Re: How to check for upcoming certificate expiration...

2017-09-13 Thread Viktor Dukhovni
On Wed, Sep 13, 2017 at 09:09:36AM +0300, Dominic Raferd wrote: > On 11 September 2017 at 19:25, Viktor Dukhovni > wrote: > > - what do I specify for the CAfile? That depends on where the operating system distribution squirrels away the usual root CA certificates. You can typically find out wh

Re: postfix/postfix-script[6735] error: unknown command: 'quiet-quick-start'

2017-09-13 Thread Viktor Dukhovni
On Tue, Sep 12, 2017 at 09:57:17PM -0700, xiedeacc wrote: > you're right, I'm learning to write a systemd style script, but not familiar > with postmulti Start scripts don't need to know anything about postmulti. The whole point of the design is that "postfix start" starts all the relevant Postf

Re: Letsencrypt tip

2017-09-13 Thread Dominic Raferd
On 11 September 2017 at 17:22, Dominic Raferd wrote: > On 11/09/2017 12:33, Christian Kivalo wrote: > >> On 2017-09-11 11:21, Dominic Raferd wrote: >> >>> ​Does anyone know a way to detect if the certificate currently being >>> used by Postfix and/or Dovecot is nearing expiry (esp. in case they >

Re: Increasing spam level to backup MX

2017-09-13 Thread Davide Marchi
Il 2017-09-11 14:23 Philip Paeps ha scritto: On 2017-09-11 14:13:29 (+0200), Davide Marchi wrote: activating a backup server I realized that some spammers using this server to send spam to my relay_recipient_maps addresses. Spam is then successfully forwarded to the main server. Is there a pa

Header_Checks non-exsiting field check

2017-09-13 Thread Robby Van Mieghem
Hi is there a way with header_checks to check if a field does not exist ? We want to reject mails that do not include the field X-MS-Exchange-CrossTenant-id But unable to find it ... Any hekp pls tx R

Re: Header_Checks non-exsiting field check

2017-09-13 Thread Noel Jones
On 9/13/2017 9:02 AM, Robby Van Mieghem wrote: > Hi > > is there a way with header_checks to check if a field does not exist ? > > We want to reject mails that do not include the field > X-MS-Exchange-CrossTenant-id No, header_checks cannot check for a missing header. It examines each header in

Re: Letsencrypt tip

2017-09-13 Thread Viktor Dukhovni
> On Sep 13, 2017, at 4:10 AM, Dominic Raferd wrote: > > As Postfix SMTP server does not support SNI I think there is no point using > -servername option above, so the above can be shortened to: > > ​echo | > sudo openssl s_client -connect 127.0.0.1:587 -starttls smtp 2>/dev/null | > openssl x5

RE: TLS on 587

2017-09-13 Thread Mohammed Khalid Ansari
Dear Mr. Victor, Sorry for the late response on your request of log. Following is the log when I ran postfix on submission (587) port with connection type in the client as SSL/TLS (and not STARTTLS)... Sep 13 21:07:54 mx02 postfix/smtpd[19896]: connect from unknown[192.168.10.38] Sep 13 21:07:54

Re: TLS on 587

2017-09-13 Thread Benny Pedersen
Mohammed Khalid Ansari skrev den 2017-09-13 19:19: delays=0.11/0/0/0.01, dsn=2.0.0, status=sent (delivered to maildir) Sep 13 21:12:59 mx02 postfix/qmgr[19890]: 4235945E2424: removed Sep 13 21:12:59 mx02 postfix/smtpd[19972]: disconnect from unknown[192.168.10.38] and this is possible port 25,

Re: How to check for upcoming certificate expiration...

2017-09-13 Thread Łukasz Wąsikowski
W dniu 2017-09-11 o 18:25, Viktor Dukhovni pisze: > >> On Sep 11, 2017, at 5:21 AM, Dominic Raferd wrote: >> >> Does anyone know a way to detect if the certificate currently being used by >> Postfix and/or Dovecot is nearing expiry (esp. in case they haven't picked >> up the updated letsencrypt

Re: How to check for upcoming certificate expiration...

2017-09-13 Thread Viktor Dukhovni
> On Sep 13, 2017, at 3:43 PM, Łukasz Wąsikowski wrote: > >> See below for OpenSSL 1.0.2 or later. Earlier versions don't >> have the "-verify_hostname" option, you can delete it if you >> like, and omit that part of the certificate check, in which >> case the code will also work for OpenSSL 1.