Security: Postfix stable release 3.0.2 and legacy releases 2.11.6, 2.10.8, and 2.9.14

2015-07-21 Thread Wietse Venema
[An on-line version of this announcement will be available at http://www.postfix.org/announcements/postfix-3.0.2.html] Postfix stable release 3.0.2 is available, as well as legacy releases 2.11.6, 2.10.8, and 2.9.14. With all supported Postfix releases, the default settings have been updated so t

Re: RC4 in live email servers?

2015-07-21 Thread A. Schulze
DTNX Postmaster: Then it may not be the most useful datapoint for a decision on how to treat RC4 in OpenSSL 1.1 :-/ again: correct. Viktor: ignore my noise ... Andreas

Re: Migrating From Postfix 2.5.5 to Postfix 2.11

2015-07-21 Thread Wolfe , Robert
Hmm, have you tried building 3.0 from source and then installing that?  (After removing the 2.xx binaries and making a backup of your config files of course).  What you are seeing with 'apt-get install' is what I see typical of Debian.  Not that that is a bad thing. On Tuesday, July 21, 2015 1

Re: Migrating From Postfix 2.5.5 to Postfix 2.11

2015-07-21 Thread Viktor Dukhovni
On Tue, Jul 21, 2015 at 07:25:59PM +, Ivan Avery Frey wrote: > I would have liked to install postfix 3.0, but "apt-get install postfix" > installs version 2.11 in Debian Jessie 8.1. So you are on Debian then, be aware that Debian's repackaging of Postfix breaks "postfix upgrade-configuration"

Re: makedefs.out

2015-07-21 Thread @lbutlr
On Jul 21, 2015, at 4:53 AM, Wietse Venema wrote: > > Find the lines with: > ># Start of summary of user-configurable 'make makefiles' options. ># CCARGS=XXX ># AUXLIBS=YYY Ah, but nothing like make -f makedefs.out OK, just wondering if I was missing something (well, many things,

Re: Migrating From Postfix 2.5.5 to Postfix 2.11

2015-07-21 Thread Ivan Avery Frey
On Tue, 21 Jul 2015 11:57 Noel Jones wrote: And I'll mention that although 2.11 is still on the "supported" list, the current stable postfix is version 3.0. I would have liked to install postfix 3.0, but "apt-get install postfix" installs version 2.11 in Debian Jessie 8.1. Ivan.

Re: Migrating From Postfix 2.5.5 to Postfix 2.11

2015-07-21 Thread Viktor Dukhovni
On Tue, Jul 21, 2015 at 10:56:43AM -0500, Noel Jones wrote: > > If I were to copy /etc/postfix and /var/spool/postfix to the new > > server, would something break? > > That should work. You'll likely need to rerun postmap on your > indexed files so they match the libraries on the new server. Bu

Re: RC4 in live email servers?

2015-07-21 Thread DTNX Postmaster
On 21 Jul 2015, at 17:34, Viktor Dukhovni wrote: > On Tue, Jul 21, 2015 at 09:49:01AM +0200, A. Schulze wrote: > >>> Should I remove "smtpd_tls_mandatory_exclude_ciphers = 3DES" >>> and look how the cipher use change over the next days ? >> >> immediately after I removed "smtpd_tls_mandatory_ex

Re: Migrating From Postfix 2.5.5 to Postfix 2.11

2015-07-21 Thread Noel Jones
On 7/21/2015 10:20 AM, Ivan Avery Frey wrote: > What defines a Postfix installation? > > If I were to copy /etc/postfix and /var/spool/postfix to the new > server, would something break? That should work. You'll likely need to rerun postmap on your indexed files so they match the libraries on th

Re: RC4 in live email servers?

2015-07-21 Thread DTNX Postmaster
On 21 Jul 2015, at 17:28, A. Schulze wrote: >> I suspect this is a problem with either your configuration, or your TLS >> stack. Exchange 2010 should do better, even in it's default >> configuration, as the minimum OS stack is Windows Server 2008, which >> supports TLSv1 with the 'ECDHE-RSA-AES12

Re: RC4 in live email servers?

2015-07-21 Thread Viktor Dukhovni
On Tue, Jul 21, 2015 at 09:49:01AM +0200, A. Schulze wrote: > >Should I remove "smtpd_tls_mandatory_exclude_ciphers = 3DES" > >and look how the cipher use change over the next days ? > > immediately after I removed "smtpd_tls_mandatory_exclude_ciphers = 3DES" > some servers fail to establish TLS.

Re: RC4 in live email servers?

2015-07-21 Thread A. Schulze
DTNX Postmaster: I suspect this is a problem with either your configuration, or your TLS stack. Exchange 2010 should do better, even in it's default configuration, as the minimum OS stack is Windows Server 2008, which supports TLSv1 with the 'ECDHE-RSA-AES128-SHA' cipher if the relay server sup

Migrating From Postfix 2.5.5 to Postfix 2.11

2015-07-21 Thread Ivan Avery Frey
What defines a Postfix installation? If I were to copy /etc/postfix and /var/spool/postfix to the new server, would something break? I'm looking for books about Postfix and I have found a 2001 book by Richard Blum, Postfix (the definitive guide) released in Dec. 2003, and The Book of Postfix by R

Re: Content filter then transport maps

2015-07-21 Thread Wietse Venema
Michael Peter: [ Charset ISO-8859-1 converted... ] > Hi, > > I have question about transport maps and content filter > > In main.cf > > content_filter = trans:localhost:10025 > > so all emails has the next-hop to localhost:10025 and the transport agent > is trans. > > But also we included in m

Re: Get a copy of email sent by null sender

2015-07-21 Thread Wietse Venema
Alexandre Ellert: > If I understand well your answer and the documentation, this solution should > work with Postfix 3.0: > 1. remove sender_bcc_maps directive > 2. add a check_sender_access. For example : > smtpd_recipient_restrictions = check_sender_access > regexp:/etc/postfix/sender_bcc_maps_

Re: Testing reject_unknown_client_hostname on not-live system

2015-07-21 Thread John Gateley
On 7/19/15 10:47 PM, Viktor Dukhovni wrote: On Sun, Jul 19, 2015 at 10:44:09PM -0500, John Gateley wrote: However, the question still remains: how can I test this without actually making one of my domains live? Define "test". It will work as documented. Test: ensuring that my understanding

Re: postfix with opendkim: dkim signed forwarded emails fail verification

2015-07-21 Thread level420
Just reporting back to close up this issue: Yes! It is a exchange server bug! Discussion in ms technet here: https://social.technet.microsoft.com/Forums/en-US/c0b76505-8737-4b6e-bcee-62cb1ea5ef96/dkim-automatic-forwarding-to-gmail-dkim-neutral?forum=exchangesvrsecuremessaginglegacy The corres

Content filter then transport maps

2015-07-21 Thread Michael Peter
Hi, I have question about transport maps and content filter In main.cf content_filter = trans:localhost:10025 so all emails has the next-hop to localhost:10025 and the transport agent is trans. But also we included in main.cf transport_maps = hash:/etc/postfix/transport will all the email g

Re: makedefs.out

2015-07-21 Thread Wietse Venema
@lbutlr: > Is there a simple way to use the makedefs.conf file to recompile a new > version of Postfix? > Find the lines with: # Start of summary of user-configurable 'make makefiles' options. # CCARGS=XXX # AUXLIBS=YYY ... # End of summary of user-configurable 'make makefil

Re: RC4 in live email servers?

2015-07-21 Thread DTNX Postmaster
On 21 Jul 2015, at 09:49, A. Schulze wrote: >> Should I remove "smtpd_tls_mandatory_exclude_ciphers = 3DES" >> and look how the cipher use change over the next days ? > > immediately after I removed "smtpd_tls_mandatory_exclude_ciphers = 3DES" > some servers fail to establish TLS. At least one w

Re: Get a copy of email sent by null sender

2015-07-21 Thread Alexandre Ellert
> Le 20 juil. 2015 à 12:46, Wietse Venema a écrit : > > Alexandre Ellert: >> Hello, >> >> I often use sender_bcc_maps to audit suspicious account and it works great. >> Today, I need to have a look at email sent by null sender <> >> >> Here is my relevant configuration : >> >> # grep sender_b

Re: RC4 in live email servers?

2015-07-21 Thread A. Schulze
A. Schulze: Should I remove "smtpd_tls_mandatory_exclude_ciphers = 3DES" and look how the cipher use change over the next days ? immediately after I removed "smtpd_tls_mandatory_exclude_ciphers = 3DES" some servers fail to establish TLS. At least one was a Exchange 2010 Version 14.03... :

Re: postfix with opendkim: dkim signed forwarded emails fail verification

2015-07-21 Thread Dietrich Streifert
Hi all, I think I've found the cause of the problem, which is the exchange server receiving the forwarded message. gmail dkim signatures include signing of the Content-Type field, which is somehow altered by the receiving exchange server this way: -Content-Type: text/plain; charset=utf-8; f