Fwd: Issue with Postfix and GSSAPI Authentication

Hello, I want to set up a Postfix SMTP server with cyrus-sasl in GSSAPI mode. I have two Samba4 servers in AD mode, and my clients are in windows 10. I removed the execution of Posfix in chroot to simplify. I added two keytab in /etc/krb5.keytab smtp/smtptest.domain.fr and host/ smtptest.domain.fr

Re: Fwd: Issue with Postfix and GSSAPI Authentication

Hello, Le 01/10/2021 à 16:17, Sam R a écrit : Hello, I want to set up a Postfix SMTP server with cyrus-sasl in GSSAPI mode. I have two Samba4 servers in AD mode, and my clients are in windows 10. I removed the execution of Posfix in chroot to simplify. I added two keytab in /etc/krb5.keytab s

cleanup services cpu overload

Hello, I have three servers with Postfix and all day they were with a lot of CPU use and it is not normal for this to happen. top - 11:56:16 up 199 days, 56 min, 6 users, load average: 40,12, 31,17, 21,94 Tasks: 578 total, 46 running, 528 sleeping, 0 stopped, 4 zombie %Cpu0 : 88,1 us, 5,

Re: Fwd: Issue with Postfix and GSSAPI Authentication

On Fri, Oct 01, 2021 at 04:17:03PM +0200, Sam R wrote: > I added two keytab in /etc/krb5.keytab There's your problem, the /etc/krb5.keytab file, given services like SSH with GSSAPI authentication, contains secrets sufficient to login to the host as any user, possibly including root. It must belo

Re: cleanup services cpu overload

SysAdmin EM: > ## Chequeo de header > header_checks = regexp:/etc/postfix/header_checks > > ## Chequeos de body > body_checks = regexp:/etc/postfix/body_checks These can use lots of CPU for example with patterns that require backtracking. (google for "regexp cpu"). Note that regexp: is less effi

Re: Fwd: Issue with Postfix and GSSAPI Authentication

On Fri, Oct 01, 2021 at 12:47:29PM -0400, Viktor Dukhovni wrote: > > -- basics -- > > Postfix: 3.5.6 > > Since you're using Postfix 3.5, which by default supports long SASL > messages after the initial response, your client is in violation of the > SMTP SASL specification, and needs to have a bug

Re: cleanup services cpu overload

Hello Wietse. Thank you for your answer, you are always attentive to everyone, you were very kind. I'm going to start using pcre, in the header_checks file I have certain locks to prevent sending spam or phishing. /^Subject: Invest once and get passive income.*/ DISCARD SUB

Re: cleanup services cpu overload

On 01.10.21 14:16, SysAdmin EM wrote: Hello Wietse. Thank you for your answer, you are always attentive to everyone, you were very kind. I'm going to start using pcre, in the header_checks file I have certain locks to prevent sending spam or phishing. /^Subject: Invest once and get passive inco

Re: cleanup services cpu overload

SysAdmin EM: > Hello Wietse. Thank you for your answer, you are always attentive to > everyone, you were very kind. > > I'm going to start using pcre, in the header_checks file I have certain > locks to prevent sending spam or phishing. > > /^Subject: Invest once and get passive income.*/ >

Re: cleanup services cpu overload

Thanks Wietse and Matus. I understand that I must work this way, examples: if /^Subject:/ /^Subject: Invest once and get passive income(.*)/ DISCARD SUBJECTSPAM2293 /^Subject: Earnings on a trading robot(.*)/ DISCARD SUBJECTSPAM2294 /^Subject: Working Online At Home(.*)/

Re: cleanup services cpu overload

SysAdmin EM: > Thanks Wietse and Matus. > > I understand that I must work this way, examples: > > if /^Subject:/ > /^Subject: Invest once and get passive income(.*)/ > DISCARD SUBJECTSPAM2293 > /^Subject: Earnings on a trading robot(.*)/ DISCARD > SUBJECTSPAM2294 > /^Subjec

Re: cleanup services cpu overload

On 2021-10-01 at 13:16:12 UTC-0400 (Fri, 1 Oct 2021 14:16:12 -0300) SysAdmin EM is rumored to have said: > I am going to ask an additional question, is the syntax of pcre similar to > regexp? because I will have to modify many rules. PCRE is an acronym for "Perl Compatible Regular Expressions"