Re: extended ascii codes in rfc822-formatted message?

2016-02-22 Thread Wietse Venema
Mailing Lists: > I have accidentally learned that a postfix server has accepted and > attempted to deliver an email with the envelope sender containing 8 bit > ascii codes (it looks like this T\?\?m...@domain.tld - that's a backslash and > then ascii extended code 177). the imap backend - an old cy

Re: [SOLVED] Re: A bug, maybe?

2016-02-22 Thread Curtis Maurand
On 2/22/2016 3:03 PM, Viktor Dukhovni wrote: On Mon, Feb 22, 2016 at 02:57:23PM -0500, Curtis Maurand wrote: The problem was in the /etc/nsswitch.conf. I changed the line hosts: files dns to hosts:dns files and that solved the trouble. Is "delivery.mailspamprotection.

Re: clients connecting to port 25 with ssl/tls

2016-02-22 Thread Viktor Dukhovni
> On Feb 22, 2016, at 5:11 PM, Rich Wales wrote: > > The last time I checked, iPhones and iPads refused to do STARTTLS on > mail submission. Since I use an iPad, I had no choice but to enable > submission via port 465 (SSL) on my mail server -- in addition to > STARTTLS on port 587 for use by o

extended ascii codes in rfc822-formatted message?

2016-02-22 Thread Mailing Lists
I have accidentally learned that a postfix server has accepted and attempted to deliver an email with the envelope sender containing 8 bit ascii codes (it looks like this T\▒\▒m...@domain.tld - that's a backslash and then ascii extended code 177). the imap backend - an old cyrus lmtp service - has

Re: clients connecting to port 25 with ssl/tls

2016-02-22 Thread CSS
> On Feb 22, 2016, at 5:11 PM, Rich Wales wrote: > > Regarding port 465 -- > > The last time I checked, iPhones and iPads refused to do STARTTLS on > mail submission. Since I use an iPad, I had no choice but to enable > submission via port 465 (SSL) on my mail server -- in addition to > STARTT

Re: clients connecting to port 25 with ssl/tls

2016-02-22 Thread Rich Wales
Regarding port 465 -- The last time I checked, iPhones and iPads refused to do STARTTLS on mail submission. Since I use an iPad, I had no choice but to enable submission via port 465 (SSL) on my mail server -- in addition to STARTTLS on port 587 for use by other, saner devices. I would love, of

Re: clients connecting to port 25 with ssl/tls

2016-02-22 Thread morbi...@rx900.org
On Mon, 22 Feb 2016 21:13:24 + Viktor Dukhovni wrote: > On Mon, Feb 22, 2016 at 10:07:51PM +0100, morbi...@rx900.org wrote: > > > Problem is that connections to 465 (with ssl/tls) appears in the logs > > identical to 25 (with ssl/tls) > > so that would lead to a lot false positives, if i've

Re: clients connecting to port 25 with ssl/tls

2016-02-22 Thread Viktor Dukhovni
On Mon, Feb 22, 2016 at 10:07:51PM +0100, morbi...@rx900.org wrote: > Problem is that connections to 465 (with ssl/tls) appears in the logs > identical to 25 (with ssl/tls) > so that would lead to a lot false positives, if i've understood correctly. Fix that. The relevant commented-out sample e

Re: clients connecting to port 25 with ssl/tls

2016-02-22 Thread morbi...@rx900.org
On Mon, 22 Feb 2016 20:58:51 + Viktor Dukhovni wrote: > On Mon, Feb 22, 2016 at 09:35:42PM +0100, morbi...@rx900.org wrote: > > > Currently my postfix server is accepting both cleartext and ssl/tls > > connections on port 25, but my data center is introducing a new rule > > (perhaps a new fi

Re: clients connecting to port 25 with ssl/tls

2016-02-22 Thread morbi...@rx900.org
On Mon, 22 Feb 2016 15:55:48 -0500 (EST) wie...@porcupine.org (Wietse Venema) wrote: > morbi...@rx900.org: > > Anonymous TLS connection established from xxx[yyy]: TLSv1.2 with cipher > > ECDHE-RSA-AE > > S128-GCM-SHA256 (128/128 bits) > > > > but that doesn't help much to determine the exact acc

Re: clients connecting to port 25 with ssl/tls

2016-02-22 Thread Viktor Dukhovni
On Mon, Feb 22, 2016 at 09:35:42PM +0100, morbi...@rx900.org wrote: > Currently my postfix server is accepting both cleartext and ssl/tls > connections on port 25, but my data center is introducing a new rule > (perhaps a new firewall) which will drop ssl/tls connections to port 25 > while allowin

Re: clients connecting to port 25 with ssl/tls

2016-02-22 Thread Wietse Venema
morbi...@rx900.org: > Anonymous TLS connection established from xxx[yyy]: TLSv1.2 with cipher > ECDHE-RSA-AE > S128-GCM-SHA256 (128/128 bits) > > but that doesn't help much to determine the exact account involved. Would logging the SASL username help? The Postfix SMTP server logs: queueid:

clients connecting to port 25 with ssl/tls

2016-02-22 Thread morbi...@rx900.org
Hello, I am in the need to catch mail clients connecting to port 25 with ssl/tls on my postfix server. Currently my postfix server is accepting both cleartext and ssl/tls connections on port 25, but my data center is introducing a new rule (perhaps a new firewall) which will drop ssl/tls connect

Re: Can't get mynetworks to match a specific host

2016-02-22 Thread @lbutlr
> On Feb 21, 2016, at 8:37 AM, Michael Sperber wrote: > > > Noel Jones writes: > >> On 2/17/2016 1:56 AM, Michael Sperber wrote: > In the log, it goes on from there like this: > > ... > Feb 16 03:38:48 deinprogramm postfix/submission/smtpd[76503]: > generic_checks: name=

Re: [SOLVED] Re: A bug, maybe?

2016-02-22 Thread Viktor Dukhovni
On Mon, Feb 22, 2016 at 02:57:23PM -0500, Curtis Maurand wrote: > The problem was in the /etc/nsswitch.conf. > I changed the line > hosts: files dns > to > hosts:dns files > and that solved the trouble. Is "delivery.mailspamprotection.com" listed in /etc/hosts? If so, then

Re: [SOLVED] Re: A bug, maybe?

2016-02-22 Thread Danny Horne
On 22/02/2016 7:57 pm, Curtis Maurand wrote: > > The problem was in the /etc/nsswitch.conf. > > I changed the line > > hosts: files dns > > to > > hosts:dns files > > and that solved the trouble. Interesting, I got the IP result Viktor got, but have the same nsswitch.conf setting as

[SOLVED] Re: A bug, maybe?

2016-02-22 Thread Curtis Maurand
On 2/20/2016 5:19 PM, Curtis Maurand wrote: On 2/20/2016 1:46 PM, Viktor Dukhovni wrote: On Sat, Feb 20, 2016 at 01:37:39PM -0500, Curtis Maurand wrote: Nothing is chrooted. resolv.conf is world readable. Wietse's program returns a valid address. It might not match the reverse, but it d

Re: transport_destination_rate_delay question

2016-02-22 Thread Rich Shepard
On Mon, 22 Feb 2016, Wietse Venema wrote: If you did not change any of the _destination_recipient_limit settings, this will send 240 messages per hour to the ISP. It also rate-limits all other Postfix delivery agents (local delivery, in particular). Wietse, I can live with a 15s delay local

Re: transport_destination_rate_delay question

2016-02-22 Thread Wietse Venema
Rich Shepard: >Running postfix-3.0.3 on Slackware-14.1 here. > >I need to relay outbound messages through my ISP. When I send newsletters > to subscribers I need to limit the number of messages per hour to < 300. To > accommodate this need I understand that within main.cf I set > > defaul

transport_destination_rate_delay question

2016-02-22 Thread Rich Shepard
Running postfix-3.0.3 on Slackware-14.1 here. I need to relay outbound messages through my ISP. When I send newsletters to subscribers I need to limit the number of messages per hour to < 300. To accommodate this need I understand that within main.cf I set default_destination_rate_delay = 15

Re: SV: Security: How to limit authentication attempts?

2016-02-22 Thread Michael Ströder
Kiss Gábor wrote: >>> My colleagues need authenticated channel to submit mails when traveling. >>> So disabling sasl is not an option. >> >> read again i just say disalbe it on port 25 >> >> and convense users to use submission port 587, or 465 as users se fits > > Can you guarantee that hotel fir

Re: postfix/dovecot - [private/dovecot-lmtp]: No such file or directory

2016-02-22 Thread Lukas Erlacher
Hi, this is not a postfix problem. Furthermore it is fully covered in the dovecot docs. You need to put the dovecot-lmtp socket into /var/spool/postfix/private. This means the unix_listener must get the path to that. See here: http://wiki2.dovecot.org/HowTo/PostfixDovecotLMTP Also note tha