Re: [OT] Spam Prevention

On Mon, 2009-08-03 at 16:52 +1000, Thomas wrote: > Hey, > > [..] > > Yes, I use that too - but I like a quick summary on demand. > See: > You can use the scripts _without_ logwatch and get an instant summary of > your mail.log. > > Cheers, > Thomas Indeed

allow sasl authenticated on submission port and bypass rbl

Hi all, Since adding check_sender_access to stop our domain from emailing unauthed from the outside and our Wireless Broadband now being in the pbl.spamhaus.org list, we want to allow TLS/SASL Auth'd users to email from their broadband cards and get them bypassing the rbl's, ie RBL checks on port

Re: allow sasl authenticated on submission port and bypass rbl

On 8/3/09 12:26 AM, Nick Sharp wrote: Hi all, Since adding check_sender_access to stop our domain from emailing unauthed from the outside and our Wireless Broadband now being in the pbl.spamhaus.org list, we want to allow TLS/SASL Auth'd users to email from their broadband cards and get them byp

Postfix HELO FQDN requirement

I read John Peach's response to a mail regarding the Postfix option to reject non-FQDN HELO transactions. http://www.irbs.net/internet/postfix/0302/0183.html He states that Joris Benschop is correct in that email. I was scanning through RFC 821 (and also through RFC2821 which has superseeded it)

Re: Postfix HELO FQDN requirement

On Mon, 03 Aug 2009 11:14:10 +0200, Robin Smidsrød wrote: > I read John Peach's response to a mail regarding the Postfix option to > reject non-FQDN HELO transactions. > > http://www.irbs.net/internet/postfix/0302/0183.html > > He states that Joris Benschop is correct in that email. > > I was s

Re: Postfix HELO FQDN requirement

On Mon, 03 Aug 2009 12:18:53 +0200, Willy De la Court wrote: > On Mon, 03 Aug 2009 11:14:10 +0200, Robin Smidsrød > wrote: >> I read John Peach's response to a mail regarding the Postfix option to >> reject non-FQDN HELO transactions. >> >> http://www.irbs.net/internet/postfix/0302/0183.html >>

Re: Postfix HELO FQDN requirement

Willy De la Court wrote: > On Mon, 03 Aug 2009 11:14:10 +0200, Robin Smidsrød > wrote: [snip] > > rfc2821 contains the following > > - the clarifications and applicability statements in RFC 1123 [2], [snip] > http://www.freesoft.org/CIE/RFC/1123/90.htm > > where it states > > The sender-SMT

Re: Postfix HELO FQDN requirement

On Mon, 03 Aug 2009 13:18:52 +0200 Robin Smidsr__d wrote: [snip] > Willy De la Court wrote: > > > Does this mean that all of the reject rules are in fact not > RFC-conformant? > > The reason I mention reject_invalid_helo_hostname is that I'm unsure > if the IPv(4|6) address syntax is part of thi

Re: Postfix HELO FQDN requirement

John Peach: > On Mon, 03 Aug 2009 13:18:52 +0200 > Robin Smidsr__d wrote: > [snip] > > Willy De la Court wrote: > > > > > > Does this mean that all of the reject rules are in fact not > > RFC-conformant? > > > > The reason I mention reject_invalid_helo_hostname is that I'm unsure > > if the IPv(

Differ between rejects

Hi, Is there a way to differ between rejected mails? I'm just interested in outgoing mails from my server which got rejected. All the mails I'm rejecting from the internet are not important for my pflogsumm report. Chris

Re: Postfix HELO FQDN requirement

On Mon, 3 Aug 2009 08:05:26 -0400 (EDT), wie...@porcupine.org (Wietse Venema) wrote: > John Peach: >> On Mon, 03 Aug 2009 13:18:52 +0200 >> Robin Smidsr__d wrote: >> [snip] >> > Willy De la Court wrote: >> > This was the question asked by robin. Something went wrong with the quoting. >> > >> >

Re: Postfix HELO FQDN requirement

Wietse Venema wrote: > John Peach: >> On Mon, 03 Aug 2009 13:18:52 +0200 >> Robin Smidsr__d wrote: >> [snip] >>> Willy De la Court wrote: >>> >>> >>> Does this mean that all of the reject rules are in fact not >>> RFC-conformant? >>> >>> The reason I mention reject_invalid_helo_hostname is that I'

Question about address verification in MX2 when primary MX is down...

Hi!. I have a secondary MX server and I'm trying to configure it to "check" recipient addresses against primary SMTP servers to reject emails directed to non existing addresses. I've read the following: http://www.postfix.org/ADDRESS_VERIFICATION_README.html So I added this to my main.cf:

postfix mx check

Hello all, i'am having a problem at customer's site. I'am using postfix 2.5.5 Customer tries to send email to @vf.uk.vodafone.com. This domain does not exist: $ dig -t any vf.uk.vodafone.com ; <<>> DiG 9.4.3-P1 <<>> -t any vf.uk.vodafone.com ;; global options: printcmd ;; Got answer: ;; ->>

Re: Log analysis

> each recipient will be in its own log line when the message is delivered. So I've got 101 lines like this one: Jul 27 xx:yy:zz server postfix/qmgr[2580]: 50B106A60A8: from=, size=754061, nrcpt=436 (queue active) The time differs (this line is printed there approx. ones an hour so it seems that

Re: postfix mx check

Udo Mueller wrote, at 08/03/2009 09:01 AM: > Hello all, > > i'am having a problem at customer's site. I'am using postfix 2.5.5 > > Customer tries to send email to @vf.uk.vodafone.com. This domain does > not exist: > > $ dig -t any vf.uk.vodafone.com > > ; <<>> DiG 9.4.3-P1 <<>> -t any vf.uk.vod

Re: Log analysis

On Aug 3, 2009, at 9:08 AM, Martina Tomisova wrote: each recipient will be in its own log line when the message is delivered. So I've got 101 lines like this one: Jul 27 xx:yy:zz server postfix/qmgr[2580]: 50B106A60A8: from=, size=754061, nrcpt=436 (queue active) The time differs (this li

lost my Delivered-To: header

Hullo I've been a happy user and recommender of postfix for about 8 years now. I've tried to work out what's wrong in my situation through the documentation, but failed. Must be something obvious, I'm sure. For historical reasons, I was using the Delivered-To: header as part of an IMAP Si

Re: Question about address verification in MX2 when primary MX is down...

Santiago Romero wrote: > > This works nicely when MX1 servers are working and answering RCPT-TO > checks, but then I asked ... what happens if my server can't reach the > primary MX (server stopped, misconfiguration, power outage...) ? > > In that case my server reacts rejecting ALL email because i

RE: allow sasl authenticated on submission port and bypass rbl

> > A sample submission entry in master.cf: > > submission inet n - n - - smtpd > -o smtpd_tls_security_level=encrypt > -o smtpd_tls_auth_only=yes > -o smtpd_sasl_auth_enable=yes > -o broken_sasl_auth_clients=yes > -o > receive_override_options=n

Re: allow sasl authenticated on submission port and bypass rbl

Nick Sharp wrote: >> A sample submission entry in master.cf: >> >> submission inet n - n - - smtpd >> -o smtpd_tls_security_level=encrypt >> -o smtpd_tls_auth_only=yes >> -o smtpd_sasl_auth_enable=yes >> -o broken_sasl_auth_clients=yes >> -o >> rece

Re: postfix mx check

2009-08-03 21:02:01 Udo Mueller wrote: >My question: Is it possible to disable the domain check an let postfix >send these emails to me.vodafone.com Yes.You can use transport_maps http://www.postfix.org/transport.5.html debian:/etc/postfix# postconf -e 'transport_maps = hash:/etc/postfix/tr

Re: postfix mx check

On Mon, 3 Aug 2009 22:11:49 +0800 "sosogh" wrote: > > 2009-08-03 21:02:01 Udo Mueller wrote: > > >My question: Is it possible to disable the domain check an let > >postfix send these emails to me.vodafone.com > > Yes.You can use transport_maps > http://www.postfix.org/transport.5.html > > de

Re: Re: postfix mx check

2009-08-03 22:18:09 John Peach wrote: >...and you would really expect vodafone to accept those emails? How to route the mail is a matter of postfix, whether accept those mails or not is a matter of the receiver server Isn't that Udo Mueller's thought --

RE: allow sasl authenticated on submission port and bypass rbl

> -Original Message- > From: owner-postfix-us...@postfix.org [mailto:owner-postfix- > us...@postfix.org] On Behalf Of Brian Evans - Postfix List > Sent: Monday, August 03, 2009 11:35 PM > To: Postfix users > Subject: Re: allow sasl authenticated on submission port and bypass rbl > > Nick

Reverse DNS requirement

Hi list, Maybe a little OT, but I thought maybe you guys know how to deal with this. I'm currently blocking all attepmts to connect from hosts not having a valid reverse DNS name with "reject_unknown_reverse_client_hostname". This is very effective for dealing with spam. This is not our only pro

Re: allow sasl authenticated on submission port and bypass rbl

Nick Sharp wrote: > Sorry, was referring to the same log in my previous email, but didn't > consider people may not always have that handy.. > > Aug 3 22:08:27 mail1 postfix/smtpd[25798]: NOQUEUE: reject: CONNECT from > unknown[58.171.194.208]: 554 5.7.1 : Client host > rejected: Access denied; pr

Re: Reverse DNS requirement

Mikael Bak wrote, at 08/03/2009 10:38 AM: > I'm currently blocking all attepmts to connect from hosts not having a > valid reverse DNS name with "reject_unknown_reverse_client_hostname". > > This is very effective for dealing with spam. This is not our only > protection though :-) > > Although f

Re: Question about address verification in MX2 when primary MX is down...

On 8/3/2009, Santiago Romero (srom...@servicom2000.com) wrote: > This works nicely when MX1 servers are working and answering RCPT-TO > checks, but then I asked ... what happens if my server can't reach > the primary MX (server stopped, misconfiguration, power outage...) ? > > In that case my serv

Message Size from network and localhost

Hi guys There is a way I currently have a postfix 2.3.3 running. The parameter message_size_limit = 100 and it's working fine. My question is. There is a way to keep this limits for network conections, but stablish a bigger limit or less restrictive limit to conections from localhost or o

Re: Reverse DNS requirement

Mikael Bak wrote: > I'm currently blocking all attepmts to connect from hosts not having a > valid reverse DNS name with "reject_unknown_reverse_client_hostname". > ... > Nevermind. To make it short: Is it ok to reject such sending servers or > not? :-) In my believes using reject_unknown_reverse

Re: Reverse DNS requirement

When I was still managing an email system and got a complaint like that. I'd actually contact the postmaster for the mail system with the errors and let them know it's failing. Typically they'd just fix it right up. Only once did I have someone argue with me over a misconfigured mail server but

Content_filter exceptions

Hi Mice, As I've set up postfix+amavisd with content_filter option, I'd like to have some exceptions,some users wont passed to amavisd, instead next-hope will be forwarded, Is there a easy way to do this? TIA LD

RE: allow sasl authenticated on submission port and bypass rbl

> -Original Message- > From: owner-postfix-us...@postfix.org [mailto:owner-postfix- > us...@postfix.org] On Behalf Of Brian Evans - Postfix List > Sent: Tuesday, August 04, 2009 12:30 AM > To: Postfix users > Subject: Re: allow sasl authenticated on submission port and bypass rbl > > Nick

Chasing down postmaster of large organizations

Bryan Irvine wrote: When I was still managing an email system and got a complaint like that. I'd actually contact the postmaster for the mail system with the errors and let them know it's failing. Let's say the problem is yahoo.com or gmail.com. Have you ever tried to reach a postmaster at l

Re: allow sasl authenticated on submission port and bypass rbl

Nick Sharp wrote: >> -Original Message- >> From: owner-postfix-us...@postfix.org [mailto:owner-postfix- >> us...@postfix.org] On Behalf Of Brian Evans - Postfix List >> Sent: Tuesday, August 04, 2009 12:30 AM >> To: Postfix users >> Subject: Re: allow sasl authenticated on submission port a

Re: Content_filter exceptions

Luis Daniel Lucio Quiroz wrote: Hi Mice, As I've set up postfix+amavisd with content_filter option, I'd like to have some exceptions,some users wont passed to amavisd, instead next-hope will be forwarded, Is there a easy way to do this? TIA LD The easy way is to set those users as viru

No hash in Solaris 10

I am compiling postfix 2.6.1 in a Solaris 10 box using the following script: #!/bin/bash make tidy make makefiles CC=gcc \ CCARGS='-DUSE_TLS -DHAS_PCRE -DUSE_SASL_AUTH \ -DDEF_SERVER_SASL_TYPE=\"dovecot\" \ -I/usr/sfw/include -I/opt/sfw/include -I/usr/local/include \ -I/usr/local/Berke

Re: Reverse DNS requirement

Jorey Bump schrieb: > Mikael Bak wrote, at 08/03/2009 10:38 AM: > >> I'm currently blocking all attepmts to connect from hosts not having a >> valid reverse DNS name with "reject_unknown_reverse_client_hostname". >> >> This is very effective for dealing with spam. This is not our only >> protectio

Re: No hash in Solaris 10

Mauricio Tavares wrote: > I am compiling postfix 2.6.1 in a Solaris 10 box using the > following script: > > #!/bin/bash > make tidy > make makefiles CC=gcc \ > CCARGS='-DUSE_TLS -DHAS_PCRE -DUSE_SASL_AUTH \ > -DDEF_SERVER_SASL_TYPE=\"dovecot\" \ > -I/usr/sfw/include -I/opt/sfw/include -

too many postfix smtp active internet connections

Dear netizens sorry to trouble you. My server is just overloaded with too much spams. When I view the output of netstat -ln, there are over 400 ip addresses connecting to my postfix server actively. In our mail.log, the connections are from these ip addresses that had nothing to do with our compa

Re: too many postfix smtp active internet connections

jessk...@brel.com wrote: > Dear netizens > > sorry to trouble you. My server is just overloaded with too much spams. > > When I view the output of netstat -ln, there are over 400 ip addresses > connecting to my postfix server actively. In our mail.log, the connections > are from these ip addresses

Re: too many postfix smtp active internet connections

jessk...@brel.com: > Dear netizens > > sorry to trouble you. My server is just overloaded with too much spams. > > When I view the output of netstat -ln, there are over 400 ip addresses > connecting to my postfix server actively. In our mail.log, the connections > are from these ip addresses that

Re: too many postfix smtp active internet connections (2)

Hi again here is my postconf output. I had configured my smtpd_client_restrictions = check_client_access hash:/usr/local/etc/postfix/access and hash a file, access with the list of ip addresses that I would like to block. But I am not sure if this is a good solution. Thanks in advanced! Jessica

Re: No hash in Solaris 10

Mauricio Tavares: > make makefiles CC=gcc \ >CCARGS='-DUSE_TLS -DHAS_PCRE -DUSE_SASL_AUTH \ >-DDEF_SERVER_SASL_TYPE=\"dovecot\" \ >-I/usr/sfw/include -I/opt/sfw/include -I/usr/local/include \ >-I/usr/local/BerkeleyDB.4.7/include ' \ That does not enable any of the Postfix Berkeley

Re: Postfix HELO FQDN requirement

On Monday 03 August 2009 07:58:48 Robin Smidsrød wrote: > Wietse Venema wrote: > > John Peach: > >> On Mon, 03 Aug 2009 13:18:52 +0200 > >> Robin Smidsr__d wrote: > >> [snip] > >> > >>> Willy De la Court wrote: > >>> > >>> > >>> Does this mean that all of the reject rules are in fact not > >>> RFC

Re: Differ between rejects

On Monday 03 August 2009 07:10:42 Christian Wittwer wrote: > Is there a way to differ between rejected mails? > I'm just interested in outgoing mails from my server which got rejected. > All the mails I'm rejecting from the internet are not important for my > pflogsumm report. grep(1) is your frie

virtual_alias_maps and pipe to command

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello, I have many mappings in virtual_alias_maps to other mail addresses, but I am not succesfull in aliasing to a command using the "|" in the form: virtal...@zejda.net |"/usr/bin/procmail /home/veronika/.procmailrc" If I simply add entry to t

Black magic rejecting header Subjects

Dear all I cannot understand why Postfix/cleanup rejects particular Subject lines, since I have been searching for the respective regexps but haven't found what I've been looking for. My question is simple: why are subject lines rejected that I cannot find definitions for? When a subject contain

Re: Black magic rejecting header Subjects

> It rejects the reception of eMails from within cleanup with the error > code > 5.7.1 message content rejected > and the log reports > [postfix/cleanup] 99C2312CEAC: reject: header Subject: ferte e What does postconf -n say? Terry

Re: too many postfix smtp active internet connections (2)

jessk...@brel.com wrote: > Hi again > > here is my postconf output. I had configured my > smtpd_client_restrictions = > check_client_access hash:/usr/local/etc/postfix/access > and hash a file, access with the list of ip addresses that I would like to > block. But I am not sure if this is a good

Re: virtual_alias_maps and pipe to command

On Monday 03 August 2009 15:27:40 David Zejda wrote: > I have many mappings in virtual_alias_maps to other mail addresses, but > I am not succesfull in aliasing to a command using the "|" in the form: > > virtal...@zejda.net |"/usr/bin/procmail /home/veronika/.procmailrc" That's because it was n

mynetworks

Maybe a dumb question but I can't seem to change mynetworks in main.cf. I change it to something like: mynetworks = 127.0.0.0/8, xx.xx.xx.0/8, xx.xx.xxx.xxx, xx.xx.xxx.xxx # mynetworks_style = subnet Then I restart postfix and run postconf -d and I get this: mynetworks = 127.0.0.0/8 127

Re: Black magic rejecting header Subjects

On Monday 03 August 2009 15:34:59 Lukas Ruf wrote: > I cannot understand why Postfix/cleanup rejects particular Subject > lines, since I have been searching for the respective regexps but > haven't found what I've been looking for. My question is simple: why > are subject lines rejected that I can

Re: Reverse DNS requirement

Robert Schetterer wrote, at 08/03/2009 03:40 PM: > lost mail to where ? gone universe *g? > the mail got rejected at last with a debug code > so the sender may take his brain to fix its problem > or try to reach you by phone , valid mailservers etc > if the sender cant fix it you can simply wh

Re: mynetworks

On Aug 3, 2009, at 5:03 PM, "AMP Admin" wrote: Maybe a dumb question but I can’t seem to change mynetworks in main. cf. I change it to something like: mynetworks = 127.0.0.0/8, xx.xx.xx.0/8, xx.xx.xxx.xxx, xx.xx.xxx.xxx # mynetworks_style = subnet Then I restart postfix and run postco

Re: Reverse DNS requirement

Jorey Bump schrieb: > Robert Schetterer wrote, at 08/03/2009 03:40 PM: > >> lost mail to where ? gone universe *g? >> the mail got rejected at last with a debug code >> so the sender may take his brain to fix its problem >> or try to reach you by phone , valid mailservers etc >> if the sender

RE: mynetworks

OH! So when I do it w/o the -d it shows my current config?! I do see mynetworks is correct now w/o the -d!!! Thank you so much... sometimes it's the little things that make us happy. I'm obviously new to postfix. :) -Original Message- From: owner-postfix-us...@postfix.org [mailto:owne

Re: postfix mx check

sosogh schrieb: 2009-08-03 22:18:09 John Peach wrote: ...and you would really expect vodafone to accept those emails? How to route the mail is a matter of postfix, whether accept those mails or not is a matter of the receiver server Isn't that Udo Mueller's thought I *know* that this ser

Re: virtual_alias_maps and pipe to command

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Thank you for the extensive reply, you pointed me to look on the config in whole more seriously and really, there were odd remains of experiments from the past, which caused the behavior.. it seems, that everything works OK now. D. /dev/rob0 napsal(a

Re: lost my Delivered-To: header

On 3-Aug-2009, at 07:46, Tim Coote wrote: For historical reasons, I was using the Delivered-To: header as part of an IMAP Sieve rule. However, I seem to have lost this header in my inbound mail. from the headers I got of your mail: Return-Path: X-Original-To: krem...@kreme.com Delivered-To:

Re: lost my Delivered-To: header

On Mon, 03 Aug 2009, Tim Coote wrote: > I've been a happy user and recommender of postfix for about 8 years now. You've been using Postfix long enough to include 'postconf -n' and the other information as outlined in DEBUG_README. :-) > For historical reasons, I was using the Delivered-To: head

Re: mynetworks

On Mon, 03 Aug 2009, AMP Admin wrote: > OH! So when I do it w/o the -d it shows my current config?! I do see > mynetworks is correct now w/o the -d!!! Yes, read the postconf(1) manual to understand the meaning of '-d' and other flags. > Thank you so much... sometimes it's the little things that

Re: mynetworks

On 3-Aug-2009, at 16:03, AMP Admin wrote: OH! So when I do it w/o the -d it shows my current config?! I do see mynetworks is correct now w/o the -d!!! run postconf -n for your settings minus the default. This is generally all you care about. Also, read man postconf And lastly, don't top

Re: Reverse DNS requirement

On 3-Aug-2009, at 15:57, Robert Schetterer wrote: yes i know many mailling services from big companies who missed the reverse dns, but its their problem, after all if they cant get out their mail it should finally bounce to someone responsable No, you're still not understanding. Say you have

Re: No hash in Solaris 10

On Mon, Aug 03, 2009 at 03:38:35PM -0400, Mauricio Tavares wrote: > > I thought it would be there since I have db 4.7 installed in the > machine. Am I missing something here or just being mistaken as usual? Is > it being called something else? PS. Consider using simple and fast http://www.post

[SOLVED] RE: allow sasl authenticated on submission port and bypass rbl

> >> > >> Nick Sharp wrote: > smtpd_client_restrictions=permit_mynetworks,permit_sasl_authenticated,r > eject > > in the submission bit in master.cf, the connect immediately rejects > unless > > matching mynetworks, still not giving a chance to do SASL.. > > > > Any ideas why this would be? > > > >

Re: too many postfix smtp active internet connections

On Mon, 2009-08-03 at 16:08 -0400, Wietse Venema wrote: > Get rid of the backscatter: > http://www.postfix.org/BACKSCATTER_README.html Has anybody inplemented something like this with Postfix yet? -- --- C Werclick .Lot Technical incompe

Re: too many postfix smtp active internet connections

On Mon, 2009-08-03 at 16:08 -0400, Wietse Venema wrote: > Get rid of the backscatter: > http://www.postfix.org/BACKSCATTER_README.html > > Wietse Has anybody implemented something like this with Postfix? http://en.wikipedia.org/wiki/Bounce_Address_Tag_Validation Any observations or advice

Re: too many postfix smtp active internet connections

* Clunk Werclick : > On Mon, 2009-08-03 at 16:08 -0400, Wietse Venema wrote: > > Get rid of the backscatter: > > http://www.postfix.org/BACKSCATTER_README.html > > > > Wietse > > Has anybody implemented something like this with Postfix? > > http://en.wikipedia.org/wiki/Bounce_Address_Tag_Val

Re: too many postfix smtp active internet connections

On Tue, 2009-08-04 at 08:12 +0200, Patrick Ben Koetter wrote: > > You need the milter capabilities from Postfix 2.6. Use the > batv-milter. > > That's all I know at the moment. I am confused? batv-milter? Is it not pvrs? I see this: http://sourceforge.net/projects/batv-milter/ The idea looks v