Re: smtps via 465 is not working

2015-06-10 Thread Christian Kivalo
On 2015-06-11 07:51, Jithesh AP wrote: Hi, Hi, I am a newbie and setting up my postfix+mysql+dovecot. I got things working for receiving/sending mails, via port 993 and 25 (used a client opera mail). After that i tried to enable smtps via 465, but it is not working, the log is giving this e

smtps via 465 is not working

2015-06-10 Thread Jithesh AP
Hi, I am a newbie and setting up my postfix+mysql+dovecot. I got things working for receiving/sending mails, via port 993 and 25 (used a client opera mail). After that i tried to enable smtps via 465, but it is not working, the log is giving this error (receiving via 993 still works fine).

Re: smarthost forwarding, restricted by TLS-no-SASL, rejecting outbound recipient.

2015-06-10 Thread PGNd
On Wed, Jun 10, 2015, at 08:15 PM, Viktor Dukhovni wrote: > You should not need that. You can safely replace "smtpd_tls_req_ccert" > with "smtpd_tls_ask_ccert". Clients that don't present a certificate > will be denied access anyway. > Also IIRC your logging reported > "Trusted" client connect

Re: smarthost forwarding, restricted by TLS-no-SASL, rejecting outbound recipient.

2015-06-10 Thread Viktor Dukhovni
On Wed, Jun 10, 2015 at 07:44:01PM -0700, PGNd wrote: > > Check the content with "postmap -q lmdb:..." > > > > > -o smtpd_client_restrictions= > > > -o smtpd_helo_restrictions= > > > -o smtpd_sender_restrictions= > > > -o smtpd_recipient_restrictions= > > > -o smtpd_relay_res

Re: smarthost forwarding, restricted by TLS-no-SASL, rejecting outbound recipient.

2015-06-10 Thread PGNd
On Wed, Jun 10, 2015, at 06:53 PM, Viktor Dukhovni wrote: > > -o permit_tls_clientcerts=yes > > No such parameter. Yes, caught that. It's correctly in -o smtpd_relay_restrictions=permit_tls_clientcerts,reject Not clear how I ended up with that. Gone now. > > -o relay_clientce

Re: smarthost forwarding, restricted by TLS-no-SASL, rejecting outbound recipient.

2015-06-10 Thread Viktor Dukhovni
On Wed, Jun 10, 2015 at 11:01:09AM -0700, PGNd wrote: > Sending a test message via the local server, log at the smarthost shows > message reject "Recipient address rejected: Access denied", > > Jun 10 08:14:52 remote016 postfix/smarthost/smtpd[20272]: Trusted > TLS connection estab

Re: Local recipients ?

2015-06-10 Thread Jim Reid
On 11 Jun 2015, at 00:20, Timothy Murphy wrote: > Here helen.gayleard.com is the internal name of my server > (on which postfix and dovecot are running), > while mail.eircom.net is my smarthost. helen.gayleard.com does not resolve in the public DNS and mail.eircom.net is correctly saying this n

Re: Local recipients ?

2015-06-10 Thread Wietse Venema
Timothy Murphy: > How does postfix define local recipients? > I'm getting this error in /var/log/maillog > > Jun 10 20:25:14 helen postfix/smtp[6867]: 9C2A081968: > to=, orig_to=, > relay=mail.eircom.net[159.134.198.135]:25, delay=8696, > delays=8682/0.06/3.1/10, dsn=4.1.0, status=deferred >

Local recipients ?

2015-06-10 Thread Timothy Murphy
How does postfix define local recipients? I'm getting this error in /var/log/maillog Jun 10 20:25:14 helen postfix/smtp[6867]: 9C2A081968: to=, orig_to=, relay=mail.eircom.net[159.134.198.135]:25, delay=8696, delays=8682/0.06/3.1/10, dsn=4.1.0, status=deferred (host mail.eircom.net[159.134.1

Re: smarthost forwarding, restricted by TLS-no-SASL, rejecting outbound recipient.

2015-06-10 Thread PGNd
On Wed, Jun 10, 2015, at 03:19 PM, A. Schulze wrote: > > openssl x509 -pubkey -noout -in /etc/ssh/mail/commercial.crt | > > openssl pkey -pubin -outform DER | openssl dgst -sha1 -c > > take the output of "openssl x509 -sha1 -fingerprint -noout -in cert.pem" To what end? That will extract the

Re: smarthost forwarding, restricted by TLS-no-SASL, rejecting outbound recipient.

2015-06-10 Thread A. Schulze
PGNd: openssl x509 -pubkey -noout -in /etc/ssh/mail/commercial.crt | openssl pkey -pubin -outform DER | openssl dgst -sha1 -c take the output of "openssl x509 -sha1 -fingerprint -noout -in cert.pem" Andreas

smarthost forwarding, restricted by TLS-no-SASL, rejecting outbound recipient.

2015-06-10 Thread PGNd
I'm next configuring a service to provide outbound smarthosting to a local server. As with several of my other services, the goal is to use TLS cert check/auth only, no SASL. Sending a test message via the local server, log at the smarthost shows message reject "Recipient address rejected: Acce

Re: SASL AUTH dictionary attacks

2015-06-10 Thread Alex JOST
Am 10.06.2015 um 00:19 schrieb Scott Lambert: I've been looking for, but haven't found, yet, a postfix option that would delay x seconds after a failed auth attempt. We still use fail2ban, but the botnets are just too large. This can be set within Dovecot when using Dovecot for SASL authentica