Re: TLS client certificate

2014-08-22 Thread Christian Rößner
Am 23.08.2014 um 00:28 schrieb Bill Cole : > On 22 Aug 2014, at 14:16, Christian Rößner wrote: > Aug 22 19:14:10 mx0 postfix-submission/smtpd[29528]: Anonymous TLS connection established from static-201-106.deltasurf.de[193.239.106.201]:47064: TLSv1 with cipher ECDHE-RSA-

TLS library problem - handshake failure

2014-08-22 Thread robin.wakefield
Hi, We recently upgraded from Postfix 2.5.5 to 2.8.17 and OpenSSL 0.9.8k to 1.0.1h (both compiled from source). A number of domains that we normally send to are now not working. The log is showing the following typical entries: Aug 22 23:51:37 ssng0016xmh postfix-internal/smtp[6284]: [ID 1975

Re: TLS client certificate

2014-08-22 Thread Bill Cole
On 22 Aug 2014, at 14:16, Christian Rößner wrote: Aug 22 19:14:10 mx0 postfix-submission/smtpd[29528]: Anonymous TLS connection established from static-201-106.deltasurf.de[193.239.106.201]:47064: TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits) Your server SASL layer did not offer a SA

Re: postscreen_dnsbl_threshold don't reject

2014-08-22 Thread Wietse Venema
li...@rhsoft.net: > "postscreen_dnsbl_action = enforce" helps a lot :-) OK, that is one mystery solved. > somehow unexpected and should be highlighted in the docs POSTSCREEN_README mentions each "postscreen_mumble_action" parameter in the context of its "postscreen_mumble" feature. You want to h

Re: postscreen_dnsbl_threshold don't reject

2014-08-22 Thread li...@rhsoft.net
Am 22.08.2014 um 22:06 schrieb li...@rhsoft.net: > why don't "DNSBL rank 15" don't drop the connection? > my expectation was that it should even not make it to smtpd > > postscreen_cache_retention_time = 1d > postscreen_dnsbl_ttl = 10m > postscreen_dnsbl_threshold = 8 > postscreen_dnsbl_sites = d

Re: postscreen_dnsbl_threshold don't reject

2014-08-22 Thread Wietse Venema
li...@rhsoft.net: > Hi > > why don't "DNSBL rank 15" don't drop the connection? > my expectation was that it should even not make it to smtpd Well, my ranks does not go beyond 4, but clients that exceed the threshold (2) are blocked here. > Aug 22 21:49:46 localhost postfix/dnsblog[713]: addr 62

postscreen_dnsbl_threshold don't reject

2014-08-22 Thread li...@rhsoft.net
Hi why don't "DNSBL rank 15" don't drop the connection? my expectation was that it should even not make it to smtpd postscreen_cache_retention_time = 1d postscreen_dnsbl_ttl = 10m postscreen_dnsbl_threshold = 8 postscreen_dnsbl_sites = dul.dnsbl.sorbs.net*8 dnsbl.inps.de*7 b.barracudacentral.or

Re: TLS client certificate

2014-08-22 Thread Christian Rößner
>> Aug 22 19:14:10 mx0 postfix-submission/smtpd[29528]: Anonymous TLS >> connection established from >> static-201-106.deltasurf.de[193.239.106.201]:47064: TLSv1 with cipher >> ECDHE-RSA-AES256-SHA (256/256 bits) > > Your server SASL layer did not offer a SASL "EXTERNAL" mechanism, > and probab

Re: TLS client certificate

2014-08-22 Thread Viktor Dukhovni
On Fri, Aug 22, 2014 at 07:16:39PM +0200, Christian R??ner wrote: > Here is a log with Thunderbird: > > Aug 22 19:00:47 mx0 postfix-submission/smtpd[29056]: connect from > static-201-106.deltasurf.de[193.239.106.201]:36755 > Aug 22 19:00:54 mx0 postfix-submission/smtpd[29056]: Trusted TLS connec

Re: TLS client certificate

2014-08-22 Thread Christian Rößner
First of all thanks for the answers. >> I hope my question is not off topic. I try to create a self signed >> certificate, which is signed by my own CA. I have created a pkcs12 file, >> which includes cert, key, and CA: > > Is this an S/MIME email signing/encryption certificate? Or a TLS > cli

Re: TLS client certificate

2014-08-22 Thread Viktor Dukhovni
On Fri, Aug 22, 2014 at 04:46:56PM +0200, Christian R??ner wrote: > Hi, > > I hope my question is not off topic. I try to create a self signed > certificate, which is signed by my own CA. I have created a pkcs12 file, > which includes cert, key, and CA: Is this an S/MIME email signing/encryptio

Re: TLS client certificate

2014-08-22 Thread Wietse Venema
> 1.) Thunderbird (works) > 2.) Apple Mail (fails) Without going into details, you need to check that the two above use the same Postfix SMTP server address and port (25 or 587), otherwise the comparison will not be valid. Wietse

TLS client certificate

2014-08-22 Thread Christian Rößner
Hi, I hope my question is not off topic. I try to create a self signed certificate, which is signed by my own CA. I have created a pkcs12 file, which includes cert, key, and CA: openssl pkcs12 -export -in newcert.pem -inkey newkey.pem -CAfile cacert.pem -chain -out croessner.p12 I have import

Re: Automated personal whitelist (?)

2014-08-22 Thread Noel Jones
On 8/21/2014 5:33 PM, Ronald F. Guilmette wrote: > In message <53f664fe.1030...@megan.vbhcs.org>, > Noel Jones wrote: > >> amavisd-new has a "penpals" feature that integrates nicely with >> postfix as a pre-queue smtpd_proxy_filter, or a post-queue >> content_filter. I don't use this particular

Re: Apply a redirect before checking other restrictions

2014-08-22 Thread Wietse Venema
Wietse Venema: > Darren Pilgrim: > > Postfix doesn't appear to do alias resolution on the REDIRECT'ed > > address. Do I need to add something to a setting that controls > > lookups on redirects? > > REDIRECT addresses are currently not subject to "before queue" > address rewriting. There exists n

Re: Apply a redirect before checking other restrictions

2014-08-22 Thread Wietse Venema
Darren Pilgrim: > Postfix doesn't appear to do alias resolution on the REDIRECT'ed > address. Do I need to add something to a setting that controls > lookups on redirects? REDIRECT addresses are currently not subject to "before queue" address rewriting. There exists no code do do that. W

Re: Automated personal whitelist (?)

2014-08-22 Thread Nicolas HAHN
Ok, I've just implemented that in my Postfix policy server (the GreyLSE). I've to update the web user interface of two other components of my project (the ELSE and ELSEMC components) in order to let internal users to allow this feature or not. Ronald, I'll provide you an answer to the email yo

Re: Apply a redirect before checking other restrictions

2014-08-22 Thread Darren Pilgrim
On 8/21/2014 2:49 PM, Viktor Dukhovni wrote: On Thu, Aug 21, 2014 at 02:22:46PM -0700, Darren Pilgrim wrote: I want to rewrite the envelope recipient of a message if it's from a specific sender, but have that rewrite change the envelope before reaching permit_auth_destination (i.e., an immediat