Re: pishing from ME

2019-03-22 Thread @lbutlr
On 22 Mar 2019, at 19:45, Bill Cole wrote: > Do not accept mail claiming to be from any address in a local domain on the > port 25 (smtp) smtpd service. Only accept such mail via port 587 (submission) > and 465 (smtps) services configured to require authentication. And the way to do this is:

Re: pishing from ME

2019-03-22 Thread Bill Cole
On 22 Mar 2019, at 20:54, Kevin A. McGrail wrote: On 3/22/2019 7:55 PM, Viktor Dukhovni wrote: No. The scareware alerts are generally completely fake. They are spammed indiscriminately to users the scammer knows nothing about. Viktor, that does not agree with my significant experience study

OFF-TOPIC: KAM.cf to Core SA was Re: pishing from ME

2019-03-22 Thread Kevin A. McGrail
On 3/22/2019 10:45 PM, Benny Pedersen wrote: > Kevin A. McGrail skrev den 2019-03-23 00:34: > >> Also see KAM.cf and the KAM_CRIM ruleset for spamassassin for this >> exact run of spams. > > will you add good rules to core spamassassin ? > > so above is testing rules, not yet ready for core, if its

Re: pishing from ME

2019-03-22 Thread Benny Pedersen
Kevin A. McGrail skrev den 2019-03-23 00:34: Also see KAM.cf and the KAM_CRIM ruleset for spamassassin for this exact run of spams. will you add good rules to core spamassassin ? so above is testing rules, not yet ready for core, if its stable just not in core i can see why thay could not be

Re: pishing from ME

2019-03-22 Thread Bill Cole
On 22 Mar 2019, at 21:56, Mauricio Tavares wrote: I would add that spamassassin does not seem to have much of a problem catching that True. This is due to a lot of work by John Hardin to create and maintain a focused rule cluster that catches a big slice of this garbage. It has morphed subs

Re: pishing from ME

2019-03-22 Thread Mauricio Tavares
On Fri, Mar 22, 2019 at 9:46 PM Bill Cole wrote: > > On 22 Mar 2019, at 19:19, Christian Schmitz wrote: > > > Hi everyone: > > I have a small mail server with fewer emails account, The server is: > > Opensuse/Postfix/apache > > > > Today i receive a pishing email Words more or less say that

Re: pishing from ME

2019-03-22 Thread Kevin A. McGrail
On 3/22/2019 9:31 PM, Viktor Dukhovni wrote: >> Have you checked on haveibeenpwned for the email addresses and domains >> in question? > There's no need. The team mailboxes in question are not associated > with any login accounts, they're just public contact addresses > scraped from websites. You

Re: pishing from ME

2019-03-22 Thread Mick
On 22/03/2019 23:19, Christian Schmitz wrote: Hi everyone: I have a small mail server with fewer emails account, The server is: Opensuse/Postfix/apache Today i receive a pishing email Words more or less say that i was hacked, that he know my passwords blah blah blah and i must pay on bit

Re: pishing from ME

2019-03-22 Thread Bill Cole
On 22 Mar 2019, at 19:19, Christian Schmitz wrote: Hi everyone: I have a small mail server with fewer emails account, The server is: Opensuse/Postfix/apache Today i receive a pishing email Words more or less say that i was hacked, that he know my passwords blah blah blah and i must pay

Re: pishing from ME

2019-03-22 Thread Viktor Dukhovni
On Fri, Mar 22, 2019 at 09:23:13PM -0400, Kevin A. McGrail wrote: > > Sure they may also be scraping email addresses from breaches, but > > that's one source. These scams are not a specific indication that > > one's passwords are at risk. That's true or false with or without > > receipt of these

Re: pishing from ME

2019-03-22 Thread Kevin A. McGrail
On 3/22/2019 9:06 PM, Viktor Dukhovni wrote: > Sure they may also be scraping email addresses from breaches, but > that's one source. These scams are not a specific indication that > one's passwords are at risk. That's true or false with or without > receipt of these scams. Have you checked on h

Re: pishing from ME

2019-03-22 Thread Phil Stracchino
On 3/22/19 9:11 PM, Julian Opificius wrote: > > On 3/22/2019 7:54 PM, Kevin A. McGrail wrote: >> On 3/22/2019 7:55 PM, Viktor Dukhovni wrote: >>> No. The scareware alerts are generally completely fake. They >>> are spammed indiscriminately to users the scammer knows nothing >>> about. >> >> Vikt

Re: pishing from ME

2019-03-22 Thread Julian Opificius
On 3/22/2019 7:54 PM, Kevin A. McGrail wrote: On 3/22/2019 7:55 PM, Viktor Dukhovni wrote: No. The scareware alerts are generally completely fake. They are spammed indiscriminately to users the scammer knows nothing about. Viktor, that does not agree with my significant experience studying

Re: pishing from ME

2019-03-22 Thread Kevin A. McGrail
On 3/22/2019 7:55 PM, Viktor Dukhovni wrote: > No. The scareware alerts are generally completely fake. They > are spammed indiscriminately to users the scammer knows nothing > about. Viktor, that does not agree with my significant experience studying this particular spam threat.  Yes, they are "

Re: pishing from ME

2019-03-22 Thread Viktor Dukhovni
> On Mar 22, 2019, at 7:34 PM, Kevin A. McGrail wrote: > > They do know the passwords but they didn't hack your PC. See > haveibeenpwned.com. They compromised other services you use and you need > better password management. No. The scareware alerts are generally completely fake. They a

Re: pishing from ME

2019-03-22 Thread Kevin A. McGrail
On 3/22/2019 7:19 PM, Christian Schmitz wrote: > Hi everyone: > I have a small mail server with fewer emails account, The server is: > Opensuse/Postfix/apache > > Today i receive a pishing email Words more or less say that i was hacked, > that > he know my passwords blah blah blah and i mu

pishing from ME

2019-03-22 Thread Christian Schmitz
Hi everyone: I have a small mail server with fewer emails account, The server is: Opensuse/Postfix/apache Today i receive a pishing email Words more or less say that i was hacked, that he know my passwords blah blah blah and i must pay on bit_coins. The email content is 100% pishing and

Aw: Re: Add Header only if sent via sendmail

2019-03-22 Thread lutz . niederer
It seems to work. Thank you!   Gesendet: Freitag, 22. März 2019 um 16:15 Uhr Von: "Viktor Dukhovni" An: "Postfix users" Betreff: Re: Add Header only if sent via sendmail > On Mar 22, 2019, at 3:00 AM, lutz.niede...@gmx.net wrote: > > But how can I do this? As noted below. > In master.cf I

Re: Postfix Active: active (exited) - (code=exited, status=0/SUCCESS)

2019-03-22 Thread Davide Marchi
Scott Kitterman ha scritto: First, this is a Debian specific question based on how we did systemd integration. It's not a general issue. For Debian specific questions, distro support resources are a better place to seek help. [..] Yes, I had done it, then (two days later) I posted in ML B.

Re: Postfix Active: active (exited) - (code=exited, status=0/SUCCESS)

2019-03-22 Thread Scott Kitterman
On March 22, 2019 3:11:24 PM UTC, Davide Marchi wrote: >Hi Friends, >on a VPS Debian Stretch, Postfix 3.1.9-0, Dovecot 2.2.27-3, rspamd >1.8.3-1, Clamav 0.100.2, postfix-mysql 3.1.9-0, dovecot-mysql 2.2.27-3 > >running "systemctl -l status postfix" obtain: > > >● postfix.service - Postfix Mail

Re: Postfix Active: active (exited) - (code=exited, status=0/SUCCESS)

2019-03-22 Thread Wietse Venema
Davide Marchi: > Hi Friends, > on a VPS Debian Stretch, Postfix 3.1.9-0, Dovecot 2.2.27-3, rspamd > 1.8.3-1, Clamav 0.100.2, postfix-mysql 3.1.9-0, dovecot-mysql 2.2.27-3 > > running "systemctl -l status postfix" obtain: > Perhaps surprisingly, Postfix logs why it terminates. http://www.postfi

Re: Postfix Active: active (exited) - (code=exited, status=0/SUCCESS)

2019-03-22 Thread B. Reino
On Fri, 22 Mar 2019, Davide Marchi wrote: Hi Friends, on a VPS Debian Stretch, Postfix 3.1.9-0, Dovecot 2.2.27-3, rspamd 1.8.3-1, Clamav 0.100.2, postfix-mysql 3.1.9-0, dovecot-mysql 2.2.27-3 running "systemctl -l status postfix" obtain: ● postfix.service - Postfix Mail Transport Agent Lo

Re: Add Header only if sent via sendmail

2019-03-22 Thread Viktor Dukhovni
> On Mar 22, 2019, at 3:00 AM, lutz.niede...@gmx.net wrote: > > But how can I do this? As noted below. > In master.cf I add a service eg called "mycleanup" with > mycleanup unix ... cleanup -o header_checks=file Well, not "=file" but "=pcre:file" or similar. > Essentially a renamed copy of the

Postfix Active: active (exited) - (code=exited, status=0/SUCCESS)

2019-03-22 Thread Davide Marchi
Hi Friends, on a VPS Debian Stretch, Postfix 3.1.9-0, Dovecot 2.2.27-3, rspamd 1.8.3-1, Clamav 0.100.2, postfix-mysql 3.1.9-0, dovecot-mysql 2.2.27-3 running "systemctl -l status postfix" obtain: ● postfix.service - Postfix Mail Transport Agent Loaded: loaded (/lib/systemd/system/postfix.s

Aw: Re: Add Header only if sent via sendmail

2019-03-22 Thread lutz . niederer
But how can I do this? In master.cf I add a service eg called "mycleanup" with mycleanup unix ... cleanup -o header_checks=file Essentially a renamed copy of the cleanup service with -o header_checks Then I add the parameter -o cleanup_service_name=mycleanup to existing pickup I don't need to