Re: Prevent sender address spoofing

2019-09-30 Thread @lbutlr
On Sep 30, 2019, at 8:21 AM, Matus UHLAR - fantomas wrote: >> On Sep 30, 2019, at 5:29 AM, Matus UHLAR - fantomas >> wrote: >>> rarely someone notices they are different. > > On 30.09.19 08:05, @lbutlr wrote: >> And often there are perfectly legitimate reasons for them to be different. > > yes

Re: Prevent sender address spoofing

2019-09-30 Thread Hugo Florentino
El lun, 30-09-2019 a las 17:58 -0400, Bill Cole escribió: > On 29 Sep 2019, at 20:30, Hugo Florentino wrote: > > > El vie, 27-09-2019 a las 09:33 -0400, Bill Cole escribió: > > > [...] > > > > > > Because, as documented, header_checks (and the other built-in > > > content > > > filtering in Postf

Re: Prevent sender address spoofing

2019-09-30 Thread Bill Cole
On 29 Sep 2019, at 20:30, Hugo Florentino wrote: El vie, 27-09-2019 a las 09:33 -0400, Bill Cole escribió: [...] Because, as documented, header_checks (and the other built-in content filtering in Postfix) does not support restrictions or restriction classes as results of a pattern match. A

Re: Virtual Alias Domains

2019-09-30 Thread Viktor Dukhovni
On Mon, Sep 30, 2019 at 01:00:18PM +, Nicolas Breuer wrote: > Indeed if i remove the IP address from "mynetworks", I got a "relay access > denied" Good, this is the expected behaviour. > The behavior is strange because : > - the MX of the domain is not this server itself. That's not releva

Re: Specifying certificates in master.cf

2019-09-30 Thread Viktor Dukhovni
On Mon, Sep 30, 2019 at 06:53:38AM -0700, linkcheck wrote: > I have the following for smtp and submission... > > smtp inet n - n - - smtpd > [...] > -o smtpd_tls_cert_file=/etc/letsencrypt/live/(name).pem > -o smtpd_tls_key_file=/etc/letsencrypt/live/(na

Re: Specifying certificates in master.cf

2019-09-30 Thread Anton Rieger
smtp inet n - n - - smtpd -o smtpd_tls_cert_file=/etc/letsencrypt/live/(name).pem -o smtpd_tls_key_file=/etc/letsencrypt/live/(name).pem -o smtp_tls_cert_file=/etc/letsencrypt/live/(name).pem -o smtp_tls_key_file=/etc/letsencrypt/live/(name).pem submission

Re: Prevent sender address spoofing

2019-09-30 Thread Matus UHLAR - fantomas
On Sep 30, 2019, at 5:29 AM, Matus UHLAR - fantomas wrote: rarely someone notices they are different. On 30.09.19 08:05, @lbutlr wrote: And often there are perfectly legitimate reasons for them to be different. yes, but this thread is AFAIK about spoofing local addresses. -- Matus UHLAR -

Re: Specifying certificates in master.cf

2019-09-30 Thread @lbutlr
On Sep 30, 2019, at 7:53 AM, linkcheck wrote: > I have the following for smtp and submission… Seems like a lot. This is all I have, in main.cf: smtpd_tls_cert_file = /usr/local/etc/dehydrated/certs/covisp.net/fullchain.pem smtpd_tls_key_file = /usr/local/etc/dehydrated/certs/covisp.net/privkey.

Re: Prevent sender address spoofing

2019-09-30 Thread @lbutlr
On Sep 30, 2019, at 5:29 AM, Matus UHLAR - fantomas wrote: > rarely someone notices they are different. And often there are perfectly legitimate reasons for them to be different. -- showing snuffy is when Sesame Street jumped the shark

Specifying certificates in master.cf

2019-09-30 Thread linkcheck
I have been running postfix for several years. The latest certificate has almost run out so I switched to letsencrypt. Whilst installing the certificate and key in master.cf it occurred to me to wonder if I wasn't over-specifying their use. I have checked around the web and found nothing like my se

RE: Virtual Alias Domains

2019-09-30 Thread Nicolas Breuer
Hello Viktor, First, thanks for all your explanations. Indeed if i remove the IP address from "mynetworks", I got a "relay access denied" The behavior is strange because : - the MX of the domain is not this server itself. - the domain is * not * in virtual_alias_domain - the email is * still * i

Re: Prevent sender address spoofing

2019-09-30 Thread Matus UHLAR - fantomas
On 30.09.19 11:40, Christos Chatzaras wrote: Add this line to main.cf : smtpd_sender_login_maps = hash:/usr/local/etc/postfix/smtpd_sender_login_maps And then add to smtpd_sender_login_maps : u...@example.com u...@example.com This only validates envelope from headers according to SASL login

Re: Prevent sender address spoofing

2019-09-30 Thread Christos Chatzaras
> On 30.09.19 11:40, Christos Chatzaras wrote: >> Add this line to main.cf : >> >> smtpd_sender_login_maps = hash:/usr/local/etc/postfix/smtpd_sender_login_maps >> >> And then add to smtpd_sender_login_maps : >> >> u...@example.com u...@example.com > > This only validates envelope from header

Re: Prevent sender address spoofing

2019-09-30 Thread Matus UHLAR - fantomas
Allow me to pose a slightly different scenario then, but still related to my original doubt: I separate smtp and submission, and prevent using my domain through smtp. However somehow someones's PC gets compromised and sends mail modifying the From header in the data section. Even if the envelope

Re: Prevent sender address spoofing

2019-09-30 Thread Christos Chatzaras
> > Allow me to pose a slightly different scenario then, but still related > to my original doubt: > > I separate smtp and submission, and prevent using my domain through > smtp. However somehow someones's PC gets compromised and sends mail > modifying the From header in the data section. > > Ev