating the DKIM signatures. The most prominent and obvious case is eBay and PayPal where gmail is now bouncing/dropping messages where the signature doesn't match. I caused ebay to send a

What is table='t'

2008-12-01 Thread Stephen Liu
Hi folks, I have a /etc/postfix/mysql_*.cf file with following content; user=mail password=mypasswd dbname=maildb table='t' select_field=domains where_field=domains hosts=127.0.0.1 additional_conditions = and enabled = 1 Please help me to understand table='t'. What is 't'? TIA B.R. Stephen

Re: "Dunce Moment" as regards to spoofing email headers (spam)

2008-12-01 Thread Ronald MacDonald
On 01/12/2008, Ronald MacDonald <[EMAIL PROTECTED]> wrote: > On 01/12/2008, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote: > > Ronald MacDonald wrote: > ... > > > > However, in one of those "crap, what do I do now" moments, I'm > > > confuzzled as to how to get Postfix to realise that the mail *sh

Re: "Dunce Moment" as regards to spoofing email headers (spam)

2008-12-01 Thread Ronald MacDonald
On 01/12/2008, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote: > Ronald MacDonald wrote: ... > > However, in one of those "crap, what do I do now" moments, I'm > > confuzzled as to how to get Postfix to realise that the mail *should* > > be checked, since it's coming in from outside the network. > > >

Re: "Dunce Moment" as regards to spoofing email headers (spam)

2008-12-01 Thread postfix
Ronald MacDonald wrote: It's been a hectic couple of weeks, and I'm getting complaints from users after having upgraded to a new system that mails are coming in which have been spoofed. I see exactly what's going on - a rogue system opens up port 25 on my system, tells it the mail's from one of t

Re: 3dm2 (3ware daemon) smtp/e-mail issue (lost connection after QUIT)

2008-12-01 Thread Victor Duchovni
On Mon, Dec 01, 2008 at 03:25:00PM -0500, Wietse Venema wrote: > > /* > > * Don't bother checking the syntax. > > */ > > smtpd_chat_reply(state, "221 2.0.0 Bye"); > > > > /* > > * When the "." and quit replies are pipelined, make sure they are > > * flushed now, to

Re: 3dm2 (3ware daemon) smtp/e-mail issue (lost connection after QUIT)

2008-12-01 Thread Wietse Venema
Victor Duchovni: > On Mon, Dec 01, 2008 at 11:58:42AM -0500, Charles Marcus wrote: > > > On 12/1/2008 11:54 AM, Victor Duchovni wrote: > > > There is nothing wrong with lost connections after QUIT. Newer versions > > > of Postfix only log "lost connection" in the SMTP server during data > > > tran

"Dunce Moment" as regards to spoofing email headers (spam)

2008-12-01 Thread Ronald MacDonald
Dear list, It's been a hectic couple of weeks, and I'm getting complaints from users after having upgraded to a new system that mails are coming in which have been spoofed. I see exactly what's going on - a rogue system opens up port 25 on my system, tells it the mail's from one of the users on th

Re: Avoiding (trivial) spoofed "mail from"

2008-12-01 Thread Noel Jones
Roman Medina-Heigl Hernandez wrote: Noel Jones escribió: You are (again) right, perhaps spamassasin is better for performing this kind of check... with the added bonus that filtered mail is not dropped, but quarantined (so you could always rescue a false negative). Do you know "how well" does

Re: Avoiding (trivial) spoofed "mail from"

2008-12-01 Thread Roman Medina-Heigl Hernandez
Noel Jones escribió: > If you have a large number of domains, keep a separate list of the domains > and let the computer build the different tables for you. Use a Makefile to > make it easy. Or I could use two different mysql queries, over the same table containing the vdomains... > Some web

Re: 3dm2 (3ware daemon) smtp/e-mail issue (lost connection after QUIT)

2008-12-01 Thread Victor Duchovni
On Mon, Dec 01, 2008 at 11:58:42AM -0500, Charles Marcus wrote: > On 12/1/2008 11:54 AM, Victor Duchovni wrote: > > There is nothing wrong with lost connections after QUIT. Newer versions > > of Postfix only log "lost connection" in the SMTP server during data > > transfer or when sending the "."

Re: permit_sasl_authenticated ONLY from one interface

2008-12-01 Thread Simone Felici
Noel Jones ha scritto: mouss wrote: Mouss, this could be a solution... but haven't find any example or documation to try it. Could you pount me at any example? make sure to read: http://www.postfix.org/postconf.5.html#smtpd_discard_ehlo_keyword_address_maps smtpd_discard_ehlo_keyword_

Re: 3dm2 (3ware daemon) smtp/e-mail issue (lost connection after QUIT)

2008-12-01 Thread Charles Marcus
On 12/1/2008 11:54 AM, Victor Duchovni wrote: > There is nothing wrong with lost connections after QUIT. Newer versions > of Postfix only log "lost connection" in the SMTP server during data > transfer or when sending the "." response. The client is free to > disconnect without "QUIT" at all other

Re: 3dm2 (3ware daemon) smtp/e-mail issue (lost connection after QUIT)

2008-12-01 Thread Victor Duchovni
On Mon, Dec 01, 2008 at 11:05:44AM -0500, Justin Piszcz wrote: > Quick question-- > > Nov 30 17:39:03 p34 postfix/smtpd[15257]: 6B3A310676: > client=localhost.localdomain[127.0.0.1] > Nov 30 17:39:03 p34 postfix/cleanup[15260]: 6B3A310676: > message-id=<[EMAIL PROTECTED]> > Nov 30 17:39:03 p34

Re: Avoiding (trivial) spoofed "mail from"

2008-12-01 Thread Noel Jones
Roman Medina-Heigl Hernandez wrote: Noel Jones escribió: Roman Medina-Heigl Hernandez wrote: Hello, Spammers often send (forged) mail where "mail from" address is the same as "rcpt to" address. An extension of that could be using a "mail from" address where src domain is one of our valid virtu

Re: Avoiding (trivial) spoofed "mail from"

2008-12-01 Thread Roman Medina-Heigl Hernandez
Noel Jones escribió: > Roman Medina-Heigl Hernandez wrote: >> Hello, >> >> Spammers often send (forged) mail where "mail from" address is the >> same as >> "rcpt to" address. An extension of that could be using a "mail from" >> address where src domain is one of our valid virtual domains. I can onl

Re: spam from valid accounts on our domain / require smtp auth

2008-12-01 Thread Noel Jones
J.P. Trosclair wrote: For the past couple of weeks we've been getting a lot of spam from valid mail accounts on our domain. The spam gets automatically white listed since it's from our domain. Short of removing our own domain from our white lists, I'm looking for a way to put an end to this. Ou

Re: permit_sasl_authenticated ONLY from one interface

2008-12-01 Thread mouss
Noel Jones a écrit : > mouss wrote: >> Simone Felici a écrit : >>> mouss ha scritto: Simone Felici a écrit : > Why? Uhm, dunno... > It seems certain mailclients has Autenticated smtp enabled as default > and if the client found the smtp server support it, then it try to > send

3dm2 (3ware daemon) smtp/e-mail issue (lost connection after QUIT)

2008-12-01 Thread Justin Piszcz
Quick question-- Nov 30 17:39:03 p34 postfix/smtpd[15257]: 6B3A310676: client=localhost.localdomain[127.0.0.1] Nov 30 17:39:03 p34 postfix/cleanup[15260]: 6B3A310676: message-id=<[EMAIL PROTECTED]> Nov 30 17:39:03 p34 postfix/qmgr[18872]: 6B3A310676: from=<[EMAIL PROTECTED]>, size=430, nrcpt=1

Re: Avoiding (trivial) spoofed "mail from"

2008-12-01 Thread Noel Jones
Roman Medina-Heigl Hernandez wrote: Hello, Spammers often send (forged) mail where "mail from" address is the same as "rcpt to" address. An extension of that could be using a "mail from" address where src domain is one of our valid virtual domains. I can only think of 3 cases: 1) Src IP is 127.0

Re: permit_sasl_authenticated ONLY from one interface

2008-12-01 Thread Noel Jones
mouss wrote: Simone Felici a écrit : mouss ha scritto: Simone Felici a écrit : Why? Uhm, dunno... It seems certain mailclients has Autenticated smtp enabled as default and if the client found the smtp server support it, then it try to send in auth. This return an error, due inappropriate setti

Avoiding (trivial) spoofed "mail from"

2008-12-01 Thread Roman Medina-Heigl Hernandez
Hello, Spammers often send (forged) mail where "mail from" address is the same as "rcpt to" address. An extension of that could be using a "mail from" address where src domain is one of our valid virtual domains. I can only think of 3 cases: 1) Src IP is 127.0.0.1 -> Mail should pass (eg: sent by

Re: permit_sasl_authenticated ONLY from one interface

2008-12-01 Thread mouss
Simone Felici a écrit : > mouss ha scritto: >> Simone Felici a écrit : >>> Why? Uhm, dunno... >>> It seems certain mailclients has Autenticated smtp enabled as default >>> and if the client found the smtp server support it, then it try to send >>> in auth. This return an error, due inappropriate se

spam from valid accounts on our domain / require smtp auth

2008-12-01 Thread J.P. Trosclair
For the past couple of weeks we've been getting a lot of spam from valid mail accounts on our domain. The spam gets automatically white listed since it's from our domain. Short of removing our own domain from our white lists, I'm looking for a way to put an end to this. Our server already requi

Re: Permission denied error

2008-12-01 Thread Antonio Tommasi
Hi to all, i want to set a dimension limit in relation to recipients number and attachment's size; that is if number_recipients * attachment's size exceed 100MB than i want to discard these email, otherwise i can permit them. Can i do it? How? Thanks in advance

Re: permit_sasl_authenticated ONLY from one interface

2008-12-01 Thread Simone Felici
mouss ha scritto: Simone Felici a écrit : Why? Uhm, dunno... It seems certain mailclients has Autenticated smtp enabled as default and if the client found the smtp server support it, then it try to send in auth. This return an error, due inappropriate settings of the client. if you know their

Re: Qstat and Postqueue

2008-12-01 Thread Noel Jones
Sriram Nyshadham wrote: [please don't top-post] No Sahil, Qstat is also used for Postfix. What is Qstat and where did it come from? All the references I find on google indicate it's part of qmail. It's certainly not part of postfix. I would always trust an official postfix utility bef

RE: Qstat and Postqueue

2008-12-01 Thread Sriram Nyshadham
No Sahil, Qstat is also used for Postfix. I just found that postqueue also displays the repeated attempts to connect to any mail server(s) which are not accepting mails. That's why the count becomes bigger. I believe qstat gives the right value. Thanks, Sriram Nyshadham. -Original Messa

Re: Send stdout from command down a pipe

2008-12-01 Thread Wietse Venema
Adrian Overbury: > Is it possible, if I specify a mailbox_command in my main.cf, to pipe > any output that produces on stdout to somewhere else? Like, say, to $ man logger $ man postlog Wietse

Re: Permission denied error

2008-12-01 Thread Wietse Venema
Daryl: > Greetings, > For the second time in a month I have a postfix/sendmail: fatal: > chdir > /var/spool/postfix Permission denied error. > There are no possible solutions in my logs, and googling, has found nothing. > My permissions > for postfix are correct; > > #ls -ld /var/

Re: Qstat and Postqueue

2008-12-01 Thread Sahil Tandon
Sriram Nyshadham <[EMAIL PROTECTED]> wrote: > I am new to postfix and am wondering what is the difference between qstat and > postqueue contents. When I check my qstat > I get only 4000 mails in the queue. Whereas when I try postqueue, I See > around 18000. Please help me. Stick to postqueue.

Qstat and Postqueue

2008-12-01 Thread Sriram Nyshadham
Hi All, I am new to postfix and am wondering what is the difference between qstat and postqueue contents. When I check my qstat I get only 4000 mails in the queue. Whereas when I try postqueue, I See around 18000. Please help me. out04# postqueue -p |wc -l 17852 out04# qstat