Re: Postscreen setup

2016-03-31 Thread John
On 31/03/2016 5:34 PM, /dev/rob0 wrote: BTW, regarding the apology, thanks. It wasn't my thread, but indeed all of us who use threaded mail readers are affected by "thread hijacking." Now a few comments about your config, one of which is a serious problem ... On Thu, Mar 31, 2016 at 01:32:02PM

Re: Issues with postscreen and barracuda spam firewall

2016-03-31 Thread Wietse Venema
Quanah Gibson-Mount: > Hi, > > We have customers testing our next Zimbra release, which includes support > for postscreen. By default, postscreen is not set to take any actions. > However, one tester found that even with this being the case, connections > from their Barracuda Spam Firewall are

Re: understanding postscreen cache?

2016-03-31 Thread Wietse Venema
> > Mar 29 18:25:28 mail01 postfix/dnsblog[24238]: addr 79.13.92.233 listed > > by domain zen.spamhaus.org as 127.0.0.10 > > Mar 29 18:25:28 mail01 postfix/dnsblog[24240]: addr 79.13.92.233 listed > > by domain dnsbl.sorbs.net as 127.0.0.10 ... > > Mar 29 18:26:02 mail01 postfix/dnsbl

Re: Issues with postscreen and barracuda spam firewall

2016-03-31 Thread Quanah Gibson-Mount
--On Thursday, March 31, 2016 6:57 PM -0500 "/dev/rob0" wrote: Anyone have an idea how to work around this? Try adding the client to postscreen_access_list? I asked them if it was in mynetworks, but they haven't responded yet. I'll ask again. ;) Clearly having their spam appliance be

Re: Issues with postscreen and barracuda spam firewall

2016-03-31 Thread /dev/rob0
On Thu, Mar 31, 2016 at 03:15:11PM -0700, Quanah Gibson-Mount wrote: > We have customers testing our next Zimbra release, which includes > support for postscreen. Very nice! Congratulations. > By default, postscreen is not set to take any actions. > However, one tester found that even with this

Issues with postscreen and barracuda spam firewall

2016-03-31 Thread Quanah Gibson-Mount
Hi, We have customers testing our next Zimbra release, which includes support for postscreen. By default, postscreen is not set to take any actions. However, one tester found that even with this being the case, connections from their Barracuda Spam Firewall are being rejected thusly: Mar 11

Re: send to ESP with broken STARTTLS

2016-03-31 Thread Viktor Dukhovni
On Thu, Mar 31, 2016 at 10:21:00PM +0200, A. Schulze wrote: > As mentioned we see numerous domains with the same broken MX. > I have to list them one by one in the transport table > or did I forgot a cool configuration to catch any destination domain with > this specific MX? There is no such cool

Re: Postscreen setup

2016-03-31 Thread /dev/rob0
BTW, regarding the apology, thanks. It wasn't my thread, but indeed all of us who use threaded mail readers are affected by "thread hijacking." Now a few comments about your config, one of which is a serious problem ... On Thu, Mar 31, 2016 at 01:32:02PM -0400, John Allen wrote: > As I expect

Re: understanding postscreen cache?

2016-03-31 Thread Noel Jones
On 3/31/2016 3:30 PM, jaso...@mail-central.com wrote: > I'd like to understand postscreen's cache behavior a bit better than I do. > > Looking at my logs for one example > > Mar 29 18:25:28 mail01 postfix/postscreen[24234]: CONNECT from > [79.13.92.233]:64564 to [192.0.2.24]:25 > Mar

understanding postscreen cache?

2016-03-31 Thread jasonsu
I'd like to understand postscreen's cache behavior a bit better than I do. Looking at my logs for one example Mar 29 18:25:28 mail01 postfix/postscreen[24234]: CONNECT from [79.13.92.233]:64564 to [192.0.2.24]:25 Mar 29 18:25:28 mail01 postfix/dnsblog[24238]: addr 79.13.92.233 li

Re: send to ESP with broken STARTTLS

2016-03-31 Thread A. Schulze
Viktor Dukhovni: iutax.de.pri-mx.eu0105.smtproutes.com[94.186.192.102]:25 Yes, this server has a 768-bit DH key. a larger email service provider :-/ see https://www.robtex.com/en/advisory/ip/94/186/192/102/ The 1024-bit lower limit is enforced internally by the OpenSSL library and cannot b

Re: block all mail from mta's with a FQDN match?

2016-03-31 Thread John Allen
I am not sure what I did here, but I seem to have taken over /dev/rob0's thread, not my intention. My apologies to everyone and in particular to /dev/rob0 John A

Re: Postscreen setup

2016-03-31 Thread Viktor Dukhovni
On Thu, Mar 31, 2016 at 02:01:57PM -0400, John Allen wrote: > From everything I had read I expected the smtp entry in master to be > > smtp inet n - n - 1postscreen > -o cleanup_service_name=pre-cleanup > > But you are saying it should be > > smtp

Re: send to ESP with broken STARTTLS

2016-03-31 Thread Viktor Dukhovni
On Thu, Mar 31, 2016 at 04:47:10PM +0200, A. Schulze wrote: > I hit an MX-Server with weak DH: > > # SLES-Host > # posttls-finger iutax.de > posttls-finger: Connected to > iutax.de.pri-mx.eu0105.smtproutes.com[94.186.192.102]:25 Yes, this server has a 768-bit DH key. > posttls-finger: < 220 gm

Re: Postscreen setup

2016-03-31 Thread John Allen
On Mar 31, 2016, at 1:32 PM, John Allen wrote: I have read the documentation and it would appear that I don't need to do very much to get postscreen working. Which makes me think I have got it wrong. So I have some questions: 1) I have to change smtp ... smtpd to smtp ... postscreen. As my

Re: Postscreen setup

2016-03-31 Thread Wietse Venema
John Allen: > As postscreen does dnsbl lookups do I still need the reject_rbl_client > entries in smtpd_recipient_restrictions? Do the latter entries do more > than the dnsbl entries? It does not hurt. The DNS reply is cached in the DNS server. > My postscreen setup would be something like: >

Re: OT: mirror update contact e-mail

2016-03-31 Thread Wietse Venema
Matthew McGehrin: > Hello. > > I run a mirror for Postfix and I need to update the URL. I have e-mailed > Wietse several times in the past few years, and every time the e-mail is > being ignored. What is the proper subject to use to contact Wietse to > update my mirror details? Sorry about tha

Re: Postscreen setup

2016-03-31 Thread Viktor Dukhovni
> On Mar 31, 2016, at 1:32 PM, John Allen wrote: > > I have read the documentation and it would appear that I don't need to do > very much to get postscreen working. Which makes me think I have got it > wrong. > > So I have some questions: > > 1) I have to change smtp ... smtpd to smtp ...

Postscreen setup

2016-03-31 Thread John Allen
I am trying to setup postscreen,. I have read the documentation and it would appear that I don't need to do very much to get postscreen working. Which makes me think I have got it wrong. So I have some questions: 1) I have to change smtp ... smtpd to smtp ... postscreen. As my master.cf seem

Re: How to log output from whatever pipe runs ?

2016-03-31 Thread chaouche yacine
On Thursday, March 31, 2016 3:55 PM, Bennett Todd wrote: >How about running a logging wrapper script, instead. Good idea. When maildrop is invoked from the command line, it works. Each mail is delivered to the correct Maildir. Here's what it outputs : root@messagerie[10.10.10.20] ~ # echo "en

OT: mirror update contact e-mail

2016-03-31 Thread Matthew McGehrin
Hello. I run a mirror for Postfix and I need to update the URL. I have e-mailed Wietse several times in the past few years, and every time the e-mail is being ignored. What is the proper subject to use to contact Wietse to update my mirror details? Thanks

Re: How to log output from whatever pipe runs ?

2016-03-31 Thread Wietse Venema
chaouche yacine: > maildrop: Delivery complete. > root@messagerie[10.10.10.20] ~ # > > > What could be the reason to have two different outputs for the same command ? One obvious diference is that Postfix does not run the maildrop program as user ROOT. Have to tried to run it by hand as user V

Re: How to log output from whatever pipe runs ?

2016-03-31 Thread Bennett Todd
How about running a logging wrapper script, instead. Rather than invoking the maildrop executable, invoke a script, perhaps something like #!/bin/sh exec >/tmp/maildrop.log 2>&1 echo $0 "$@" set -x printenv maildrop ...

How to log output from whatever pipe runs ?

2016-03-31 Thread chaouche yacine
The setup : postfix + maildrop in a virtual user setup. Maildirs are in /var/vmail/domain{1,2,...}/user{1,2,...} When maildrop is invoked from the command line, it delievers the mail correctly. But when it is invoked by postfix, the mail is delivered to the wrong place (/var/vmail/Maildir inst

send to ESP with broken STARTTLS

2016-03-31 Thread A. Schulze
Hello, I hit an MX-Server with weak DH: # SLES-Host # posttls-finger iutax.de posttls-finger: Connected to iutax.de.pri-mx.eu0105.smtproutes.com[94.186.192.102]:25 posttls-finger: < 220 gmy2-mh901.smtproutes.com kath-5.0.3 ESMTP Ready posttls-finger: > EHLO idvmailout03.datev.de posttls-fing