TLS Question, untrusted connection

2013-03-26 Thread Marko Weber | ZBF
i sometimes mail with the deutschebank. when i send mails i use a tls_policy_map: db.com secure match=loninmrp23.uk.db.com:nyjinsmp07.us.db.com:loninmrp22.uk.db.com:loninmrp14.uk.db.com:nyginsmp02.us.db.com:nyjinsmp01.us.db.com .db.com secure match=loninmrp23.uk.db.com:nyjinsmp07.us.db.com

Re: Dont add the $myorigin domain to the FROM header field

2013-03-26 Thread Marko Weber | ZBF
Am 2013-03-22 18:50, schrieb Noel Jones: On 3/22/2013 11:44 AM, Victor d'Agostino wrote: Hi all, I use postfix as relay server to several internal domains. xxx is the main one. postconfig | grep domain prints : append_dot_mydomain = no mydomain = xxx myorigin = $mydomain relay_domains = $my

Re: TLS Question, untrusted connection

2013-03-26 Thread Reindl Harald
Am 26.03.2013 09:44, schrieb Marko Weber|ZBF: > Mar 25 14:04:35 mail postfix/smtpd[31103]: Untrusted TLS connection > established from > loninmrp15.uk.db.com[160.83.44.131]: TLSv1 with cipher DHE-RSA-AES256-SHA > (256/256 bits) > > why is on incoming mails the TLS connection untrusted? http:/

Re: check_recipient_access, regexp and case sensitivity

2013-03-26 Thread Fabio Sangiovanni
Viktor Dukhovni dukhovni.org> writes: > > On Mon, Mar 25, 2013 at 05:44:45PM +0100, Fabio Sangiovanni wrote: > > > $ postmap -q 'test domain.tld' \ > > regexp:/etc/postfix/check_recipient_access.regexp > > REJECT wrong format > > > > while: > > $ postmap -q 'tEsT domain.tld' \ > > re

Re: TLS Question, untrusted connection

2013-03-26 Thread Marko Weber | ZBF
Am 2013-03-26 10:30, schrieb Reindl Harald: Am 26.03.2013 09:44, schrieb Marko Weber|ZBF: Mar 25 14:04:35 mail postfix/smtpd[31103]: Untrusted TLS connection established from loninmrp15.uk.db.com[160.83.44.131]: TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits) why is on incoming mails th

Re: TLS Question, untrusted connection

2013-03-26 Thread Reindl Harald
Am 26.03.2013 10:53, schrieb Marko Weber|ZBF: > > > Am 2013-03-26 10:30, schrieb Reindl Harald: >> Am 26.03.2013 09:44, schrieb Marko Weber|ZBF: >>> Mar 25 14:04:35 mail postfix/smtpd[31103]: Untrusted TLS connection >>> established from >>> loninmrp15.uk.db.com[160.83.44.131]: TLSv1 with ciph

Re: TLS Question, untrusted connection

2013-03-26 Thread Simon Brereton
On 26 March 2013 10:53, Marko Weber | ZBF wrote: > > > Am 2013-03-26 10:30, schrieb Reindl Harald: >> >> Am 26.03.2013 09:44, schrieb Marko Weber|ZBF: >>> >>> Mar 25 14:04:35 mail postfix/smtpd[31103]: Untrusted TLS connection >>> established from >>> loninmrp15.uk.db.com[160.83.44.131]: TLSv1 wit

Distributed Postfix

2013-03-26 Thread Gaby L
Hi My teoretic question is how configure multiple (distributed) postfix mail servers for one domain,which can load balance tasks? (e.g gmail),but all servers same (unique) users list,alias,rules for one domain? Thanks gaby

Re: Dont add the $myorigin domain to the FROM header field

2013-03-26 Thread Wietse Venema
Marko Weber | ZBF: > > http://www.postfix.org/ADDRESS_REWRITING_README.html#william > > http://www.postfix.org/postconf.5.html#remote_header_rewrite_domain > > > > When you're using a content_filter, it's often useful to set: > > # main.cf > > remote_header_rewrite_domain = domain.invalid > > Wha

Re: dictionary-attack

2013-03-26 Thread Lima Union
On Mon, Mar 25, 2013 at 10:52 AM, Noel Jones wrote: > On 3/25/2013 7:55 AM, Lima Union wrote: >> On Sat, Mar 23, 2013 at 11:31 AM, Benny Pedersen wrote: >>> Ejaz skrev den 2013-03-23 11:49: >>> > ... >>> >>> are you missing http://www.hardwarefreak.com/fqrdns.pcre ? :) >> >> very interesting link

Re: Distributed Postfix

2013-03-26 Thread Wietse Venema
Gaby L: > Hi > My teoretic question is how configure multiple (distributed) > postfix mail servers for one domain,which can load balance tasks? Multiple DNS MX records, multiple DNS A records, or a TCP-level load balancer. > but all servers same (unique) users list,alias,rules > for one d

Re: Distributed Postfix

2013-03-26 Thread Victor d'Agostino
2013/3/26 Gaby L > ** > > > > Hi > My teoretic question is how configure multiple (distributed) postfix > mail servers for one domain,which can load balance tasks? (e.g gmail),but > all servers same (unique) users list,alias,rules for one domain? > > Thanks > gaby > > Hi, First, you can easil

Re: Distributed Postfix

2013-03-26 Thread Victor d'Agostino
see attachment 2013/3/26 Victor d'Agostino > 2013/3/26 Gaby L > >> ** >> >> >> >> Hi >> My teoretic question is how configure multiple (distributed) postfix >> mail servers for one domain,which can load balance tasks? (e.g gmail),but >> all servers same (unique) users list,alias,rules for one

Re: Distributed Postfix

2013-03-26 Thread Bill Cole
On 26 Mar 2013, at 6:51, Gaby L wrote: Hi My teoretic question is how configure multiple (distributed) postfix mail servers for one domain,which can load balance tasks? (e.g gmail),but all servers same (unique) users list,alias,rules for one domain? As Dr. Venema's answer implies, splitting

Re: dictionary-attack

2013-03-26 Thread Noel Jones
On 3/26/2013 7:04 AM, Lima Union wrote: > On Mon, Mar 25, 2013 at 10:52 AM, Noel Jones wrote: >> On 3/25/2013 7:55 AM, Lima Union wrote: >>> On Sat, Mar 23, 2013 at 11:31 AM, Benny Pedersen wrote: Ejaz skrev den 2013-03-23 11:49: >> ... are you missing http://www.hardwarefreak

Re: dictionary-attack

2013-03-26 Thread Stan Hoeppner
On 3/26/2013 7:04 AM, Lima Union wrote: ... > ok, it seems that for some reason the check is not being triggered > (#847) after a postfix reload and 24 hours of operation in a busy > server, any ideas? So when you grep "Please relay via ISP" against your mail log you get nothing? Do you have any

Re: TLS Question, untrusted connection

2013-03-26 Thread Viktor Dukhovni
On Tue, Mar 26, 2013 at 09:44:12AM +0100, Marko Weber | ZBF wrote: > Mar 22 10:34:52 mail postfix/smtp[13970]: > smtp2.db.com[160.83.77.178]:25: Matched subjectAltName: > nyginsmp02.us.db.com > Mar 22 10:34:52 mail postfix/smtp[13970]: > smtp2.db.com[160.83.77.178]:25 CommonName nyginsmp02.us.db.c

Re: dictionary-attack

2013-03-26 Thread Lima Union
On Tue, Mar 26, 2013 at 1:17 PM, Stan Hoeppner wrote: > On 3/26/2013 7:04 AM, Lima Union wrote: > ... >> ok, it seems that for some reason the check is not being triggered >> (#847) after a postfix reload and 24 hours of operation in a busy >> server, any ideas? > > So when you grep "Please relay

Re: check_recipient_access, regexp and case sensitivity

2013-03-26 Thread Viktor Dukhovni
On Tue, Mar 26, 2013 at 09:35:40AM +, Fabio Sangiovanni wrote: > > > This behaviour is correct, but I can't get it using the restriction > > > in postfix. > > > > The Postfix table layer is at the mercy of any upstream rewriting. > > Are you sure your input address is not mapped to lower case

Re: dictionary-attack

2013-03-26 Thread Benny Pedersen
Lima Union skrev den 2013-03-26 13:04: 853 #reject_unverified_recipient, postconf -n not just content listning from main.cf your error might just be that you have # at random lines

Re: dictionary-attack

2013-03-26 Thread Benny Pedersen
Lima Union skrev den 2013-03-26 18:59: what can I check? dig +trace ipv4.google.com are the trace with hostnames all places ? if you are on ipv6 change ipv4 to ipv6 are you using forwarders that does not support dnssec ? is it working if you use nameserver 8.8.8.8 in resolv.conf ?

Re: dictionary-attack

2013-03-26 Thread Wietse Venema
Lima Union: > working. This MTA is behing a firewall, in a DMZ with a bidirectional > mapping (1:1). I issued a grep ': connect from' and everything shown > is 'connect from unknown[ip.add.re.ss]'. I'm using pdnsd for caching > purposes. My resolv.conf points to 127.0.0.1 and seems to be working >

Re: dictionary-attack

2013-03-26 Thread Lima Union
On Tue, Mar 26, 2013 at 3:14 PM, Benny Pedersen wrote: > Lima Union skrev den 2013-03-26 13:04: >> >>853 #reject_unverified_recipient, > > > postconf -n > > not just content listning from main.cf > > your error might just be that you have # at random lines ok, here it's (hostname/ip

Re: dictionary-attack

2013-03-26 Thread Lima Union
On Tue, Mar 26, 2013 at 3:20 PM, Benny Pedersen wrote: > Lima Union skrev den 2013-03-26 18:59: >> >> what can I check? > > > dig +trace ipv4.google.com > > are the trace with hostnames all places ? > > if you are on ipv6 change ipv4 to ipv6 > > are you using forwarders that does not support dnsse

Re: dictionary-attack

2013-03-26 Thread Lima Union
On Tue, Mar 26, 2013 at 3:21 PM, Wietse Venema wrote: > Lima Union: >> working. This MTA is behing a firewall, in a DMZ with a bidirectional >> mapping (1:1). I issued a grep ': connect from' and everything shown >> is 'connect from unknown[ip.add.re.ss]'. I'm using pdnsd for caching >> purposes.

Re: dictionary-attack

2013-03-26 Thread Reindl Harald
Am 26.03.2013 19:36, schrieb Lima Union: > On Tue, Mar 26, 2013 at 3:21 PM, Wietse Venema wrote: >> A common mistake is to turn on chroot operation in the master.cf >> file without going through all the necessary steps to set up a >> chroot environment. This causes Postfix daemon processes to fa

Re: dictionary-attack

2013-03-26 Thread Lima Union
> Am 26.03.2013 19:36, schrieb Lima Union: >>> >> Wietse, ok, I'll disable the fqrdns check for now and check the chroot >> configuration after I return from holidays > > this is ONE char in the master.cf and if i where you i > would not make holidays as long a production server is > known misconfi

Re: dictionary-attack

2013-03-26 Thread Wietse Venema
Lima Union: [ Charset ISO-8859-1 unsupported, converting... ] > > Am 26.03.2013 19:36, schrieb Lima Union: > >>> > >> Wietse, ok, I'll disable the fqrdns check for now and check the chroot > >> configuration after I return from holidays > > > > this is ONE char in the master.cf and if i where you i

Re: check_recipient_access, regexp and case sensitivity

2013-03-26 Thread Fabio Sangiovanni
Viktor Dukhovni dukhovni.org> writes: > Sorry, I don't do pastebins. If you want help include the relevant > information in your message. Relevant (long piece of) information included at the end of this message :) > Addresses used in access checks are case folded in Postfix upstream > of the

Re: check_recipient_access, regexp and case sensitivity

2013-03-26 Thread Viktor Dukhovni
On Tue, Mar 26, 2013 at 08:25:43PM +0100, Fabio Sangiovanni wrote: > > Addresses used in access checks are case folded in Postfix upstream > > of the access table. The original address goes into the queue file, > > but access checks use case folded addresses. > > Is it maybe the case to update t

Re: check_recipient_access, regexp and case sensitivity

2013-03-26 Thread Wietse Venema
Viktor Dukhovni: >src/smtpd/smtpd_resolve.c: > lowercase(STR(reply->recipient)); /* XXX */ This may have escaped the code cleanup when forced lowercase was removed from access maps. Wietse

Vaction for Virtual Domains?

2013-03-26 Thread craig . postfix
Hi, Product: postfix-2.6.6-2.2.el6_1.x86_64 We used to use the old vacation package for ages http://sourceforge.net/projects/vacation/. However since moving to virtual domains, I've had to move away from this product (as virtual domains don't support .forward files). Has anyone else found a so

Re: Vaction for Virtual Domains?

2013-03-26 Thread Reindl Harald
Am 27.03.2013 00:03, schrieb craig.post...@noboost.org: > Product: > postfix-2.6.6-2.2.el6_1.x86_64 > > > We used to use the old vacation package for ages > http://sourceforge.net/projects/vacation/. However since moving to > virtual domains, I've had to move away from this product (as virtual

Delivery to command in aliases ignored ?

2013-03-26 Thread Kajetan Dolinar
Greetings to everyone, I have a working Postfix + Cyrus system tested (has got some history of usage) but I want to add the Mailman system to it. However, it seems that I cannot get mail through to the Mailman system past the Mailman's aliases, i.e. the delivery to commands which Mailman uses to p

Re: Delivery to command in aliases ignored ?

2013-03-26 Thread Viktor Dukhovni
On Wed, Mar 27, 2013 at 12:26:36AM +0100, Kajetan Dolinar wrote: > Greetings to everyone, > > I have a working Postfix + Cyrus system tested (has got some history of > usage) but I want to add the Mailman system to it. However, it seems that I > cannot get mail through to the Mailman system past