Delivered-To Backscatter

2014-04-23 Thread Jonas Wielicki
Hi list, I’m sorry that this question has been discussed before. I am aware of the following posts and threads: http://www.irbs.net/internet/postfix/0609/0648.html (Backscatter from Delivered-To headers) http://www.irbs.net/internet/postfix/0609/0487.html (Preventing backscatter with

external postfix content filter poc doesn't work

2014-04-23 Thread Gökhan Alkan
I try to develop poc code for postfix content filtering. All i need is read the 10025/tcp and send all data which i can read to 10026/tcp. Below is my poc code. But i try to send email it doesn't work and postfix show me "451 4.3.0 Error: queue file write error". #include #include #include #inc

Can postfix smtp client request DSN from remote server?

2014-04-23 Thread Erik Logtenberg
Hi, If I request a (success) DSN from my Postfix server, my server responds as expected. Usually my mail server has to deliver the mail remotely and I would like Postfix to request a DSN from the remote server as well if the user asked for one. Is that possible? Kind regards, Erik.

Second forward (via aliases file and ldap) not being executed

2014-04-23 Thread Frederik Himpe
Hi, I'm using a Postfix 2.9.6 and Cyrus IMAP mail system connected to an OpenLDAP directory managed by Gosa 2.7.4. Now I have a user (user1) which has set up e-mail forward in gosa, which is stored in the ldap server as gosaMailForwardingAddress: user1...@gmail.com Now in my /etc/aliases I also

postfix content filter poc

2014-04-23 Thread Gökhan Alkan
I try to develop poc code for postfix content filtering. All i need is read the 10025/tcp and send all data which i can read to 10026/tcp. Below is my poc code. But i try to send email it doesn't work and postfix show me "451 4.3.0 Error: queue file write error". #include #include #include #inc

Re: external postfix content filter poc doesn't work

2014-04-23 Thread Wietse Venema
G?khan Alkan: > I try to develop poc code for postfix content filtering. All i need is read > the 10025/tcp and send all data which i can read to 10026/tcp. Below is my > poc code. But i try to send email it doesn't work and postfix show me "451 > 4.3.0 Error: queue file write error". I recommend

Re: Second forward (via aliases file and ldap) not being executed

2014-04-23 Thread Viktor Dukhovni
On Wed, Apr 23, 2014 at 02:19:45PM +0200, Frederik Himpe wrote: > Now I have a user (user1) which has set up e-mail forward in gosa, which > is stored in the ldap server as gosaMailForwardingAddress: > user1...@gmail.com Presumably this is via an LDAP table in virtual_alias_maps. > Now in my /et

Re: Can postfix smtp client request DSN from remote server?

2014-04-23 Thread Wietse Venema
Erik Logtenberg: > If I request a (success) DSN from my Postfix server, my server responds > as expected. Usually my mail server has to deliver the mail remotely and > I would like Postfix to request a DSN from the remote server as well if > the user asked for one. Is that possible? This is not de

SMTP STARTTLS - "best practices"?

2014-04-23 Thread Per Thorsheim
Hi, RFC3207 says publicly available servers are required to support plaintext and fallback to plaintext if cipher negotations etc fail. wikileaks.org - self-signed cert, supports SSLv3, TLSv1, TLSv1.1 and TLSv1.2, AnonDH, key size 2048 bits, weakest cipher essentially zero. google.com - TTP cert

Re: SMTP STARTTLS - "best practices"?

2014-04-23 Thread Viktor Dukhovni
On Wed, Apr 23, 2014 at 04:21:14PM +0200, Per Thorsheim wrote: > RFC3207 says publicly available servers are required to support > plaintext and fallback to plaintext if cipher negotations etc fail. Correct. > It seems to me as if mailadmins prefer supporting "everything", > since anything is be

Re: SMTP STARTTLS - "best practices"?

2014-04-23 Thread lst_hoe02
Zitat von Viktor Dukhovni : On Wed, Apr 23, 2014 at 04:21:14PM +0200, Per Thorsheim wrote: RFC3207 says publicly available servers are required to support plaintext and fallback to plaintext if cipher negotations etc fail. Correct. It seems to me as if mailadmins prefer supporting "everyt

Re: SMTP STARTTLS - "best practices"?

2014-04-23 Thread Viktor Dukhovni
On Wed, Apr 23, 2014 at 04:54:44PM +0200, lst_ho...@kwsoft.de wrote: > Are there any experience with DNSSEC capable DNS Providers at the lower cost > range suitable for KMU? I've not looked at the cost of full-service DNS outsourcing. Some of the .org registrars are quite cost-effective and have

Re: Can postfix smtp client request DSN from remote server?

2014-04-23 Thread Michael Storz
Am 2014-04-23 13:39, schrieb Erik Logtenberg: Hi, If I request a (success) DSN from my Postfix server, my server responds as expected. Usually my mail server has to deliver the mail remotely and I would like Postfix to request a DSN from the remote server as well if the user asked for one. I

Re: SMTP STARTTLS - "best practices"?

2014-04-23 Thread Per Thorsheim
Den 23.04.2014 16:35, skrev Viktor Dukhovni: > On Wed, Apr 23, 2014 at 04:21:14PM +0200, Per Thorsheim wrote: > It seems to me as if mailadmins prefer supporting "everything", > since anything is better than plaintext. > Correct. This is called "opportunistic TLS". For an explanation > of why tha

Re: SMTP STARTTLS - "best practices"?

2014-04-23 Thread Viktor Dukhovni
On Wed, Apr 23, 2014 at 05:53:31PM +0200, Per Thorsheim wrote: > My worries here, as with HTTPS, is users (mailadmins?) putting way too > much trust into it, as soon as they see a mailheader saying SSLv2 > ciphers were used. In opportunistic TLS mode, Postfix by default sets no floor on cipher su

Accept external SMTP traffic only from MX hosts

2014-04-23 Thread James B. Byrne
I am in the process of debugging an application to Postfix error and thus have occasion to have the maillog tailed in a session window. The vast, vast majority of the traffic I see is spam and attempted spam most of which is being handled by amavis-new and spamassasin. Does the idea of configurin

Re: Reverse DNS Lookup

2014-04-23 Thread James Cloos
> "TS" == Tim Smith writes: TS> So to summarize, the delivery.mailspampropection.com domain has 81 A TS> records which, when queried won't fit into a UDP packet which explains TS> why Postfix correctly says it can't resolve the hostname. TS> Is there some kind of fix I can employ here for th

Re: Accept external SMTP traffic only from MX hosts

2014-04-23 Thread Larry Stone
On Wed, 23 Apr 2014, James B. Byrne wrote: Does the idea of configuring Postfix so that external (to our network) smtp connections are only accepted from servers identified with MX records for the connecting IP address make any sense? Is it possible? No, it makes no sense at all. MX records d

Cassandra/NoSQL table support

2014-04-23 Thread List
Are there any plans or existing projects that support connecting Postfix to a Cassandra cluster to execute CQL queries for table lookups? Or any other NoSQL databases?

Re: Cassandra/NoSQL table support

2014-04-23 Thread Wietse Venema
List: > Are there any plans or existing projects that support connecting Postfix > to a Cassandra cluster to execute CQL queries for table lookups? Or any > other NoSQL databases? If someone has a plan, then they are welcome to implement it! For a simple example see util/dict_env.c. For more

Re: Accept external SMTP traffic only from MX hosts

2014-04-23 Thread Ron Wheeler
Another approach to reduce SPAM would be to use fail2ban for a "reasonable" period to shut out IP addresses for a "reasonable" period that are sending a "lot" of SPAM in a "short" period. Ron On 23/04/2014 3:56 PM, Larry Stone wrote: On Wed, 23 Apr 2014, James B. Byrne wrote: Does the idea o

Re: external postfix content filter poc doesn't work

2014-04-23 Thread Gökhan Alkan
Hi all, Thank you for your reply. - You recommened me that use netcat. But what for ? (debugging, sending test email vs vs ...) Can you explain a bit more please ? - As you said i added the code error handling. But when i run this poc code and try to send email postfix again says me "451 4.3.0

Re: external postfix content filter poc doesn't work

2014-04-23 Thread Wietse Venema
G?khan Alkan: > Hi all, > > Thank you for your reply. Your program copies only in one direction. SMTP requires that you copy data in both directions between the client that connects to port 10025/tcp, and the server that listens on port 10026/tcp. Look in with a search engine for smtpprox. It s

Re: external postfix content filter poc doesn't work

2014-04-23 Thread Gökhan Alkan
Hi all, Thank you for your reply again. I assume that receive data from 10025/tcp and send to 10026 is enough for this purpose. But i think, i am wrong this subject. I should send data both client which connect to 10025 and other side which i will connect to 10026. I will explore this project na

Re: external postfix content filter poc doesn't work

2014-04-23 Thread Wietse Venema
G?khan Alkan: > Hi all, > > Thank you for your reply again. > > I assume that receive data from 10025/tcp and send to 10026 is enough for > this purpose. But i think, i am wrong this subject. I should send data both > client which connect to 10025 and other side which i will connect to 10026. >

Re: Accept external SMTP traffic only from MX hosts

2014-04-23 Thread Ron Wheeler
1) I am blocking sites that: a) send SPAM to addresses in our domain b) have broken one of our e-mail passwords and try to send bulk mail through our server by faking an Artifact Software user. If postfix or spamassassin detects this behaviour, it blocks it as best as it can (without making legi

Re: external postfix content filter poc doesn't work

2014-04-23 Thread Gökhan Alkan
Hi Thanks for your replies. Best regards On Thursday, April 24, 2014, Wietse Venema wrote: > G?khan Alkan: > > Hi all, > > > > Thank you for your reply again. > > > > I assume that receive data from 10025/tcp and send to 10026 is enough for > > this purpose. But i think, i am wrong this subjec

Re: Accept external SMTP traffic only from MX hosts

2014-04-23 Thread Joey J
You can not try to start figuring out who is legit or not, it's a never ending task and will cause you nothing but a headache. Use SPF, DKIM and other traditional methods, utilize some RBL's. I do block them using fail2ban for long periods of time, if someone is identified as sending spam, there i