Re: Delivery to command in aliases ignored ?

2013-03-27 Thread Kajetan Dolinar
Hi, Viktor, Thank you very much for your answer. I did run the command, as you suggested, but the result may be seen ... # postmap -q test hash:/var/lib/mailman/data/aliases "|/usr/lib/mailman/mail/mailman post test" this is exactly what i would like to have ... the delivery of mail intended fo

Re: dictionary-attack

2013-03-27 Thread Lima Union
On Tue, Mar 26, 2013 at 4:16 PM, Wietse Venema wrote: > Lima Union: > [ Charset ISO-8859-1 unsupported, converting... ] >> > Am 26.03.2013 19:36, schrieb Lima Union: >> >>> >> >> Wietse, ok, I'll disable the fqrdns check for now and check the chroot >> >> configuration after I return from holidays

Fw: Distributed Postfix

2013-03-27 Thread Gaby L
Thanks I have refered to split only postfix functions,but for it ,is need create coherent users system. For example if I create one user in gmail system,this user physical is stored only one central machine then is accesed through diverse distribute mechanism (same DNS),or is replicate in a

Re: dictionary-attack

2013-03-27 Thread Wietse Venema
Lima Union: > >> Mar 26 15:56:34 relay1 postfix/smtpd[2021]: warning: 64.191.105.74: > >> hostname 64-191-105-74.static.hostnoc.net verification failed: Name or > >> service not known > > > > Yes, broken DNS happens. Instead of reject_unknown_client_hostname > > you could use reject_unknown_reverse

Re: check_recipient_access, regexp and case sensitivity

2013-03-27 Thread Fabio Sangiovanni
Wietse Venema porcupine.org> writes: > > Viktor Dukhovni: > >src/smtpd/smtpd_resolve.c: > > lowercase(STR(reply->recipient)); /* XXX */ > > This may have escaped the code cleanup when forced lowercase > was removed from access maps. > > Wietse > > Thanks for your

Re: check_recipient_access, regexp and case sensitivity

2013-03-27 Thread Wietse Venema
Viktor Dukhovni: >src/smtpd/smtpd_resolve.c: > lowercase(STR(reply->recipient)); /* XXX */ Wietse Venema: > This may have escaped the code cleanup when forced lowercase > was removed from access maps. Fabio Sangiovanni: > Thanks for your answer, Wietse. Should we then expe

Re: dictionary-attack

2013-03-27 Thread Stan Hoeppner
On 3/27/2013 7:30 AM, Lima Union wrote: > Wietse, there's something I don't understand. I've commented out the > check_reverse_client_hostname_access, Re-enable it. > reloaded postfix and am still > finding those DNS warnings (ie: hostname > 77-121-229-206.dhcp.kram-city.net verification failed

Re: dictionary-attack

2013-03-27 Thread Stan Hoeppner
On 3/26/2013 1:29 PM, Lima Union wrote: > No ipv6 here and pdnsd is using 8.8.8.8 as DNS server. Instead of using a caching DNS proxy daemon querying Google's public DNS servers, I recommend you run a recursing caching resolver on your Postfix host, such as PowerDNS recursor (I've been using it f

Re: dictionary-attack

2013-03-27 Thread Matthew Hall
Hello, I ran into a bit of an issue trying out fqrdns.pcre as recommended here in this thread. The header in the file recommended adding it into smtpd_client_restrictions. However if I place it there, I end up rejecting mail even from SASL authenticated client devices, if they also match a rule in

AW: dictionary-attack

2013-03-27 Thread Uwe Drießen
Im Auftrag von Matthew Hall > Hello, > > I ran into a bit of an issue trying out fqrdns.pcre as recommended > here in this thread. The header in the file recommended adding it into > smtpd_client_restrictions. However if I place it there, I end up > rejecting mail even from SASL authenticated clie

Re: dictionary-attack

2013-03-27 Thread Noel Jones
On 3/27/2013 5:11 PM, Matthew Hall wrote: > Hello, > > I ran into a bit of an issue trying out fqrdns.pcre as recommended > here in this thread. The header in the file recommended adding it into > smtpd_client_restrictions. However if I place it there, I end up > rejecting mail even from SASL auth

Re: dictionary-attack

2013-03-27 Thread Stan Hoeppner
On 3/27/2013 5:11 PM, Matthew Hall wrote: > I ran into a bit of an issue trying out fqrdns.pcre as recommended > here in this thread. The header in the file recommended adding it into > smtpd_client_restrictions. The instructions I provide are examples, not a concise how-to. As with any restric

Re: dictionary-attack

2013-03-27 Thread /dev/rob0
On Wed, Mar 27, 2013 at 05:56:03PM -0500, Stan Hoeppner wrote: > Frankly I'm surprised anyone still uses the old multi-section > restrictions configuration these days. Sometimes it's necessary for complex restrictions, but I think the worst I've ever needed was 2-3 mumbles of smtpd_mumble_restri

Re: dictionary-attack

2013-03-27 Thread Stan Hoeppner
On 3/27/2013 5:39 PM, Noel Jones wrote: > One could argue the example included in the file should > be clearer I'm open to suggestions. As long as the doc section doesn't end up longer than the expression list. > (and it's missing the required '='). Fixed. Thanks for catching this oversight

Re: dictionary-attack

2013-03-27 Thread Matthew Hall
On Wed, Mar 27, 2013 at 3:56 PM, Stan Hoeppner wrote: > It seems pretty clear you need to convert to putting everything under > smtpd_recipient_restrictions. Makes things a lot easier. I give an > example of this in the instructions as well. Doing so gives you precise > control of restriction e

Re: dictionary-attack

2013-03-27 Thread Matthew Hall
I altered the restrictions according to the new advice: relay_restrictions - removed smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, reject_invalid_hostname, reject_non_fqdn_hostname, reject_non_fqdn_sender, rejec

Re: dictionary-attack

2013-03-27 Thread Noel Jones
On 3/27/2013 6:15 PM, Stan Hoeppner wrote: > On 3/27/2013 5:39 PM, Noel Jones wrote: > >> One could argue the example included in the file should >> be clearer > > I'm open to suggestions. As long as the doc section doesn't end up > longer than the expression list. I would suggest a fully-work

Re: dictionary-attack

2013-03-27 Thread Noel Jones
On 3/27/2013 7:07 PM, Matthew Hall wrote: > > smtpd_relay_restrictions = > permit_sasl_authenticated, > permit_mynetworks, > #check_reverse_client_hostname_access pcre:/etc/postfix/fqrdns.pcre, > reject_unauth_destination The above is wrong in two ways. First, anti-spam access li

Re: dictionary-attack

2013-03-27 Thread Noel Jones
On 3/27/2013 7:18 PM, Matthew Hall wrote: > I altered the restrictions according to the new advice: > > relay_restrictions - removed there's no reason to remove the safety net. smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated reject_unauth_destination Yes, these are

Re: compile and path

2013-03-27 Thread Mohsen Pahlevanzadeh
hi, sorry for late. i merged CCARGS as : / make -f Makefile.init makefiles 'CCARGS=-DHAS_MYSQL -I/usr/include/mysql/ -DUSE_SASL_AUTH -DDEF_SERVER_SASL_TYPE=\"dovecot\" -DUSE_TLS -I/usr/include/openssl/' 'AUXLIBS=-L/usr/lib64/mysql -L/usr/lib -lmysqlclient -lz -lm -lssl

Re: dictionary-attack

2013-03-27 Thread Matthew Hall
On Wed, Mar 27, 2013 at 7:20 PM, Noel Jones wrote: > On 3/27/2013 7:18 PM, Matthew Hall wrote: >> I altered the restrictions according to the new advice: >> >> relay_restrictions - removed > > there's no reason to remove the safety net. Makes sense. Corrected. > Your smtpd_recipient_restrictions

Re: dictionary-attack

2013-03-27 Thread Noel Jones
On 3/27/2013 10:07 PM, Matthew Hall wrote: > One other question here. So, if I have a host which matches > permit_sasl_authenticated, but also matches one of the rejections > present in check_reverse_client_hostname_access, but > permit_sasl_authenticated comes first in recipient_restrictions, then

link question

2013-03-27 Thread Mohsen Pahlevanzadeh
Dear all, i have 2 question about postfix links: 1. -ldl and -llber is needed for sasl and TLS? 2. i know -lm soname of mathmmetical or -lpthred is soname of POSIX thread. but i don't know about above links. you make me happy if decribe about them. --mohsen