Re: problem, pass bad header thru amavis and dont quarantine them

2013-05-17 Thread Marko Weber | ZBF
Hi Patrick, Am 2013-05-17 00:20, schrieb Patrick Ben Koetter: Marko, * Marko Weber | ZBF : hello, i set in amavid.conf : $final_bad_header_destiny = D_PASS; but in logs i see this lines; May 16 23:22:11 mail amavis[15703]: (15703-13) Passed BAD-HEADER-1 {RelayedOpenRelay,Quarantined}, [***.*

Re: problem, pass bad header thru amavis and dont quarantine them

2013-05-17 Thread Marko Weber | ZBF
Hi Patrick, i did it like described in your blog. (bit changed for my structure) @local_domains_maps = ( ".$mydomain", read_hash('/etc/postfix/lookups/hash/virtual_domains_amavis') ); # list of all local domains # ### weber stop the result in logfile is now: May 17 09:57:05 mail amavis[15982

Re: Tweaking DNS timeouts

2013-05-17 Thread /dev/rob0
On Thu, May 16, 2013 at 07:48:24PM -0400, Wietse Venema wrote: > /dev/rob0: > > In the time since I've been running this, I saw the first thing > > that might be seen as a problem: dnsblog timing out on one of > > the DNSBL lookups: > > > > May 16 21:51:44 harrier postfix/postscreen[29502]: CONNEC

Re: Tweaking DNS timeouts

2013-05-17 Thread Viktor Dukhovni
On Fri, May 17, 2013 at 12:26:13PM -0500, /dev/rob0 wrote: > > Increasing the greet-wait to 10+ seconds could result in > > legitimate clients hanging up, so I would not recommend that. > > Do we have any testing to validate this? I'm pretty sure I recall > from a few years back on the old origi

Re: problem, pass bad header thru amavis and dont quarantine them

2013-05-17 Thread Patrick Ben Koetter
* Marko Weber | ZBF : > > Hi Patrick, > i did it like described in your blog. (bit changed for my structure) > > @local_domains_maps = ( > ".$mydomain", > read_hash('/etc/postfix/lookups/hash/virtual_domains_amavis') > ); # list of all local domains > # > ### weber stop > > the result in logfil

Re: virtual user (unknown user)

2013-05-17 Thread Benny Pedersen
postfi...@fuckaround.org skrev den 2013-05-16 14:10: fuckaround postfix/local[5595]: ADDFD758237: to=, relay=local, delay=0.06, delays=0.03/0.01/0/0.02, dsn=5.1.1, status=bounced (unknown user: "fred") useradd fred fred is not yet an unix user :=) -- senders that put my email into body cont

Re: Tweaking DNS timeouts

2013-05-17 Thread /dev/rob0
On Fri, May 17, 2013 at 05:53:47PM +, Viktor Dukhovni wrote: > On Fri, May 17, 2013 at 12:26:13PM -0500, /dev/rob0 wrote: > Wietse: > > > Increasing the greet-wait to 10+ seconds could result in > > > legitimate clients hanging up, so I would not recommend that. > > > > Do we have any testing

Re: Tweaking DNS timeouts

2013-05-17 Thread Wietse Venema
/dev/rob0: > > I guess this says that postscreen_dnsbl_action fires at the end of > the greet pause when postscreen_dnsbl_threshold is met, but > postscreen_dnsbl_whitelist_threshold is not calculated. Here's the [begin background material] I mis-understood how postscreen works (I do not cons

Re: postfix ssl errors in log, what does they mean?

2013-05-17 Thread Wietse Venema
Marko Weber | ZBF: > hello , > > i find many of these in my mail.log: > > May 16 14:27:33 mail opendkim[2926]: 119CA2FB20: s=dktest > d=porcupine.org SSL error:04091068:rsa routines:INT_RSA_VERIFY:bad > signature > > is my openssl broken or something else glitchy? or does this mean the > dkim

Re: postfix ssl errors in log, what does they mean?

2013-05-17 Thread Wietse Venema
Wietse Venema: > Marko Weber | ZBF: > > hello , > > > > i find many of these in my mail.log: > > > > May 16 14:27:33 mail opendkim[2926]: 119CA2FB20: s=dktest > > d=porcupine.org SSL error:04091068:rsa routines:INT_RSA_VERIFY:bad > > signature > > > > is my openssl broken or something else gli

Snapshot 20130517 (was: Tweaking DNS timeouts)

2013-05-17 Thread Wietse Venema
Wietse Venema: > I can change postscreen to also use partial scores for whitelisting > of non-DNS tests, and thereby make whitelisting of non-DNS tests > consistent with DNS-based blocking (that's one less WTF factor). > This requires minor code duplication. Released as

Re: Snapshot 20130517

2013-05-17 Thread /dev/rob0
s one > > less WTF factor). This requires minor code duplication. > > Released as snapshot 20130517. For testing I reenabled PSBL, and I'll see what comes in overnight. I thought I could make my own pseudo-DNSBL on a random IP address with blocked ports 53, but I need to set up a