[pfx] Re: milter service connection refused

2025-01-22 Thread Curtis Vaughan via Postfix-users
3:36:50 PM PST, Jaroslaw Rafa via Postfix-users wrote: >Dnia 22.01.2025 o godz. 14:22:05 Curtis Vaughan via Postfix-users pisze: >> >> mv opendkim opendkim-real >> >> I'm moving /usr/sbin/opendkim to /usr/bin/opendkim-real ? Nope, there is no >> such pr

[pfx] Re: milter service connection refused

2025-01-22 Thread Curtis Vaughan via Postfix-users
to note the following error: opendkim-testkey -vvv opendkim-testkey: using default configfile /etc/opendkim.conf opendkim-testkey: invalid data set type So maybe I need to recreate all the keys or something? On 1/22/25 13:31, Wietse Venema via Postfix-users wrote: Curtis Vaughan via Postfix-users

[pfx] Re: milter service connection refused

2025-01-22 Thread Curtis Vaughan via Postfix-users
Curtis Vaughan via Postfix-users: I realize there have been a lot of posts about this issue, but in my attempts so far, nothing has resolved this issue for me. The postfix server in question is running on Ubuntu LTS 24.04 and has been in operation for over a decade. But today while looking in

[pfx] milter service connection refused

2025-01-22 Thread Curtis Vaughan via Postfix-users
I realize there have been a lot of posts about this issue, but in my attempts so far, nothing has resolved this issue for me. The postfix server in question is running on Ubuntu LTS 24.04 and has been in operation for over a decade. But today while looking in the logs about a different issue I

[pfx] Re: Handing off via localhost:10025 to spamassassin for scanning failure

2024-06-29 Thread Curtis J Blank via Postfix-users
in those log entries. Just saying looks like my expectations were off... On 6/29/24 11:59, Matus UHLAR - fantomas via Postfix-users wrote: On 29.06.24 10:28, Curtis J Blank via Postfix-users wrote: I meant to mention I do not see any connections/traffic on port 10026 in the mail logs. see

[pfx] Re: Handing off via localhost:10025 to spamassassin for scanning failure

2024-06-29 Thread Curtis J Blank via Postfix-users
I meant to mention I do not see any connections/traffic on port 10026 in the mail logs. -Curt On 6/29/24 10:21, Curtis J Blank via Postfix-users wrote: On 6/29/24 04:01, Matus UHLAR - fantomas via Postfix-users wrote: On 29.06.24 01:41, Curtis J Blank via Postfix-users wrote: No I am not

[pfx] Re: Handing off via localhost:10025 to spamassassin for scanning failure

2024-06-29 Thread Curtis J Blank via Postfix-users
On 6/29/24 09:38, Bill Cole via Postfix-users wrote: On 2024-06-28 at 23:45:33 UTC-0400 (Fri, 28 Jun 2024 22:45:33 -0500) Curtis J Blank via Postfix-users is rumored to have said: OK I tired this. What "mydestination" is set to does not matter whether it's localhost or 127.

[pfx] Re: Handing off via localhost:10025 to spamassassin for scanning failure

2024-06-29 Thread Curtis J Blank via Postfix-users
On 6/29/24 08:40, Ralph Seichter via Postfix-users wrote: * Curtis J. Blank via Postfix-users: Everything except this that is: mydestination = $myhostname, localhost.$mydomain, $mydomain, www.$mydomain Should this be set to: mydestination = $myhostname, 127.0.0.1.$mydomain, $mydomain, www

[pfx] Re: Handing off via localhost:10025 to spamassassin for scanning failure

2024-06-29 Thread Curtis J Blank via Postfix-users
On 6/29/24 04:01, Matus UHLAR - fantomas via Postfix-users wrote: On 29.06.24 01:41, Curtis J Blank via Postfix-users wrote: No I am not confusing inbound and outbound not you, someone other perhaps :-) and for this I'm only concerned about inbound and actually only on ports 10024-26

[pfx] Re: Handing off via localhost:10025 to spamassassin for scanning failure

2024-06-28 Thread Curtis J Blank via Postfix-users
   -o mynetworks=127.0.0.0/8     -o smtpd_use_tls=no     -o smtp_use_tls=no spamtnsp   unix  -   n   n   -   -   local     -o alias_maps=lmdb:/etc/aliaases On 6/29/24 01:26, Peter via Postfix-users wrote: On 29/06/24 18:09, Curtis J Blank via Postfix-users wrote: I don'

[pfx] Re: Handing off via localhost:10025 to spamassassin for scanning failure

2024-06-28 Thread Curtis J Blank via Postfix-users
ual_alias_domains = lmdb:/etc/postfix/virtual virtual_alias_maps = lmdb:/etc/postfix/virtual On 6/28/24 23:27, Peter via Postfix-users wrote: On 29/06/24 15:16, Curtis J Blank via Postfix-users wrote: Peter, my  misunderstanding, sorry. This is what I discovered today in my testing. I expl

[pfx] Re: Handing off via localhost:10025 to spamassassin for scanning failure

2024-06-28 Thread Curtis J Blank via Postfix-users
set to use 127.0.01 explicitly. If anyone can explain the detailed why I am curious to know. Thanks, -Curt On 6/28/24 22:16, Curtis J Blank via Postfix-users wrote: Peter, my  misunderstanding, sorry. This is what I discovered today in my testing. I explicitly used 127.0.0.1 and not localhost

[pfx] Re: Handing off via localhost:10025 to spamassassin for scanning failure

2024-06-28 Thread Curtis J Blank via Postfix-users
Yeah I thought of including the config but that OP was long due to all the logging so I didn't want to make it longer. I did say in my OP I would provide anything if requested. -Curt On 6/28/24 21:11, Peter via Postfix-users wrote: On 29/06/24 05:59, Curtis J Blank via Postfix-users

[pfx] Re: Handing off via localhost:10025 to spamassassin for scanning failure

2024-06-28 Thread Curtis J Blank via Postfix-users
tfix-users wrote: On 29/06/24 03:17, Curtis J Blank via Postfix-users wrote: Well Peter all the "mynetworks =" that I have defined explicitly state 127.0.0.1 not localhost and all the logging shows 127.0.0.1 not localhost. So that is why I say I am using 127.0.0.1. So I cannot follow

[pfx] Re: Handing off via localhost:10025 to spamassassin for scanning failure

2024-06-28 Thread Curtis J Blank via Postfix-users
tool to drill the hole in the cable. When the DESTA came out and you could use Thinwire (coax) that was a revolution!. Yes I'm old. LOL https://gunkies.org/wiki/DEC_Ethernet_Transceivers On 6/28/24 12:59, Curtis J Blank via Postfix-users wrote: Always in a good mood. It's a waste not

[pfx] Re: Handing off via localhost:10025 to spamassassin for scanning failure

2024-06-28 Thread Curtis J Blank via Postfix-users
ch off that backbone. TCP/IP was in it's infancy too at the time. That was over 30 years before ipv6 was around so localhost was 127.0.0.1 and now to me, oh yeah, ::1 is too now. -Curt On 6/28/24 12:09, Ralph Seichter via Postfix-users wrote: * Curtis J. Blank via Postfix-users: What I

[pfx] Re: Handing off via localhost:10025 to spamassassin for scanning failure

2024-06-28 Thread Curtis J Blank via Postfix-users
Thank you, Alexander, Matus, Jaroslaw, Peter, and Bill, just the kind of ideas I was looking for. My old postfix server is running 2.11 and I have not dealt much with postfix really since then because like I said it just worked, did what I needed it to do. Currently I'm working with 3.9 and I

[pfx] Re: Handing off via localhost:10025 to spamassassin for scanning failure

2024-06-28 Thread Curtis J Blank via Postfix-users
ter via Postfix-users wrote: * Curtis J. Blank via Postfix-users: I would like to get some insight as to the cause and correct configuration to use. [...] Maybe it is simply too early in the morning for me to get your point, but what insight are you looking for, exactly? You already found out that

[pfx] Handing off via localhost:10025 to spamassassin for scanning failure

2024-06-27 Thread Curtis J Blank via Postfix-users
I would like to get some insight as to the cause and correct configuration to use. Building a new server that in part is my postfix server and spent the last couple of days pulling my hair out trying to get it to deliver mail. I have an existing postfix server that has been working since 2014

[pfx] Stupid questions

2023-09-18 Thread Curtis Maurand via Postfix-users
om (policy=temperror) SPF, DKIM, and DMARC all pass at gmail. Thanks, Curtis ___ Postfix-users mailing list -- postfix-users@postfix.org To unsubscribe send an email to postfix-users-le...@postfix.org

[pfx] Re: Postfix: running a script on authentication failure

2023-06-23 Thread Curtis Maurand via Postfix-users
ave a long list of banned ip addresses in my system. I've also changed the length of time addresses get banned for from hours to months. --Curtis ___ Postfix-users mailing list -- postfix-users@postfix.org To unsubscribe send an email to postfi

[pfx] Re: [P-U] Re: Postfix lists are migrating to a new list server

2023-03-10 Thread Curtis Maurand via Postfix-users
a the ispconfig interface. I agree that it's documentation is cryptic and not for the faint of heart.  They surely don't stick to the KISS method. -- Curtis https://curtis.maurand.com ___ Postfix-users mailing list -- postfix-users@postfi

[pfx] Re: [P-U] Re: Postfix lists are migrating to a new list server

2023-03-10 Thread Curtis Maurand via Postfix-users
;-) I've been running rspamd for nearly a year and I've been very happy with it.  It's a huge improvement over amavis/spamassassin. It is very fast. --Curtis -- Curtis https://curtis.maurand.com ___ Postfix-users mailing list -- pos

Re: [EXTERNAL] Re: Mail queue took 3 hours to recover from a flood. Suggestions ?

2023-01-23 Thread Curtis Maurand
where do I find smtp-amavis connect timeout ? Tweaking the timeouts won't help in this case, the real issue is Amavis performance.  Disable the content inspection features that make it slow, or replace Amavis with something faster. -- Viktor. -- Curtis https://curtis.maurand.com

Re: mail.protection.outlook.com rejections

2022-11-02 Thread Curtis Maurand
Sadly MS is as fallible as the rest of us. Sent from my iPhone > On Nov 2, 2022, at 4:56 AM, Linkcheck wrote: > > Thanks, Viktor. That's interesting. You'd think someone like MS could get it > right. :( >

Re: Odd DNS issue requiring reboot.

2022-09-05 Thread Curtis Maurand
)  and disable systemd-resolvd and dnsmasq.  speeds things up dramatically.  Makes things much more reliable.  I have much harsher opinions about systemd, but that's not for this list. --Curtis -- Curtis https://curtis.maurand.com

Re: Where to place spamhaus tests

2022-08-08 Thread Curtis Maurand
I might also suggest pdns-recursor. very fast. Sent from my iPhone > On Aug 8, 2022, at 4:18 PM, Demi Marie Obenour wrote: > > On 8/7/22 09:50, Linkcheck wrote: >>> On 07/08/2022 1:12 pm, Rob McGee wrote: >>> dig 2.0.0.127.zen.spamhaus.org. any >> >> ANY has to be after DIG, not at the end, b

Re: Postfix-fg and maillog_file to stdout

2021-11-06 Thread Curtis Maurand
using syslog-ng within the container. > Em sáb., 6 de nov. de 2021 às 09:56, Curtis Maurand < > cur...@maurand.com> escreveu: > > On Fri, 2021-11-05 at 13:34 -0300, Rafael Azevedo wrote: > > > One last thing, is it possible to change the date format of the > > > out

Re: Postfix-fg and maillog_file to stdout

2021-11-06 Thread Curtis Maurand
On Fri, 2021-11-05 at 13:34 -0300, Rafael Azevedo wrote: > One last thing, is it possible to change the date format of the > output? > Current format: > Nov 05 13:20:06 smtp21 postfix/smtp[136]: 9D86C60BBE > > I'd like to use ISO format: > 2021-10-29T19:37:52.017684-03:00 smtp21 postfix/smtp > >

Re: How to tell postfix to be more verbose on the smtp port?

2021-09-28 Thread Curtis Maurand
would be a compelling choice of an an SMTP server for students new to network protocols looking for verbose error messages. I did a search and found this about custom bounce messages. https://www.howtoforge.com/configure-custom-postfix-bounce-messages Cheers, --Curtis

Re: Warning: Hostname Does Not Resolve

2021-03-09 Thread Curtis Maurand
your a record and fqdn, your helo/ehlo hostname and the ptr record all need to match. Sent from my iPhone > On Mar 9, 2021, at 12:36 PM, Greg Sims wrote: > >  > We are receiving the following in our email logs: > > Mar 09 08:12:15 mail01.raystedman.org postfix/smtpd[13431]: warning: hostnam

Re: Deprecated: white is better than black

2021-02-24 Thread Curtis Maurand
I totally agree with this and I am going to work to scrub the prior terminology from my system. Thank you, Wietse —Curtis Sent from my iPhone > On Feb 24, 2021, at 12:12 PM, Wietse Venema wrote: > > The following is from the postfix-3.6-20210221 release notes. > >Wiet

Re: Mail from @somedomain.tld allowed only from some CIDR ranges?

2021-02-07 Thread Curtis Maurand
were trying to send via google. SPF said nay, nay the policy says all incoming mail from x.tld should come from spf.protection.outlook.com not the ip address that google owns from which the message originated. Cheers, Curtis

Re: Corner cases in SSL_shutdown.

2021-02-02 Thread Curtis Maurand
-Curtis Sent from my iPhone > On Feb 2, 2021, at 10:31 AM, Bill Cole > wrote: > > On 2 Feb 2021, at 9:49, Leo Bicknell wrote: > >> Perhaps Postfix does not support returning to clear text from a STARTTLS >> session and doing futher protocol operations. I have not

Re: New postfix server, authentication confusion

2021-01-24 Thread Curtis Maurand
for the blackhole lists, etc. take a look ar mxtoolbox.com postfix should be passing sasl requests to dovecot’s imap process. I use a tool called ispconfig which sets all of this up along with other tools such as clamav, rspamd or amavisd along with per user policies. my $0.02. I like its se

Re: Ignoring a failing dictionary ?

2021-01-20 Thread Curtis Maurand
Sent from my iPhone > On Jan 20, 2021, at 10:27 AM, Jaroslaw Rafa wrote: > > Dnia 20.01.2021 o godz. 15:48:29 Ganael Laplanche pisze: >>> So just try to create some simple "proxy" to your LDAP server that does only >>> one thing: if LDAP is available, just return the response from LDAP; if >

Re: Ignoring a failing dictionary ?

2021-01-19 Thread Curtis Maurand
s with snapshot capabilities. stop the ldap server, restore the database from the snapshot, start the server. that can also be automated and have it happen in seconds. —Curtis Sent from my iPhone

Re: Reject email containing Google forms

2020-12-01 Thread Curtis Maurand
How about a general sieve rule in your dovecot server or a filter in your delivery agent? Sent from my iPhone > On Dec 1, 2020, at 5:11 PM, lists wrote: > > About 70% of my spam these days contains links to Google Forms. I've been > googling for tips on how to reject such email but Google fi

Re: Recommended milters for small setup

2020-10-15 Thread curtis
October 15 2020 3:33 PM, "Patrick Ben Koetter" wrote: > * Ian Evans : > >> The long story short is that due to dealing with family medical issues over >> the past few years, my Combo web/postfix server is still on Ubuntu 14.04. >> >> In a couple of months I will have some time to upgrade. Instea

Re: Raw postfix newbie here...

2020-08-09 Thread Curtis Maurand
> On Aug 9, 2020, at 8:09 PM, Viktor Dukhovni > wrote: > > - Mail to managed lists with an owner-alias >- Mail to pipes >- Mail to :include:/some/file lists. this can be put into the transports table and you can skip the /etc/aliases altogether.

Re: Postfix behind NAT -> failover IP -> wrong HELO

2020-07-01 Thread Curtis Maurand
easier than that.  use linux heartbeat on the two postfix service. the failover happens within seconds.  use the unison file system to keep the spool folders and other necessary folders needed to pick up on the failover machine and when the primary fails, whatever services that need to be runni

Re: Postfix behind NAT -> failover IP -> wrong HELO

2020-06-30 Thread Curtis Maurand
really better to execute a command that sets both the external address AND Postfix settings. Wietse Wietse's solution is better.  what he said. --Curtis

Re: Postfix behind NAT -> failover IP -> wrong HELO

2020-06-30 Thread Curtis Maurand
It's part of the config in main.cf You can specify "myhostname" myhostname = host.domain.tld Cheers, Curtis On 6/30/20 4:55 PM, Istvan Prosinger wrote: On 6/30/20 10:34 PM, Wietse Venema wrote: Istvan Prosinger: On 6/30/20 9:49 PM, Wietse Venema wrote: Istvan Prosinger:

Re: Postfix "IPv6-only" - experience/recommendation question

2020-05-11 Thread Curtis Villamizar
In message "michae...@rocketmail.com" writes: > THANKS to a all who answered!!! > > A lot of shared experience, learned a lot, cool. It's always very > interesting how threads are meandering, somehow, adding new aspects to > unasked but also relevant questions. Crowd as it's best :-) Summarize

Re: Postfix "IPv6-only" - experience/recommendation question

2020-05-08 Thread Curtis Villamizar
t example.com if you can only get one IPv4 address. Hope this helps. Curtis > - EOM for impatient readers :-) --- > > Hi patient readers :-) > > reason for my question: > > I'm running my own small postfix/dovecot etc. environment on a > VPS. Running fine

Re: Query

2020-02-14 Thread Curtis Maurand
you could set up the mail aliases in transport maps to pass them to mailman Sent from my iPhone > On Feb 14, 2020, at 10:43 AM, Peter Fraser wrote: > >  > Hi All > I am trying to figure out how to get this working. I run Mailman through > Postfix. The Mailman aliases are in alias_maps. I find

Re: Building recipient maps from Exchange/O365

2020-02-09 Thread Curtis Maurand
On 2/9/20 12:39 PM, Gerard E. Seibert wrote: On Sun, 9 Feb 2020 07:56:53 -0500, Curtis Maurand stated: it should be. use ldap. active directory is nothing but a glorified ldap server and listens on port 389. If it were ldap over ssl the port is 636 I believe. I stand corrected.

Re: Building recipient maps from Exchange/O365

2020-02-09 Thread Curtis Maurand
it should be. use ldap. active directory is nothing but a glorified ldap server and listens on port 389. Sent from my iPhone > On Feb 9, 2020, at 7:04 AM, John Regan wrote: > >  > Hi, > > Is it possible for postfix to directly access the email addresses or userlist > from an Exchange ser

Re: [OT] why ATT.net still host its email on Verizon Yahoo

2019-09-17 Thread Curtis Maurand
Not competitors. Oligarchs. Colluders market fixers. Competition killers. Sent from my iPhone > On Sep 17, 2019, at 4:44 AM, Wesley Peng wrote: > > Hello, > > though this is a little OT, but I was curious since verizon has bought yahoo > for long days, why ATT still host its customer email

Re: warning: hostname dc1.xxx.com.au does not resolve to address xxx.xxx.73.197

2019-07-01 Thread Curtis Maurand
ify-server-response-to-ehlo-helo?forum=exchangesvradmin Cheers, Curtis On 7/1/19 1:24 AM, subscription1 wrote: I'd appreciate you help with the following: I'm looking after two server on 2 differents domains. During testing I found the following issue. On the sending server I get the fol

Re: Authentication attempts for x...@com.au addresses

2019-04-02 Thread Curtis Maurand
ponses. fail2ban is a resource hog as it is. Cheers, Curtis -- Best Regards Curtis Maurand mailto:cur...@maurand.com

Re: consolidate virtual and relay_recipients files

2019-03-08 Thread Curtis Maurand
If possible, I would like to avoid writing a list of all my user mailbox @ all domain names neither in virtual, nor in relay_recipients file. Thanks a lot for your help. Samuel -- Best Regards Curtis Maurand mailto:cur...@maurand.com

Re: postscreen_dnsbl_action "drop" not working correctly?

2019-03-06 Thread Curtis Maurand
through several layers. DNS has become very ugly as Google and Cloudflare attempt to monopolize it. -- Best Regards Curtis Maurand mailto:cur...@maurand.com

Re: Click tracker removal ideas?

2019-02-15 Thread Curtis Maurand
Wouldn't procmail do something like this? I haven't used procmail for quite some time, but iirc it can handle passing to a filter program, then the filter can hand it to the lmtp (dovecot for instance). Just a thought. I now return to the lurkers lair. --Curtis On February 15, 20

Re: best practice for HA cluster

2019-02-08 Thread curtis
You could use Unison to keep the config folders in sync. Open source. runs on just about everything. February 8 2019 8:59 AM, "De Petter Mattheas" wrote: > Yeas we have F5 loadbalancer. > > But how do we shift the config ? as far as i know there is no central mgmt > for postfix only config >

Re: It is possible for Postfix logging to bypass journald?

2019-01-28 Thread Curtis
On 1/9/2019 5:55 PM, Robert L Mathews wrote: On 1/9/19 4:05 PM, Curtis wrote: We recently switched our Postfix mail servers to Ubuntu Server 18, which uses journald for logging. Since we have monitoring systems that parse /var/log/maillog, we enabled rsyslog with imuxsock so we still can parse

It is possible for Postfix logging to bypass journald?

2019-01-09 Thread Curtis
s less CPU intensive than journald/imjournal. Ideas? Thanks, Curtis

Re: best practice - integrating spamassassin/clamav in postfix - amavis yes/no?

2018-10-19 Thread curtis
to a new group for management from the author. This happened within the last couple of weeks. I'm on that mailing list, too. They're working on getting the changes into the package repos. Amavis just received a new lease on life. Back to the discussion at hand, --Curtis

Re: Are sha1 & TLSv1 fully deprecated wrt mail, and time to block them?

2018-10-15 Thread curtis
October 15 2018 11:19 AM, "Kris Deugau" wrote: > Laura Smith wrote: > >> Honestly, you are most likely wasting your time on that point because all >> that you are likely to >> get back is a page of waffle saying "blah blah blah ... security reasons... >> blah blah blah" >>> I know this because

Re: server hw sizing

2018-10-04 Thread curtis
or viruses and spam. amavisd-new is written perl. It's a resource hog. Add fuzzy OCR and clamav and resource utilization starts going up. Lot's of regulare expressions in all those rules and policies. --Curtis October 4 2018 11:46 AM, "Viktor Dukhovni" wrote: > On Thu,

What is the upper limit allowed for smtp_line_length_limit?

2017-10-16 Thread Curtis
ms of stability? Thanks, Curtis

OT (was Re: Backup MX setup - alternative to db?)

2017-04-29 Thread Curtis Villamizar
and postfix) used by that particular type of host. I have to "cd install_certs; gmake REMOTE_HOST=fqdn install" to add TLS key, cert, and CA cert files for some hosts. I don't know if this helps since I can't at this time share the tools. But the point is i

Re: (OT)Ham Radio + SMTP (was Re: How to restrict encrypted email)

2016-07-18 Thread Curtis Villamizar
et radio in the digital stone ages. BSD dropped X.25 a decade ago but Linux still has code (marked experimental and does not seem to be supported). The ITU has pull in a lot of places so X.25 is mandated for packet radio in a lot of places. That said I'm no expert on this (or much of anything :) Curtis

OT: can't connect to Bill Cole's MX

2016-04-13 Thread Curtis Villamizar
nd no IPv6! Hello Bill. What's up? Curtis ps - sorry - I'd send direct to Bill ... but can't. Maybe the list is getting through.

Re: reality-check on 2016 practical advice re: requiring inbound TLS?

2016-04-12 Thread Curtis Villamizar
On 04/12/16 14:26, Noel Jones wrote: On 4/12/2016 11:38 AM, Curtis Villamizar wrote: On 04/12/16 06:25, Wietse Venema wrote: Curtis Villamizar: I recently had a problem with mail where an ESP was in three blacklists plus SPF failed and spamassassin tossed some mail. That ESP is down to one

Re: reality-check on 2016 practical advice re: requiring inbound TLS?

2016-04-12 Thread Curtis Villamizar
getting reports from anyone else, that is a good thing. I don't think there is any requirement to send empty reports or that those reports would serve any purpose (except maybe create "I got your report and here is your" loops). Curtis

Re: reality-check on 2016 practical advice re: requiring inbound TLS?

2016-04-12 Thread Curtis Villamizar
On 04/12/16 06:25, Wietse Venema wrote: Curtis Villamizar: I recently had a problem with mail where an ESP was in three blacklists plus SPF failed and spamassassin tossed some mail. That ESP is down to one blacklist now. A sender got to me out-of-band and I dug up the maillog from a few days

Re: reality-check on 2016 practical advice re: requiring inbound TLS?

2016-04-12 Thread Curtis Villamizar
xes that. Best Regards MfG Robert Schetterer Curtis

Re: reality-check on 2016 practical advice re: requiring inbound TLS?

2016-04-11 Thread Curtis Villamizar
d and I dug up the maillog from a few days earlier and informed them about how good their ESP was serving them. btw- If I had been using postscreen back then, I could not have found this in the logs based on sender email. Curtis ps - works for google, though dmarc says "accept and report

Re: reality-check on 2016 practical advice re: requiring inbound TLS?

2016-04-10 Thread Curtis Villamizar
blishing those records, you just avoid having someone forge mail as you (including to you, but there are plenty of simpler ways to protect against that). I was also planning to reject based on opendmarc at some point in the not-so-distant future. Curtis

Re: gmail servers requiring postscreen_access whitelisting

2016-04-10 Thread Curtis Villamizar
In message "@lbutlr" writes: > > On Apr 10, 2016, at 10:24 AM, Curtis Villamizar = > wrote: > > postscreen_dnsbl_sites =3D > > list.dnswl.org*-5 > > # followed by some blacklist sites > > It was my understanding that eh the order of te

Re: what error is being reported back to sender, and how to avoid reporting back internal server ports?

2016-04-10 Thread Curtis Villamizar
better choice than inet with loopback IMO, reducing the chance of leverage. Loopback is like a socket or fifo with ugo+rw perms. Curtis

Re: gmail servers requiring postscreen_access whitelisting

2016-04-10 Thread Curtis Villamizar
In message <570a341b.9000...@pajamian.dhs.org> Peter writes: > > On 10/04/16 15:00, Curtis Villamizar wrote: > > This is a workaround that shouldn't be needed. > > > > Any idea what the cause of this is? So far no legit mail except gmail > > gets c

Re: gmail servers requiring postscreen_access whitelisting

2016-04-10 Thread Curtis Villamizar
In message <3qjz5d5s15zj...@spike.porcupine.org> Wietse Venema writes: > > Curtis Villamizar: > > Since I enabled postscreen (with soft_bounce=yes in master.cf) I was > > getting logs of this form: > > > > Apr 9 01:08:12 mta1 postfix/postscreen[18326]: &g

Re: gmail servers requiring postscreen_access whitelisting

2016-04-09 Thread Curtis Villamizar
In message <5709c8c8.1050...@megan.vbhcs.org> Noel Jones writes: > On 4/9/2016 10:00 PM, Curtis Villamizar wrote: > > Since I enabled postscreen (with soft_bounce=yes in master.cf) I was > > getting logs of this form: > > > > Apr 9 01:08:12 mta1 postfix/postscr

Re: reality-check on 2016 practical advice re: requiring inbound TLS?

2016-04-09 Thread Curtis Villamizar
In message <20160410024851.gu26...@mournblade.imrryr.org> Viktor Dukhovni writes: > On Sat, Apr 09, 2016 at 09:31:48PM -0400, Curtis Villamizar wrote: > > > > 1) It looks to me that starttls really only protects the path to the > > >first server. Classic cas

gmail servers requiring postscreen_access whitelisting

2016-04-09 Thread Curtis Villamizar
eject postscreen_access: # google mail servers 2607:f8b0:4002:c00::/60 permit [... other google server blocks ...] This is a workaround that shouldn't be needed. Any idea what the cause of this is? So far no legit mail except gmail gets caught here. Curtis

Re: rate limiting

2016-04-09 Thread Curtis Villamizar
of light is limited and geographic delays come into play. I've been involved in testing and some simulation of this type but on routers and various switchy-thingies rather than mailservers. Curtis > On 04/07/2016 06:19 PM, Wietse Venema wrote: > > See: > > http://www.postfix.org/

Re: rate limiting bad-bot HANGUPs in postscreen?

2016-04-09 Thread Curtis Villamizar
, using "zcat /var/log/maillog.0.bz2 | cat - /var/log/maillog | ..."). It gets rid of lots of PREGREET or HANGUP in under 1 sec. The threshhold of 5 is quite low but I don't think it will catch any legit mail servers. Still playing with this. Note that the big space before reject i

Re: reality-check on 2016 practical advice re: requiring inbound TLS?

2016-04-09 Thread Curtis Villamizar
Viktor. Thanks for the links. I emailed one of the authors asking why so little was said about DNSSEC and nothing at all about DANE. Curtis

Re: reality-check on 2016 practical advice re: requiring inbound TLS?

2016-04-09 Thread Curtis Villamizar
nd-to-end. Of course to encrypt using pgp or s/mime both ends must support pgp or s/mime which has been a problem. People within various communities of interest use pgp or s/mime (for example, the security community) but use is very sparse. Curtis > > Original Message > > From: Vik

Re: False positives from header_checks

2016-04-06 Thread Curtis Villamizar
t;. That doesn't solve base64 encoding. Disclaimer: I haven't tried this. Curtis On 04/06/16 22:02, Laz C. Peterson wrote: This is great information. It's very odd ... Apple has been responsible for the foundation of quite a few RFC's but in our experience has actually made it

Re: problem sending to outlook.com

2016-04-04 Thread Curtis Villamizar
ou could DKIM sign your mail and add DKIM and SPF DNS records (maybe DMARC, though I don't do that but might in the near future). DKIM and SPF pass can only help, even if just a little, and DKIM+SPF+DMARC can make sure that forgery doesn't penalize your domain. Maybe someone that actual

Re: best practice for blocking fake local domain senders

2016-03-30 Thread Curtis Villamizar
nticated before the check_sender_a_access and using smtpd_tls_auth_only if you want to use auth only with TLS (good practice). If you manage to get rid of the IP range based trust model, then add "reject" to the end of the smtpd_sender_restrictions line for port 587. Curtis btw- Great location over there at Marlboro College.

Re: Hardware with non-FQDN EHLO

2016-03-28 Thread Curtis Villamizar
ct_non_fqdn_helo_hostname >... any other stuff... On http://www.postfix.org/postconf.5.html#smtpd_helo_restrictions permit_sasl_authenticated is not listed. Which makes some sense since the HELO occurs before AUTH. HELO checks seem to be all IP and hostname related. > -- Noel Jones Am I missing som

Re: Thousands of login attempts

2016-03-20 Thread Curtis Villamizar
be nice but a large number of client certs can be a headache to keep track of and hard to get into user's client MUAs. Filters limiting access to port 587 can then be applied a lot more strickly than filters on port 25 could be. Curtis

[OT] (was Re: Is /usr/bin/mail a link to sendmail/postfix)

2016-03-15 Thread Curtis Villamizar
over time. Yes there still is a lot of similarity, but recycled version ... No - just a quick path to get closer to posix in the utilities with least restrictive licensing. Curtis

Re: OT yahoo

2016-03-13 Thread Curtis Villamizar
In message <612d47d4-9465-4031-9d48-e6a0c3a8a...@dukhovni.org> Viktor Dukhovni writes: > > > On Mar 13, 2016, at 5:42 PM, Curtis Villamizar > > wrote: > > > > The NS RR are typically delivered in a fixed order, the order in the > > zone file, and wh

Re: OT yahoo

2016-03-13 Thread Curtis Villamizar
In message <3qnxhn426dzj...@spike.porcupine.org> Wietse Venema writes: > > Curtis Villamizar: > > Are you saying they only looked at the primary NS record? Maybe I > > misread a prior post but I thought you meant primary MX record. The > > former, if true, would be

[OT] OS heritage (was: Re: source code for MacOSX tools)

2016-03-13 Thread Curtis Villamizar
lude files and library files. So I don't give it good odds on being a drop in and compile solution. Mail is very simple and fairly self contained and probably hasn't changed significantly in decades so it might drop in. I'd exhaust other options first. Curtis

Re: OT yahoo

2016-03-13 Thread Curtis Villamizar
ue, and no one else seemed to notice = > since the other DNS servers were working fine. Are you saying they only looked at the primary NS record? Maybe I misread a prior post but I thought you meant primary MX record. The former, if true, would be even more broken. Curtis

Re: OT: TLS and SNI (was Re: Postfix 3.1 and TLS Cert Files)

2016-03-09 Thread Curtis Villamizar
In message <56e0ccb4.6010...@spectralmud.org> Richard James Salts writes: > > On 10/03/16 09:32, Curtis Villamizar wrote: > > In message <56dfcd11.5010...@spectralmud.org> > > Richard James Salts writes: > > > >> On 09/03/16 06:44, Viktor Dukhovni wro

OT: TLS and SNI (was Re: Postfix 3.1 and TLS Cert Files)

2016-03-09 Thread Curtis Villamizar
In message <56dfcd11.5010...@spectralmud.org> Richard James Salts writes: > On 09/03/16 06:44, Viktor Dukhovni wrote: > >> On Mar 8, 2016, at 2:31 PM, Curtis Villamizar > >> wrote: > >> > >> With HTTP the server cert is provided after HTTP ide

Re: Postfix 3.1 and TLS Cert Files

2016-03-09 Thread Curtis Villamizar
In message Tom Browder writes: > On Tuesday, March 8, 2016, Curtis Villamizar wrote: > > Tom, > > > > I've been following this thread and also not clear on your > > objectives. See inline. > > As Viktor pointed out, look at the examples. Your home machin

Re: Postfix 3.1 and TLS Cert Files

2016-03-08 Thread Curtis Villamizar
e with a Postfix dummy. > > Best regards, > > -Tom Fine so far but you haven't said what you expect the postfix MX to do with received mail. You have a few choices. Relay it per domain (easy - use transport_maps). Deliver it locally? Easy but t...@domain1.example.com and t...@domain2.example.com end up in the same mailbox (ie: tom, typically delivered to /var/mail/tom). Set up multiple IMAP server domains? See http://www.cyrusimap.org/docs/cyrus-imapd/2.4.8/install-virtdomains.php (for example). Something else? If so what? Either way take a look at http://www.postfix.org/VIRTUAL_README.html Hope this helps. Curtis

Re: Postfix Mailman integration

2016-02-29 Thread Curtis Villamizar
ponse. Just pointing to an existance proof that the mailman architecture is not fundamentally broken. btw- I can't tell from headers whether they use sendmail.org sendmail or postfix or something else, but amavisd-new is mentioned in the headers. amsl.com runs most of the mailing lists. Curtis

Re: [SOLVED] Re: A bug, maybe?

2016-02-22 Thread Curtis Maurand
On 2/22/2016 3:03 PM, Viktor Dukhovni wrote: On Mon, Feb 22, 2016 at 02:57:23PM -0500, Curtis Maurand wrote: The problem was in the /etc/nsswitch.conf. I changed the line hosts: files dns to hosts:dns files and that solved the trouble. Is

[SOLVED] Re: A bug, maybe?

2016-02-22 Thread Curtis Maurand
On 2/20/2016 5:19 PM, Curtis Maurand wrote: On 2/20/2016 1:46 PM, Viktor Dukhovni wrote: On Sat, Feb 20, 2016 at 01:37:39PM -0500, Curtis Maurand wrote: Nothing is chrooted. resolv.conf is world readable. Wietse's program returns a valid address. It might not match the reverse, b

Re: A bug, maybe?

2016-02-20 Thread Curtis Maurand
On 2/20/2016 1:46 PM, Viktor Dukhovni wrote: On Sat, Feb 20, 2016 at 01:37:39PM -0500, Curtis Maurand wrote: Nothing is chrooted. resolv.conf is world readable. Wietse's program returns a valid address. It might not match the reverse, but it did return an address. # ./ge

Re: A bug, maybe?

2016-02-20 Thread Curtis Maurand
On 2/20/2016 12:17 PM, Viktor Dukhovni wrote: On Sat, Feb 20, 2016 at 11:40:09AM -0500, Curtis Maurand wrote: i just sent myself a test message from the client's system. Here is what I got. I immediately ran the lookups using dig. postfix can't seem to resolve things properly

  1   2   3   >