Re: checking integrity

2008-09-19 Thread Milos Prudek
> It's too late to reject the mail that's already in your queue, > better to identify the spam and discard it. I see. That is an important information. OK, I will set up spamassassin and requeue all mail. Thanks to everyone for help. -- Milos Prudek

Re: checking integrity

2008-09-18 Thread Noel Jones
Milos Prudek wrote: Are they addressed to real Domino users? Most of them are not. If not, your best use of time is to get postfix to reject mail to invalid users during SMTP, before it ever gets accepted. So I just enter "reject_unverified_sender" into main.cf and then run "postsuper -r A

Re: checking integrity

2008-09-18 Thread Milos Prudek
> dont do reject_unverified_sender until you have good reasons Sorry, I meant reject_unverified_recipient -- Milos Prudek

Re: checking integrity

2008-09-18 Thread mouss
Milos Prudek wrote: Are they addressed to real Domino users? Most of them are not. If not, your best use of time is to get postfix to reject mail to invalid users during SMTP, before it ever gets accepted. So I just enter "reject_unverified_sender" into main.cf and then run "postsuper -r A

Re: checking integrity

2008-09-18 Thread Jan P. Kessler
Robert Schetterer schrieb: Jan P. Kessler schrieb: Milos Prudek schrieb: If not, your best use of time is to get postfix to reject mail to invalid users during SMTP, before it ever gets accepted. So I just enter "reject_unverified_sender" into main.cf and then run "postsuper -r ALL",

Re: checking integrity

2008-09-18 Thread Robert Schetterer
Jan P. Kessler schrieb: Milos Prudek schrieb: If not, your best use of time is to get postfix to reject mail to invalid users during SMTP, before it ever gets accepted. So I just enter "reject_unverified_sender" into main.cf and then run "postsuper -r ALL", correct? Don't forget t

Re: checking integrity

2008-09-18 Thread Jan P. Kessler
Milos Prudek schrieb: If not, your best use of time is to get postfix to reject mail to invalid users during SMTP, before it ever gets accepted. So I just enter "reject_unverified_sender" into main.cf and then run "postsuper -r ALL", correct? Don't forget to configure your Domino S

Re: checking integrity

2008-09-18 Thread Milos Prudek
> Are they addressed to real Domino users? Most of them are not. > If not, your best use of time is to get postfix to reject mail > to invalid users during SMTP, before it ever gets accepted. So I just enter "reject_unverified_sender" into main.cf and then run "postsuper -r ALL", correct? > Yo

Re: checking integrity

2008-09-18 Thread Erwan David
On Thu, Sep 18, 2008 at 11:26:52AM CEST, Milos Prudek <[EMAIL PROTECTED]> said: > Dne Wednesday 17 of September 2008 22:56:00 Brian Evans - Postfix List > napsal(a): > > No relay_recipient_maps? You could be a Backscatter source and may end > > up on blacklists. > > Is relay_recipient_maps a list

Re: checking integrity

2008-09-18 Thread Milos Prudek
Dne Wednesday 17 of September 2008 22:56:00 Brian Evans - Postfix List napsal(a): > No relay_recipient_maps? You could be a Backscatter source and may end > up on blacklists. Is relay_recipient_maps a list of valid email addresses? Should each valid email address be in that map? It may be diff

Re: checking integrity

2008-09-18 Thread Milos Prudek
> > virtual_alias_domains = hash:/etc/postfix/virtual > > virtual_alias_maps = hash:/etc/postfix/virtual > > This is suspicious and may cause problems if done incorrectly. You don't > list the map /etc/postfix/virtual so it's hard to say. /etc/postfix/virtual: [EMAIL PROTECTED][EMAIL PROT

Re: checking integrity

2008-09-17 Thread Noel Jones
mouss wrote: Brian Evans - Postfix List wrote: You have tvojeimage.cz and ibclubcenter.com in two address classes (virtual_mailbox and relay). he probably have warnings in his logs! No, this is legal, but probably not what the OP intends. Postfix thinks "tvojeimage.cz" is a virtual mailbo

Re: checking integrity

2008-09-17 Thread mouss
Brian Evans - Postfix List wrote: Milos Prudek wrote: Again, It seems you missed the critical welcome message: OK, here's postconf -n: [...] relay_domains = vinoteky.cz, ewine.cz, pilaoplustil.cz, swisshaus.ru, swisshaus.org, moravin.cz, tvojeimage.cz,ibclubcenter.com smtpd_sender_

Re: checking integrity

2008-09-17 Thread Noel Jones
Duane Hill wrote: On Wed, 17 Sep 2008, Noel Jones wrote: Milos Prudek wrote: Dne Wednesday 17 of September 2008 18:32:35 Ralf Hildebrandt napsal(a): * Milos Prudek <[EMAIL PROTECTED]>: I suspect that my email server has been cracked. How do I make sure it happened? You check the logs. You c

Re: checking integrity

2008-09-17 Thread Brian Evans - Postfix List
Milos Prudek wrote: >> Again, >> >> It seems you missed the critical welcome message: >> > > OK, here's postconf -n: > [...] > relay_domains = vinoteky.cz, ewine.cz, pilaoplustil.cz, swisshaus.ru, > swisshaus.org, moravin.cz, tvojeimage.cz,ibclubcenter.com > > smtpd_sender_restrictions = h

Re: checking integrity

2008-09-17 Thread Duane Hill
On Wed, 17 Sep 2008, Noel Jones wrote: Milos Prudek wrote: Dne Wednesday 17 of September 2008 18:32:35 Ralf Hildebrandt napsal(a): * Milos Prudek <[EMAIL PROTECTED]>: I suspect that my email server has been cracked. How do I make sure it happened? You check the logs. You check the integrity

Re: checking integrity

2008-09-17 Thread Noel Jones
Milos Prudek wrote: Dne Wednesday 17 of September 2008 18:32:35 Ralf Hildebrandt napsal(a): * Milos Prudek <[EMAIL PROTECTED]>: I suspect that my email server has been cracked. How do I make sure it happened? You check the logs. You check the integrity of the system files using aide or samhain

Re: checking integrity

2008-09-17 Thread Milos Prudek
Dne Wednesday 17 of September 2008 18:32:35 Ralf Hildebrandt napsal(a): > * Milos Prudek <[EMAIL PROTECTED]>: > > I suspect that my email server has been cracked. How do I make sure it > > happened? > > You check the logs. > You check the integrity of the system files using aide or samhain > > > Ho

Re: checking integrity

2008-09-17 Thread Milos Prudek
> Again, > > It seems you missed the critical welcome message: OK, here's postconf -n: alias_maps = hash:/etc/aliases biff = no canonical_maps = hash:/etc/postfix/canonical command_directory = /usr/sbin config_directory = /etc/postfix daemon_directory = /usr/lib/postfix debug_peer_level = 2 defer

Re: checking integrity

2008-09-17 Thread Brian Evans - Postfix List
Milos Prudek wrote: >> You need to figure out which service is connection denied on localhost. >> See also http://www.postfix.org/DEBUG_README.html#logging >> > > Thank you! I run egrep '(warning|error|fatal|panic):' /var/log/mail | less. I > got a filtered list that looks like this: > > Sep

Re: checking integrity

2008-09-17 Thread Milos Prudek
> You check the integrity of the system files using aide or samhain Thank you very much, I will try that tommorow. > > However, /var/log/mail contains huge number of lines like this one: > > What does > qshape > report? T 5 10 20 40 80 160 320 640 1280 1280+

Re: checking integrity

2008-09-17 Thread Milos Prudek
> You need to figure out which service is connection denied on localhost. > See also http://www.postfix.org/DEBUG_README.html#logging Thank you! I run egrep '(warning|error|fatal|panic):' /var/log/mail | less. I got a filtered list that looks like this: Sep 17 18:40:04 mail postfix/smtpd[416]: w

Re: checking integrity

2008-09-17 Thread Brian Evans - Postfix List
Milos Prudek wrote: > Hi, > > I suspect that my email server has been cracked. How do I make sure it > happened? > > I verified via external website service that my server is not an open relay. > > I verified that my server is not listed at spamhaus RBL (yet). > > However, /var/log/mail contains

Re: checking integrity

2008-09-17 Thread Ralf Hildebrandt
* Milos Prudek <[EMAIL PROTECTED]>: > I suspect that my email server has been cracked. How do I make sure it > happened? You check the logs. You check the integrity of the system files using aide or samhain > However, /var/log/mail contains huge number of lines like this one: What does qshape

Re: checking integrity

2008-09-17 Thread Ralf Hildebrandt
* Milos Prudek <[EMAIL PROTECTED]>: > Hi, > > I suspect that my email server has been cracked. How do I make sure it > happened? > > I verified via external website service that my server is not an open relay. > > I verified that my server is not listed at spamhaus RBL (yet). > > However, /va