Re: virus_scan_failed

2009-08-21 Thread Oscar m Cruz
On Fri, Aug 21, 2009 at 5:09 PM, J.P. Trosclair wrote: > > Oscar m Cruz wrote: > >> F003D25C001 2057 Fri Aug 21 16:10:58 u...@domain.com >> (host 127.0.0.1[127.0.0.1] said: 451-4.5.0 Error in processing, >> id=08510-11, >> virus_scan FAILED: virus_scan: ALL VIRUS SCANNERS FAILED: ClamAV-clam

Fwd: Reg:Virtual Aliases forwarding

2009-08-21 Thread Priyanka Tyagi
Hello List, I have setup a virtual alias at my Postfix mail server as: u...@mydomain.com ---> u...@gmail.com I have set up SPF record for 'mydomain.com' and passes SPF, in case email originates from my postfix server. But SPF verification fails while it forwards email using virtual aliases. Fo

Re: virus_scan_failed

2009-08-21 Thread J.P. Trosclair
Oscar m Cruz wrote: F003D25C001 2057 Fri Aug 21 16:10:58 u...@domain.com (host 127.0.0.1[127.0.0.1] said: 451-4.5.0 Error in processing, id=08510-11, virus_scan FAILED: virus_scan: ALL VIRUS SCANNERS FAILED: ClamAV-clamd av-scanner FAILED: CODE(0x816e564) Too many retries to talk to 127.0.0

Reg:Virtual Aliases forwarding

2009-08-21 Thread Priyanka Tyagi
I have setup a virtual alias at my Postfix mail server as:u...@mydomain.com---> u...@gmail.com I have set up SPF record for 'mydomain.com' and passes SPF, in case email originates from my postfix server. But SPF verification fails while it forwards email using virtual aliases. For example, an

virus_scan_failed

2009-08-21 Thread Oscar m Cruz
Hi list I've been doing a problem with my server apparently all virus scan fail after 2 weeks of working without reboot it, i suspect that my server is not mount on the best equipment, because im runnning a postfix mail server, web server, ftp server etc using an simple desktop computer, whenever

Re: rbl checks, best place

2009-08-21 Thread mouss
Olivier Nicole a écrit : > Hi Dave, > >> I'm running postfix, amavisd-new and spamassassin. Currently in my >> postfix smtpd_recipient_restrictions right at the end last thing i have some >> rbl checks. I'm wondering if that's the best place for them or should i >> disable that and activate t

Re: rbl checks, best place

2009-08-21 Thread mouss
Dave a écrit : > Hello, > I'm running postfix, amavisd-new and spamassassin. Currently in my > postfix smtpd_recipient_restrictions right at the end last thing i have some > rbl checks. I'm wondering if that's the best place for them or should i > disable that and activate them in spamassassi

Re: MS-Exchange fails when receiving postfix has smtpd_enforce_tls=true

2009-08-21 Thread Victor Duchovni
On Fri, Aug 21, 2009 at 10:54:49PM +0200, gmx wrote: > Hi Victor, > > In http://marc.info/?l=postfix-users&m=116171112425304&w=2 you described > problems with ciphers when connecting from MS-Exchange to postfix. Has there > been any improvement in the last almost-3 years? AFAIK, the problem is r

Errors from the Xserve

2009-08-21 Thread The Doctor
postconf -n command_directory = /usr/sbin config_directory = /etc/postfix content_filter = smtp-amavis:[127.0.0.1]:10024 daemon_directory = /usr/libexec/postfix debug_peer_level = 2 enable_server_options = yes header_checks = regexp:/etc/postfix/header_checks home_mailbox = Mailbox html_directory

Re: anyone? success with smtpd_tls_req_ccert and iPhone as client?

2009-08-21 Thread Victor Duchovni
On Fri, Aug 21, 2009 at 11:08:31AM -0700, Florin Andrei wrote: > Victor Duchovni wrote: >> It has been some time since I looked at this, hence the IIRC. Mulberry >> made the setting explicit, and perhaps allowed one to choose the right >> client cert. If I recall correctly, Thunderbird uses certif

Re: anyone? success with smtpd_tls_req_ccert and iPhone as client?

2009-08-21 Thread Florin Andrei
Victor Duchovni wrote: It has been some time since I looked at this, hence the IIRC. Mulberry made the setting explicit, and perhaps allowed one to choose the right client cert. If I recall correctly, Thunderbird uses certificates silently, without explicit configuration control... I any case, t

Re: real-world issues with smtpd_tls_ask_ccert?

2009-08-21 Thread Wietse Venema
Victor Duchovni: > On Fri, Aug 21, 2009 at 12:35:38PM -0400, Wietse Venema wrote: > > > I looked up TLS_README, and it would not hurt to have a short > > sentence here and there to define terminology. > > Will the following do? Yes, that helps. Wietse > Index: proto/TLS_README.html > -

Re: real-world issues with smtpd_tls_ask_ccert?

2009-08-21 Thread Victor Duchovni
On Fri, Aug 21, 2009 at 12:35:38PM -0400, Wietse Venema wrote: > I looked up TLS_README, and it would not hurt to have a short > sentence here and there to define terminology. Will the following do? Index: proto/TLS_README.html --- proto/TLS_README.html 28 Apr 2009 21:44:30 - 1.1.

Re: real-world issues with smtpd_tls_ask_ccert?

2009-08-21 Thread Wietse Venema
Noel Jones: > Victor Duchovni wrote: > > On Fri, Aug 21, 2009 at 06:09:52AM -0500, Noel Jones wrote: > > > >> Ralf Hildebrandt wrote: > Aug 20 22:49:01 server postfix/smtpd[7724]: connect from > unknown[XXX.YYY.ZZZ.KKK] > Aug 20 22:49:02 server postfix/smtpd[7724]: setting up TLS co

Re: anyone? success with smtpd_tls_req_ccert and iPhone as client?

2009-08-21 Thread Victor Duchovni
On Fri, Aug 21, 2009 at 04:51:45PM +0200, Patrick Ben Koetter wrote: > * Victor Duchovni : > > On Fri, Aug 21, 2009 at 06:02:41AM -0500, Noel Jones wrote: > > > > > Florin Andrei wrote: > > >> Is there any magic incantation that needs to be performed to convince > > >> the iPhone to present the c

Re: real-world issues with smtpd_tls_ask_ccert?

2009-08-21 Thread Noel Jones
Victor Duchovni wrote: On Fri, Aug 21, 2009 at 06:09:52AM -0500, Noel Jones wrote: Ralf Hildebrandt wrote: Aug 20 22:49:01 server postfix/smtpd[7724]: connect from unknown[XXX.YYY.ZZZ.KKK] Aug 20 22:49:02 server postfix/smtpd[7724]: setting up TLS connection from unknown[XXX.YYY.ZZZ.KKK] Aug 2

Re: anyone? success with smtpd_tls_req_ccert and iPhone as client?

2009-08-21 Thread Patrick Ben Koetter
* Victor Duchovni : > On Fri, Aug 21, 2009 at 06:02:41AM -0500, Noel Jones wrote: > > > Florin Andrei wrote: > >> Is there any magic incantation that needs to be performed to convince > >> the iPhone to present the certificate to Postfix? The puzzling part is > >> that it seems to work fine with

Re: anyone? success with smtpd_tls_req_ccert and iPhone as client?

2009-08-21 Thread Victor Duchovni
On Fri, Aug 21, 2009 at 06:02:41AM -0500, Noel Jones wrote: > Florin Andrei wrote: >> Is there any magic incantation that needs to be performed to convince >> the iPhone to present the certificate to Postfix? The puzzling part is >> that it seems to work fine with Dovecot and imaps. > > Very few

Re: real-world issues with smtpd_tls_ask_ccert?

2009-08-21 Thread Victor Duchovni
On Fri, Aug 21, 2009 at 06:09:52AM -0500, Noel Jones wrote: > Ralf Hildebrandt wrote: >>> >>> Aug 20 22:49:01 server postfix/smtpd[7724]: connect from >>> unknown[XXX.YYY.ZZZ.KKK] >>> Aug 20 22:49:02 server postfix/smtpd[7724]: setting up TLS connection >>> from unknown[XXX.YYY.ZZZ.KKK] >>> Aug 20

Re: Significant relay delays

2009-08-21 Thread Phill Macey
Sorry in advance for the top posting or whatever gmail does on mobile phones - i have no control over that. I bumped into a very similar problem today. Mail was queuing up on one of our servers with exactly the same messages as what you had. In our case a perl script on the postfix server had gone

Re: real-world issues with smtpd_tls_ask_ccert?

2009-08-21 Thread Noel Jones
Ralf Hildebrandt wrote: Aug 20 22:49:01 server postfix/smtpd[7724]: connect from unknown[XXX.YYY.ZZZ.KKK] Aug 20 22:49:02 server postfix/smtpd[7724]: setting up TLS connection from unknown[XXX.YYY.ZZZ.KKK] Aug 20 22:49:02 server postfix/smtpd[7724]: Anonymous TLS connection established from unkn

Re: anyone? success with smtpd_tls_req_ccert and iPhone as client?

2009-08-21 Thread Noel Jones
Florin Andrei wrote: Is there any magic incantation that needs to be performed to convince the iPhone to present the certificate to Postfix? The puzzling part is that it seems to work fine with Dovecot and imaps. Very few mail clients support client certificates. Unless you will be using

Re: real-world issues with smtpd_tls_ask_ccert?

2009-08-21 Thread Ralf Hildebrandt
* Florin Andrei : > I'm setting up SASL with TLS for remote clients. As an additional > security measure, I would like the server to ask the email clients to > present their client certificates. According to the docs, this is > accomplished with: > > smtpd_tls_ask_ccert = yes > > But there are so

anyone? success with smtpd_tls_req_ccert and iPhone as client?

2009-08-21 Thread Florin Andrei
Using smtpd_tls_req_ccert=yes on port 587. submission inet n - - - - smtpd -o smtpd_tls_cert_file=/blah/server.crt -o smtpd_tls_key_file=/blah/server.key -o smtpd_tls_CAfile=/blah/ca.crt -o smtpd_tls_security_level=enc

Re: real-world issues with smtpd_tls_ask_ccert?

2009-08-21 Thread Florin Andrei
Barney Desmond wrote: Of course, you couldn't enforce this except on a non-public-facing system, or on the submission port (587). Actually, that's exactly what I just did. I configured a separate listener on 587 and moved all TLS stuff to it. I was reluctant to do so at first (the client is a