saslauthd show remote ip address

2015-12-02 Thread Selcuk Yazar
Hi, i want to track bad login attemps on our mail server running on postfix at redhat. when i look to our syslog messages i see mail saslauthd[5345]: do_auth : auth failure: [user=] [service=smtp] [realm=our domain] [mech=ldap] [reason=Unknown] lines, is it technically posibbl

Re: saslauthd show remote ip address

2015-12-02 Thread Koko Wijatmoko
On Wed, 2 Dec 2015 12:25:53 +0200 Selcuk Yazar wrote: > i want to track bad login attemps on our mail server running on postfix at > redhat. > > when i look to our syslog messages i see > > mail saslauthd[5345]: do_auth : auth failure: [user=] > [service=smtp] [realm=our domain

Re: saslauthd show remote ip address

2015-12-02 Thread Selcuk Yazar
Thank you Koko for warning , hopelessly i try to my chance :( but i found this after ,i sent email "...From a cursory inspection of lib/pwcheck.c, saslauthd does not get passed any client IP information and cannot log it or forward it to pam..." selcuk On Wed, Dec 2, 2015 at 12:39 PM, Koko Wij

2 questions: Can I add another smtp line into master.cf for spam assassin? & spa-policy.pl

2015-12-02 Thread Robert Chalmers
Q1. Already in my master.cf I have smtp inet n - n - 1 postscreen #smtp inet n - n - - smtpd -vv smtpd pass - - n - - smtpd dnsblog unix - - n - 0 dnsblog tl

Re: 2 questions: Can I add another smtp line into master.cf for spam assassin? & spa-policy.pl

2015-12-02 Thread Wietse Venema
Robert Chalmers: > Q1. > > Already in my master.cf I have > > smtp inet ... > #smtp inet ... > smtp unix ... > > However, the set up for spamassassin requires another smtp line. > > smtp inet ... > So are they mutually exclusive ? or can I use it without breaking postfix

RE: 2 questions: Can I add another smtp line into master.cf for spam assassin? & spa-policy.pl

2015-12-02 Thread L . P . H . van Belle
Hai,   I run this on a debian Jessie, postfix 2.11 (all debian packages )   Route for me is like this.   -> postscreen -> policy-weight -> policy-spf -> clamsmtp (-> -> spamassassin) -> user     A1. I have in main.cfg    content_filter = clamsmtp:127.0.0.1:10025   A2.  Yes, you

PATCH: saslauthd show remote ip address

2015-12-02 Thread Wietse Venema
Selcuk Yazar: > Thank you Koko for warning , hopelessly i try to my chance :( > > but i found this after ,i sent email > > "...From a cursory inspection of lib/pwcheck.c, saslauthd does not get > passed > any client IP information and cannot log it or forward it to pam..." Postfix currently send

Postscreen and *outbound.protection.outlook.com

2015-12-02 Thread Bryan K. Walton
We've got a postfix mail server running postscreen that is configured to make use of the postscreen_dnsbl_whitelist_threshold feature. The postfix version is 3.0.3. Things have been working really well for the last 6 months, or so. However, we have recently discovered an issue where it seems

Re: Postscreen and *outbound.protection.outlook.com

2015-12-02 Thread Bill Cole
On 2 Dec 2015, at 10:42, Bryan K. Walton wrote: We've got a postfix mail server running postscreen that is configured to make use of the postscreen_dnsbl_whitelist_threshold feature. The postfix version is 3.0.3. Things have been working really well for the last 6 months, or so. However, we

Re: Postscreen and *outbound.protection.outlook.com

2015-12-02 Thread Bryan K. Walton
On Wed, Dec 02, 2015 at 12:28:33PM -0500, Bill Cole wrote: > >Questions: > >1. Why is this message getting a 450 message? Is the outlook mail server > >speaking out of turn here? > > Since you didn't bother providing 'postconf -n' output, which would provide > useful clues, we are left with making

Re: Postscreen and *outbound.protection.outlook.com

2015-12-02 Thread Bill Cole
On 2 Dec 2015, at 12:28, Bill Cole wrote: On 2 Dec 2015, at 10:42, Bryan K. Walton wrote: We've got a postfix mail server running postscreen that is configured to make use of the postscreen_dnsbl_whitelist_threshold feature. The postfix version is 3.0.3. Things have been working really well

Re: Postscreen and *outbound.protection.outlook.com

2015-12-02 Thread Bryan K. Walton
On Wed, Dec 02, 2015 at 12:49:05PM -0500, Bill Cole wrote: > Alternative (and I think better) random guess: you've enabled one or more > "after 220 server greeting" test. See the postscreen man page for the > consequences of such configuration and note that there's no law requiring > retry delivery

Re: Postscreen and *outbound.protection.outlook.com

2015-12-02 Thread Bill Cole
On 2 Dec 2015, at 12:48, Bryan K. Walton wrote: On Wed, Dec 02, 2015 at 12:28:33PM -0500, Bill Cole wrote: Questions: 1. Why is this message getting a 450 message? Is the outlook mail server speaking out of turn here? Since you didn't bother providing 'postconf -n' output, which would prov

Something about the -T in spamfilter.sh is failing on OSX

2015-12-02 Thread Robert Chalmers
In /usr/local/bin/spamfilter.sh there are a number of options with -T in place. i.e. CAUGHT_OUTPUT=`${SPAMASSASSIN} -4 -x -E -s $MAX_MESSAGE_SIZE -T $THRESHOLD_OFFSET` xxx

Re: Postscreen and *outbound.protection.outlook.com

2015-12-02 Thread Steve Jenkins
On Wed, Dec 2, 2015 at 9:54 AM, Bryan K. Walton wrote: > On Wed, Dec 02, 2015 at 12:49:05PM -0500, Bill Cole wrote: > > Alternative (and I think better) random guess: you've enabled one or more > > "after 220 server greeting" test. See the postscreen man page for the > > consequences of such conf

Re: Postscreen and *outbound.protection.outlook.com

2015-12-02 Thread Bill Cole
On 2 Dec 2015, at 12:54, Bryan K. Walton wrote: On Wed, Dec 02, 2015 at 12:49:05PM -0500, Bill Cole wrote: Alternative (and I think better) random guess: you've enabled one or more "after 220 server greeting" test. See the postscreen man page for the consequences of such configuration and note

Re: Postscreen and *outbound.protection.outlook.com

2015-12-02 Thread Bryan K. Walton
On Wed, Dec 02, 2015 at 01:55:01PM -0500, Bill Cole wrote: > My mistake: I didn't look carefully enough at what > postscreen_dnsbl_whitelist_threshold is supposed to do. Sorry for the > rapid-fire noise. > > Theory: Your 8 DNSBL lookups are not all completing fast enough for > postscreen to make a

Re: Postscreen and *outbound.protection.outlook.com

2015-12-02 Thread Bryan K. Walton
On Wed, Dec 02, 2015 at 10:10:27AM -0800, Steve Jenkins wrote: > At the risk of sounding spammy for my latest pet project, Bryan's use case > is exactly the type of issue an SPF-based whitelist for known senders (such > as outlook.com) would fix. > > Bryan: grab the postwhite script (https://githu