Install Postfix SHLIBS in Install Directory - how ?

2020-03-05 Thread zahn
Hello All I installed Postfix 3.4.9 with SHLIB support in /usr/local/postfix. In main.cf I set: shlib_directory = /usr/local/postfix/lib On make install: I get the following error: postfix/postfix-script[40500]: fatal: no Postfix shared-library directory /usr/local/postfix/lib! Can I not inst

Smtp delivery status filter - not working

2020-03-05 Thread Rainer Ruprechtsberger
Hi, I tried to adopt smtp dsn like dokumented here: http://www.postfix.org/postconf.5.html#default_delivery_status_filter Since the example is exactly what I want (so my users get Non delivery notifications for domains where we refuse to send without transport encryption but won't offer it earlie

problem with transport

2020-03-05 Thread natan maciej milaszewski
Hi Sorry about my probably stupid and easy question. I have one server for outgoing smtp and I added a spamassassin to filtered outgoing e-mial This is trivial like cut master.cf: start - smtp      inet  n    -    n    -    -    smtpd -o content_filter=spamassassin submission

Re: problem with transport

2020-03-05 Thread Jaroslaw Rafa
Dnia 5.03.2020 o godz. 12:06:43 natan maciej milaszewski pisze: > > I use DKIM (added like documentations) > > In log i found double added DKIM - because the mail goes back to the > queue and smtpd_milters tags it again ... > > Probably I must create a returns transport with "-o smtpd_milters="

Re: problem with transport

2020-03-05 Thread natan maciej milaszewski
Hi Thenx for replay :) You have right I forget add a "-o smtpd_milters" in smtp smtp      inet  n    -    n    -    -    smtpd  -o content_filter=spamassassin  -o smtpd_milters= But Your solution is better On 05.03.2020 12:19, Jaroslaw Rafa wrote: > Dnia 5.03.2020 o godz. 12:06:43 natan maciej

Re: Smtp delivery status filter - not working

2020-03-05 Thread Wietse Venema
Rainer Ruprechtsberger: > Hi, > > I tried to adopt smtp dsn like dokumented here: > http://www.postfix.org/postconf.5.html#default_delivery_status_filter > > Since the example is exactly what I want (so my users get Non delivery > notifications for domains where we refuse to send without transpor

Re: Install Postfix SHLIBS in Install Directory - how ?

2020-03-05 Thread Wietse Venema
zahn: > I do not want: /usr/lib/postfix! for the SHLIBS - it MUST be in the > Installation Directory: /usr/local/postfix Then you need to specify that at BUILD time not INSTALL time. See section 4.3.3 in the INSTALL file. Begin quote To override the default location of Postfix dynamically-linked

Re: Install Postfix SHLIBS in Install Directory - how ?

2020-03-05 Thread Wietse Venema
Wietse Venema: > zahn: > > I do not want: /usr/lib/postfix! for the SHLIBS - it MUST be in the > > Installation Directory: /usr/local/postfix > > Then you need to specify that at BUILD time not INSTALL time. > See section 4.3.3 in the INSTALL file. > > Begin quote > To override the default locat

round robin sender_dependent_relayhost_maps

2020-03-05 Thread Emanuel Gonzalez
Hello, I have a mail server with one domain and two servers i use to send email transactional. My question is, it's possible configure the parameter sender_dependent_relayhost_maps with round robin? sender_dependent_default_transport_maps = hash:/etc/postfix/sender_dependant_default_transport.ma

Re: round robin sender_dependent_relayhost_maps

2020-03-05 Thread Wietse Venema
Emanuel Gonzalez: > Hello, > > I have a mail server with one domain and two servers i use to send email > transactional. > > My question is, it's possible configure the parameter > sender_dependent_relayhost_maps with round robin? Generally, Postfix does not support nested tables, so it cannot d

Disabling TLSv1

2020-03-05 Thread ratatouille
Hello! Don't know why TLSv1 is still offered on our servers running mail_version = 2.11.3 smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1 but a scan by ssllabs.com or with testssl.sh shows TLSv1 is still supported. I am not sure what's wrong. What do I miss? Other parameters I set: smtpd_tls_CApa

Re: Disabling TLSv1

2020-03-05 Thread Viktor Dukhovni
On Thu, Mar 05, 2020 at 09:08:43PM +0100, ratatouille wrote: > Don't know why TLSv1 is still offered on our servers running Probably because you're not changing the configuration in the right place. Double-check that you're configuring the correct Postfix instance (if using multiple instances) a

Re: Disabling TLSv1

2020-03-05 Thread Daniel Ryšlink
Hello, I tried disabling TLSv1.0 and TLSv1.1 on our Postfix mailservers at the beginning of the year (since there were advisories that anything older than 1.2 is considered weak and broken), and it did not end well, there were numerous complaints from what turned out to be still supported LTS

Re: Disabling TLSv1

2020-03-05 Thread ratatouille
Viktor Dukhovni schrieb am 05.03.20 um 16:44:14 Uhr: > On Thu, Mar 05, 2020 at 09:08:43PM +0100, ratatouille wrote: > > > Don't know why TLSv1 is still offered on our servers running > > Probably because you're not changing the configuration in the right > place. Double-check that you're co

Re: Disabling TLSv1

2020-03-05 Thread Viktor Dukhovni
On Fri, Mar 06, 2020 at 12:26:06AM +0100, ratatouille wrote: > I have just too TLSv1 connections this month: > ... > 11 TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits) > 9 TLSv1.2 with cipher CAMELLIA256-SHA (256/256 bits) > 9 TLSv1.2 with cipher CAMELLIA128-SHA (128/128 bits) > 9 TLSv1

Re: Disabling TLSv1

2020-03-05 Thread Doug Hardie
> On 5 March 2020, at 15:26, ratatouille wrote: > > Viktor Dukhovni schrieb am 05.03.20 um 16:44:14 > Uhr: > >> On Thu, Mar 05, 2020 at 09:08:43PM +0100, ratatouille wrote: >> >>> Don't know why TLSv1 is still offered on our servers running >> >> Probably because you're not changing the

Re: Disabling TLSv1

2020-03-05 Thread Viktor Dukhovni
On Thu, Mar 05, 2020 at 03:57:59PM -0800, Doug Hardie wrote: > Small mail server with 3 weeks of logs: > >1761 TLSv1 > 18 TLSv1.1 > 20414 TLSv1.2 >6343 TLSv1.3 > > That's not what I expected. I thought v1 and v1.1 would be reversed. > There is a complete spectrum of ciphers being

Re: Disabling TLSv1

2020-03-05 Thread Allen Coates
Virtually all my TLSv1 connections come from this mailing list... Would there be any mileage in disabling OUTBOUND TLSv1 connections while accepting inbound for a little while longer? Allen C On 05/03/2020 20:08, ratatouille wrote: > Hello! > > Don't know why TLSv1 is still offered on our serve

Re: Disabling TLSv1

2020-03-05 Thread Viktor Dukhovni
On Fri, Mar 06, 2020 at 02:16:42AM +, Allen Coates wrote: > Virtually all my TLSv1 connections come from this mailing list... > > Would there be any mileage in disabling OUTBOUND TLSv1 connections while > accepting inbound for a little while longer? You can certainly configure each direction

Re: Disabling TLSv1

2020-03-05 Thread Doug Hardie
> On 5 March 2020, at 17:15, Viktor Dukhovni wrote: > > On Thu, Mar 05, 2020 at 03:57:59PM -0800, Doug Hardie wrote: > >> Small mail server with 3 weeks of logs: >> >> 1761 TLSv1 >> 18 TLSv1.1 >> 20414 TLSv1.2 >> 6343 TLSv1.3 >> >> That's not what I expected. I thought v1 and v1.1 wo