Fwd: Postfix SMTP server: errors from unknown[209.85.212.69]

2013-08-23 Thread David Benfell
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi all, Unfortunately, I'm finding this singularly unhelpful: - Original Message Subject: Postfix SMTP server: errors from unknown[209.85.212.69] Date: Thu, 22 Aug 2013 23:39:49 -0700 (PDT) From: mailer-dae...@mail.parts-unknown.or

Re: Recipient address rejected: aol.com

2013-08-23 Thread King Cao
It depends on MTA. From the log, AOL may not use Postifx or customized the checking on RCPT_TO stage (PolicyD or milter, etc). However, the result is that AOL MTA don't accept it for your MAIL FROM, RCPT TO parameters. Regards, King 2013/8/23 DTNX Postmaster > On Aug 23, 2013, at 07:54, Grant

Re: Postfix SMTP server: errors from unknown[209.85.212.69]

2013-08-23 Thread DTNX Postmaster
On Aug 23, 2013, at 09:20, David Benfell wrote: > Unfortunately, I'm finding this singularly unhelpful: > > - Original Message > Subject: Postfix SMTP server: errors from unknown[209.85.212.69] Check your DNS configuration; that IP address has matching forward and reverse rec

Re: Recipient address rejected: aol.com

2013-08-23 Thread DTNX Postmaster
On Aug 23, 2013, at 09:25, King Cao wrote: > It depends on MTA. From the log, AOL may not use Postifx or customized the > checking on RCPT_TO stage (PolicyD or milter, etc). > > However, the result is that AOL MTA don't accept it for your MAIL FROM, RCPT > TO parameters. http://postmaster.ao

block local sender

2013-08-23 Thread Barbara M.
Probably trivial, but I am in holiday and using an emergency connection, so I ask instead of searching again. Problem: a website in a multidomain server is spamming probably due to a bug in the site code. The owners are also in holiday; I can't stop the website; I can't stop postfix :-( All

Re: block local sender

2013-08-23 Thread DTNX Postmaster
On Aug 23, 2013, at 10:01, Barbara M. wrote: > Probably trivial, but I am in holiday and using an emergency connection, so I > ask instead of searching again. > Problem: a website in a multidomain server is spamming probably due to a bug > in the site code. > The owners are also in holiday; I c

Re: Postfix SMTP server: errors from unknown[209.85.212.69]

2013-08-23 Thread David Benfell
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 08/23/2013 12:55 AM, DTNX Postmaster wrote: > On Aug 23, 2013, at 09:20, David Benfell > wrote: > >> Unfortunately, I'm finding this singularly unhelpful: >> >> - Original Message Subject: Postfix SMTP >> server: errors from unk

Re: Recipient address rejected: aol.com

2013-08-23 Thread Grant
>> It depends on MTA. From the log, AOL may not use Postifx or customized the >> checking on RCPT_TO stage (PolicyD or milter, etc). >> >> However, the result is that AOL MTA don't accept it for your MAIL FROM, RCPT >> TO parameters. > > http://postmaster.aol.com/Postmaster.Errors.php > > The AOL

Re: Block certain remote hosts on submission port

2013-08-23 Thread Mikael Bak
On 08/22/2013 01:51 PM, Charles Marcus wrote: [snip] > > The simple fact is, we do not have any users based *anywhere* but the > US, so, is what is the simplest way to block any/all non-US based client > connections on my submission port? > [snip] Hi, Sometimes it seems like a good solution to f

Re: Postfix SMTP server: errors from unknown[209.85.212.69]

2013-08-23 Thread Wietse Venema
David Benfell: > Why is this line not working? > > smtp_tls_key_file = /big/www/ssl/munich/munich.parts-unknown.org.key http://www.postfix.org/DEBUG_README.html#no_chroot Try turning off chroot operation in master.cf A common mistake is to turn on chroot operation in the master.cf file without

Re: block local sender

2013-08-23 Thread Wietse Venema
Barbara M.: > smtpd_sender_restrictions = check_sender_access > hash:/etc/postfix/sender_access That is for mail received via SMTP. In your case use authorized_submit_users instead. http://www.postfix.org/postconf.5.html#authorized_submit_users Wietse

Re: Block certain remote hosts on submission port

2013-08-23 Thread Patrick Lists
On 08/23/2013 12:47 PM, Mikael Bak wrote: [snip] In fact it's not a good idea at all IMO. People do travel and they need to read and write email while they are abroad. Laptop and/or smartphone users will not like your new restriction policy when they try to get some work done while visiting a pa

Disable root email

2013-08-23 Thread Roman Gelfand
How can I disable postfix from sending administrator email notifications. ie from: r...@domain.com to: r...@domain.com? Thanks in advance

Re: Disable root email

2013-08-23 Thread li...@rhsoft.net
Am 23.08.2013 14:29, schrieb Roman Gelfand: > How can I disable postfix from sending administrator email > notifications. ie from: r...@domain.com to: r...@domain.com? why would you want to do this? disable the root cause producing the messages instead break the MTA - postfix job is to send mes

Re: Disable root email

2013-08-23 Thread Roman Gelfand
You are right. Stupid me. I just realized, I don't want to do this. Please, ignore. On Fri, Aug 23, 2013 at 8:31 AM, li...@rhsoft.net wrote: > > > Am 23.08.2013 14:29, schrieb Roman Gelfand: >> How can I disable postfix from sending administrator email >> notifications. ie from: r...@domain.com

Re: $daemon_directory [Re: upgrade to 2.10.1: pass_accept_attr: cannot receive connection attributes: Numerical result out of range

2013-08-23 Thread Leo Baltus
Op 19/08/2013 om 13:11:04 -0400, schreef Wietse Venema: > Leo Baltus: > > > > However, I did notice that postfix exec()'s new processes using the > > > > path to the binaries it got from > > > > 'PATH=symlink_to_postfix/sbin postfix start' > > > > instead of compile-time arguments DEF_COM

Re: Disable root email

2013-08-23 Thread Giles Coochey
On 23/08/2013 13:42, Roman Gelfand wrote: You are right. Stupid me. I just realized, I don't want to do this. Please, ignore. On Fri, Aug 23, 2013 at 8:31 AM, li...@rhsoft.net wrote: Am 23.08.2013 14:29, schrieb Roman Gelfand: How can I disable postfix from sending administrator email noti

Re: $daemon_directory [Re: upgrade to 2.10.1: pass_accept_attr: cannot receive connection attributes: Numerical result out of range'

2013-08-23 Thread Wietse Venema
Leo Baltus: > Op 19/08/2013 om 13:11:04 -0400, schreef Wietse Venema: > > Leo Baltus: > > > > > However, I did notice that postfix exec()'s new processes using the > > > > > path to the binaries it got from > > > > > 'PATH=symlink_to_postfix/sbin postfix start' > > > > > instead of compil

Re: Recipient address rejected: aol.com

2013-08-23 Thread DTNX Postmaster
On Aug 23, 2013, at 12:16, Grant wrote: >>> It depends on MTA. From the log, AOL may not use Postifx or customized the >>> checking on RCPT_TO stage (PolicyD or milter, etc). >>> >>> However, the result is that AOL MTA don't accept it for your MAIL FROM, >>> RCPT TO parameters. >> >> http://p

Re: Postfix SMTP server: errors from unknown[209.85.212.69]

2013-08-23 Thread DTNX Postmaster
On Aug 23, 2013, at 10:36, David Benfell wrote: >> Have you tested your server with 'openssl s_client'? This is what I >> am getting; >> >> $ openssl s_client -connect mail.parts-unknown.org:25 -starttls >> smtp CONNECTED(0003) 4851:error:140770FC:SSL >> routines:SSL23_GET_SERVER_HELLO:unkno

Re: $daemon_directory [Re: upgrade to 2.10.1: pass_accept_attr: cannot receive connection attributes: Numerical result out of range'

2013-08-23 Thread Wietse Venema
Wietse Venema: > Leo Baltus: > > Op 19/08/2013 om 13:11:04 -0400, schreef Wietse Venema: > > > Leo Baltus: > > > > > > However, I did notice that postfix exec()'s new processes using the > > > > > > path to the binaries it got from > > > > > > 'PATH=symlink_to_postfix/sbin postfix start'

Re: Postfix group lookup against Samba4 AD

2013-08-23 Thread Rowland Penny
On 19/08/13 23:15, Viktor Dukhovni wrote: On Mon, Aug 19, 2013 at 10:32:27PM +0100, Rowland Penny wrote: If you want to return a particular single address for each user, you need to select a result attribute that contains *only* that address. That is what I was trying to do, do a search of a g

Re: Recipient address rejected: aol.com

2013-08-23 Thread Grant
It depends on MTA. From the log, AOL may not use Postifx or customized the checking on RCPT_TO stage (PolicyD or milter, etc). However, the result is that AOL MTA don't accept it for your MAIL FROM, RCPT TO parameters. >>> >>> http://postmaster.aol.com/Postmaster.Errors.p

Re: block local sender

2013-08-23 Thread Barbara M.
On Fri, 23 Aug 2013, Wietse Venema wrote: Barbara M.: smtpd_sender_restrictions = check_sender_access hash:/etc/postfix/sender_access That is for mail received via SMTP. In your case use authorized_submit_users instead. http://www.postfix.org/postconf.5.html#authorized_submit_users Thanks

Re: block local sender

2013-08-23 Thread Wietse Venema
Barbara M.: > On Fri, 23 Aug 2013, Wietse Venema wrote: > > > Barbara M.: > >> smtpd_sender_restrictions = check_sender_access > >> hash:/etc/postfix/sender_access > > > > That is for mail received via SMTP. > > > > In your case use authorized_submit_users instead. > > > > http://www.postfix.org/

Authentication issues

2013-08-23 Thread David Hulsebus
I apologize in advance for the long post. I started working for a small ISP with around 3000 mailboxes and inherited a Postfix server that I've been auditing. It's based on Ubuntu 8.04 LTS, Postfix 2.51, and runs Courier for pop and imap authentication. It has encrypted passwords in a MySQL databa

Re: Authentication issues

2013-08-23 Thread Wietse Venema
David Hulsebus: > But without the ability to use CRAM-MD5, DIGEST-MD5, NTLM, how can > I use TLS to make the connection and authorize the clients? TLS (formerly known as SSL) encrypts the SMTP session. This uses the STARTTLS command. SASL authenticates the user. This uses the AUTH command. With

Re: Authentication issues

2013-08-23 Thread DTNX Postmaster
On Aug 23, 2013, at 21:38, David Hulsebus wrote: > I apologize in advance for the long post. I started working for a small ISP > with around 3000 mailboxes and inherited a Postfix server that I've been > auditing. It's based on Ubuntu 8.04 LTS, Postfix 2.51, and runs Courier for > pop and imap a

Re: Authentication issues

2013-08-23 Thread Scott Kitterman
On Friday, August 23, 2013 15:38:38 David Hulsebus wrote: > I apologize in advance for the long post. I started working for a small ISP > with around 3000 mailboxes and inherited a Postfix server that I've been > auditing. It's based on Ubuntu 8.04 LTS, Postfix 2.51, and runs Courier for > pop and

FW: Authentication issues

2013-08-23 Thread David Hulsebus
When I added "noplaintext" as a security option and because MD5 was in the mech list SASL complained about no auth mechanism when it started. MD5 was already in the mech list but never failed because auth never reached it in the past, plain took precedence. I removed "noplaintext" and removed eve

Re: Postfix group lookup against Samba4 AD

2013-08-23 Thread Viktor Dukhovni
On Fri, Aug 23, 2013 at 03:01:52PM +0100, Rowland Penny wrote: > dn: CN=albert,CN=Users,DC=example,DC=com > otherMailbox: alb...@example.com > otherMailbox: alb...@domain1.com > otherMailbox: alb...@domain2.com > > The only problem that I have found is, any LDAP search with > 'result_attribute =

Re: TLS errors with GMX/web.de

2013-08-23 Thread Viktor Dukhovni
On Wed, Aug 21, 2013 at 10:44:40PM +0200, Sebastian Wiesinger wrote: > I just did, here is the PCAP: > > http://www.karotte.org/smtp-gmx.pcap The client sends an "internal error" alert. It is not clear what problem it is encountering. The server elects: Cipher Suite: TLS_ECDHE_ECDSA_WITH_

Re: FW: Authentication issues

2013-08-23 Thread Manuel Bieling
On 08/24/2013 04:35 AM, David Hulsebus wrote: Why shouldn't I require TLS to encrypt all sessions for any clients who authenticates to send mail out. Isn't that what following parameter accomplishes ? smtpd_tls_security_level = encrypt The manual says "Encrypt - MUST NOT be applied in case of a

Re: FW: Authentication issues

2013-08-23 Thread Noel Jones
On 8/23/2013 9:35 PM, David Hulsebus wrote: > > When I added "noplaintext" as a security option and because MD5 was in the > mech list SASL complained about no auth mechanism when it started. MD5 was > already in the mech list but never failed because auth never reached it in > the past, plain too