Re: Does Postfix cache resolv.conf? [SOLVED]

2010-01-12 Thread Stan Hoeppner
Christoph Anton Mitterer put forth on 1/11/2010 5:31 PM: > Using the "resolvconf" package, should solve your problems, the Debian > postfix package ships rules for resolvconf in order to automatically > update the chroot resolv.conf. resolvconf has a long list of conflicts including ifupdown and

Postfix dovecot and sieve

2010-01-12 Thread Per Laine
Hi all! This is my first post to the list and i hope I can get some help. I'm using postfix as MTA with dovecot IMAP on Ubuntu Karmic and I'm trying to get server-side mail filtering with sieve. Everything seems like it's working but it's not. I telnet localhost sive and list rules and it seems l

Postfix dovecot and sieve

2010-01-12 Thread Per Laine
Hi all! This is my first post to the list and i hope I can get some help. I'm using postfix as MTA with dovecot IMAP on Ubuntu Karmic and I'm trying to get server-side mail filtering with sieve. Everything seems like it's working but it's not. I telnet localhost sive and list rules and it seems l

Re: Postfix dovecot and sieve

2010-01-12 Thread Eero Volotinen
Quoting Per Laine : Hi all! This is my first post to the list and i hope I can get some help. I'm using postfix as MTA with dovecot IMAP on Ubuntu Karmic and I'm trying to get server-side mail filtering with sieve. Everything seems like it's working but it's not. I telnet localhost sive and li

Re: Does Postfix cache resolv.conf? [SOLVED]

2010-01-12 Thread Christoph Anton Mitterer
On Tue, 2010-01-12 at 04:02 -0600, Stan Hoeppner wrote: > resolvconf has a long list of conflicts including ifupdown and bind8/9. Uhm has it? > Would using resolvconf > break bind? Unlikely,.. at least I'm using it together with bind9 > Aptitude seems to suggest this. Well the resolvconf packag

Re: Auto-whitelist policy

2010-01-12 Thread Stan Hoeppner
Daniel L. Miller put forth on 1/11/2010 5:03 PM: > Does anyone have an auto-whitelisting policy daemon? I want to have a > test early in sender checks that would bypass most of my other spam > prevention if a sender is in the whitelist - and have that whitelist > automatically updated by internal

Re: Auto-whitelist policy

2010-01-12 Thread Eray Aslan
On 12.01.2010 13:21, Stan Hoeppner wrote: > Daniel L. Miller put forth on 1/11/2010 5:03 PM: >> Does anyone have an auto-whitelisting policy daemon? I want to have a >> test early in sender checks that would bypass most of my other spam >> prevention if a sender is in the whitelist - and have that

Re: Messages are stuck in maildrop

2010-01-12 Thread Wietse Venema
Eugueny Kontsevoy: > I had some issues with free disk space so I had to start the server, expand > the partition and restart it again. > I did the following: > > > postsuper -r ALL > > It reported that it re-queued a bunch of messages and I can see that they're > sitting in maildrop queue. > post

Re: Postfix dovecot and sieve

2010-01-12 Thread Brian Evans - Postfix List
On 1/12/2010 5:06 AM, Per Laine wrote: > Hi all! > > This is my first post to the list and i hope I can get some help. > > I'm using postfix as MTA with dovecot IMAP on Ubuntu Karmic and I'm > trying to get server-side mail filtering with sieve. Everything seems > like it's working but it's not. I

Re: Postfix dovecot and sieve

2010-01-12 Thread Brian Evans - Postfix List
On 1/12/2010 5:11 AM, Eero Volotinen wrote: > Quoting Per Laine : > >> Hi all! >> >> This is my first post to the list and i hope I can get some help. >> >> I'm using postfix as MTA with dovecot IMAP on Ubuntu Karmic and I'm >> trying to get server-side mail filtering with sieve. Everything seems >

Re: Postfix dovecot and sieve

2010-01-12 Thread Per Laine
Ok, thanks for the reply. When I set "virtual_transport = dovecot" and add dovecot unix - n n - - pipe flags=DRhu user=vmail:vmail argv=/usr/lib/dovecot/deliver -f ${sender} -d ${recipient} to master.cf I get Can't connect to auth server at /var/run/dovecot//aut

RE: Spam Attack on my outgoing server

2010-01-12 Thread Damian Rivas
>>>On Mon, Jan 11, 2010 at 06:15:21PM -0300, Damian Rivas wrote: > >> mynetworks = 127.0.0.0/8, 200.55.14.248/29, 190.210.52.88/29 > > >These are the hosts allowed to relay. Don't mung the IP addresses. snip >> All mailing incomes seem to come from ns1.cht.com.ar, which is a >> gateway for the i

Re: Spam Attack on my outgoing server

2010-01-12 Thread /dev/rob0
On Tue, Jan 12, 2010 at 11:50:19AM -0300, Damian Rivas wrote: > >Another possibility, as you mentioned that this is the gateway for > >Postfix, is that it has a misconfigured firewall that is doing > >both source and destination NAT of port 25 to your Postfix. I just > >tested this, and was unab

Re: Spam Attack on my outgoing server

2010-01-12 Thread Terry Carmen
On 01/12/2010 09:50 AM, Damian Rivas wrote: Yeah, I've figured out that the problem was a Firewall vulnerability issue, port 25 was open to anyone. I've fixed that and problem solved! Thanks to you all for your help and my apologies because it was not a Postfix issue at all, Don't feel bad.

multiple PTR records

2010-01-12 Thread Frank Cusack
After searching the mailing list (and the web in general) what I can gather about multiple PTR records is that postfix is adamant that hosts should not have multiple PTR records. Who cares? It's like saying DNS names should not have underscores or spaces. Yes we don't like it, but it's easy for

THREAD CLOSED: (was Re: multiple PTR records)

2010-01-12 Thread Victor Duchovni
On Tue, Jan 12, 2010 at 11:27:43AM -0500, Frank Cusack wrote: > Yes we don't like it, but it's easy for postfix to accept and deal with it. You write the code, deploy it on your systems, and suffer the consequences. > I'll post my actual problem in another thread, to keep this one focused > on t

Re: multiple PTR records

2010-01-12 Thread /dev/rob0
On Tue, Jan 12, 2010 at 11:27:43AM -0500, Frank Cusack wrote: > After searching the mailing list (and the web in general) what I > can gather about multiple PTR records is that postfix is adamant > that hosts should not have multiple PTR records. > > Who cares? It's like saying DNS names should

Re: multiple PTR records

2010-01-12 Thread Frank Cusack
On January 12, 2010 11:07:25 AM -0600 "/dev/rob0" wrote: It's hard to focus on what you said when we don't know what you said. :) I thought it was pretty clear. :) On Tue, Jan 12, 2010 at 11:27:43AM -0500, Frank Cusack wrote: After searching the mailing list (and the web in general) what I

Re: multiple PTR records

2010-01-12 Thread Robert Fournerat
Quoting Frank Cusack : Apparently it only "honors" the first PTR record that getnameinfo() returns to it. Additionally this appears to be a conscious decision and in part designed to impose postfix's sense of order on the world. -frank In this case at least, I think, "postfix's sense of o

Re: multiple PTR records

2010-01-12 Thread Frank Cusack
On January 12, 2010 12:24:20 PM -0500 Frank Cusack wrote: Apparently it only "honors" the first PTR record that getnameinfo() returns to it. Additionally this appears to be a conscious decision and in part designed to impose postfix's sense of order on the world. Well, I see part of the probl

Re: multiple PTR records

2010-01-12 Thread Stan Hoeppner
Frank Cusack put forth on 1/12/2010 12:04 PM: > I don't know why you would thank Wietse when there is no disadvantage > to accepting multiple PTR records. There is only a downside. What's the downside Frank? -- Stan

THREAD STILL CLOSED: (was Re: multiple PTR records)

2010-01-12 Thread Victor Duchovni
On Tue, Jan 12, 2010 at 01:04:56PM -0500, Frank Cusack wrote: > On January 12, 2010 12:24:20 PM -0500 Frank Cusack > wrote: >> Apparently it only "honors" the first PTR record that getnameinfo() >> returns to it. Additionally this appears to be a conscious decision >> and in part designed to im

Re: multiple PTR records

2010-01-12 Thread Frank Cusack
On January 12, 2010 12:09:28 PM -0600 Stan Hoeppner wrote: Frank Cusack put forth on 1/12/2010 12:04 PM: I don't know why you would thank Wietse when there is no disadvantage to accepting multiple PTR records. There is only a downside. What's the downside Frank? Good question. I can't ac

Re: THREAD STILL CLOSED: (was Re: multiple PTR records)

2010-01-12 Thread Frank Cusack
On January 12, 2010 1:10:51 PM -0500 Victor Duchovni wrote: If you have a specific use case in which you need guidance to configure Postfix, please start a new thread, without the polemics. That is why I stated originally, for my specific problem case I will be writing in another thread. I am

Re: multiple PTR records

2010-01-12 Thread Stan Hoeppner
Frank Cusack put forth on 1/12/2010 12:12 PM: > On January 12, 2010 12:09:28 PM -0600 Stan Hoeppner > wrote: >> Frank Cusack put forth on 1/12/2010 12:04 PM: >> >>> I don't know why you would thank Wietse when there is no disadvantage >>> to accepting multiple PTR records. There is only a downsid

How to not reject valid MTAs for inconsistent forward/reverse DNS.

2010-01-12 Thread Victor Duchovni
On Tue, Jan 12, 2010 at 01:12:52PM -0500, Frank Cusack wrote: > I can't accept mail from hosts with multiple PTR records without manually > whitelisting them. Additionally, I can't even tell that I'm experiencing > a failure until it is reported to me "manually" and out of band. Don't use "rejec

Challenge/Response

2010-01-12 Thread Aaron Clausen
Are challenge response systems still heavily frowned on? -- Aaron Clausen mightymartia...@gmail.com

Re: Challenge/Response

2010-01-12 Thread Victor Duchovni
On Tue, Jan 12, 2010 at 10:39:16AM -0800, Aaron Clausen wrote: > Are challenge response systems still heavily frowned on? Yes. This is how I explain spam filtering of C/R requests to my users: The attached message was reported by you as a quarantine error. Sadly, challenge/response anti

Re: Challenge/Response

2010-01-12 Thread Noel Jones
On 1/12/2010 12:39 PM, Aaron Clausen wrote: Are challenge response systems still heavily frowned on? Yes.

Re: Challenge/Response

2010-01-12 Thread Stan Hoeppner
Noel Jones put forth on 1/12/2010 12:50 PM: > On 1/12/2010 12:39 PM, Aaron Clausen wrote: >> Are challenge response systems still heavily frowned on? >> > > Yes. Yes. -- Stan

Re: Postfix as an MTA question

2010-01-12 Thread mouss
Bucl, Casper a écrit : > Hi, > > I’m trying to use Postfix as an MTA. I don’t want to deliver any mail > locally, just relay everything to an external mail server. I would also > like everything that runs though this MTA to be sent as a particular > user, however I don’t want messages intended for

client disconnects at CONNECT (multiple PTR problem?)

2010-01-12 Thread Frank Cusack
My postfix-2.6.5 is rejecting mail from a host which has a large PTR RRset -- 44 entries and large enough to require TCP. host/dig/nslookup actually dumps core on my solaris box (looks like the bug was fixed in BIND just a few months ago). I don't know for sure that it is the PTR records that are

Re: multiple PTR records

2010-01-12 Thread Frank Cusack
On January 12, 2010 12:28:10 PM -0600 Stan Hoeppner wrote: Frank Cusack put forth on 1/12/2010 12:12 PM: On January 12, 2010 12:09:28 PM -0600 Stan Hoeppner wrote: Frank Cusack put forth on 1/12/2010 12:04 PM: I don't know why you would thank Wietse when there is no disadvantage to acceptin

Re: How to not reject valid MTAs for inconsistent forward/reverse DNS.

2010-01-12 Thread Frank Cusack
On January 12, 2010 1:33:46 PM -0500 Victor Duchovni wrote: On Tue, Jan 12, 2010 at 01:12:52PM -0500, Frank Cusack wrote: I can't accept mail from hosts with multiple PTR records without manually whitelisting them. Additionally, I can't even tell that I'm experiencing a failure until it is re

Re: client disconnects at CONNECT (multiple PTR problem?)

2010-01-12 Thread /dev/rob0
On Tue, Jan 12, 2010 at 03:02:37PM -0500, Frank Cusack wrote: > My postfix-2.6.5 is rejecting mail from a host which has a large Not according to what we see below. "Lost connection" does not mean you rejected them. > PTR RRset -- 44 entries and large enough to require TCP. > host/dig/nslookup a

Re: multiple PTR records

2010-01-12 Thread Stan Hoeppner
Frank Cusack put forth on 1/12/2010 2:29 PM: > Not to be rude, but I'm not sure why you asked me the question in the > first place. It was in fact a great question. Your response however > was merely to dismiss my problem. So it seems like your question was > just rhetoric designed to sink this

Re: client disconnects at CONNECT (multiple PTR problem?)

2010-01-12 Thread Frank Cusack
On January 12, 2010 2:49:32 PM -0600 "/dev/rob0" wrote: On Tue, Jan 12, 2010 at 03:02:37PM -0500, Frank Cusack wrote: My postfix-2.6.5 is rejecting mail from a host which has a large Not according to what we see below. "Lost connection" does not mean you rejected them. Quite. That should h

Re: client disconnects at CONNECT (multiple PTR problem?)

2010-01-12 Thread Noel Jones
On 1/12/2010 2:02 PM, Frank Cusack wrote: My postfix-2.6.5 is rejecting mail from a host which has a large PTR RRset -- 44 entries and large enough to require TCP. host/dig/nslookup actually dumps core on my solaris box (looks like the bug was fixed in BIND just a few months ago). I don't know fo

Re: client disconnects at CONNECT (multiple PTR problem?)

2010-01-12 Thread Noel Jones
On 1/12/2010 3:05 PM, Frank Cusack wrote: On January 12, 2010 2:49:32 PM -0600 "/dev/rob0" wrote: reject_unauth_pipelining won't work here, only in smtpd_data_restrictions reject_unauth_pipelining Reject the request when the client sends SMTP commands ahead of time where it is not allowed,

Re: multiple PTR records

2010-01-12 Thread Frank Cusack
On January 12, 2010 2:52:58 PM -0600 Stan Hoeppner wrote: Frank Cusack put forth on 1/12/2010 2:29 PM: Is it your opinion that the disadvantages I've described aren't valid? When it comes to multiple PTRs on a single email emitting IP, yes, it is my opinion that that the disadvantages you des

Re: client disconnects at CONNECT (multiple PTR problem?)

2010-01-12 Thread Frank Cusack
On January 12, 2010 3:10:12 PM -0600 Noel Jones wrote: On 1/12/2010 2:02 PM, Frank Cusack wrote: My postfix-2.6.5 is rejecting mail from a host which has a large PTR RRset -- 44 entries and large enough to require TCP. host/dig/nslookup actually dumps core on my solaris box (looks like the bug

Re: multiple PTR records

2010-01-12 Thread Noel Jones
On 1/12/2010 3:19 PM, Frank Cusack wrote: On January 12, 2010 2:52:58 PM -0600 Stan Hoeppner wrote: Frank Cusack put forth on 1/12/2010 2:29 PM: Is it your opinion that the disadvantages I've described aren't valid? When it comes to multiple PTRs on a single email emitting IP, yes, it is my

Re: client disconnects at CONNECT (multiple PTR problem?)

2010-01-12 Thread Noel Jones
On 1/12/2010 3:33 PM, Frank Cusack wrote: On January 12, 2010 3:10:12 PM -0600 Noel Jones wrote: Postfix uses system libraries for DNS lookups. You can test your system using the same calls with the tools in the auxiliary/name-addr-test directory in the postfix source. These aren't built by def

Re: client disconnects at CONNECT (multiple PTR problem?)

2010-01-12 Thread /dev/rob0
On Tue, Jan 12, 2010 at 03:16:53PM -0600, Noel Jones wrote: > On 1/12/2010 3:05 PM, Frank Cusack wrote: > >On January 12, 2010 2:49:32 PM -0600 "/dev/rob0" > >wrote: > >>reject_unauth_pipelining won't work here, only in > >>smtpd_data_restrictions > > > >reject_unauth_pipelining [snip] > With pos

Re: How to not reject valid MTAs for inconsistent forward/reverse DNS.

2010-01-12 Thread Victor Duchovni
On Tue, Jan 12, 2010 at 03:47:57PM -0500, Frank Cusack wrote: >> Don't use "reject_unknown_client_hostname" indiscriminantly. Do so only >> for CIDR blocks in which you find a small number of legitimate MTAs in a >> larger pool of spam sending hosts without valid PTR records. > > In my case, I don

SMTP AUTH issue

2010-01-12 Thread Atevewr
Dear All, I want to ask a simple question regarding smtp authentication. (Assuming that the user is not in my trusted networks) If smtp authentication is on & the client connects through a EHLO session, then the authentication goes fine and the user is authenticated, but if he connects through a si

Re: SMTP AUTH issue

2010-01-12 Thread Noah Sheppard
On Wed, Jan 13, 2010 at 05:21:09AM +0530, Atevewr wrote: > [..] > If smtp authentication is on & the client connects through a EHLO > session, then the authentication goes fine and the user is > authenticated, but if he connects through a simple HELO session, then > he is able to send a mail withou

Re: How to not reject valid MTAs for inconsistent forward/reverse DNS.

2010-01-12 Thread Frank Cusack
On January 12, 2010 5:59:58 PM -0500 Victor Duchovni wrote: You latched onto a red-herring, it is far wiser to report accurate symptoms than to speculate about theoretical causes of unreported behaviour. Sure, and that's the reason I started 2 threads. I thought my first one was totally legit

Speeding up Local Delivery

2010-01-12 Thread Wendigo Thompson
Hello: I maintain for a large client a Postfix/MySQL installation that archives certain messages required to be held for compliance with lawsuits and employment litigation. Postfix accepts mail from the corporate mail server and delivers the message via a pipe alias to an application that is th