trusted vs. verified TLS connection

2014-12-10 Thread A. Schulze
Hello, while checking TLS to a destination domain I noticed a difference. posttls-finger say "Verified" but log say (only) "Trusted". # posttls-finger -c -F /etc/ssl/mail/trusted_cas.pem avira.com posttls-finger: mx1.c01.avira.com[212.79.247.134]:25: subjectAltName: mx.ames.avira.net postt

Re: Bounce Message

2014-12-10 Thread Patrik Båt
On 2014-12-09 10:07, Jose Borges Ferreira wrote: > On Tue, Dec 9, 2014 at 8:46 AM, Patrik Båt wrote: >> Hello! >> >> Is it possible to not attach the email when generating a bounce? >> >> What happens if I set this to zero? bounce_size_limit (default: 5) >> > bounce_size_limit = 0 is "no limit

anvil statistics log entry syntax

2014-12-10 Thread Mark Martinec
Just came across the following logged message which failed to be parsed by our log parser: postfix/anvil[29988]: statistics: max message rate 4/60s for ([2001:1470:ff80::25]:10088:2001:1470:ff80:88::80:c) at Dec 8 19:26:44 Btw, 10088 is a port number, not part of an IP address. Perhaps an IP

Re: trusted vs. verified TLS connection

2014-12-10 Thread Viktor Dukhovni
On Wed, Dec 10, 2014 at 01:13:22PM +0100, A. Schulze wrote: > while checking TLS to a destination domain I noticed a difference. > posttls-finger say "Verified" but log say (only) "Trusted". The posttls-finger(1) utility defaults to the "dane" security level when TLSA records are present and "sec

DANE status in logfile

2014-12-10 Thread Jose Borges Ferreira
While updateing the log parsing script I came across this : TLS status is check at connect time and per destination with the following values "Anonymous" , "Verified" , "Trusted" or "Untrusted". It makes sense because is related with the destination. We have a table and use queue id as an identi

Re: DANE status in logfile

2014-12-10 Thread Viktor Dukhovni
On Wed, Dec 10, 2014 at 05:04:57PM +, Jose Borges Ferreira wrote: > The problem, for me, is to correlate the smtp proc id with the > message. Is it possible to have a extra key=value pair in the "final > smtp log line" ? TLS audit logging that includes queue-id data, is planned for the releas

Re: anvil statistics log entry syntax

2014-12-10 Thread Wietse Venema
Mark Martinec: > Just came across the following logged message which failed to be parsed > by our log parser: > > postfix/anvil[29988]: statistics: max message rate 4/60s for > ([2001:1470:ff80::25]:10088:2001:1470:ff80:88::80:c) at Dec 8 19:26:44 > > Btw, 10088 is a port number, not part of an

Re: anvil statistics log entry syntax

2014-12-10 Thread Viktor Dukhovni
On Wed, Dec 10, 2014 at 01:26:42PM -0500, Wietse Venema wrote: > The anvil service stores information under a key of service:client. > Apparently, your master.cf service is [2001:1470:ff80::25]:10088, > and in this case the client is 2001:1470:ff80:88::80:c. What if Mark also had a service entry

rfc5322 compliance of Date: field

2014-12-10 Thread Peter Volkov
Hi. We use smtplib in python to send mail through postfix. As I saw from tcpdump smtplib does not set "Date:" field, so I suspect postfix does that. Now, as I see postfix sets date as: Date: Wed, 10 Dec 2014 05:40:50 -0800 (PST) According to rfc 5322 3.6.1. "The Origination Date Field" last part

Re: rfc5322 compliance of Date: field

2014-12-10 Thread li...@rhsoft.net
Am 10.12.2014 um 20:17 schrieb Peter Volkov: We use smtplib in python to send mail through postfix. As I saw from tcpdump smtplib does not set "Date:" field, so I suspect postfix does that. Now, as I see postfix sets date as: Date: Wed, 10 Dec 2014 05:40:50 -0800 (PST) According to rfc 5322 3.6

Re: anvil statistics log entry syntax

2014-12-10 Thread Wietse Venema
Viktor Dukhovni: > On Wed, Dec 10, 2014 at 01:26:42PM -0500, Wietse Venema wrote: > > > The anvil service stores information under a key of service:client. > > Apparently, your master.cf service is [2001:1470:ff80::25]:10088, > > and in this case the client is 2001:1470:ff80:88::80:c. > > What if

Re: rfc5322 compliance of Date: field

2014-12-10 Thread Wietse Venema
Peter Volkov: > Hi. > > We use smtplib in python to send mail through postfix. As I saw from > tcpdump smtplib does not set "Date:" field, so I suspect postfix does > that. Now, as I see postfix sets date as: > Date: Wed, 10 Dec 2014 05:40:50 -0800 (PST) The (PST) is a comment. Surely, their pars

Re: rfc5322 compliance of Date: field

2014-12-10 Thread Peter Volkov
В Ср, 10/12/2014 в 14:35 -0500, Wietse Venema пишет: > Peter Volkov: > > We use smtplib in python to send mail through postfix. As I saw from > > tcpdump smtplib does not set "Date:" field, so I suspect postfix does > > that. Now, as I see postfix sets date as: > > Date: Wed, 10 Dec 2014 05:40:50 -

Re: anvil statistics log entry syntax

2014-12-10 Thread Viktor Dukhovni
On Wed, Dec 10, 2014 at 02:27:14PM -0500, Wietse Venema wrote: > In the ``service:client'' counter ID, the service is the name in > the master.cf first column. The anvil service does not require that > this has a port (but TCP does). Sure, but (perhaps I am missing something) "service:client" wit

Re: rfc5322 compliance of Date: field

2014-12-10 Thread Wietse Venema
Peter Volkov: > ? ??, 10/12/2014 ? 14:35 -0500, Wietse Venema ?: > > Peter Volkov: > > > We use smtplib in python to send mail through postfix. As I saw from > > > tcpdump smtplib does not set "Date:" field, so I suspect postfix does > > > that. Now, as I see postfix sets date as: > > > Date: W

Re: anvil statistics log entry syntax

2014-12-10 Thread Wietse Venema
Viktor Dukhovni: > On Wed, Dec 10, 2014 at 02:27:14PM -0500, Wietse Venema wrote: > > > In the ``service:client'' counter ID, the service is the name in > > the master.cf first column. The anvil service does not require that > > this has a port (but TCP does). > > Sure, but (perhaps I am missing

Re: rfc5322 compliance of Date: field

2014-12-10 Thread Michael Ströder
li...@rhsoft.net wrote: > Am 10.12.2014 um 20:17 schrieb Peter Volkov: >> We use smtplib in python to send mail through postfix. As I saw from >> tcpdump smtplib does not set "Date:" field, so I suspect postfix does >> that. Now, as I see postfix sets date as: >> Date: Wed, 10 Dec 2014 05:40:50 -08

Re: anvil statistics log entry syntax

2014-12-10 Thread Viktor Dukhovni
On Wed, Dec 10, 2014 at 03:49:18PM -0500, Wietse Venema wrote: > > Sure, but (perhaps I am missing something) "service:client" with > > "client" an "abbreviated" IPv6 address is subject to collisions > > when some services end in a numeric ":port" and others do not. > > There can be no TCP servic

warning: connect to private/tlsmgr: Resource temporarily unavailable

2014-12-10 Thread Julian Mehnle
Hi all, I'm running Postfix 2.11.0 on Ubuntu 14.04.1 LTS on multiple m3.xlarge instances (15GB RAM) on Amazon EC2. There's a milter plugged in. This setup has been running without problems on Postfix 2.9.6 on Ubuntu 12.04.2 LTS on bare metal machines (32GB RAM) for years. Only when we ported it

Re: warning: connect to private/tlsmgr: Resource temporarily unavailable

2014-12-10 Thread li...@rhsoft.net
Am 10.12.2014 um 22:59 schrieb Julian Mehnle: I'm running Postfix 2.11.0 on Ubuntu 14.04.1 LTS on multiple m3.xlarge instances (15GB RAM) on Amazon EC2. There's a milter plugged in. This setup has been running without problems on Postfix 2.9.6 on Ubuntu 12.04.2 LTS on bare metal machines (32G

Re: warning: connect to private/tlsmgr: Resource temporarily unavailable

2014-12-10 Thread Viktor Dukhovni
On Wed, Dec 10, 2014 at 01:59:37PM -0800, Julian Mehnle wrote: > I'm running Postfix 2.11.0 on Ubuntu 14.04.1 LTS on multiple m3.xlarge > instances (15GB RAM) on Amazon EC2. There's a milter plugged in. This > setup has been running without problems on Postfix 2.9.6 on Ubuntu 12.04.2 > LTS on bare

Re: DANE status in logfile

2014-12-10 Thread Jose Borges Ferreira
On Wed, Dec 10, 2014 at 5:28 PM, Viktor Dukhovni wrote: > On Wed, Dec 10, 2014 at 05:04:57PM +, Jose Borges Ferreira wrote: > >> The problem, for me, is to correlate the smtp proc id with the >> message. Is it possible to have a extra key=value pair in the "final >> smtp log line" ? > > TLS au

Is there a way to enable logging 5xx status codes?

2014-12-10 Thread deoren
My question is very similar to Richard Laysell's question: On 4/7/2014 8:42 AM, Richard Laysell wrote: > > Hello all, > > What is the best way of dealing with pests like this? > > Apr 7 12:52:40 polyphemus postfix/smtpd[24765]: lost connection after > AUTH from unknown[78.188.45.153] > Apr 7 12

Re: Is there a way to enable logging 5xx status codes?

2014-12-10 Thread Wietse Venema
deoren: > My question is very similar to Richard Laysell's question: > > On 4/7/2014 8:42 AM, Richard Laysell wrote: > > > > Hello all, > > > > What is the best way of dealing with pests like this? > > > > Apr 7 12:52:40 polyphemus postfix/smtpd[24765]: lost connection after > > AUTH from

Re: rfc5322 compliance of Date: field

2014-12-10 Thread Richard Damon
On 12/10/14, 3:46 PM, Wietse Venema wrote: Peter Volkov: ? ??, 10/12/2014 ? 14:35 -0500, Wietse Venema ?: Peter Volkov: We use smtplib in python to send mail through postfix. As I saw from tcpdump smtplib does not set "Date:" field, so I suspect postfix does that. Now, as I see postfix set