Re: Stopping compromised accounts

2016-12-06 Thread Julian Kippels
Am Mon, 5 Dec 2016 20:52:21 -0500 schrieb Alex : > Hi, > > I have a postfix-3.0.5 system with a few hundred users. They have > access to submission, webmail, and dovecot to send and receive mail. > > On occasion, user's local desktop are compromised, and with it their > account on this system. T

Re: Stopping compromised accounts

2016-12-06 Thread Allen Coates
On 06/12/16 01:52, Alex wrote: > Hi, > > I have a postfix-3.0.5 system with a few hundred users. They have > access to submission, webmail, and dovecot to send and receive mail. > > On occasion, user's local desktop are compromised, and with it their > account on this system. This leads to their

Re: Stopping compromised accounts

2016-12-06 Thread Ron Wheeler
I also limit the number of recipients allowed on an out-going email. This blocks bulk spammers since they tend to put a lot of addresses on 1 envelope. The number allowed will depend on your user's typical patters. Mine is pretty low (between 10-20) since we tend to have small project teams.

Re: Stopping compromised accounts

2016-12-06 Thread /dev/rob0
On Tue, Dec 06, 2016 at 08:59:56AM +0100, Julian Kippels wrote: > Am Mon, 5 Dec 2016 20:52:21 -0500 > schrieb Alex : > > > I have a postfix-3.0.5 system with a few hundred users. They > > have access to submission, webmail, and dovecot to send and > > receive mail. > > > > On occasion, user's loc

Can the "From:" and "Sender:" headers be swapped?

2016-12-06 Thread lucas2
Hi List, I am running an application which is sending mail through Postfix containing both a "From:" and a "Sender:" header. For one specific address in "Sender:", I would like to swap the values for "From:" and "Sender:". For example: The application dispatches a message From: addre...@doma

Re: Can the "From:" and "Sender:" headers be swapped?

2016-12-06 Thread Wietse Venema
luc...@dds.nl: > Hi List, > > I am running an application which is sending mail through Postfix > containing both a "From:" and a "Sender:" header. > > For one specific address in "Sender:", I would like to swap the values > for "From:" and "Sender:". > > For example: > The application dispatche

DNS problem (protection.outlook.com)

2016-12-06 Thread MRob
Last few days, I'm seeing large amount of failures in a log file for domains using protection.outlook.com: to=, relay=none, delay=13190, delays=13187/0.08/2.2/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=example-com.mail.protection.outlook.com type=

Re: DNS problem (protection.outlook.com)

2016-12-06 Thread Wietse Venema
MRob: > Last few days, I'm seeing large amount of failures in a log file for > domains using protection.outlook.com: > > to=, relay=none, delay=13190, delays=13187/0.08/2.2/0, > dsn=4.4.3, status=deferred (Host or domain name not found. Name service > error for name=example-com.mail.protection.

Re: DNS problem (protection.outlook.com)

2016-12-06 Thread Viktor Dukhovni
> On Dec 6, 2016, at 1:44 PM, MRob wrote: > > Last few days, I'm seeing large amount of failures in a log file for domains > using protection.outlook.com: > > to=, relay=none, delay=13190, delays=13187/0.08/2.2/0, > dsn=4.4.3, status=deferred (Host or domain name not found. Name service error

Re: Stopping compromised accounts

2016-12-06 Thread John Fawcett
On 12/06/2016 02:52 AM, Alex wrote: > Hi, > > I have a postfix-3.0.5 system with a few hundred users. They have > access to submission, webmail, and dovecot to send and receive mail. > > On occasion, user's local desktop are compromised, and with it their > account on this system. This leads to the

Re: DNS problem (protection.outlook.com)

2016-12-06 Thread MRob
Victor, Wietse, On 2016-12-06 11:16, wie...@porcupine.org wrote: MRob: Last few days, I'm seeing large amount of failures in a log file for domains using protection.outlook.com: to=, relay=none, delay=13190, delays=13187/0.08/2.2/0, dsn=4.4.3, status=deferred (Host or domain name not found. N

Re: DNS problem (protection.outlook.com)

2016-12-06 Thread Viktor Dukhovni
On Tue, Dec 06, 2016 at 04:02:21PM -0800, MRob wrote: > > This could a messed-up DNS resolver anywhere in the path, including > > a bad resolv.conf file under /var/spool/postfix/etc, or some > > 'security' filter that breaks connectivity to some DNS server. > > Victor suggested in a mail prior to

Re: DNS problem (protection.outlook.com)

2016-12-06 Thread Wietse Venema
MRob: > Having removed ipv6 from the question, I get the error I quoted above > even for domains that do resolve using "dig" from the CLI of the same > host. Why would there be that kind of discrepancy? Not at all, just some intermediate resolver that messes up as I suggested in my first reply.

Re: DNS problem (protection.outlook.com)

2016-12-06 Thread Viktor Dukhovni
On Tue, Dec 06, 2016 at 07:20:41PM -0500, Wietse Venema wrote: > > Having removed ipv6 from the question, I get the error I quoted above > > even for domains that do resolve using "dig" from the CLI of the same > > host. Why would there be that kind of discrepancy? > > Not at all, just some int

Re: DNS problem (protection.outlook.com)

2016-12-06 Thread MRob
On 2016-12-06 16:23, Viktor Dukhovni wrote: On Tue, Dec 06, 2016 at 07:20:41PM -0500, Wietse Venema wrote: > Having removed ipv6 from the question, I get the error I quoted above > even for domains that do resolve using "dig" from the CLI of the same > host. Why would there be that kind of disc

Re: DNS problem (protection.outlook.com)

2016-12-06 Thread Viktor Dukhovni
On Tue, Dec 06, 2016 at 04:56:58PM -0800, MRob wrote: > > To be fair to the good folks at PowerDNS, the software in question > > was an alpha version, that Ubuntu should probably not have shipped > > in a prod release. I don't know of any similar issues in actual > > releases of PowerDNS. > > Th

Re: DNS problem (protection.outlook.com)

2016-12-06 Thread MRob
On 2016-12-06 17:14, Viktor Dukhovni wrote: On Tue, Dec 06, 2016 at 04:56:58PM -0800, MRob wrote: > To be fair to the good folks at PowerDNS, the software in question > was an alpha version, that Ubuntu should probably not have shipped > in a prod release. I don't know of any similar issues in

Re: DNS problem (protection.outlook.com)

2016-12-06 Thread Scott Kitterman
On Tuesday, December 06, 2016 04:56:58 PM MRob wrote: > On 2016-12-06 16:23, Viktor Dukhovni wrote: > > On Tue, Dec 06, 2016 at 07:20:41PM -0500, Wietse Venema wrote: > >> > Having removed ipv6 from the question, I get the error I quoted above > >> > even for domains that do resolve using "dig" fro

Re: DNS problem (protection.outlook.com)

2016-12-06 Thread Viktor Dukhovni
On Tue, Dec 06, 2016 at 08:47:27PM -0500, Scott Kitterman wrote: > > I'm shocked that they have done such a thing. I > > wonder if a post to their mailing list would get the attention of the > > right person. > > There is almost certainly not a right person. PDNS is in the Universe > section >

Re: DNS problem (protection.outlook.com)

2016-12-06 Thread Scott Kitterman
On Wednesday, December 07, 2016 02:08:24 AM Viktor Dukhovni wrote: > On Tue, Dec 06, 2016 at 08:47:27PM -0500, Scott Kitterman wrote: > > > I'm shocked that they have done such a thing. I > > > wonder if a post to their mailing list would get the attention of the > > > right person. > > > > There

Re: DNS problem (protection.outlook.com)

2016-12-06 Thread Viktor Dukhovni
> On Dec 7, 2016, at 12:34 AM, Scott Kitterman wrote: > >> Instead of partly disabling DANE support, it seems to make more >> sense to switch to unbound or BIND. > > I agree. I think most users don't understand the distinction between the > parts of the archive. Let's hope the word gets out