Re: Best way to handle a Delivered-To exploit??

2012-11-05 Thread Reindl Harald
Am 05.11.2012 03:45, schrieb Brian Schang: > What is the best way to handle a problem like this? Right now I'm > soft_bouncing until I find a more permanent solution. The best I've > found on the net is to set up a header_check. Is this a good solution? > If so, are there any tricks in setting th

Re: Postfix Move Emails to TMP Queue Directory if recipent limit is more than 5

2012-11-05 Thread Prashanth P.Nair
Thanks for the advise. I found that we can achieve this using header_check . # restrict based on message header content header_checks = pcre:/etc/postfix/header_checks /etc/postfix/header_checks: /^To:([^@]*@){1,}/ HOLD Sorry, your message has too many recepients. /^Cc:([^@]*@){1,}/ H

Re: Postfix Move Emails to TMP Queue Directory if recipent limit is more than 5

2012-11-05 Thread Ralf Hildebrandt
* Prashanth P.Nair : > Thanks for the advise. > > I found that we can achieve this using header_check . > > # restrict based on message header content header_checks = > pcre:/etc/postfix/header_checks > > /etc/postfix/header_checks: > > /^To:([^@]*@){1,}/HOLD Sorry, your message has too man

Re: Technical question to Postfix

2012-11-05 Thread Christian Rößner
Hi, > Or use "reject_unverified_recipient", which uses a cache > of previous decisions so it won't hammer the mailbox server. thank you very much. Tested it and the solution is so simple and at the same time so powerful. I wonder that there are still many people not thinking about this solutio

Re: Postfix Move Emails to TMP Queue Directory if recipent limit is more than 5

2012-11-05 Thread /dev/rob0
On Mon, Nov 05, 2012 at 01:48:40PM +0100, Ralf Hildebrandt wrote: > * Prashanth P.Nair : > > I found that we can achieve this using header_check . > > > > # restrict based on message header content header_checks = > > pcre:/etc/postfix/header_checks > > > > /etc/postfix/header_checks: > > > > /^

Re: Postfix Move Emails to TMP Queue Directory if recipent limit is more than 5

2012-11-05 Thread Ralf Hildebrandt
* /dev/rob0 : > But what happens when some smartaleck uses an "@" sign in the RFC > 5322 "display-name" field, as I did, above? It will break. > Joe@work > Joe@home Amen to that. I've seen that even in the From: header! -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64 Franziskanerstraß

Re: Best way to handle a Delivered-To exploit??

2012-11-05 Thread Brian Schang
Hello: On 11/5/2012 5:18 AM, Reindl Harald wrote: > Am 05.11.2012 03:45, schrieb Brian Schang: >> What is the best way to handle a problem like this? Right now I'm >> soft_bouncing until I find a more permanent solution. The best I've >> found on the net is to set up a header_check. Is this a good

sender address rejected

2012-11-05 Thread James Chase
Could someone help me figure out which rule exactly is blocking this e-mail? We are trying to migrate a domain to another e-mail service and in the meantime the new service is sending mail from a domain that postfix accepts mail for. Whenever that migrating domain sends mail to a domain hosted on t

Re: sender address rejected

2012-11-05 Thread /dev/rob0
On Mon, Nov 05, 2012 at 09:57:58AM -0500, James Chase wrote: > Could someone help me figure out which rule exactly is blocking > this e-mail? It would have been easier if you had disclosed the contents of the various maps you are using, but I can surely narrow it down. > We are trying to migrat

Re: sender address rejected

2012-11-05 Thread Noel Jones
On 11/5/2012 8:57 AM, James Chase wrote: > Could someone help me figure out which rule exactly is blocking this > e-mail? We are trying to migrate a domain to another e-mail service > and in the meantime the new service is sending mail from a domain > that postfix accepts mail for. Whenever that mi

RE: sender address rejected

2012-11-05 Thread James Chase
> > and another > > > check_recipient_access > > pcre:/etc/postfix/MISC_CHECKS/ascii.pcre, check_sender_mx_access > > cidr:/etc/postfix/NETWORK_CHECKS/drop.cidr, check_policy_service > > inet:127.0.0.1:10023, check_helo_access > > pcre:/etc/postfix/NETWORK_CHECKS/helo_hostnames.pcre, > > pcre:/et

Re: sender address rejected

2012-11-05 Thread /dev/rob0
On Mon, Nov 05, 2012 at 11:14:43AM -0500, James Chase wrote: [attribution reconstructed] > > > James: > > rob0: > > and another > > > > > check_recipient_access > > > pcre:/etc/postfix/MISC_CHECKS/ascii.pcre, check_sender_mx_access > > > cidr:/etc/postfix/NETWORK_CHECKS/drop.cidr, check_policy_ser

Removing Amavis as a filter

2012-11-05 Thread The Doctor
All right. Amavis is beginning to anny me as a plugin: Big reason many a legit PDF is getting rejected and customers are yelling loud in stereo!! What must I do to remove Amavis from the postfix sequence without disrupting Postfix itself? -- Member - Liberal International This is doc...@nl2k.

RE: sender address rejected

2012-11-05 Thread James Chase
> -Original Message- > From: owner-postfix-us...@postfix.org [mailto:owner-postfix- > us...@postfix.org] On Behalf Of /dev/rob0 > Sent: Monday, November 05, 2012 11:47 AM > To: postfix-users@postfix.org > Subject: Re: sender address rejected > > On Mon, Nov 05, 2012 at 11:14:43AM -0500,

Re: Removing Amavis as a filter

2012-11-05 Thread Noel Jones
On 11/5/2012 11:38 AM, The Doctor wrote: > All right. > > Amavis is beginning to anny me as a plugin: > > Big reason many a legit PDF is getting rejected and customers are yelling > loud in stereo!! > > What must I do to remove Amavis from the postfix sequence without disrupting > Postfix itself

Re: Technical question to Postfix

2012-11-05 Thread Viktor Dukhovni
On Mon, Nov 05, 2012 at 02:11:56PM +0100, Christian R??ner wrote: > > Or use "reject_unverified_recipient", which uses a cache > > of previous decisions so it won't hammer the mailbox server. > > > thank you very much. Tested it and the solution is so simple and > at the same time so powerful. I

Re: Technical question to Postfix

2012-11-05 Thread Wietse Venema
Viktor Dukhovni: > On Mon, Nov 05, 2012 at 02:11:56PM +0100, Christian R??ner wrote: > > > > Or use "reject_unverified_recipient", which uses a cache > > > of previous decisions so it won't hammer the mailbox server. > > > > > > thank you very much. Tested it and the solution is so simple and >

Re: /var/log/mail.info

2012-11-05 Thread thorsopia
> You may want to invest some time in learning the basics of email and > system administration; this list is not the place for that. I'm willing to learn. I assume that the best way to learn is to configure my own mail server. Am I wrong? >> Should I follow this [1] advice: > No. What do you thi

Re: openssl (was: ESMTP: keys and passwords)

2012-11-05 Thread thorsopia
"Because you sign your own Postfix public key certificate, you get TLS encryption but no TLS authentication." [0] Could you explain the above? Does "TLS encryption" mean that all connections between my client machine and my server machine (and all data e.g. passwords, emails) will be encrypted?

Re: openssl

2012-11-05 Thread Reindl Harald
Am 05.11.2012 23:22, schrieb thorso...@lavabit.com: > "Because you sign your own Postfix public key certificate, you get TLS > encryption but no TLS authentication." [0] > > Could you explain the above? > > Does "TLS encryption" mean that all connections between my client > machine and my serve

Re: /var/log/mail.info

2012-11-05 Thread /dev/rob0
On Mon, Nov 05, 2012 at 05:18:23PM -0500, thorso...@lavabit.com wrote: > Jeroen: > > You may want to invest some time in learning the basics of email > > and system administration; this list is not the place for that. > > I'm willing to learn. I assume that the best way to learn is to > configure

Re: SMTP clients

2012-11-05 Thread Jeroen Geilman
On 11/05/2012 11:31 PM, Roman Gelfand wrote: I have setup postfix as mail gateway behind a firewall. There are 2 instances of smtpd. One for outgoing and the other for incoming. The outgoing smtpd is listening on non-standard port enforcing tls. Clearly, security is not as big of a concern for

Re: SMTP clients

2012-11-05 Thread Roman Gelfand
Is it a problem if I enforce tls from master.cf? Everything else, I have in place. I suppose, I could rate limit from the same ip, password attempts, etc... Thanks again On Mon, Nov 5, 2012 at 5:57 PM, Jeroen Geilman wrote: > On 11/05/2012 11:31 PM, Roman Gelfand wrote: >> >> I have setup post

Re: openssl (was: ESMTP: keys and passwords)

2012-11-05 Thread Wietse Venema
thorso...@lavabit.com: > "Because you sign your own Postfix public key certificate, you get TLS > encryption but no TLS authentication." [0] > > Could you explain the above? Assuming that you're referring to server certificates, the session will be TLS encrypted, but the client won't know if it i

Re: SMTP clients

2012-11-05 Thread Jeroen Geilman
On 11/06/2012 12:25 AM, Roman Gelfand wrote: Is it a problem if I enforce tls from master.cf? Rather the reverse: if you enforce TLS for all mail, you won't get any. Add -o smtpd_tls_security_level=encrypt (mandatory whitespace before -o, and no spaces around =) to your submission serv

Re: Best way to handle a Delivered-To exploit??

2012-11-05 Thread David Rees
On Sun, Nov 4, 2012 at 6:45 PM, Brian Schang wrote: > In the past week, my server has accepted dozens of emails that were not > deliverable. In all cases the issue has been a mail forwarding loop > which resulted in the email bouncing. Given that my configuration has > not changed in many months,

Re: Technical question to Postfix

2012-11-05 Thread Christian Rößner
Hi, >> Quick question: With Dovecot (or other LMTP servers) does this >> detect over-quota conditions? The Postfix verification probe does >> not send any message data, just "MAIL FROM", "RCPT TO" and then >> "RSET" + "QUIT" (or perhaps just "QUIT"). > > Postfix sends the message size in the MAIL

Re: Technical question to Postfix

2012-11-05 Thread Christian Rößner
Am 06.11.2012 um 08:31 schrieb Christian Rößner : > I also will test, if "sieve reject" is working the same way. If so, I can > enable this flag and give users a chance to reject unwanted mails in session. "reject" creates a new mail and sends it out. -Christian Rößner -- [*] sys4 AG http://