Re: smtp restrictions

2013-05-31 Thread Mikael Bak
Stan, On 05/31/2013 08:49 AM, Stan Hoeppner wrote: > On 5/30/2013 11:43 PM, James Zee wrote: >> I was hoping someone could take a quick glance at my >> smtpd_*_restrictions configurations. While I've read and (re-)read the >> SMTPD_ACCESS_README file a few times over I would be greatly >> apprecia

Re: smtp restrictions

2013-05-31 Thread Stan Hoeppner
On 5/31/2013 4:09 AM, Mikael Bak wrote: > Stan, > > On 05/31/2013 08:49 AM, Stan Hoeppner wrote: >> On 5/30/2013 11:43 PM, James Zee wrote: >>> I was hoping someone could take a quick glance at my >>> smtpd_*_restrictions configurations. While I've read and (re-)read the >>> SMTPD_ACCESS_README fi

Re: smtp restrictions

2013-05-31 Thread Charles Marcus
On 2013-05-31 6:04 AM, Stan Hoeppner wrote: "It is a waste of everyone's time including the poster and readers to go spell check main.cf files on the mailing list." Wietse Venema 12/09/2010 Stan, I certainly don't read that as saying people cannot ask for a sanity check on their current con

Problems with OpenSSL 1.0.1c - WAS: Re: ssl errors in log. error on remote or local side?

2013-05-31 Thread Charles Marcus
On 2013-05-22 1:45 PM, Quanah Gibson-Mount wrote: I would read the CHANGES file shipped with OpenSSL. They didn't document the changes between 1.0.1d and 1.0.1e, but you can see the changes between 1.0.1c and 1.0.1d. I read them, but nothing jumped out at me (didn't see anything significan

Re: postscreen and Google

2013-05-31 Thread Wietse Venema
LuKreme: > > Don't enable the "after 220" tests, or wait until whitelisting > > is stable. Given that Google has many servers, manual whitelisting > > is not a long-term solution. > > After looking at my log files I?ve disabled all the ?after 220? > test for now. Looking forward to the stable whit

Re: smtp restrictions

2013-05-31 Thread /dev/rob0
On Fri, May 31, 2013 at 12:43:51AM -0400, James Zee wrote: > I was hoping someone could take a quick glance at my > smtpd_*_restrictions configurations. While I've read and (re-)read the > SMTPD_ACCESS_README file a few times over I would be greatly > appreciative if someone could sanity check my w

Re: Timeouts sending to a particular server

2013-05-31 Thread Nikolaos Milas
On 30/5/2013 11:17 πμ, Ralf Hildebrandt wrote: I usually disable ESMTP when encountering those problems: transport_maps: cospico.gr noesmtp: noesmtp being defined in master.cf as: noesmtp unix - - - - - smtp -o smtp_never_send_ehlo=yes -o smtp_always_send_ehlo=no Thank you Wietse and Ralf f

Re: Timeouts sending to a particular server

2013-05-31 Thread Viktor Dukhovni
On Fri, May 31, 2013 at 03:49:44PM +0300, Nikolaos Milas wrote: > On 30/5/2013 11:17 ??, Ralf Hildebrandt wrote: > > >I usually disable ESMTP when encountering those problems: > >transport_maps: cospico.gr noesmtp: noesmtp being defined in > >master.cf as: noesmtp unix - - - - - smtp -o > >smtp_n

List rules (was: smtp restrictions)

2013-05-31 Thread Wietse Venema
Stan Hoeppner: > What I stated above is Wietse's policy: > > "It is a waste of everyone's time including the poster and readers > to go spell check main.cf files on the mailing list." To place the quote in context: Stan: > This is exactly why I wanted to see your main.cf. It's a total > mess.

Re: smtp restrictions

2013-05-31 Thread James Zee
On Fri, May 31, 2013 at 8:09 AM, /dev/rob0 wrote: > On Fri, May 31, 2013 at 12:43:51AM -0400, James Zee wrote: >> I was hoping someone could take a quick glance at my >> smtpd_*_restrictions configurations. While I've read and (re-)read the >> SMTPD_ACCESS_README file a few times over I would be g

Re: Virtual User Aliases

2013-05-31 Thread Simon B
On 30 May 2013 22:44, Wietse Venema wrote: > Simon B: >> That's what I thought. I did your suggestion and postfix did not >> complain. Not doing postfix stop/start or even /etc/init.d/postfix >> start/stop.. >> >> So, now I'm stumped. There are other master.cf on the system, but I'm >> pretty s

upgrade concerns

2013-05-31 Thread Dean Guenther
This week I upgraded postfix from a RHEL 3 box to a new install with CentOS 6.2 and Postfix 2.6.6 and Dovecot 2.0.9 Most things are working (logging in, sending mail, etc). But I'm having some issues receiving mail. But not all accounts are having this trouble. My setup is that I have /home moun

Re: upgrade concerns

2013-05-31 Thread Brian Evans
On 5/31/2013 12:51 PM, Dean Guenther wrote: I suspect I'm just missing something when converting from the earlier postfix to the newer postfix (and dovecot). Why am I getting these tmp and new files under /home/user/mail? This is a sign you are saving in maildir format. Its probably not relat

Is the absence of "smtpd_relay_restrictions" directive in Postfix versions >= 2.10 a security risk in some default configurations?

2013-05-31 Thread Ben Johnson
I seem to be able to setup a desktop email client and send email to my server, from any external network, and the email will be accepted for delivery as long as a) the sender uses any "from address" ("local part") @my.real-domain.com, and b) the recipient has a mailbox @my.real-domain.com. The onl

Re: upgrade concerns

2013-05-31 Thread Dean Guenther
Thanks Brian!!! Commenting out home_mailbox took care of the problem. I appreciate the help -- Dean On Fri, 2013-05-31 at 13:21 -0400, Brian Evans wrote: > On 5/31/2013 12:51 PM, Dean Guenther wrote: > > I suspect I'm just missing something when converting from the earlier > > postfix to the new

Re: Is the absence of "smtpd_relay_restrictions" directive in Postfix versions >= 2.10 a security risk in some default configurations?

2013-05-31 Thread Noel Jones
On 5/31/2013 12:22 PM, Ben Johnson wrote: > I seem to be able to setup a desktop email client and send email to my > server, from any external network, and the email will be accepted for > delivery as long as a) the sender uses any "from address" ("local part") > @my.real-domain.com, and b) the rec

Re: Virtual User Aliases

2013-05-31 Thread Wietse Venema
Simon B: > On 30 May 2013 22:44, Wietse Venema wrote: > > Simon B: > >> That's what I thought. I did your suggestion and postfix did not > >> complain. Not doing postfix stop/start or even /etc/init.d/postfix > >> start/stop.. > >> > >> So, now I'm stumped. There are other master.cf on the syst

Re: Virtual User Aliases

2013-05-31 Thread Viktor Dukhovni
On Fri, May 31, 2013 at 06:46:50PM +0200, Simon B wrote: > smtp inet n - - - - smtpd -v >-o receive_override_options= > cleanup unix n - - - 0 cleanup -v > > #Stop Postfix from cleaning emails before sending to amavis > pre-

Re: Is the absence of "smtpd_relay_restrictions" directive in Postfix versions >= 2.10 a security risk in some default configurations?

2013-05-31 Thread Ben Johnson
On 5/31/2013 2:39 PM, Noel Jones wrote: > On 5/31/2013 12:22 PM, Ben Johnson wrote: >> I seem to be able to setup a desktop email client and send email to my >> server, from any external network, and the email will be accepted for >> delivery as long as a) the sender uses any "from address" ("loc

Re: Virtual User Aliases

2013-05-31 Thread Simon B
On 31 May 2013 21:07, "Viktor Dukhovni" wrote: > > On Fri, May 31, 2013 at 06:46:50PM +0200, Simon B wrote: > > > smtp inet n - - - - smtpd -v > >-o receive_override_options= > > cleanup unix n - - - 0 cleanup -v > > > > #Sto

Re: Is the absence of "smtpd_relay_restrictions" directive in Postfix versions >= 2.10 a security risk in some default configurations?

2013-05-31 Thread Noel Jones
On 5/31/2013 2:06 PM, Ben Johnson wrote: > Okay. I understand. The implication here is that it doesn't matter > whether the user-agent connects directly to my server via SMTP to > delivery mail to my users, or he connects through his ISP's SMTP server > to do the same. Correct? Correct. By defaul

Re: Is the absence of "smtpd_relay_restrictions" directive in Postfix versions >= 2.10 a security risk in some default configurations?

2013-05-31 Thread /dev/rob0
On Fri, May 31, 2013 at 03:06:38PM -0400, Ben Johnson wrote: > On 5/31/2013 2:39 PM, Noel Jones wrote: > > On 5/31/2013 12:22 PM, Ben Johnson wrote: > >> Postfix "postfinger" output for this server (prior to closing > >> this "hole"): > >> > >> http://pastebin.com/QGE3cah5 > > > > ... mail_versio

Re: Is the absence of "smtpd_relay_restrictions" directive in Postfix versions >= 2.10 a security risk in some default configurations?

2013-05-31 Thread Ben Johnson
On 5/31/2013 3:52 PM, Noel Jones wrote: > On 5/31/2013 2:06 PM, Ben Johnson wrote: > >> Okay. I understand. The implication here is that it doesn't matter >> whether the user-agent connects directly to my server via SMTP to >> delivery mail to my users, or he connects through his ISP's SMTP serv

Re: Is the absence of "smtpd_relay_restrictions" directive in Postfix versions >= 2.10 a security risk in some default configurations?

2013-05-31 Thread Ben Johnson
On 5/31/2013 4:11 PM, /dev/rob0 wrote: > On Fri, May 31, 2013 at 03:06:38PM -0400, Ben Johnson wrote: >> On 5/31/2013 2:39 PM, Noel Jones wrote: >>> On 5/31/2013 12:22 PM, Ben Johnson wrote: Postfix "postfinger" output for this server (prior to closing this "hole"): http://pa

Re: Virtual User Aliases

2013-05-31 Thread Viktor Dukhovni
On Fri, May 31, 2013 at 09:23:40PM +0200, Simon B wrote: > > Last entry wins. > > Brilliant, thanks Victor & Wietse. So, comment the virtual_alias_maps in > pre-clean-up until I get amavis back up and running..? Be a bit more confident, you don't need to ask. -- Viktor.

Re: smtp restrictions

2013-05-31 Thread /dev/rob0
On Fri, May 31, 2013 at 11:15:05AM -0400, James Zee wrote: > On Fri, May 31, 2013 at 8:09 AM, /dev/rob0 wrote: > > On Fri, May 31, 2013 at 12:43:51AM -0400, James Zee wrote: snip > > Also, you really should separate submission from your inbound > > port 25. I only allow relaying on the submission

Challenges of an internal relay server

2013-05-31 Thread Jason Price
Background: Internal Mail Relay server. Connections from the internet are not possible. The vast majority of messages are going to Google Apps. Problem one: How to properly 'blacklist' certain To: addresses. I am currently using: header_checks = pcre:/etc/postfix/header_checks where header_c

Is it time for 2.x.y -> x.y?

2013-05-31 Thread Wietse Venema
After the confusion that Postfix 2.10 is not Postfix 2.1, maybe it is time to change the release numbering scheme. We could to the Linux thing where 2.mumble was followed by 3.mumble. or we could do it like Sun. After releasing Solaris 2.0 .. 2.6, they changed the numbering scheme with Solaris 7

Re: Challenges of an internal relay server

2013-05-31 Thread Wietse Venema
Jason Price: > > *May 30 12:38:23 rmail3b01 postfix/error[6485]: DD01F7B0: > > to=, relay=none, delay=403, delays=0.01/403/0/0, > > dsn=4.4.2, status=deferred (delivery temporarily suspended: conversation > > However, while watching tcpdump output very carefully, I can find no > evidence that post

Re: Is it time for 2.x.y -> x.y?

2013-05-31 Thread Christoph Anton Mitterer
Hi. I think the best is major.minor.patch, with major being really ground breaking changes, or those that add major incompatibilities... e.g. getting rid of all kind of legacy config option names or such... Minor being used for all other feature releases (which do not add major incompatibilities

Re: Is the absence of "smtpd_relay_restrictions" directive in Postfix versions >= 2.10 a security risk in some default configurations?

2013-05-31 Thread Noel Jones
On 5/31/2013 3:19 PM, Ben Johnson wrote: > Also, you're right; I had confused Postfix version 2.10 with 2.1. I now > realize that the directive "smtpd_relay_restrictions" is not yet > available with respect to my version of Postfix. > > Thanks again, > > -Ben > probably combined with the (perh

Re: Is it time for 2.x.y -> x.y?

2013-05-31 Thread /dev/rob0
On Fri, May 31, 2013 at 04:56:11PM -0400, Wietse Venema wrote: > After the confusion that Postfix 2.10 is not Postfix 2.1, maybe > it is time to change the release numbering scheme. The 2.10=2.1 confusion is something we commonly see in IRC. On the plus side, it shows that the person was reading

Re: Challenges of an internal relay server

2013-05-31 Thread Jason Price
I've reviewed the pcap file, looking for "ip.addr == 173.194.65.27" for all times between 12:31:39 (when postfix received the message), and 12:48:22 (when it was successfully delivered), and there are no frames that mention 'acrespo' at all (except the initial reception, and the final delivery). Th

Re: Is it time for 2.x.y -> x.y?

2013-05-31 Thread Quanah Gibson-Mount
--On Friday, May 31, 2013 4:43 PM -0500 "/dev/rob0" wrote: My wish is that Postfix 3.0, should it ever happen, would be a rewrite which sacrifices backward compatibility and the easy upgradability. Many things were learned over the course of Postfix 1.x/2.x development, and a Postfix 3.0 (in my

Re: Is it time for 2.x.y -> x.y?

2013-05-31 Thread Noel Jones
On 5/31/2013 3:56 PM, Wietse Venema wrote: > After the confusion that Postfix 2.10 is not Postfix 2.1, maybe it > is time to change the release numbering scheme. > > We could to the Linux thing where 2.mumble was followed by 3.mumble. > > or we could do it like Sun. After releasing Solaris 2.0 ..

Re: Challenges of an internal relay server

2013-05-31 Thread Noel Jones
On 5/31/2013 4:54 PM, Jason Price wrote: > I've reviewed the pcap file, looking for "ip.addr == 173.194.65.27" > for all times between 12:31:39 (when postfix received the message), > and 12:48:22 (when it was successfully delivered), and there are no > frames that mention 'acrespo' at all (except t

Re: upgrade concerns

2013-05-31 Thread LuKreme
On 31 May 2013, at 11:27 , Dean Guenther wrote: > Thanks Brian!!! Commenting out home_mailbox took care of the problem. I > appreciate the help -- Dean Suggest, in the strongest possible terms, that you do not use mbox format. Maildir is far more robust and is also much more efficient, requiring

Re: Is it time for 2.x.y -> x.y?

2013-05-31 Thread LuKreme
On 31 May 2013, at 14:56 , Wietse Venema wrote: > After the confusion that Postfix 2.10 is not Postfix 2.1, maybe it > is time to change the release numbering scheme. The amount of confusion doesn't seem worth changing to me. I know that some people will see 2.1.1 and think that's exactly the sa

Re: Is it time for 2.x.y -> x.y?

2013-05-31 Thread Christoph Anton Mitterer
On Fri, 2013-05-31 at 16:43 -0500, /dev/rob0 wrote: > My wish is that Postfix 3.0, should it ever happen, would be a > rewrite which sacrifices backward compatibility and the easy > upgradability. Many things were learned over the course of Postfix > 1.x/2.x development, and a Postfix 3.0 (in my

Re: Is it time for 2.x.y -> x.y?

2013-05-31 Thread Robert Lopez
> On Fri, 2013-05-31 at 16:43 -0500, /dev/rob0 wrote: >> My wish is that Postfix 3.0, should it ever happen, would be a >> rewrite which sacrifices backward compatibility and the easy >> upgradability. Many things were learned over the course of Postfix >> 1.x/2.x development, and a Postfix 3.0 (in

Re: upgrade concerns

2013-05-31 Thread Steve Jenkins
On Fri, May 31, 2013 at 3:33 PM, LuKreme wrote: > Suggest, in the strongest possible terms, that you do not use mbox format. > Maildir is far more robust and is also much more efficient, requiring far > fewer resources on your machine. > >From one Cougar (BYU) to another (WSU), may I also sugges

Microsoft asking for input on Exchange Server 2013 and Outlook 2013

2013-05-31 Thread Jerry
Microsoft is actually publicly asking for feedback on its Exchange Server and Outlook Standards. This might be a good time to tell them specific problems you have with those two products and what changes are needed to make them more compatible with FOSS products. This pertains to Exchange Server 20

Re: Is it time for 2.x.y -> x.y?

2013-05-31 Thread Larry Stone
On May 31, 2013, at 5:48 PM, LuKreme wrote: > I know that some people will see 2.1.1 and think that's exactly the same > thing as 2.10.1, But why should they? As a number, 2.1 and 2.10 are the same thing (except for implied precision). And I can see possible confusion there. But 2.1.0 and 2.

Re: Is it time for 2.x.y -> x.y?

2013-05-31 Thread Scott Kitterman
On Friday, May 31, 2013 04:56:11 PM Wietse Venema wrote: > After the confusion that Postfix 2.10 is not Postfix 2.1, maybe it > is time to change the release numbering scheme. > > We could to the Linux thing where 2.mumble was followed by 3.mumble. > > or we could do it like Sun. After releasing

Re: Is it time for 2.x.y -> x.y?

2013-05-31 Thread Bryan Irvine
On Fri, May 31, 2013 at 1:56 PM, Wietse Venema wrote: > After the confusion that Postfix 2.10 is not Postfix 2.1, maybe it > is time to change the release numbering scheme. > > We could to the Linux thing where 2.mumble was followed by 3.mumble. > > or we could do it like Sun. After releasing Sol

Re: Is it time for 2.x.y -> x.y?

2013-05-31 Thread Christoph Anton Mitterer
On Fri, 2013-05-31 at 17:33 -0700, Bryan Irvine wrote: > I've always found the OpenBSD method the easiest. after 2.9 comes 3.0 then > 3.13.9 then 4.0. Guess that depends on how one interprets version "numbers" Is it a plain number? Then the model as also used by OpenBSD makes sense as 3.1

Re: Is it time for 2.x.y -> x.y?

2013-05-31 Thread Peter
On 06/01/2013 08:56 AM, Wietse Venema wrote: After the confusion that Postfix 2.10 is not Postfix 2.1, maybe it is time to change the release numbering scheme. I would take the confusion with a grain of salt, and I think that changing the numbering scheme will generate even more confusion. I

Re: Is it time for 2.x.y -> x.y?

2013-05-31 Thread Mike.
On 5/31/2013 at 4:56 PM wie...@porcupine.org wrote: |After the confusion that Postfix 2.10 is not Postfix 2.1, = In 20/20 hindsight, perhaps Postfix 2.1 should have been Postfix 2.01, allowing 100 minor versions before the major version was forced to change. I have a similar pro

Re: Is it time for 2.x.y -> x.y?

2013-05-31 Thread Jim Wright
On May 31, 2013, at 3:56 PM, wie...@porcupine.org (Wietse Venema) wrote: > After the confusion that Postfix 2.10 is not Postfix 2.1, maybe it is time to > change the release numbering scheme. If they can't figure it out, they shouldn't be running a mail server. There is nothing wrong with the

Re: Is it time for 2.x.y -> x.y?

2013-05-31 Thread Mike.
On 5/31/2013 at 10:23 PM Jim Wright wrote: |On May 31, 2013, at 3:56 PM, wie...@porcupine.org (Wietse Venema) wrote: | |> After the confusion that Postfix 2.10 is not Postfix 2.1, maybe it is |time to change the release numbering scheme. | |If they can't figure it out, they shouldn't be running

Re: Challenges of an internal relay server

2013-05-31 Thread Jason Price
On Friday, May 31, 2013, Noel Jones wrote: > > > Please don't top-post. > > When postfix logs "delivery temporarily suspended", it means no > attempt was made to deliver this message. The destination has been > marked as down due to multiple prior failures. > > > > -- Noel Jones > > Thank you.

Re: Is it time for 2.x.y -> x.y?

2013-05-31 Thread David Benfell
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 05/31/2013 08:30 PM, Mike. wrote: > > > On 5/31/2013 at 10:23 PM Jim Wright wrote: > > |On May 31, 2013, at 3:56 PM, wie...@porcupine.org (Wietse Venema) > wrote: | |> After the confusion that Postfix 2.10 is not Postfix > 2.1, maybe it is |tim