Re: Advice on filtering setup

2011-02-03 Thread Stan Hoeppner
Aggelos put forth on 2/2/2011 10:49 PM: > on 02/03/2011 05:24 AM Aggelos wrote the following: > >> With that setup, if I wanted to accept mail from a specific Internet IP, >> which would otherwise be filtered out, how would I do it? >> > > I meant clients that are rejected like so: > Feb 3 06:46

Re: Selective Relaying

2011-02-03 Thread lkml
> Dominik Schulz: >> I'm currently planning to migrate an Exim mailserver to Postfix due to >> performance issues and security concerns. >> >> The Exim mailserver is configured to handle several virtual domains. If >> a >> recipient is not found in the virtual table, before rejecting this >> recipi

Re: recipient_bcc_maps not working

2011-02-03 Thread lkml
> l...@ds.gauner.org: >> I've configured recipient_bcc_maps to capture outgoing mail to some domains to debug delivery issues, i.e. some senders can't send mails to yahoo and yahoo wants the full body. So I thought I could just capture these mails using recipient_bcc_maps and later forward them to

Re: Advice on filtering setup

2011-02-03 Thread Aggelos
on 02/03/2011 10:05 AM Stan Hoeppner wrote the following: > Aggelos put forth on 2/2/2011 10:49 PM: >> on 02/03/2011 05:24 AM Aggelos wrote the following: >> >>> With that setup, if I wanted to accept mail from a specific Internet IP, >>> which would otherwise be filtered out, how would I do it? >>

Vacation with maildir format ?

2011-02-03 Thread Frank Bonnet
Hello I'm migrating my mailhub. on the fly I'm converting the mailboxes format from MBOX to Maildir and I wonder how to use the vacation program ( or equivalent ) with Maiidir format ? Thanks for any infos , links ... etc.

Re: Vacation with maildir format ?

2011-02-03 Thread John Adams
Am 03.02.2011 10:24, schrieb Frank Bonnet: Hello I'm migrating my mailhub. on the fly I'm converting the mailboxes format from MBOX to Maildir and I wonder how to use the vacation program ( or equivalent ) with Maiidir format ? Thanks for any infos , links ... etc. Hi take a look at dovec

Re: Question about: postfix/smtpd[ ]: connect from unknown[unknown]

2011-02-03 Thread J4K
On 02/02/2011 11:54 PM, Steve Jenkins wrote: > On Wed, Feb 2, 2011 at 2:33 PM, Stan Hoeppner wrote: >> In the mean time, maybe give this a go. 1600+ expressions matching rDNS >> patterns of many millions of broadband IPs worldwide that shouldn't be >> sending >> direct SMTP. Catches quite a bit

Re: spammers getting better? help with filtering this one

2011-02-03 Thread J4K
On 02/03/2011 10:36 AM, Daniel Bromberg wrote: > The following spam got past all my filters. They're constantly > evolving :-( > > I can't find the IP in any RBLs. Some meta-RBLs claim it's listed, but > when I follow up to the actual RBL, it's clean. I use zen.spamhaus & > spamcop. SpamAssassin wa

Re: Question about: postfix/smtpd[ ]: connect from unknown[unknown]

2011-02-03 Thread Daniel Bromberg
On 2/3/2011 4:44 AM, J4K wrote: [snip] I can attest to the awesomeness of Stan's pcre file. I run it on all 5 of our Postfix servers, and it catches a LOT of stuff. From my logs, what it seems to do best is block zombie mailers on dynamic IPs. And I updated to your latest version today, Stan. T

Re: Question about: postfix/smtpd[ ]: connect from unknown[unknown]

2011-02-03 Thread J4K
On 02/03/2011 10:56 AM, Daniel Bromberg wrote: > On 2/3/2011 4:44 AM, J4K wrote: >> [snip] >>> I can attest to the awesomeness of Stan's pcre file. I run it on all 5 >>> of our Postfix servers, and it catches a LOT of stuff. From my logs, >>> what it seems to do best is block zombie mailers on dyna

Re: Question about: postfix/smtpd[ ]: connect from unknown[unknown]

2011-02-03 Thread Jerry
On Wed, 02 Feb 2011 18:44:46 -0600 Stan Hoeppner articulated: > Jeroen Geilman put forth on 2/2/2011 2:56 PM: > > > Debian won't have 2.8 in stable until at least 2013, although you > > may be able to get it as a backport later this year: > > > > http://packages.debian.org/search?keywords=postf

Re: Question about: postfix/smtpd[ ]: connect from unknown[unknown]

2011-02-03 Thread John Peach
On Thu, 03 Feb 2011 10:44:13 +0100 J4K wrote: > On 02/02/2011 11:54 PM, Steve Jenkins wrote: > > On Wed, Feb 2, 2011 at 2:33 PM, Stan Hoeppner > > wrote: > >> In the mean time, maybe give this a go. 1600+ expressions matching rDNS > >> patterns of many millions of broadband IPs worldwide that

Re: spammers getting better? help with filtering this one

2011-02-03 Thread Mark Alan
On Thu, 03 Feb 2011 04:36:26 -0500, Daniel Bromberg wrote: > Those who can block this, how did you do it? I hope whatever > technique(s) also help block many more like it. Blocked here with bogofilter (bayesian header+body filter). M.

Re: Advice on filtering setup

2011-02-03 Thread Brian Evans - Postfix List
On 2/3/2011 3:34 AM, Aggelos wrote: > on 02/03/2011 10:05 AM Stan Hoeppner wrote the following: >> Aggelos put forth on 2/2/2011 10:49 PM: >>> on 02/03/2011 05:24 AM Aggelos wrote the following: >>> With that setup, if I wanted to accept mail from a specific Internet IP, which would other

multiple ssl certificates for multiple domains but just one IP

2011-02-03 Thread Alokat
Hi, I have a server which accepts eMails for multiple Domains. And I wanna provide for each Domain a SSL certificate. How can I use SNI (Server Name Indication) with postfix or is there another way to solve this problem? Regards, alokat

Postscreen is great !

2011-02-03 Thread Frank Bonnet
Hello Just few words to say how postscreen is great ! Thanks for that !!!

Re: multiple ssl certificates for multiple domains but just one IP

2011-02-03 Thread Wietse Venema
Alokat: > Hi, > > I have a server which accepts eMails for multiple Domains. > And I wanna provide for each Domain a SSL certificate. > > How can I use SNI (Server Name Indication) with postfix or is there > another way to solve this problem? This is not yet implemented in Postfix. One option i

Re: Selective Relaying

2011-02-03 Thread Victor Duchovni
On Thu, Feb 03, 2011 at 09:16:27AM +0100, l...@ds.gauner.org wrote: > I've tried Victor's suggestion using check_recipient_access backend by a > longish MySQL query and empty relay_recipient_maps, but I'm still unsure > wheter this'd be the best solution. Using an access map instead of "relay_rec

Re: multiple ssl certificates for multiple domains but just one IP

2011-02-03 Thread Victor Duchovni
On Thu, Feb 03, 2011 at 10:30:33AM -0500, Wietse Venema wrote: > Alokat: > > Hi, > > > > I have a server which accepts eMails for multiple Domains. > > And I wanna provide for each Domain a SSL certificate. > > > > How can I use SNI (Server Name Indication) with postfix or is there > > another

Re: multiple ssl certificates for multiple domains but just one IP

2011-02-03 Thread Alokat
On 02/03/2011 05:03 PM, Victor Duchovni wrote: On Thu, Feb 03, 2011 at 10:30:33AM -0500, Wietse Venema wrote: Alokat: Hi, I have a server which accepts eMails for multiple Domains. And I wanna provide for each Domain a SSL certificate. How can I use SNI (Server Name Indication) with postfix

Re: multiple ssl certificates for multiple domains but just one IP

2011-02-03 Thread Victor Duchovni
On Thu, Feb 03, 2011 at 05:16:58PM +0100, Alokat wrote: >> For MUAs reaching a submission server, the picture is much more simple, >> so this is perhaps viable, but which MUAs are SNI enabled? > > Okay ... thanks for all your comments. > So how would you solve my problem? Multiple Instances? Idea

Re: multiple ssl certificates for multiple domains but just one IP

2011-02-03 Thread Reindl Harald
Am 03.02.2011 17:16, schrieb Alokat: > Okay ... thanks for all your comments. > So how would you solve my problem? Multiple Instances? > > Regards, > Alokat * One Servername * One Certificate I see really no reason why not "mail.yourcompany.tld" using in all MX-records and client-configs, nobod

Re: Question about: postfix/smtpd[ ]: connect from unknown[unknown]

2011-02-03 Thread Steve Jenkins
On Thu, Feb 3, 2011 at 1:44 AM, J4K wrote: > Its a good idea, but this would limit a user from using a server on his > residential ADSL from being an Email server, and force them to use their > ISPs relay.  Else they might have to upgrade to a business package or spend > more money for a static IP

Re: Postscreen is great !

2011-02-03 Thread /dev/rob0
On Thu, Feb 03, 2011 at 03:31:07PM +0100, Frank Bonnet wrote: > Just few words to say how postscreen is great ! > > Thanks for that !!! Indeed, but I'd like to add some content to this thread and ask the list as a whole: 1. What are you using for dnsbl sites and threshold? 2. Have you enabled d

Re: Advice on filtering setup

2011-02-03 Thread Aggelos
on 02/03/2011 04:13 PM Brian Evans - Postfix List wrote the following: > On 2/3/2011 3:34 AM, Aggelos wrote: >> on 02/03/2011 10:05 AM Stan Hoeppner wrote the following: >>> Aggelos put forth on 2/2/2011 10:49 PM: on 02/03/2011 05:24 AM Aggelos wrote the following: > With that setup,

Re: Postfix with virtual domains and the username

2011-02-03 Thread e-frog
On 03.02.2011 00:27, wrote Matt: > On Wed, Feb 2, 2011 at 5:31 PM, Mauricio Tavares wrote: >> On Wed, Feb 2, 2011 at 5:10 PM, Matt wrote: >>> I'm working on replacing an ageing Posfix install with a new server. >>> >>> On the old and new server we use virtual domains. >>> >>> On the old server we

Re: Postscreen is great !

2011-02-03 Thread Noel Jones
On 2/3/2011 11:53 AM, /dev/rob0 wrote: On Thu, Feb 03, 2011 at 03:31:07PM +0100, Frank Bonnet wrote: Just few words to say how postscreen is great ! Thanks for that !!! Indeed, but I'd like to add some content to this thread and ask the list as a whole: 1. What are you using for dnsbl sites

Re: recipient_bcc_maps not working

2011-02-03 Thread Jeroen Geilman
On 2/3/11 9:18 AM, l...@ds.gauner.org wrote: l...@ds.gauner.org: I've configured recipient_bcc_maps to capture outgoing mail to some domains to debug delivery issues, i.e. some senders can't send mails to yahoo and yahoo wants the full body. So I thought I could just capture these mails using r

Postscreen + SenderBase

2011-02-03 Thread David Touzeau
Did anyone have tips to integrate PostScreen with SenderBase DNSBL has the Cisco IronMail blacklist ? Bestr regards

Re: multiple ssl certificates for multiple domains but just one IP

2011-02-03 Thread Chris Tandiono
On Thu, 03 Feb 2011 08:16:58 -0800, Alokat wrote: On 02/03/2011 05:03 PM, Victor Duchovni wrote: On Thu, Feb 03, 2011 at 10:30:33AM -0500, Wietse Venema wrote: Alokat: Hi, I have a server which accepts eMails for multiple Domains. And I wanna provide for each Domain a SSL certificate. How

Re: multiple ssl certificates for multiple domains but just one IP

2011-02-03 Thread Reindl Harald
Am 03.02.2011 20:05, schrieb Chris Tandiono: > You can get a multi-domain SSL certificate. It is one certificate that lists > all the > domains for which it is valid. in theory xes but this is not scaleable If you get 3 new customers with their own domains you cert does not include them and

Delivering Mail with priority based on domain

2011-02-03 Thread James R. Marcus
Hi, I have been reading about prioritizing mail in Postfix on this list. It seems that the answer is, there is a shared queue and mail is not prioritized. I want to make sure that I fully understand if this applies to my situation. All of our servers that send mail go through our Postfix gate

Re: Delivering Mail with priority based on domain

2011-02-03 Thread Joe
On 02/03/2011 11:24 AM, James R. Marcus wrote: Hi, I have been reading about prioritizing mail in Postfix on this list. It seems that the answer is, there is a shared queue and mail is not prioritized. I want to make sure that I fully understand if this applies to my situation. All of our s

Re: Postscreen is great !

2011-02-03 Thread Matt Rude
On 2/3/2011 11:53 AM, /dev/rob0 wrote: On Thu, Feb 03, 2011 at 03:31:07PM +0100, Frank Bonnet wrote: Just few words to say how postscreen is great ! The only drawback, which is minor from our point of view, but maybe major for the DNSBL operators, is that every connection means a hit on every

Re: Postscreen + SenderBase

2011-02-03 Thread Ralf Hildebrandt
* David Touzeau : > Did anyone have tips to integrate PostScreen with SenderBase DNSBL has > the Cisco IronMail blacklist ? Please rephrase and please do mention how one would query the SenderBase DNSBL! -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedi

Re: message tracking logging request

2011-02-03 Thread Alan Batie
On 2/2/11 12:20 AM, Matthias Andree wrote: > Postfix logs the ID whenever one is available, and it did in your case. > I'm wondering what exactly you seem to be missing. If it's about the > client connection as logged by postfix/smtpd, then it has no connection > to individual messages, hence does

Re: message tracking logging request

2011-02-03 Thread Reindl Harald
Am 03.02.2011 20:41, schrieb Alan Batie: > On 2/2/11 12:20 AM, Matthias Andree wrote: > >> Postfix logs the ID whenever one is available, and it did in your case. >> I'm wondering what exactly you seem to be missing. If it's about the >> client connection as logged by postfix/smtpd, then it has

Re: Postscreen is great !

2011-02-03 Thread Wietse Venema
Matt Rude: > On 2/3/2011 11:53 AM, /dev/rob0 wrote: > > On Thu, Feb 03, 2011 at 03:31:07PM +0100, Frank Bonnet wrote: > >> Just few words to say how postscreen is great ! > > > > The only drawback, which is minor from our point of view, but maybe > > major for the DNSBL operators, is that every con

Re: Postscreen is great !

2011-02-03 Thread Benny Pedersen
On Thu, 03 Feb 2011 12:52:47 -0600, Noel Jones wrote: > list.dnswl.org*-5 this includes dnswl_none just a note > hostkarma.junkemailfilter.com=127.0.0.1*-5 super that its is supported, still missing rhsbl in postscreen ?

Re: Postscreen is great !

2011-02-03 Thread Wietse Venema
Benny Pedersen: > On Thu, 03 Feb 2011 12:52:47 -0600, Noel Jones > wrote: > > list.dnswl.org*-5 > > this includes dnswl_none just a note > > > hostkarma.junkemailfilter.com=127.0.0.1*-5 > > super that its is supported, still missing rhsbl in postscreen ? There is not yet a us

Re: Postscreen is great !

2011-02-03 Thread /dev/rob0
On Thu, Feb 03, 2011 at 03:01:56PM -0500, Wietse Venema wrote: > Benny Pedersen: > > super that its is supported, still missing rhsbl in postscreen ? > > There is not yet a user interface design for rhsbl in postscreen. > Suggestions are welcome. I don't see how it would be useful. The only thing

Re: Postscreen is great !

2011-02-03 Thread Wietse Venema
/dev/rob0: > On Thu, Feb 03, 2011 at 03:01:56PM -0500, Wietse Venema wrote: > > Benny Pedersen: > > > super that its is supported, still missing rhsbl in postscreen ? > > > > There is not yet a user interface design for rhsbl in postscreen. > > Suggestions are welcome. > > I don't see how it woul

Re: Postscreen + SenderBase

2011-02-03 Thread David Touzeau
Sorry, I rephrase How can we set PostScreen to query SenderBase DNBSL ? Best regards Le jeudi 03 février 2011 à 20:37 +0100, Ralf Hildebrandt a écrit : > * David Touzeau : > > > Did anyone have tips to integrate PostScreen with SenderBase DNSBL has > > the Cisco IronMail blacklist ? > > Pleas

Re: Delivering Mail with priority based on domain

2011-02-03 Thread Jeroen Geilman
On 2/3/11 8:31 PM, Joe wrote: On 02/03/2011 11:24 AM, James R. Marcus wrote: Hi, I have been reading about prioritizing mail in Postfix on this list. It seems that the answer is, there is a shared queue and mail is not prioritized. I want to make sure that I fully understand if this applie

Re: Postscreen + SenderBase

2011-02-03 Thread Jeroen Geilman
On 2/4/11 12:33 AM, David Touzeau wrote: Sorry, I rephrase How can we set PostScreen to query SenderBase DNBSL ? Best regards Le jeudi 03 février 2011 à 20:37 +0100, Ralf Hildebrandt a écrit : * David Touzeaumailto:da...@touzeau.eu>>: > Did anyone have tips to integrate PostScreen with Send

Re: Question about: postfix/smtpd[ ]: connect from unknown[unknown]

2011-02-03 Thread Jeroen Geilman
On 2/3/11 1:44 AM, Stan Hoeppner wrote: Jeroen Geilman put forth on 2/2/2011 2:56 PM: Debian won't have 2.8 in stable until at least 2013, although you may be able to get it as a backport later this year: http://packages.debian.org/search?keywords=postfix They lag behind something awful. You

Re: Delivering Mail with priority based on domain

2011-02-03 Thread Joe
On 02/03/2011 03:51 PM, Jeroen Geilman wrote: On 2/3/11 8:31 PM, Joe wrote: On 02/03/2011 11:24 AM, James R. Marcus wrote: Hi, I have been reading about prioritizing mail in Postfix on this list. It seems that the answer is, there is a shared queue and mail is not prioritized. I want to ma

Re: Postscreen is great !

2011-02-03 Thread Noel Jones
On 2/3/2011 1:59 PM, Benny Pedersen wrote: On Thu, 03 Feb 2011 12:52:47 -0600, Noel Jones wrote: list.dnswl.org*-5 this includes dnswl_none just a note I intentionally don't want to RBL block sometimes-legit hosts. To only whitelist low..high trusted hosts, something like: l

Re: Delivering Mail with priority based on domain

2011-02-03 Thread Wietse Venema
Jeroen Geilman: [ Charset UTF-8 unsupported, converting... ] > On 2/3/11 8:31 PM, Joe wrote: > > On 02/03/2011 11:24 AM, James R. Marcus wrote: > >> Hi, > >> I have been reading about prioritizing mail in Postfix on this list. > >> It seems that the answer is, there is a shared queue and mail is n

Re: Delivering Mail with priority based on domain

2011-02-03 Thread Jeroen Geilman
On 2/4/11 1:25 AM, Wietse Venema wrote: Jeroen Geilman: [ Charset UTF-8 unsupported, converting... ] Oops... Bad Thunderbird. On 2/3/11 8:31 PM, Joe wrote: On 02/03/2011 11:24 AM, James R. Marcus wrote: Hi, I have been reading about prioritizing mail in Postfix on this list. It seems that t

Re: Delivering Mail with priority based on domain

2011-02-03 Thread Wietse Venema
Jeroen Geilman: > >>> One huge improvement you can make is to specify the "relay" transport > >>> for incoming mail. > >> To achieve what ? > > Postfix has separate "smtp" and "relay" transports for a good > > reason. > > > > The scheduler uses round-robin destination selection. > > Does this mean

Re: Delivering Mail with priority based on domain

2011-02-03 Thread Jeroen Geilman
On 2/4/11 3:38 AM, Wietse Venema wrote: Jeroen Geilman: One huge improvement you can make is to specify the "relay" transport for incoming mail. To achieve what ? Postfix has separate "smtp" and "relay" transports for a good reason. The scheduler uses round-robin destination selection. Does

Re: spammers getting better? help with filtering this one

2011-02-03 Thread Stan Hoeppner
Daniel Bromberg put forth on 2/3/2011 3:36 AM: > The following spam got past all my filters. They're constantly evolving :-( > > I can't find the IP in any RBLs. Some meta-RBLs claim it's listed, but when I > follow up to the actual RBL, it's clean. I use zen.spamhaus & spamcop. > SpamAssassin was

Re: Question about: postfix/smtpd[ ]: connect from unknown[unknown]

2011-02-03 Thread Stan Hoeppner
J4K put forth on 2/3/2011 3:44 AM: > Its a good idea, but this would limit a user from using a server on his > residential ADSL from being an Email server, As the directions in the file itself state, fix situations like this with a simple whitelist. Given the number of hobbyist servers your MX w

Re: Question about: postfix/smtpd[ ]: connect from unknown[unknown]

2011-02-03 Thread Stan Hoeppner
J4K put forth on 2/3/2011 4:09 AM: > True. Some of the matches don't reject, but prepend this header: > X-GenericStaticHELO > What is this header used for? This exists due to the grey area between "residential" and "business" classification. Some providers offer static IP service to small busi

Re: Question about: postfix/smtpd[ ]: connect from unknown[unknown]

2011-02-03 Thread Stan Hoeppner
Jerry put forth on 2/3/2011 5:19 AM: > FreeBSD had the 2.8 release in its ports system a few days after it was > officially released. The 2.9(beta) release will be released into the > ports system shortly. The original 2.8(beta) was available almost > from its inception. The speed with which a pac

Re: Delivering Mail with priority based on domain

2011-02-03 Thread Victor Duchovni
On Fri, Feb 04, 2011 at 12:51:36AM +0100, Jeroen Geilman wrote: >> That will create a separate queue from the outgoing mail which is using >> the "smtp" transport, > > There is one queue. Physically, yes. Logically, and this is what matters more: no. Each transport has a separate pool of delive

Re: Question about: postfix/smtpd[ ]: connect from unknown[unknown]

2011-02-03 Thread Stan Hoeppner
Steve Jenkins put forth on 2/3/2011 11:18 AM: > On Thu, Feb 3, 2011 at 1:44 AM, J4K wrote: >> Its a good idea, but this would limit a user from using a server on his >> residential ADSL from being an Email server, and force them to use their >> ISPs relay. Else they might have to upgrade to a bus

Re: Postscreen + SenderBase

2011-02-03 Thread Stan Hoeppner
Jeroen Geilman put forth on 2/3/2011 5:55 PM: > If it uses the common query method, just add it to your list of DNSBLs. from: http://spamlinks.net/filter-dnsbl-lists.htm query.senderbase.orgSENDERBASE ... Returns TXT records Not suitable for direct Postfix use. I manually dug a fe

Re: Vacation with maildir format ?

2011-02-03 Thread mouss
Le 03/02/2011 10:24, Frank Bonnet a écrit : > Hello > > I'm migrating my mailhub. > > on the fly I'm converting the mailboxes format from MBOX to Maildir > and I wonder how to use the vacation program ( or equivalent ) with > Maiidir format ? > vacation has nothing to do with the storage. > Th

Re: Order of restrictions

2011-02-03 Thread mouss
Le 02/02/2011 21:25, Noel Jones a écrit : > On 2/2/2011 1:48 PM, mouss wrote: >> Le 02/02/2011 19:28, Steve Jenkins a écrit : >>> smtpd_recipient_restrictions = >>> permit_sasl_authenticated, >>> permit_mynetworks, >>> reject_unauth_destination, >>> check_client_