Re: What am I missing

2012-12-21 Thread Reindl Harald
Am 21.12.2012 01:19, schrieb John Allen: > I am doing the admin work for a small group, about 30 people. > > While this setup works I have the feeling that I am missing something in the > Submission stanza of master.cf which > might leave me vulnerable and how do you imagine anybody can help y

Re: What am I missing from my Sunmission stanza in Master.

2012-12-21 Thread John Allen
On 21/12/2012 6:25 AM, Reindl Harald wrote: Am 21.12.2012 01:19, schrieb John Allen: I am doing the admin work for a small group, about 30 people. While this setup works I have the feeling that I am missing something in the Submission stanza of master.cf which might leave me vulnerable and h

Re: generating the TLS cert

2012-12-21 Thread Wietse Venema
Robert Moskowitz: > I was thinking about this, and what assurance does your CA provide for > the names in the certs it signs? It provides assurance that the certificate was signed by your CA. That is all. The rest is just a lot of wishful thinking that keeps techno-parasites in business.

Re: What am I missing from my Sunmission stanza in Master.

2012-12-21 Thread /dev/rob0
On Fri, Dec 21, 2012 at 06:52:21AM -0500, John Allen wrote: > On 21/12/2012 6:25 AM, Reindl Harald wrote: > >Am 21.12.2012 01:19, schrieb John Allen: > >>I am doing the admin work for a small group, about 30 people. > >> > >>While this setup works I have the feeling that I am missing > >>something

Re: generating the TLS cert

2012-12-21 Thread Jerry
On Fri, 21 Dec 2012 07:03:29 -0500 (EST) Wietse Venema articulated: > Robert Moskowitz: > > I was thinking about this, and what assurance does your CA provide > > for the names in the certs it signs? > > It provides assurance that the certificate was signed by your CA. > That is all. The rest is

Re: What am I missing from my Sunmission stanza in Master.

2012-12-21 Thread Reindl Harald
Am 21.12.2012 13:23, schrieb /dev/rob0: > On Fri, Dec 21, 2012 at 06:52:21AM -0500, John Allen wrote: >> On 21/12/2012 6:25 AM, Reindl Harald wrote: >>> Am 21.12.2012 01:19, schrieb John Allen: I am doing the admin work for a small group, about 30 people. While this setup works I h

Re: generating the TLS cert

2012-12-21 Thread Robert Moskowitz
On 12/21/2012 07:29 AM, Jerry wrote: On Fri, 21 Dec 2012 07:03:29 -0500 (EST) Wietse Venema articulated: Robert Moskowitz: I was thinking about this, and what assurance does your CA provide for the names in the certs it signs? It provides assurance that the certificate was signed by your CA.

Re: Most users local, some users (same domain) rerouted via transport

2012-12-21 Thread Ignacio Vazquez
2012/12/20 Viktor Dukhovni : > Instead of resolving an unmodified rfc822 address to a different > transport:nexthop, rewrite the rfc822 address (via virtual_alias_maps) > to a domain which is routed (via MX records or per-nexthop transport > table entries) to that transport:nexthop. I've test this

RE: body_check and content filtering

2012-12-21 Thread Jim Nalepa - US
Viktor, Thanks, but can you or anyone else show an example or anything that would actually help me obtain that functionality? I know the BCC is not a supported ACTION in body_checks, but is there a non-trivial work around? Jim -Original Message- From: owner-postfix-us...@post

Re: Most users local, some users (same domain) rerouted via transport

2012-12-21 Thread Ignacio Vazquez
Just for the record I found a workaround that makes not mandatory specifying the remote users. It's a kind of a mixture local/virtual: mydomain = example.com mydestination = $myhostname localhost.$mydomain localhost $mydomain transport_maps = hash:/etc/postfix/transport local_recipient_maps = $tran

Re: Most users local, some users (same domain) rerouted via transport

2012-12-21 Thread Wietse Venema
Ignacio Vazquez: > transport_maps = hash:/etc/postfix/transport > local_recipient_maps = $transport_maps, $virtual_mailbox_maps, > $alias_maps, $alias_database By design, transport maps decide how Postfix should DELIVER a recipient. By design, transport maps do not decide what recipients Postfix

Re: body_check and content filtering

2012-12-21 Thread Wietse Venema
Jim Nalepa - US: > Viktor, > Thanks, but can you or anyone else show an example or > anything that would actually help me obtain that > functionality? I know the BCC is not a supported ACTION > in body_checks, but is there a non-trivial work around? 1) Use an exte

Re: Most users local, some users (same domain) rerouted via transport

2012-12-21 Thread Viktor Dukhovni
On Fri, Dec 21, 2012 at 02:55:39PM +0100, Ignacio Vazquez wrote: > Just for the record I found a workaround that makes not mandatory > specifying the remote users. It's a kind of a mixture local/virtual: > transport_maps = hash:/etc/postfix/transport > local_recipient_maps = $transport_maps, $vir

Re: postfwd, ratelimiting and whitelisting questions

2012-12-21 Thread Rich Bishop
I recently implemented postfwd here to help with our smtp-auth spammer problems. On 12/21/2012 05:28 AM, Miha Valencic wrote: Hi! I sent similar mail to postfwd mailing list as well, but it seems that the list is very slow, and I could not find any archives on the net as well. With regards to

VERP Sanity Check

2012-12-21 Thread Sam Jones
Good afternoon List Members, I'm having a bit of a problem getting VERP to work on my multi-instance Postfix. I'm probably missing a step. I've checked I have PCRE available, and that they work. I've set up everything as per http://www.postfix.org/VERP_README.html. MAPS /^(MAIL FROM:<.+@munged1\

Re: VERP Sanity Check

2012-12-21 Thread Viktor Dukhovni
On Fri, Dec 21, 2012 at 04:12:11PM +, Sam Jones wrote: > I've checked I have PCRE available, and that they work. I've set up > everything as per http://www.postfix.org/VERP_README.html. See: http://www.postfix.org/VERP_README.html#config You likely forgot to set: smtpd_authorized_ve

Re: [Bulk] Re: VERP Sanity Check

2012-12-21 Thread Sam Jones
Thank you Viktor - that is exactly it. I assumed it was an option but when I read further that was incorrect. It is now working just as intended. Thank you very much for taking the time to look at my post and reply. I am very grateful for your time. Kind regards and happy holidays. Sam On Fri, 2

smtpd error sleep time

2012-12-21 Thread motty cruz
Hello, I have the following in my configuration but does not seem to make any difference on the connection errors I see in the logs smtpd_error_sleep_time=1h smtpd_soft_error_limit=10 smtpd_hard_error_limit=20 log: Dec 21 09:22:53 mas postfix/smtpd[23941]: connect from unknown[186.81.31.93] Dec

Re: smtpd error sleep time

2012-12-21 Thread Reindl Harald
Am 21.12.2012 18:25, schrieb motty cruz: > Hello, > I have the following in my configuration but does not seem to make any > difference on the connection errors I see in > the logs > > smtpd_error_sleep_time=1h > smtpd_soft_error_limit=10 > smtpd_hard_error_limit=20 > > log: > Dec 21 09:22:53

Re: smtpd error sleep time

2012-12-21 Thread Reindl Harald
DO NOT REPLY OFF-LIST AND TOP-POST ON MAILING LISTS Am 21.12.2012 18:56, schrieb motty cruz: > Hello Reindl, > thanks for your prompt reply and I apologize for not being specific, the IP > address is a spammer and after too many > network connection errors Postfix should refuse connections but it

better way to rewrite sender address -- how?

2012-12-21 Thread Hleb Valoshka
Hallo! I want to change addresses like login@host.domain to Name.Surname@domain. It looks like job for sender_canonical_maps + masquerading, but it doesn't work like I want because masquerading is applied _after_ canonical mappings. I also know about other ways to do that but they looks like dir

Re: smtpd error sleep time

2012-12-21 Thread Noel Jones
On 12/21/2012 11:25 AM, motty cruz wrote: > Hello, > I have the following in my configuration but does not seem to make > any difference on the connection errors I see in the logs > > smtpd_error_sleep_time=1h The above is a good way to DoS yourself. Error sleep time should be 0s or 1s, never m

Re: smtpd error sleep time

2012-12-21 Thread motty cruz
Thank you very much! you explaining very well! I will close my eyes in this case. Thanks very much again! -Motty On Fri, Dec 21, 2012 at 10:07 AM, Noel Jones wrote: > On 12/21/2012 11:25 AM, motty cruz wrote: > > Hello, > > I have the following in my configuration but does not seem to make > >

Re: better way to rewrite sender address -- how?

2012-12-21 Thread Viktor Dukhovni
On Fri, Dec 21, 2012 at 08:07:00PM +0200, Hleb Valoshka wrote: > I want to change addresses like login@host.domain to Name.Surname@domain. > > It looks like job for sender_canonical_maps + masquerading, but it > doesn't work like I want because masquerading is applied _after_ > canonical mappings

Re: better way to rewrite sender address -- how?

2012-12-21 Thread Hleb Valoshka
On 12/21/12, Viktor Dukhovni wrote: > You're not missing much. Another option is to apply masquerading > before the content filter, and canonical rewriting after if your > MTA is already doing content_filter (say anti-virus, ...) inspection. Oh, yes. But I don't use content filtering. > I don't

postconf expansion

2012-12-21 Thread Wietse Venema
Viktor Dukhovni: > I've not looked too closely at what it would take for "postconf" > to be able to perform fully recursive parameter expansion. It is > apparently a bit tricky (from past conversations with Wietse). It > would be useful however. I restructured the postconf code 12 months ago, to a

Re: better way to rewrite sender address -- how?

2012-12-21 Thread Noel Jones
On 12/21/2012 1:15 PM, Hleb Valoshka wrote: > On 12/21/12, Viktor Dukhovni wrote: > >> You're not missing much. Another option is to apply masquerading >> before the content filter, and canonical rewriting after if your >> MTA is already doing content_filter (say anti-virus, ...) inspection. > >

Re: better way to rewrite sender address -- how?

2012-12-21 Thread Wietse Venema
Hleb Valoshka: > My patch is very small it's only few LOC (I like the way postfix is > written) and reodering is disabled by default so it won't require much > efforts to maintain it. I hope Wietse will be interesting in it :) The cleanup daemon supports multiple address transformations. Like (to

Re: postconf expansion

2012-12-21 Thread Viktor Dukhovni
On Fri, Dec 21, 2012 at 03:10:11PM -0500, Wietse Venema wrote: > Viktor Dukhovni: > > I've not looked too closely at what it would take for "postconf" > > to be able to perform fully recursive parameter expansion. It is > > apparently a bit tricky (from past conversations with Wietse). It > > woul

Re: postconf expansion

2012-12-21 Thread Simon Brereton
On Dec 21, 2012 6:13 PM, "Viktor Dukhovni" wrote: > > On Fri, Dec 21, 2012 at 03:10:11PM -0500, Wietse Venema wrote: > > > Viktor Dukhovni: > > > I've not looked too closely at what it would take for "postconf" > > > to be able to perform fully recursive parameter expansion. It is > > > apparently