Restricting port 25 with cidr table

2012-01-20 Thread Nikolaos Milas
Hello, As our internal (main) mail server only accepts mail from two mail gateways and users submit their mail through submission port (587), I am planning to explicitly allow accepting mail on port 25 ONLY by our mail gateway servers (and the mail server itself). So, in main.cf: smtpd_clien

Re: Restricting port 25 with cidr table

2012-01-20 Thread Reindl Harald
Am 20.01.2012 09:18, schrieb Nikolaos Milas: > Hello, > > As our internal (main) mail server only accepts mail from two mail gateways > and users submit their mail through > submission port (587), I am planning to explicitly allow accepting mail on > port 25 ONLY by our mail gateway servers >

Re: Postfix very slow accepting a mail having a massive recipient list

2012-01-20 Thread Stan Hoeppner
On 1/20/2012 1:30 AM, Konrad Rzepecki wrote: > W dniu 20.01.2012 01:39, Stan Hoeppner pisze: >> On 1/19/2012 5:07 AM, Konrad Rzepecki wrote: >>> Yes, you have right. But I found recently, that disk mounted on my >>> server are slow 5.9K. My tests on in shows that they do fsync 1.5x-2x >>> slower th

Return-Path filtering

2012-01-20 Thread Jack Knowlton
Hi all. I'm looking to filter emails that have a specific return-path address. As far as I understand, the rule's going to be in header_checks..but can I REJECT or only DISCARD the message? Also, what should the regex look like? I tried a quick fix yesterday but it doesn't seem to be working: #/^R

Re: Return-Path filtering

2012-01-20 Thread Ralf Hildebrandt
* Jack Knowlton : > Hi all. > I'm looking to filter emails that have a specific return-path address. Use check_sender_access -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel.

Re: Return-Path filtering

2012-01-20 Thread Jack Knowlton
On Fri, January 20, 2012 11:15 am, Ralf Hildebrandt wrote: > * Jack Knowlton : >> Hi all. >> I'm looking to filter emails that have a specific return-path address. > Use check_sender_access > Ok, but will it work even though From:<> != Return-Path:<> ? Also, I was under the impression that to filt

Re: Return-Path filtering

2012-01-20 Thread Ralf Hildebrandt
* Jack Knowlton : > On Fri, January 20, 2012 11:15 am, Ralf Hildebrandt wrote: > > * Jack Knowlton : > >> Hi all. > >> I'm looking to filter emails that have a specific return-path address. > > Use check_sender_access > > > > Ok, but will it work even though From:<> != Return-Path:<> ? Return-Pat

Re: Return-Path filtering

2012-01-20 Thread Jack Knowlton
On Fri, January 20, 2012 11:24 am, Ralf Hildebrandt wrote: > * Jack Knowlton : >> On Fri, January 20, 2012 11:15 am, Ralf Hildebrandt wrote: >> > * Jack Knowlton : >> >> Hi all. >> >> I'm looking to filter emails that have a specific return-path >> address. >> > Use check_sender_access >> > >> >> O

Re: Restricting port 25 with cidr table

2012-01-20 Thread Charles Marcus
On 2012-01-20 3:31 AM, Reindl Harald wrote: Am 20.01.2012 09:18, schrieb Nikolaos Milas: As our internal (main) mail server only accepts mail from two mail gateways and users submit their mail through submission port (587), I am planning to explicitly allow accepting mail on port 25 ONLY by our

Re: Postfix very slow accepting a mail having a massive recipient list

2012-01-20 Thread Stan Hoeppner
On 1/20/2012 1:50 AM, Michael Tokarev wrote: > Please excuse me for the somewhat harsh words, but except of the > alignment issues which should be solved for once when partitioning > and creating filesystem, the rest is a complete bullshit collected > from various forums where people does not unde

Re: Postfix 2.9 STABLE release candidate 1

2012-01-20 Thread Luigi Rosa
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Wietse Venema said the following on 18/01/12 20:23: > Postfix 2.9.0-RC1 is ready for download. Please report any problems that > may remain after a few months of cleaning up. Just a minor issue, I suppose. A make upgrade upgraded the system as exp

Stats on smtp method used by clients (with pflogsumm or not)

2012-01-20 Thread Nikolaos Milas
Hi, Is there a solution to display stats on how many of the incoming smtp connections were using port 25 and how many of them 587 (or other custom)? (We are still allowing client connections to port 25.) We are using pflogsumm (with --smtpd_stats options), but smtp stats don't differentiate

Re: Postfix 2.9 STABLE release candidate 1

2012-01-20 Thread Wietse Venema
Luigi Rosa: > A make upgrade upgraded the system as expected, but at the end right before > "COMPATIBILITY: editing main.cf, setting inet_protocols=ipv4." message the > following message appeared 17 times: > > /usr/sbin/postconf: warning: /etc/postfix/main.cf: unused parameter: > strict_mime_domai

Re: Stats on smtp method used by clients (with pflogsumm or not)

2012-01-20 Thread Wietse Venema
Nikolaos Milas: > Hi, > > Is there a solution to display stats on how many of the incoming smtp > connections were using port 25 and how many of them 587 (or other > custom)? (We are still allowing client connections to port 25.) You can make this visible in logging. In master.cf, add the port

Re: Access Map

2012-01-20 Thread lst_hoe02
Zitat von DN Singh : Hello group, I was configuring some restrictions on the Postfix level using access map. It is in has format. It is has a pretty good number of domains in it. So, I was wondering, how large can be the file, without affecting the performance? These are configured in recipient

Re: reject_authenticated_sender_login_mismatch issue

2012-01-20 Thread Benny Pedersen
On Fri, 20 Jan 2012 11:28:08 +0400, Anton Raytsin wrote: How to fix it? smtpd_sender_restrictions=reject_authenticated_sender_login_mismatch,permit_sasl_authenticated,. swap reject_authenticated_sender_login_mismatch and permit_sasl_authenticated

Re: Restricting port 25 with cidr table

2012-01-20 Thread Nikolaos Milas
On 20/1/2012 12:55 μμ, Charles Marcus wrote: # reject all clients not matching anything above, and be damn sure # to comment out the last reject under recipient_restrictions # 0.0.0.0/0 reject unauthorized client, please use our MX You mean to remove "reject" from *smtpd_client_restri

Re: Spamcop listed gmail?

2012-01-20 Thread Jerry
On Fri, 20 Jan 2012 00:24:33 -0500 Simon Brereton articulated: > On Jan 19, 2012 7:13 PM, "Steve Fatula" > wrote: > >> > >> From: Robert Fitzpatrick > >> To: Postfix > >> Sent: Monday, January 16, 2012 1:12 PM > >> Subject: Spamcop listed gmail? > >> > >> Perhaps this is not the place for this,

Re: Postfix 2.9 STABLE release candidate 1

2012-01-20 Thread Jerry
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On Fri, 20 Jan 2012 13:36:14 +0100 Luigi Rosa articulated: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > Wietse Venema said the following on 18/01/12 20:23: > > > Postfix 2.9.0-RC1 is ready for download. Please report any problems > > that

Re: lost connection after EHLO from unknown

2012-01-20 Thread /dev/rob0
On Thu, Jan 19, 2012 at 10:18:33PM -0600, Noel Jones wrote: > On 1/19/2012 9:44 PM, santosh malavade wrote: > > this pertains to the issue raised by our unit in barbados, > > having ip address 173.225.251.221, i have included the said > > ip in debug_peer_list > > > > we are getting lot of message

Re: Strange Postfix error

2012-01-20 Thread Wietse Venema
Johan Andersson: > Jan 19 23:56:21 servername postfix/cleanup[29089]: [ID 947731 mail.crit] > fatal: fstat flow pipe write descriptor: Value too large for defined data type The logging comes from this code fragment: ssize_t mail_flow_get(ssize_t len) { const char *myname = "mail_

current spam wave yahoo.com and aol.com servers

2012-01-20 Thread Robert Schetterer
Hi , to whom it may concern i seeing a massive spam wave from yahoo.com and aol.com servers to my most spam beloved domain seems like the have a lot of "hacked" accounts there present i have ever such stuff in my logs but it did spike since a few hours i tmp blocked them via access table, looking

SV: Strange Postfix error

2012-01-20 Thread Johan Andersson
Hi Thanks for your answer. I don't think that's the answerbecause i haven't replaced anything really (well, apart from replacing the binaries with a copy of the ones that were already running). I also have those binaries running on two more servers and I don't have this problem there. Thi

Re: Stats on smtp method used by clients (with pflogsumm or not)

2012-01-20 Thread James Seymour
On Fri, 20 Jan 2012 08:15:35 -0500 (EST) Wietse Venema wrote: [snip] > > In the logging you will see postfix/smtps/smtpd, > postfix/submission/smtpd and postfix/smtpd. [snip] Two things (addressed to the OP and other readers): 1. This will break Pflogsumm. It expects to see "postfix/smtpd

Re: Stats on smtp method used by clients (with pflogsumm or not)

2012-01-20 Thread Wietse Venema
James Seymour: > On Fri, 20 Jan 2012 08:15:35 -0500 (EST) > Wietse Venema wrote: > > [snip] > > > > In the logging you will see postfix/smtps/smtpd, > > postfix/submission/smtpd and postfix/smtpd. > [snip] BTW this is the default setting as of Postfix 2.9, so it may show up on distros in a yea

Re: SV: Strange Postfix error

2012-01-20 Thread Wietse Venema
Johan Andersson: > Hi > > Thanks for your answer. > > I don't think that's the answerbecause i haven't replaced > anything really (well, apart from replacing the binaries with a > copy of the ones that were already running). My reply was 100% about the consequences of replacing Postfix binar

Re: Restricting port 25 with cidr table

2012-01-20 Thread Reindl Harald
Am 20.01.2012 11:55, schrieb Charles Marcus: >> why are you not only opening from the allowed addresses in >> the packet-filter (iptables)? so you have no log-entries >> from spammers all over the world and any protection should >> generally happen as wide as possible before the service > > I a

Re: Stats on smtp method used by clients (with pflogsumm or not)

2012-01-20 Thread Nikolaos Milas
On 20/1/2012 4:47 μμ, James Seymour wrote: [snip] In the logging you will see postfix/smtps/smtpd, postfix/submission/smtpd and postfix/smtpd. [snip] Two things (addressed to the OP and other readers): 1. This will break Pflogsumm. It expects to see "postfix/smtpd" 2. (1) is easil

Re: Stats on smtp method used by clients (with pflogsumm or not)

2012-01-20 Thread James Seymour
On Fri, 20 Jan 2012 09:52:21 -0500 (EST) Wietse Venema wrote: > James Seymour: > > On Fri, 20 Jan 2012 08:15:35 -0500 (EST) > > Wietse Venema wrote: > > > > [snip] > > > > > > In the logging you will see postfix/smtps/smtpd, > > > postfix/submission/smtpd and postfix/smtpd. > > [snip] > > BTW

SV: SV: Strange Postfix error

2012-01-20 Thread Johan Andersson
Hi. The binaries used are compiled on a Solaris server and have been in use since September 21st last year without any problems until yesterday when they suddenly stopped working. I replaced them with the exact same binaries that was used when the server was upgraded on September 21st (didn't h

Re: Stats on smtp method used by clients (with pflogsumm or not)

2012-01-20 Thread Simon Brereton
On 20 January 2012 09:47, James Seymour wrote: > On Fri, 20 Jan 2012 08:15:35 -0500 (EST) > Wietse Venema wrote: > > [snip] >> >> In the logging you will see postfix/smtps/smtpd, >> postfix/submission/smtpd and postfix/smtpd. > [snip] > > Two things (addressed to the OP and other readers): > >  

Re: MTA hosted on cloud server

2012-01-20 Thread /dev/rob0
On Thu, Jan 19, 2012 at 09:16:34PM -0800, Ori Bani wrote: > I am evaluating a potential move of a mail server from a dedicated > server to a cloud-based server instance. I am trying to research > the cons (I am comfortable with the pros) of doing so. > > From what I can tell, we have to conside

Re: SV: SV: Strange Postfix error

2012-01-20 Thread Wietse Venema
Your symptoms indicate a mis-match between the IN-MEMORY master daemon process, and the ON-DISK executable files for smtpd, cleanup, etc. To fix, see the suggestion at the end of my first reply. This is my final response. Wietse

Re: reject_authenticated_sender_login_mismatch issue

2012-01-20 Thread /dev/rob0
On Fri, Jan 20, 2012 at 02:23:00PM +0100, Benny Pedersen wrote: > On Fri, 20 Jan 2012 11:28:08 +0400, Anton Raytsin wrote: > >How to fix it? > > > smtpd_sender_restrictions= > > reject_authenticated_sender_login_mismatch, > > permit_sasl_authenticated,. > > swap reject_authenticated_sender_lo

Re: Stats on smtp method used by clients (with pflogsumm or not)

2012-01-20 Thread James Seymour
On Fri, 20 Jan 2012 17:00:14 +0200 Nikolaos Milas wrote: [snip] > > Can you please at least provide directions on how to do the fix when > logging as "postfix/submission/smtpd"?? Quick fix is attached as "pflogsumm_quickfix.txt." There's no line numbers, as I'm working from the next rev, whic

Re: SV: SV: Strange Postfix error

2012-01-20 Thread Wietse Venema
Wietse Venema: > Your symptoms indicate a mis-match between the IN-MEMORY master > daemon process, and the ON-DISK executable files for smtpd, cleanup, > etc. Famous last words. This may be the result of a Linux "misfeature" where a pipe inode number goes over 32bit: http://bugs.debian.org/cgi-bi

Re: reject_authenticated_sender_login_mismatch issue

2012-01-20 Thread Benny Pedersen
On Fri, 20 Jan 2012 09:42:43 -0600, /dev/rob0 wrote: swap reject_authenticated_sender_login_mismatch and permit_sasl_authenticated Benny, the only thing that does is to ensure that the sender login mismatch check is never done, because all authenticated senders are permitted, regardless of wha

Re: MTA hosted on cloud server

2012-01-20 Thread Ori Bani
On Fri, Jan 20, 2012 at 7:19 AM, /dev/rob0 wrote: > On Thu, Jan 19, 2012 at 09:16:34PM -0800, Ori Bani wrote: >> I am evaluating a potential move of a mail server from a dedicated >> server to a cloud-based server instance.  I am trying to research >> the cons (I am comfortable with the pros) of d

Re: Restricting port 25 with cidr table

2012-01-20 Thread Nikolaos Milas
On 20/1/2012 3:24 μμ, Nikolaos Milas wrote: # reject all clients not matching anything above, and be damn sure # to comment out the last reject under recipient_restrictions # 0.0.0.0/0 reject unauthorized client, please use our MX You mean to remove "reject" from *smtpd_client_restric

Re: Restricting port 25 with cidr table

2012-01-20 Thread Wietse Venema
Nikolaos Milas: [ Charset UTF-8 unsupported, converting... ] > On 20/1/2012 3:24 ??, Nikolaos Milas wrote: > > >> # reject all clients not matching anything above, and be damn sure > >> # to comment out the last reject under recipient_restrictions > >> # > >> 0.0.0.0/0 reject unauthorized

could not find any active network interfaces (no IPv6)

2012-01-20 Thread Stefan Foerster
While testing something completely different, I noticed that a newly installed test machine didn't send any mail: Jan 20 11:45:27 vhrstest postfix/pickup[9992]: fatal: could not find any active network interfaces Jan 20 11:45:27 vhrstest postfix/master[12458]: warning: process /usr/lib/postfix/p

Re: could not find any active network interfaces (no IPv6)

2012-01-20 Thread Stefan Foerster
* Stefan Foerster : > While testing something completely different, I noticed that a newly > installed test machine didn't send any mail: > > Jan 20 11:45:27 vhrstest postfix/pickup[9992]: fatal: could not find any > active network interfaces > Jan 20 11:45:27 vhrstest postfix/master[12458]: warn

Re: could not find any active network interfaces (no IPv6)

2012-01-20 Thread Wietse Venema
Try using strace. See http://www.postfix.org/DEBUG_README.html Wietse

Re: Problem with SMTPs SSL_accept error | lost connection after CONNECT

2012-01-20 Thread Benny Pedersen
On Wed, 18 Jan 2012 16:44:14 -0600, Noel Jones wrote: Jan 18 18:20:54 newmail postfix/smtpd[83432]: lost connection after CONNECT from adsl-99-98-44-85.dsl.lsan03.sbcglobal.net[99.98.44.85] What would you advise me to further debug this ? CONNECT is a non SMTP protocol, are you running tor