Re: How best to eliminate "domain mismatch" warning in mail clients when TLS is used

2013-07-15 Thread Jeffrey 'jf' Lim
On Tue, Jul 16, 2013 at 12:47 AM, Ben Johnson wrote: > Hello, > > We host mail services for a few dozen domains. We will eventually > require TLS for all client connections. > > I have reviewed what seems to be the most comprehensive thread on this > subject ( > http://postfix.1071664.n5.nabble.co

Re: How best to eliminate "domain mismatch" warning in mail clients when TLS is used

2013-07-15 Thread Jeffrey 'jf' Lim
On 16 Jul 2013 03:15, "Wietse Venema" wrote: > > Ben Johnson: > > On 7/15/2013 1:10 PM, Viktor Dukhovni wrote: > > > On Mon, Jul 15, 2013 at 12:47:53PM -0400, Ben Johnson wrote: > > > > > >> In essence, our clients wish to use their own SSL certificates for their > > >> SMTP connections. > > > > >

smtpd_client_restrictions = reject_unauth_pipelining weirdness

2013-07-28 Thread Jeffrey 'jf' Lim
Am I misunderstanding something here, that setting 'smtpd_client_restrictions = reject_unauth_pipelining' should reject a client that sends the EHLO, or HELO before the smtp banner? (http://www.postfix.org/postconf.5.html#reject_unauth_pipelining: 'Reject the request when the client sends SMTP comm

Re: smtpd_client_restrictions = reject_unauth_pipelining weirdness

2013-07-28 Thread Jeffrey 'jf' Lim
On Mon, Jul 29, 2013 at 3:56 AM, Wietse Venema wrote: > Jeffrey 'jf' Lim: >> Am I misunderstanding something here, that setting >> 'smtpd_client_restrictions = reject_unauth_pipelining' should reject a >> client that sends the EHLO, or HELO before th

Re: smtpd_client_restrictions = reject_unauth_pipelining weirdness

2013-07-28 Thread Jeffrey 'jf' Lim
On Mon, Jul 29, 2013 at 4:13 AM, Wietse Venema wrote: > Jeffrey 'jf' Lim: >> On Mon, Jul 29, 2013 at 3:56 AM, Wietse Venema wrote: >> > Jeffrey 'jf' Lim: >> >> Am I misunderstanding something here, that setting >> >> 'sm

Re: smtpd_client_restrictions = reject_unauth_pipelining weirdness

2013-07-28 Thread Jeffrey 'jf' Lim
On Mon, Jul 29, 2013 at 4:51 AM, Wietse Venema wrote: > Jeffrey 'jf' Lim: >> > Allow me to repeat my reply above: >> > >> > Current reject_unauth_pipelining implementations [...] don't reject >> > clients that talk before Postfix greets them

Re: postfix.org down?

2013-08-20 Thread Jeffrey 'jf' Lim
On Tue, Aug 20, 2013 at 10:34 PM, Charles Marcus wrote: > On 2013-08-20 10:29 AM, btb wrote: > > On 2013.08.20 10.23, Charles Marcus wrote: > > for me at least... > > > http://www.downforeveryoneorjustme.com/www.postfix.org > > > Well, it is back up now for me, so either it was really down for a

Re: Rejecting emails based on domain blacklist

2013-11-25 Thread Jeffrey 'jf' Lim
On Mon, Nov 25, 2013 at 9:51 PM, Wietse Venema wrote: > Mark Goodge: > > What would be the simplest method in Postfix of implementing an > > equivalent to the exim ACL mentioned in this blog post: > > > > http://blog.hinterlands.org/2013/10/unwanted-email-from-communicado-ltd/ > > > > That is, wh

Re: Blocking executables. What did I miss?

2014-06-01 Thread Jeffrey 'jf' Lim
On Sun, Jun 1, 2014 at 1:11 PM, Inteq Solution - Dep. Tehnic wrote: > Hello > > > > Tonight, while checking Postfix config, I have stumbled upon something > weird. > > > > I am blocking executables and potentially dangerous extensions with > header_checks = pcre:/etc/postfix/header_checks.pcre > >

Re: Blocking executables. What did I miss?

2014-06-01 Thread Jeffrey 'jf' Lim
2014 at 02:52:44AM +0800, Jeffrey 'jf' Lim wrote: > > > I'm not really familiar with the usage of pcre with postfix, but > > [...] > > Therefore, you should not be adding to the OP's confusion. > > -- > Viktor. >

Re: Blocking executables. What did I miss?

2014-06-01 Thread Jeffrey 'jf' Lim
On Jun 2, 2014 4:18 AM, "Viktor Dukhovni" wrote: > > On Mon, Jun 02, 2014 at 02:52:44AM +0800, Jeffrey 'jf' Lim wrote: > > > I'm not really familiar with the usage of pcre with postfix, but > > [...] > > Therefore, you should not be adding

Re: Blocking executables. What did I miss?

2014-06-01 Thread Jeffrey 'jf' Lim
On Mon, Jun 2, 2014 at 11:43 AM, Noel Jones wrote: > On 6/1/2014 1:52 PM, Jeffrey 'jf' Lim wrote: >> On Sun, Jun 1, 2014 at 1:11 PM, Inteq Solution - Dep. Tehnic >> wrote: >>> Hello >>> >>> >>> >>> Tonight, w

Re: policy daemon failure

2014-06-03 Thread Jeffrey 'jf' Lim
On Jun 3, 2014 12:06 AM, wrote: > > > > > you *do not* lose anything > > > > 451 is a *temporary* error > > 5xx would be a complete reject > > > > Yes, but many mails rejected in an incident this morning haven't been resent. I guess we're dealing with broken clients. > What sort of "broken" clien

Re: blocking spam IP with netfitler good idea or not ?

2014-06-19 Thread Jeffrey 'jf' Lim
On Thu, Jun 19, 2014 at 10:04 PM, Birta Levente wrote: > On 19/06/2014 16:57, Giuseppe De Nicolo' wrote: > >> Hi, >> >> I have a question for you more experienced admin , I have some good >> abuse on my servers by IP listed in spam list , since I am using postscreen >> to block those all is

Re: Reject Chinese mail

2019-11-23 Thread Jeffrey 'jf' Lim
On Sat, 23 Nov 2019 at 10:00, 황병희 wrote: > merr...@fn.de writes: > > > [...] do you think if it is possible to reject all mails from China? > Thanks > > How about moving to Gmail(Google Apps)? Gmail's spam defense is not bad, i > think. I disagree. It often labels mailing list email as spam, ev

typo in SASL_README or? (s/per-sender relayhost file/per-sender sender_dependent_relayhost_maps file/ maybe?)

2015-10-29 Thread Jeffrey 'jf' Lim
Under 'Configuring Sender-Dependent SASL authentication', it says: Likewise, the Postfix trivial-rewrite(8) daemon will search the per-sender relayhost file, and use the default relayhost setting only as a final resort. Would it be clearer to say "per-sender sender_dependent_relayhost_maps file"

Re: Blank EHLO/HELO commands

2015-12-21 Thread Jeffrey 'jf' Lim
On Tue, Dec 22, 2015 at 7:26 AM, Noel Jones wrote: > On 12/21/2015 4:54 PM, Wolfe, Robert wrote: > > Hi all. This is not a postfix-specific question, but rather a > > generic one, but I hope I can get the answer I am searching for here. > > > > > > I run a third part SMTP filtering program in wh

Re: Blank EHLO/HELO commands

2015-12-22 Thread Jeffrey 'jf' Lim
On Tue, Dec 22, 2015 at 2:50 PM, Noel Jones wrote: > On 12/21/2015 6:44 PM, Jeffrey 'jf' Lim wrote: > > On Tue, Dec 22, 2015 at 7:26 AM, Noel Jones > > > I quit using reject_unknown_helo_hostname a couple years ago when it > > quickly became clear th

Re: (ot) beware libressl on Freebsd

2016-09-12 Thread Jeffrey 'jf' Lim
On Tue, Sep 13, 2016 at 6:13 AM, wrote: > Freebsd 10.3 > > I ran freebsd "pkg" ‎and didn't see any of the mail suite or openssl in the > list of files to update, so I figured it was safe to run. (I've been burnt > by pkg messing up dovecot or postfix, so I always use the ports). > > Some program

enable_long_queue_ids vowels are unsafe why?

2015-01-01 Thread Jeffrey 'jf' Lim
As per subject. http://www.postfix.org/postconf.5.html#enable_long_queue_ids says: "For safety reasons the vowels (AEIOUaeiou) are excluded from the alphabet." In what way are vowels unsafe? I can see why certain letters might be avoided in order to avoid typos (capital 'i' might be mistaken for l

Re: enable_long_queue_ids vowels are unsafe why?

2015-01-01 Thread Jeffrey 'jf' Lim
On Fri, Jan 2, 2015 at 4:19 AM, Viktor Dukhovni wrote: > On Fri, Jan 02, 2015 at 03:46:49AM +0800, Jeffrey 'jf' Lim wrote: > >> As per subject. >> http://www.postfix.org/postconf.5.html#enable_long_queue_ids says: >> "For safety reasons the vowels (AEIOUa

on compiling: does turning on dynamic loading of database clients save on memory too?

2015-03-08 Thread Jeffrey 'jf' Lim
Dynamic linking results in smaller binaries ( http://www.postfix.org/INSTALL.html#shared_enable), and memory savings, but what about dynamic loading of database clients? Does this work the same way, or is this something different from dynamic linking? It's not altogether clear to me. What does it m

Re: on compiling: does turning on dynamic loading of database clients save on memory too?

2015-03-08 Thread Jeffrey 'jf' Lim
On Mon, Mar 9, 2015 at 3:55 AM, Viktor Dukhovni wrote: > On Mon, Mar 09, 2015 at 03:36:42AM +0800, Jeffrey 'jf' Lim wrote: > > > Dynamic linking results in smaller binaries ( > > http://www.postfix.org/INSTALL.html#shared_enable), and memory savings, > but &g

minor patch: main.cf: note about default for mydestination

2015-03-31 Thread Jeffrey 'jf' Lim
Not too sure about the procedure for contributing, but I noticed something in main.cf (postfix 3.0.0) that didn't look right, specifically the note about the default for mydestination. 'postconf -d' confirms it, as well as http://www.postfix.org/postconf.5.html#mydestination --- a/conf/main.cf

'virtual_transport = lmtp:inet:localhost' produces "Name service error for name=localhost type=A: Host not found"?

2015-03-31 Thread Jeffrey 'jf' Lim
Not too sure what the problem is, but I had to use '127.0.0.1' in place of 'localhost' for my virtual_transport setting to work. 'localhost' is in /etc/hosts ('127.0.0.1 localhost.localdomain localhost'), and a 'ping localhost' at the command line works. This is the line in the log t

Re: 'virtual_transport = lmtp:inet:localhost' produces "Name service error for name=localhost type=A: Host not found"?

2015-03-31 Thread Jeffrey 'jf' Lim
On Wed, Apr 1, 2015 at 8:03 AM, Noel Jones wrote: > On 3/31/2015 5:26 PM, Jeffrey 'jf' Lim wrote: > > Not too sure what the problem is, but I had to use '127.0.0.1' in > > place of 'localhost' for my virtual_transport setting to work.

Re: 'virtual_transport = lmtp:inet:localhost' produces "Name service error for name=localhost type=A: Host not found"?

2015-04-01 Thread Jeffrey 'jf' Lim
On Wed, Apr 1, 2015 at 8:54 AM, Viktor Dukhovni wrote: > On Wed, Apr 01, 2015 at 06:26:44AM +0800, Jeffrey 'jf' Lim wrote: > > > Not too sure what the problem is, but I had to use '127.0.0.1' in place > of > > 'localhost' for my virtual_transpor

Re: minor patch: main.cf: note about default for mydestination

2015-04-01 Thread Jeffrey 'jf' Lim
On Wed, Apr 1, 2015 at 6:57 PM, Wietse Venema wrote: > Jeffrey 'jf' Lim: > > -# The default is $myhostname + localhost.$mydomain. On a mail domain > > -# gateway, you should also include $mydomain. > > +# The default is $myhostname + localhost.$mydomain + localh

Re: Connection timed out

2015-04-19 Thread Jeffrey 'jf' Lim
On Mon, Apr 20, 2015 at 3:53 AM, Richard < inbound-lists-post...@listmail.innovate.net> wrote: > > > Original Message > > Date: Sunday, April 19, 2015 21:37:54 +0200 > > From: Krzs > > > > Hi list ... > > my smtp refuses to deliver mail to SOME adressess not all giving >

Re: lots of connections that make no sense

2019-11-14 Thread Jeffrey &#x27;jf' Lim
On Fri, Nov 15, 2019 at 12:52 PM Viktor Dukhovni wrote: > > On Fri, Nov 15, 2019 at 04:47:55AM +0100, Fourhundred Thecat wrote: > > > I am wondering what is the purpose of connections like these: > > > > postfix/smtpd[5147]: connect from unknown[193.56.28.121] > > postfix/smtpd[5147]: discon

Re: lots of connections that make no sense

2019-11-15 Thread Jeffrey &#x27;jf' Lim
On Fri, Nov 15, 2019 at 6:23 PM Allen Coates wrote: > > > > On 15/11/2019 05:10, Fourhundred Thecat wrote: > > On 15/11/2019 06.06, Jeffrey 'jf' Lim wrote: > >> > >> ok then this makes sense. I've seen bots retry multiple passwords at > >&

Re: lots of connections that make no sense

2019-11-15 Thread Jeffrey &#x27;jf' Lim
On Fri, 15 Nov 2019, 22:26 Bill Cole, < postfixlists-070...@billmail.scconsult.com> wrote: > On 15 Nov 2019, at 5:28, Jeffrey 'jf' Lim wrote: > > > On Fri, Nov 15, 2019 at 6:23 PM Allen Coates > > wrote: > [...] > >> Disabling auth does not stop