Re: When milter (opendkim) is behind a proxy/relay, how to give it the original client IP?

2014-06-25 Thread li...@rhsoft.net
Am 25.06.2014 03:01, schrieb Thomas R.: > OpenDKIM bases its decision whether mail can be signed on, among other > things, the connecting IP. However this > only works if there has been no SMTP relay or proxy prior to the mail > reaching the milter. If there has been, > OpenDKIM sees the IP ad

Re: When milter (opendkim) is behind a proxy/relay, how to give it the original client IP?

2014-06-25 Thread Wietse Venema
Thomas R.: > Hello, > > OpenDKIM bases its decision whether mail can be signed on, among other > things, the connecting IP. However this only works if there has been no > SMTP relay or proxy prior to the mail reaching the milter. If there has > been, OpenDKIM sees the IP address of the relay/

valid names for postfix services

2014-06-25 Thread A. Schulze
Hello, I have to setup a special transport to send messages to a broken system. If I name the transport "foo", I could add transport specific setting in main.cf as foo_destination_rate_delay for example. Does that work too if I name the service "foo_smtp" so the settig must be named foo_s

Re: logging when message_size_limit is exceeded

2014-06-25 Thread Wietse Venema
smtpd_delay_reject applies only to the configurable policies. smtpd_delay_reject does not apply to invalid SMTP commands such as syntax errors, parameter errors such as SIZE, commands out of order, and the like. Wietse

Re: valid names for postfix services

2014-06-25 Thread li...@rhsoft.net
Am 25.06.2014 13:13, schrieb A. Schulze: > I have to setup a special transport to send messages to a broken system. > If I name the transport "foo", I could add transport specific setting in > main.cf > as foo_destination_rate_delay for example. > > Does that work too if I name the service "foo_

Re: valid names for postfix services

2014-06-25 Thread A. Schulze
lists _at_ rhsoft dot net: use foo_outgoing that's the point: the underscore in the service name It may be worth to think about not naming it _smtp but I just do that and have no problems. I'm only unsure if setting parameters ${transportname}_mumble in main.cf work if ${transportname} conta

Re: When milter (opendkim) is behind a proxy/relay, how to give it the original client IP?

2014-06-25 Thread li...@rhsoft.net
why respond off-list? not able to handle a MUA but maintain mailservers. Am 25.06.2014 13:27, schrieb Thomas R.: >> why not change the order? >> >> a contentfilter is anyways expensive and should be the last one >> nad so only face messages which made it trough all the cheaper >> tests and fil

Re: valid names for postfix services

2014-06-25 Thread Wietse Venema
A. Schulze: > I'm only unsure if setting parameters ${transportname}_mumble in main.cf > work if ${transportname} contain a underscore itself. Postfix takes the master.cf service name field and appends "_mumble". Wietse

Re: When milter (opendkim) is behind a proxy/relay, how to give it the original client IP?

2014-06-25 Thread Thomas R.
On 25/06/2014 9:41 PM, li...@rhsoft.net wrote: > why respond off-list? not able to handle a MUA but maintain mailservers. An accident. You're quite rude. Your email looked like a list email and I didn't catch my mistake. > *both* are before-queue and so only the order matters > http://

Re: When milter (opendkim) is behind a proxy/relay, how to give it the original client IP?

2014-06-25 Thread Wietse Venema
Thomas Rutter: > > Use XCLIENT! > > > > XFORWARD is for LOGGING. > > > > XCLIENT is for IMPERSONATION. > > Thank you! I don't know why I haven't looked into this already. Postfix supports client IP address forwarding with haproxy (uses their protocol) and with nginx (uses XCLIENT). Wiet

status=deferred (Server certificate not trusted) - but why?

2014-06-25 Thread Ralf Hildebrandt
Jun 25 15:12:23 albatross postfix/smtp[16480]: Untrusted TLS connection established to mail.lastmikoi.net[212.83.147.35]:25: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits) Jun 25 15:12:23 albatross postfix/smtp[16480]: 3gz3jG3v0Mz7LjZ: to=<...@lastmikoi.net>, relay=mail.lastmikoi

Restricting Intra-Office Receiving

2014-06-25 Thread Asai
Greetings, I've worked out how to restrict intra-office sending from a user to a user, but I'm a bit stumped on how to restrict intra-office receiving; restricting from who a user can receive mail. This is what I have at this point: smtpd_recipient_restrictions = permit_sasl_authenticated,

Re: Restricting Intra-Office Receiving

2014-06-25 Thread Asai
I think I got it: smtpd_relay_restrictions = permit_mynetworks, check_recipient_access mysql:/etc/postfix/mysql_restricted_recipients.cf, permit_sasl_authenticated, defer_unauth_destination I moved check_recipient_access from smtpd_recipient_restrictions to smtpd_relay

Re: Restricting Intra-Office Receiving

2014-06-25 Thread Viktor Dukhovni
On Wed, Jun 25, 2014 at 09:46:33AM -0700, Asai wrote: > I think I got it: > > smtpd_relay_restrictions = permit_mynetworks, > check_recipient_access > mysql:/etc/postfix/mysql_restricted_recipients.cf, > permit_sasl_authenticated, > defer_unauth_destination > > I moved che

Re: Limit number of deliveries for pipe delivery

2014-06-25 Thread Julian Mehnle
Wietse Venema wrote: > Julian Mehnle: >> I have a transport "foo" defined in master.cf that delivers messages >> via a pipe command. In an edge case Postfix is receiving messages >> with multiple recipients (multiple RCPT TO commands). I'm looking >> for a way to have such messages delivered to

Re: Limit number of deliveries for pipe delivery

2014-06-25 Thread Viktor Dukhovni
On Wed, Jun 25, 2014 at 01:54:21PM -0700, Julian Mehnle wrote: > > That is exactly what Postfix does by default, without any tweaking > > of destination recipient settings. > > Great! Now, if it currently *doesn't* (i.e., it invokes the pipe > command once per RCPT TO, not once per message), wha

Re: Limit number of deliveries for pipe delivery

2014-06-25 Thread Julian Mehnle
Thanks for your replies so far! Viktor Dukhovni wrote: > On Wed, Jun 25, 2014 at 01:54:21PM -0700, Julian Mehnle wrote: > >>> That is exactly what Postfix does by default, without any tweaking >>> of destination recipient settings. >> >> Great! Now, if it currently *doesn't* (i.e., it invokes

Updated note for Postfix maintainers

2014-06-25 Thread Wietse Venema
In response to maintainer feedback, I have cleaned up Postfix shared-library and database plugin support. The result of several iterations is postfix-2.12-20140625. See RELEASE_NOTES and INSTALL for an updated introduction. What has changed: - Non-executable files are no longer installed in

AOL delivery issues

2014-06-25 Thread Paul C
Hey all, has anyone seen this happen with postfix ... delivery temporarily suspended: connect to mailin-01.mx.aol.com[64.12.88.132]:25: Connection timed out I realize it probably some lag going on somewhere, just taking too long to finish the smtp convo with aol, but its only happening with aol a

Re: AOL delivery issues

2014-06-25 Thread Wietse Venema
Paul C: > Hey all, has anyone seen this happen with postfix ... > > delivery temporarily suspended: connect to > mailin-01.mx.aol.com[64.12.88.132]:25: Connection timed out S**t happens... > I realize it probably some lag going on somewhere, just taking too > long to finish the smtp convo with a

Re: AOL delivery issues

2014-06-25 Thread Paul C
Yes s**t does happen lol. I've had delivery issues in the past, they always respond with 421 or some type of error code, not time outs, but here's what I am seeing in some tests: If it starts timing out, every single message does, I have a multiple ip set up and it happens across the board on ever

Re: Limit number of deliveries for pipe delivery

2014-06-25 Thread Viktor Dukhovni
On Wed, Jun 25, 2014 at 02:31:18PM -0700, Julian Mehnle wrote: > > You may be misreading the logs. What evidence do you have that > > in fact there is a separate delivery for each recipient. LOGS! > > Here's a log excerpt: > > > Jun 25 00:17:14 etl-qa-00 postfix/qmgr[19911]: 8830140409E9E: > >

email sent to bad address, is it possible to change recipient

2014-06-25 Thread Robert Fantini
Hello due to a bug in some other software we have mail occasionally get stuck in the queue. I've tried editing /var/spool/postfix/defer/1/176CD2193E to fix the address, but after running 'postfix flush' , that files reverts to its original recipient. I could not find another file to edit.. Th

Re: Limit number of deliveries for pipe delivery

2014-06-25 Thread Julian Mehnle
Viktor Dukhovni wrote: > On Wed, Jun 25, 2014 at 02:31:18PM -0700, Julian Mehnle wrote: > >> Here's a log excerpt: >> >>> Jun 25 00:17:14 etl-qa-00 postfix/qmgr[19911]: 8830140409E9E: >>> from=, >>> size=3023, nrcpt=2 (queue active) >>> Jun 25 00:44:26 etl-qa-00 postfix/pipe[29392]: 8830

Re: Limit number of deliveries for pipe delivery

2014-06-25 Thread Viktor Dukhovni
On Wed, Jun 25, 2014 at 03:30:26PM -0700, Julian Mehnle wrote: > > Yes, this is two deliveries, for two recipient records in the queue > > file, that are in fact the same recipient address? Why does this > > message have to identical envelope recipients? The pipe(8) pid > > would be the same for

Re: Limit number of deliveries for pipe delivery

2014-06-25 Thread Julian Mehnle
Viktor Dukhovni wrote: > On Wed, Jun 25, 2014 at 03:30:26PM -0700, Julian Mehnle wrote: > >> The original RCPT TO addresses are actually different, but they >> resolve to the same destination internally. If there was a way to >> make Postfix collapse them into a single delivery, that would solve

Re: Limit number of deliveries for pipe delivery

2014-06-25 Thread Viktor Dukhovni
On Wed, Jun 25, 2014 at 03:45:30PM -0700, Julian Mehnle wrote: > > You'd need to use virtual(5) aliases and transport(5), not local > > aliases(5) and mailbox_transport to multiple recipients in one > > delivery. > > Awesome, that's a very clear pointer in the right direction. I > will work on c