ldap_table works and doesn't...

2014-08-20 Thread Marek Kozlowski
:-) I have an openldap server for accounts and other servers use pam_ldap. We'd like to to store e-mail aliases as an LDAP `mail' attribute. A user with a common name `temp1' has the attribute `mail' set to `m.kozlow...@poczta.mini.pw.edu.pl'. Expected behavior: mail sent to `m.kozlow...@poczta.mi

Re: ldap_table works and doesn't...

2014-08-21 Thread Marek Kozlowski
:-) > The documented lookup key for local aliases(5) in the local(8) > delivery agent is the bare localpart of the address "m.kozlowski" > not "m.kozlow...@poczta.mini.pw.edu.pl". > > You're likely to have more luck with LDAP-based address to address > rewriting via virtual_alias_maps not alias_m

Re: ldap_table works and doesn't...

2014-08-21 Thread Marek Kozlowski
:-) > The documented lookup key for local aliases(5) in the local(8) > delivery agent is the bare localpart of the address "m.kozlowski" > not "m.kozlow...@poczta.mini.pw.edu.pl". > > You're likely to have more luck with LDAP-based address to address > rewriting via virtual_alias_maps not alias_m

Re: ldap_table works and doesn't...

2014-08-21 Thread Marek Kozlowski
On 08/21/2014 02:03 PM, Wietse Venema wrote: > Marek Kozlowski: >> Why didn't I have such error during the `RCPT TO:' phase? Why did it >> "partially" worked - solved and continued to the `DATA' phase not failed >> at all? > > That works &q

Selected `RCPT TO:' addresses allowed only from SASL authenticated?

2014-08-23 Thread Marek Kozlowski
:-) I wonder if it is possible. If so - thanks for any tips. I'd like some `RCPT TO:' addresses accepted if and only if those mails are send by local users - that is those authenticated via SASL. That is for some selected `RCPT TO:'s : permit_sasl_authenticated, reject Best regards, Mare

smtp_tls*_protocols and !TLSv1

2021-07-02 Thread Marek Kozlowski
:-) Maybe seems strange but... With those settings my postfix (3.5.9) no broken connections are reported: smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1.1 smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1.1 But when I change to those: smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1,

Re: smtp_tls*_protocols and !TLSv1

2021-07-02 Thread Marek Kozlowski
:-) On 7/2/21 3:56 PM, Bastian Blank wrote: On Fri, Jul 02, 2021 at 03:14:58PM +0200, Marek Kozlowski wrote: It looks like '!TLSv1' is seen as something like "!TLSv1.x" ("no TLS 1.x at all") rather than "!TLSv1.0". Yes it is a stup

forged sender addresses from my domain

2021-07-02 Thread Marek Kozlowski
:-) I'd like to disable any mail from 'my.domain' from external networks and non authenticated users. For envelope addresses my solution works and is as follows: At first bind valid addresses with their owners: smtpd_sender_restrictions = ... reject_sender_login_mismatch,

Re: forged sender addresses from my domain

2021-07-02 Thread Marek Kozlowski
:-) I'd like to disable any mail from 'my.domain' from external networks and non authenticated users. For envelope addresses my solution works and is as follows: At first bind valid addresses with their owners: Precisely: smtpd_sender_restrictions = check_sender_acces ... c

Re: forged sender addresses from my domain

2021-07-02 Thread Marek Kozlowski
:-) On 7/2/21 5:02 PM, post...@ptld.com wrote: Do you mean this literally? Stopping me from sending an email using my mail server that claims to be from 'your.domain'? You can't, you can only publish SPF records and hope the receiving mail server of the spoofed email rejects it based on those

Re: forged sender addresses from my domain

2021-07-02 Thread Marek Kozlowski
:-) On 7/2/21 5:10 PM, post...@ptld.com wrote: OK, small clarification: I'd like to disable any mail from 'my.domain' from external networks and non authenticated users... ...delivered to my users. Making sure i understand, you are saying you want to stop me from using my mail server from s

Canonicals and SRS

2019-11-20 Thread Marek Kozlowski
:-) Due to SPF restrictions I'm interested in SRS address rewriting. For this purpose I'm using postsrsd (do you have any better solution?). The recommended configuration of postsrsd is quite simple and as follows (main.cf): sender_canonical_maps = tcp:localhost:10001 sender_canonical_classe

Forwarding mail without breaking SPF?

2019-11-26 Thread Marek Kozlowski
:-) Some users forward their incoming mail to some external mail servers. Unfortunately AFAIK with no action taken it may result in breaking the SPF. The solution for this problem I know is rewriting addresses with SRS (postsrsd). Unfortunately postsrsd uses the same settings as canonicals do

Re: Forwarding mail without breaking SPF?

2019-11-26 Thread Marek Kozlowski
:-) Some users forward their incoming mail to some external mail servers. Unfortunately AFAIK with no action taken it may result in breaking the SPF. The solution for this problem I know is rewriting addresses with SRS (postsrsd). Unfortunately postsrsd uses the same settings as canonicals do wh

Re: Forwarding mail without breaking SPF?

2019-11-26 Thread Marek Kozlowski
:-) sender_canonical_maps = unionmap:{ldap:/etc/postfix/ldap-canonical.cf, ldap:/etc/postfix/ldap-canonical2.cf, tcp:127.0.0.1:10001} By design, unionmap can produce multiple results separated by comma. That would be wrong. > Why not: sender_canonical_maps = ldap:/etc/postfix/ldap-canonical.c

Preventing domain impresonation

2020-08-27 Thread Marek Kozlowski
:-) Let's assume my hostname is 'sth.mydomain.tld' The following configuration: #- smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, check_sender_access hash:/etc

Very selective relay

2020-09-18 Thread Marek Kozlowski
:-) I've been asked a very strange question. According to the best of my knowledge there is no setting but maybe I'm wrong: Is it possible the define a very selective relay according to the following pseudo code: /* a, b and c are set to some single values */ if (client's_IP==a) if (MAIL

Re: Very selective relay

2020-09-22 Thread Marek Kozlowski
:-) On 9/18/20 6:09 PM, Viktor Dukhovni wrote: On Fri, Sep 18, 2020 at 11:50:02AM +0200, Marek Kozlowski wrote: I've been asked a very strange question. According to the best of my knowledge there is no setting but maybe I'm wrong: Is it possible the define a very selective relay

Disabling delivery to local users

2020-09-22 Thread Marek Kozlowski
:-) Well... Let's imagine that my SMTP server is an MX for 'mydomain.tld' (and some other ones). I've defined LDAP query for 'virtual_alias_maps', something like: virtual_alias_maps = ldap:/etc/postfix/ldap-aliases.cf The query file in some very simplified form can be expressed as: server_h

Re: Disabling delivery to local users

2020-09-25 Thread Marek Kozlowski
As far as I can see the problem regards only mails sent from this server (from local users). If there is a mail from a remote one it works fine, that is: Recipient address rejected: User unknown in local recipient table error occurs. Hmm? On 9/22/20 4:43 PM, Marek Kozlowski wrote: :-) Well

Re: Disabling delivery to local users

2020-09-26 Thread Marek Kozlowski
:-) First of all. The Directory structure and the config may seems a little bit strange but, in fact, there are some important historical reasons (backward compatibility, many, many years ago we started with Novell NDS and NetWare4 and so on...) for having it as described. It's worth mentioni

testing an LDAP lookup?

2020-10-10 Thread Marek Kozlowski
:-) I can't find the answer in both: http://www.postfix.org/LDAP_README.html http://www.postfix.org/ldap_table.5.html :-( Is there a way of testing an LDAP (alias_maps = ldap:...) lookup table apart of the postfix. I mean: for some set of addresses I'm not sure if the result is as expected a

Delivering to virtual_alias_maps only?

2020-10-10 Thread Marek Kozlowski
:-) Must be simple... but I missed it. I asked for it in the context on LDAP but I think I may simplify my question: Is it possible to accept mail if the recipients address is found in virtual_alias_maps and reject in all other cases? Let's imagine I have two entries for virtual_alias_maps:

Mail from @somedomain.tld allowed only from some CIDR ranges?

2021-02-07 Thread Marek Kozlowski
:-) Presumably it's my fault but I cannot find such an option. If so - thank you for directing me to it. I'm wondering if it possible to limit incoming mail with '...@somedomain.tld' specified as a sender address*) to IPs belonging from some CIDR ranges: - if addresses from the ranges belong

Re: Mail from @somedomain.tld allowed only from some CIDR ranges?

2021-02-07 Thread Marek Kozlowski
th sender's address 'sth3.tld' should be accepted even if the user is not authenticated, and rejected without authentication for other CIDR blocks. Best regards, Marek On 2/7/21 5:33 PM, Marek Kozlowski wrote: :-) Presumably it's my fault but I cannot find such an option. If

Re: Mail from @somedomain.tld allowed only from some CIDR ranges?

2021-02-07 Thread Marek Kozlowski
:-) On 2/7/21 6:34 PM, Benny Pedersen wrote: On 2021-02-07 18:28, Marek Kozlowski wrote: Mail from 192.168.3/24 with sender's address 'sth3.tld' should be accepted even if the user is not authenticated, and rejected without authentication for other CIDR blocks. add 19

Re: Mail from @somedomain.tld allowed only from some CIDR ranges?

2021-02-07 Thread Marek Kozlowski
:-) On 2/7/21 7:51 PM, Bill Cole wrote: On 7 Feb 2021, at 12:52, Marek Kozlowski wrote: :-) On 2/7/21 6:34 PM, Benny Pedersen wrote: On 2021-02-07 18:28, Marek Kozlowski wrote: Mail from 192.168.3/24 with sender's address 'sth3.tld' should be accepted even if the user is no

fork_attempts=10 ?

2021-02-07 Thread Marek Kozlowski
:-) I'm working on simplification, adding comments and brushing up my main.cf. I've just found the following entry: fork_attempts=10 Seems to be added manually so there was some reason for it. Unfortunately there is no comment on it in the file. The documentation is very short: "Limit on

Re: fork_attempts=10 ?

2021-02-07 Thread Marek Kozlowski
:-) On 2/7/21 10:00 PM, Wietse Venema wrote: Marek Kozlowski: :-) I'm working on simplification, adding comments and brushing up my main.cf. I've just found the following entry: fork_attempts=10 Seems to be added manually so there was some reason for it. How many people

Re: fork_attempts=10 ?

2021-02-08 Thread Marek Kozlowski
:-) On 2/7/21 11:29 PM, Bob Proulx wrote: Marek Kozlowski wrote: No, such configurable limits are great. My question was different. I suppose that many many years ago, many versions ago I had some problem with this server and I tried to solve it or apply a quick fix by incrementing the limit

why people connect clamav as milter in main.cf and smapassassin in master.cf?

2021-02-10 Thread Marek Kozlowski
:-) I know that clamav and spamassassin are out of scope of this list. But my question is more postfix-related. Most systems and Linux distros have tutorials on postfix, spamassassin and clamav. In most of I've read the recommended way of connecting clamav is via smtpd_milters in main.cf. But

Settings for limiting abuse

2021-03-03 Thread Marek Kozlowski
:-) I mean protecting from the situation that one user's password has been compromised and it results in a lot of spam in being sent by our server (human's reaction takes a few minutes and it my be too much, I'm afraid). I've found several useful settings in http://www.postfix.org/postconf.5

Re: Settings for limiting abuse

2021-03-03 Thread Marek Kozlowski
anvil_rate_time_unit for that purpose? Best regards, Marek On 3/3/21 1:09 PM, Marek Kozlowski wrote: :-) I mean protecting from the situation that one user's password has been compromised and it results in a lot of spam in being sent by our server (human's reaction takes a few

MAIL FROM: <""> ??

2021-03-03 Thread Marek Kozlowski
:-) When testing my server via telnet ... 25 it works: MAIL FROM: <""> 250 2.1.0 Ok Moreover an active 'reject_sender_login_mismatch' restriction not blocked mail from SASL authenticated user (a compromised account) with such an envelope address. What have I missed? BTW: MAIL FROM: <> 503

Re: MAIL FROM: <""> ??

2021-03-03 Thread Marek Kozlowski
:-) On 3/3/21 5:18 PM, Bill Cole wrote: On 3 Mar 2021, at 9:51, Marek Kozlowski wrote: :-) When testing my server via telnet ... 25 it works: MAIL FROM: <""> 250 2.1.0 Ok Rejections in SMTP based on client, helo, and sender policy criteria are normally postponed until the R

smtpd_client_recipient_rate_limit - how about a SASL authenticated user?

2021-03-04 Thread Marek Kozlowski
:-) smtpd_client_recipient_rate_limit : "The maximal number of recipient addresses that any client is allowed to send to this service per time unit, regardless of whether or not Postfix actually accepts those recipients." I'm afraid I know several anvil related limits for *clients* rather tha

reject_sender_login_mismatch and rewriting problem...

2014-09-22 Thread Marek Kozlowski
:-) My postfix hostname is `mail.my.domain'. DNS settings result in redirecting not only mail to `some...@mail.my.domain' but also mail addressed to: `sm...@programmers.my.domain', `jo...@office.my.domain', etc to this host. `virtual_alias_maps' allow resolving: sm...@programmers.my.domain -> sm

Re: reject_sender_login_mismatch and rewriting problem...

2014-09-22 Thread Marek Kozlowski
:-) >> My postfix hostname is `mail.my.domain'. >> >> DNS settings result in redirecting not only mail to >> `some...@mail.my.domain' but also mail addressed to: >> `sm...@programmers.my.domain', `jo...@office.my.domain', etc to this host. >> >> `virtual_alias_maps' allow resolving: >> sm...@progra

LDAP: choosing one value from a multi-valued attribute

2014-09-22 Thread Marek Kozlowski
:-) Is it possible: I'm looking for YES or NO and can't find in the docs. Can I define a filter for a multivalued LDAP attribute to obtain a single selected (pattern-matching) value? Best regards, Marek

How to disable Unix users?

2014-09-29 Thread Marek Kozlowski
:-) Maybe a stupid question... I'd like to allow incoming (or local) mail only addressed to aliases specified in `vitual_alias_maps' and `alias_map' but reject recipient addresses using user names. For example I have a user `smithj' which has an alias (or virtual) `john.smith'(@...). I'd like to ac

Re: How to disable Unix users?

2014-09-29 Thread Marek Kozlowski
On 09/29/2014 08:30 PM, Wietse Venema wrote: > Marek Kozlowski: >> Maybe a stupid question... >> I'd like to allow incoming (or local) mail only addressed to aliases >> specified in `vitual_alias_maps' and `alias_map' but reject recipient >> addresses u

Re: How to disable Unix users?

2014-09-29 Thread Marek Kozlowski
On 09/29/2014 08:39 PM, Wietse Venema wrote: > Marek Kozlowski: > [ Charset ISO-8859-2 converted... ] >> On 09/29/2014 08:30 PM, Wietse Venema wrote: >>> Marek Kozlowski: >>>> Maybe a stupid question... >>>> I'd like to allow incoming (or local

Re: How to disable Unix users?

2014-09-29 Thread Marek Kozlowski
On 09/29/2014 08:51 PM, Wietse Venema wrote: > Wietse Venema: >> Wietse Venema: >>> Marek Kozlowski: >>> [ Charset ISO-8859-2 converted... ] >>>> On 09/29/2014 08:30 PM, Wietse Venema wrote: >>>>> Marek Kozlowski: >>>>>> Mayb

mydestination and virtual_alias_maps problem

2014-09-30 Thread Marek Kozlowski
:-) The scenario: For some reasons there are two mail servers: `myshost.mydomain' and `mydomain'. `myhost.mydomain' uses LDAP servers (pam_ldap, nss_ldap) as an authentication source. Users' email addresses are stored as an LDAP attributes which are accessed via: virtual_alias_maps = ldap:/etc/p

Re: mydestination and virtual_alias_maps problem

2014-09-30 Thread Marek Kozlowski
14 11:04 AM, Marek Kozlowski wrote: > :-) > > The scenario: > > For some reasons there are two mail servers: `myshost.mydomain' and > `mydomain'. `myhost.mydomain' uses LDAP servers (pam_ldap, nss_ldap) as > an authentication source. Users' email addresse

Re: mydestination and virtual_alias_maps problem

2014-09-30 Thread Marek Kozlowski
On 09/30/2014 01:26 PM, Wietse Venema wrote: > Marek Kozlowski: > [ Charset ISO-8859-2 converted... ] >> :-) >> >> The scenario: >> >> For some reasons there are two mail servers: `myshost.mydomain' and >> `mydomain'. `myhost.mydomain' uses

Re: mydestination and virtual_alias_maps problem

2014-09-30 Thread Marek Kozlowski
On 09/30/2014 02:47 PM, Wietse Venema wrote: > Marek Kozlowski: >> So the question is: can I "ignore" virtual map entries with domain names >> not present in some list if I cannot edit the virtual_alias_maps source? > > See "man 5 ldap", and look for the

Re: mydestination and virtual_alias_maps problem

2014-09-30 Thread Marek Kozlowski
:-) >> So: yes, I can deal with it. One again the question: Can I do it at >> postfix (not postfix driver) level? Is there any postfix option which says: >> "I'm serving only the following virtual domains; ignore those entries >> in virtual_alias_maps that don't match it"? > > If you say "I'm se

Re: mydestination and virtual_alias_maps problem

2014-09-30 Thread Marek Kozlowski
:-) > If you want to apply the same filter to MULTIPLE maps: > > /etc/postfix/main.cf: > virtual_alias_maps = > pipemap{pcre:/etc/postfix/domain_filter, ldap:/path/to/ldapfile} > pipemap{pcre:/etc/postfix/domain_filter, mysql:/path/to/myselfile} > > /etc/postfix/domain_filter: >

Re: mydestination and virtual_alias_maps problem

2014-09-30 Thread Marek Kozlowski
:-) >> The first solution seems much better for me because there is one filter >> defined and used for numerous sources. One list defined and stored in >> one place. In the second case I have to modify each driver configuration > > No, the above example INSERTS the SAME FILTER into MULTPILE FILES

How transparently move account to a different server?

2014-10-01 Thread Marek Kozlowski
:-) Two mail servers: `sth1.domain.tld' and `sth2.domain.tld'. Each serves only one (non-virtual) domain. I need to transparently move a few user accounts from `sth1' to `sth2'. That is: for some users the maildir is moved from `sth1' to `sth2' and served (SMTP/IMAP) by `sth2' instead of `sth1' bu

Something like `flags_final' ?

2017-02-15 Thread Marek Kozlowski
:-) I'm wondering if it is possible for two parameters, let's say (not particularly those, generally): sender_canonical_maps = sth1, sth2, sth3 recipient_canonical_maps = sth4, sth5, sth6 (`sth' is any source, it doesn't matter I hope) to force the following behavor: 1. For `sender_canonical_ma

Re: Something like `flags_final' ?

2017-02-15 Thread Marek Kozlowski
On 02/15/2017 02:04 PM, Marek Kozlowski wrote: > :-) > > I'm wondering if it is possible for two parameters, let's say (not > particularly those, generally): > > sender_canonical_maps = sth1, sth2, sth3 > recipient_canonical_maps = sth4, sth5, sth6 > > (`st

Re: Something like `flags_final' ?

2017-02-15 Thread Marek Kozlowski
On 02/15/2017 04:26 PM, Noel Jones wrote: > On 2/15/2017 7:18 AM, Marek Kozlowski wrote: >>> >>> That is: `sender_canonical_maps' allows several rewrites for a single >>> entry while `recipient_canonical_maps' only one (the very first found). >> >&

Re: Something like `flags_final' ?

2017-02-15 Thread Marek Kozlowski
On 02/15/2017 05:07 PM, Mickaël DEQUIDT wrote: > > Le 15/02/2017 à 17:00, Marek Kozlowski a écrit : >> But I don't want postsrsd to manipulate "from:" header fields. How can I >> achieve it? > > I believe setting : > > sender_canonical_classes =

Re: Something like `flags_final' ?

2017-02-15 Thread Marek Kozlowski
On 02/15/2017 02:18 PM, Marek Kozlowski wrote: > On 02/15/2017 02:04 PM, Marek Kozlowski wrote: >> sender_canonical_maps = sth1, sth2, sth3 > > One more question: > > Is it possible to apply different `sender_canonical_classes' for sth1, > sth2 and sth3 respective

canonical vs smtp_generic_maps vs ...?

2017-02-17 Thread Marek Kozlowski
:-) "The optional generic(5) table specifies an address mapping that applies when mail is delivered. This is the opposite of canonical(5) mapping, which applies when mail is received." (http://www.postfix.org/generic.5.html) Nice... "With the smtp_generic_maps parameter you can specify generic

Re: canonical vs smtp_generic_maps vs ...?

2017-02-17 Thread Marek Kozlowski
On 02/17/2017 07:41 PM, Noel Jones wrote: > On 2/17/2017 12:04 PM, Marek Kozlowski wrote: >> I'm searching for a possibbility of rewriting (senders') addresses only >> for all mail originating from my system - no matter if it is local or >> remote delivery. I mean:

Re: canonical vs smtp_generic_maps vs ...?

2017-02-17 Thread Marek Kozlowski
On 02/17/2017 08:09 PM, Noel Jones wrote: > On 2/17/2017 12:53 PM, Marek Kozlowski wrote: >> When smithj authenticates via SASL to my server and sends e-mail from >> `smi...@something.com' locally or remotely I'd like to replace it to >> `j.sm...@sth.com'. Bu

unionmap?

2017-02-21 Thread Marek Kozlowski
:-) unionmap (read-only) A table that sends each query to multiple lookup tables and that concatenates all found results, separated by comma. The table name syntax is the same as for pipemap tables. (http://www.postfix.org/DATABASE_README.html#types) Seems a little unclear to me how it works

Re: unionmap?

2017-02-21 Thread Marek Kozlowski
On 02/21/2017 08:00 PM, Marek Kozlowski wrote: > Maybe by example. Let's assume: I've just checked :-) > virtual_alias_maps = unionmap:{sth1, sth2} Note: `unionmap' available since postfix 3.0! > What is the result of `rcpt to:' set to `someone1' in the or

Re: unionmap?

2017-02-21 Thread Marek Kozlowski
On 02/22/2017 01:16 AM, Wietse Venema wrote: > Marek Kozlowski: >>> virtual_alias_maps = unionmap:{sth1, sth2} >>> if: >>> `sth1' maps someone1 -> someone2 >>> `sth2' maps someone2 -> someone1 >> >> ERROR! Message not delivered du

Re: unionmap?

2017-02-22 Thread Marek Kozlowski
On 02/22/2017 12:37 PM, Wietse Venema wrote: > Marek Kozlowski: > [ Charset ISO-8859-2 converted... ] >> On 02/22/2017 01:16 AM, Wietse Venema wrote: >>> Marek Kozlowski: >>>>> virtual_alias_maps = unionmap:{sth1, sth2} >>>>> if: >>>&g

Re: unionmap?

2017-02-22 Thread Marek Kozlowski
On 02/22/2017 03:31 PM, Wietse Venema wrote: > Marek Kozlowski: >>>>>> Why in this case: >>>>>> >>>>>> `sth1': someone1 -> someone1,someone2 >>>>>> `sth2': someone2 -> someone3 >>>>

Re: unionmap?

2017-02-22 Thread Marek Kozlowski
:-) >> I won't answer to follow-up unless they are concrete enough (includinbg >> Postfix build information) that they can be verified independently. > > I don't think that someone modified the sources cause that is ArchLinux > which almost always fully relies on upstream; it never happens that t

Re: unionmap?

2017-02-25 Thread Marek Kozlowski
On 02/22/2017 03:49 PM, Marek Kozlowski wrote: > :-) > >>> I won't answer to follow-up unless they are concrete enough (includinbg >>> Postfix build information) that they can be verified independently. >> >> I don't think that someone modified the s

master.cf services and postfix architecture

2017-02-26 Thread Marek Kozlowski
:-) I've had some problems with using unionmaps. Finally it showed that they were caused by improper configuration of services in the `master.cf'. So I have decided to improve my knowledge by studying how postfix services really work and cooperate more thoroughly. I've started with: http://www.po

Re: master.cf services and postfix architecture

2017-02-26 Thread Marek Kozlowski
On 02/26/2017 06:18 PM, Viktor Dukhovni wrote: > >> On Feb 26, 2017, at 11:37 AM, Marek Kozlowski >> wrote: >> >> Let's assume that services defined in `master.cf' are as follows: >> -

Re: master.cf services and postfix architecture

2017-02-26 Thread Marek Kozlowski
On 02/26/2017 06:40 PM, Viktor Dukhovni wrote: [...] Thank you (and Wietse) very much for clarification! Best regars, Marek smime.p7s Description: S/MIME Cryptographic Signature

SRS software for postfix?

2017-03-01 Thread Marek Kozlowski
:-) I'm searching for a Sender Rewriting Scheme tool well integrated with postfix. postsrsd seems nice and generally works nice however it causes some problems if canonicals for all four addresses are used - it operates on the same `sender_canonical_classes' and `recipient_canonical_classes' setti

LDAP-based autoresponder?

2017-03-01 Thread Marek Kozlowski
:-) Not a postfix issue in fact... Forgive me, please! I've found something like this: http://www.onyxbits.de/gnarwl/ So old so abandoned, there is surely no forum/list/support/help on it. Is there - by accident - anyone who used it and have integrated it with postfix? Thanks in advance! Best re

Why my host tekes relay mail??

2017-05-18 Thread Marek Kozlowski
:-) mydomain = mini.pw.edu.pl mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain, mail.$mydomain, www.$mydomain, ftp.$mydomain relay_domains = $mydestination I'm wondering why after telnet connection to port 25 the host accepts any `RCPT TO:' addresses ending with `mini.pw.edu

Re: Why my host tekes relay mail??

2017-05-18 Thread Marek Kozlowski
On 05/18/2017 08:53 PM, Noel Jones wrote: > On 5/18/2017 1:32 PM, Marek Kozlowski wrote: >> :-) >> >> mydomain = mini.pw.edu.pl >> mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain, >> mail.$mydomain, www.$mydomain, ftp.$mydomain >> r

non_smtpd_milters and canonical_maps - what goes first?

2017-06-02 Thread Marek Kozlowski
:-) I'm reading http://www.postfix.org/MILTER_README.html and I'm still not quite sure. Both are performed by cleanup. What determines the order: which goes first and which goes then? I can't find any variable determining this... :-( Is it pre-defined (what order?). Can I force changing the order?

Re: non_smtpd_milters and canonical_maps - what goes first?

2017-06-03 Thread Marek Kozlowski
:-) >> I'm reading http://www.postfix.org/MILTER_README.html and I'm still not >> quite sure. Both are performed by cleanup. What determines the order: >> which goes first and which goes then? I can't find any variable >> determining this... :-( Is it pre-defined (what order?). Can I force >> chan

Re: non_smtpd_milters and canonical_maps - what goes first?

2017-06-03 Thread Marek Kozlowski
On 06/03/2017 02:13 PM, Wietse Venema wrote: >>> Canonical maps replace headers or envelopes before the entire message >>> is received. Milters replace/add/delete envelope or content after >>> the entire message is received. >> >> I'm not quite sure if I understand the term you use: `before/after

Re: Changing "mail from"

2017-06-03 Thread Marek Kozlowski
:-) On 06/04/2017 07:58 AM, Mark Scholten wrote: > Hello, > > We have a few forwarders where we need to change the "mail from" during the > SMTP stage. Nothing else has to change and I know that spam would be seen as > coming from our mail server if we forward it. This last part is acceptable > f

Forward SRS with postfix

2017-06-08 Thread Marek Kozlowski
:-) Numerous users of my system use forward to external MTAs. From time to time it causes some issues with SPF on those MTAs. SRS could resolve those. I'm wondering if you could recommend any SRS software which nicely integrates with postfix and doesn't interfere with canonicals (postsrsd does[*])

Re: Forward SRS with postfix

2017-06-08 Thread Marek Kozlowski
On 06/08/2017 12:04 PM, Benny Pedersen wrote: > Marek Kozlowski skrev den 2017-06-08 11:55: > >> [*]I need to rewrite both senders' addresses (`MAIL FROM:' and `From:') >> for all outgoing mail with canonicals before SRS is applied. Moreover: >> canonica

Re: Forward SRS with postfix

2017-06-08 Thread Marek Kozlowski
:-) On 06/08/2017 12:38 PM, Dominic Raferd wrote: > On 08/06/2017 10:55, Marek Kozlowski wrote: >> :-) >> >> Numerous users of my system use forward to external MTAs. From time to >> time it causes some issues with SPF on those MTAs. SRS could resolve >> tho

reject_sender_login_mismatch exception

2018-06-07 Thread Marek Kozlowski
:-) I have all users in an LDAP database and store users' aliases, virtuals, canonicals, forwards etc as attributes. For that purpose using the `reject_sender_login_mismatch' seems to be a simple and powerful solution for increasing security and I'm using it. Excluding some e-mail addresses f

postqueue: warning: unix_trigger: write to public/qmgr: Broken pipe

2018-11-14 Thread Marek Kozlowski
:-) postfix + postsrsd + clamav + spamassassin + dovecot Everything seems to work OK. No changes done recently (used to work for a long long time). No error messages in logs. Some mails are delivered correctly and immediately. Outgoing mail - OK. The problems are: 1. About 20-50 mails shown

Re: postqueue: warning: unix_trigger: write to public/qmgr: Broken pipe

2018-11-14 Thread Marek Kozlowski
W dniu 2018-11-14 16:07, Wietse Venema napisał(a): A problem report without looking at the logs? http://www.postfix.org/DEBUG_README.html#logging DO NOT turn on debug logging unless asked to do so. Wietser The ONLY entries matching include: 1. [warning,mail]postfix/postqueue[13925]:

Re: postqueue: warning: unix_trigger: write to public/qmgr: Broken pipe

2018-11-14 Thread Marek Kozlowski
W dniu 2018-11-14 17:33, Viktor Dukhovni napisał(a): On Nov 14, 2018, at 11:04 AM, Marek Kozlowski wrote: The ONLY entries matching include: 1. [warning,mail]postfix/postqueue[13925]: warning: unix_trigger: write to public/qmgr: Broken pipe 2. [warning,mail]postfix/master[9522]: warning

Re: postqueue: warning: unix_trigger: write to public/qmgr: Broken pipe

2018-11-14 Thread Marek Kozlowski
W dniu 2018-11-14 19:29, Wietse Venema napisał(a): 2. [warning,mail]postfix/master[9522]: warning: unix_trigger_event: read timeout for service public/pickup What does the master.cf entry for the pickup service look like? It should say 'unix' not 'fifo'. Postfix stopped using the 'fifo' years

Re: postqueue: warning: unix_trigger: write to public/qmgr: Broken pipe

2018-11-14 Thread Marek Kozlowski
:-) A new type of warning in logs found: [warning,mail]postfix/master[458]: warning: master_wakeup_timer_event: service pickup(public/pickup): Resource temporarily un available May I ask for some explanation? Best regards, Marek

Re: postqueue: warning: unix_trigger: write to public/qmgr: Broken pipe

2018-11-14 Thread Marek Kozlowski
:-) On 11/14/18 8:40 PM, Wietse Venema wrote: Marek Kozlowski: W dniu 2018-11-14 19:29, Wietse Venema napisa?(a): 2. [warning,mail]postfix/master[9522]: warning: unix_trigger_event: read timeout for service public/pickup What does the master.cf entry for the pickup service look like? It

Re: postqueue: warning: unix_trigger: write to public/qmgr: Broken pipe

2018-11-14 Thread Marek Kozlowski
On 11/14/18 10:01 PM, Marek Kozlowski wrote: :-) On 11/14/18 8:40 PM, Wietse Venema wrote: Marek Kozlowski: W dniu 2018-11-14 19:29, Wietse Venema napisa?(a): 2. [warning,mail]postfix/master[9522]: warning: unix_trigger_event: read timeout for service public/pickup What does the

Re: postqueue: warning: unix_trigger: write to public/qmgr: Broken pipe

2018-11-25 Thread Marek Kozlowski
:-) On 11/14/18 11:25 PM, Viktor Dukhovni wrote: On Nov 14, 2018, at 5:14 PM, Marek Kozlowski wrote: Your kernel's UNIX-domain stack is messed up, or some 'security' system is interfering with proper operation. https://dilbert.com/strip/1995-06-24 Well. I've disconnec

postfix architecture and dovecot LMTP

2019-03-06 Thread Marek Kozlowski
:-) I know the basic postfix operational scheme: http://www.postfix.org/OVERVIEW.html I have a generic spamassassin instance that marks messages recognized as spam, `/etc/postfix/master.cf' : smtp inet n - n - - smtpd -o content_filter=spamassassin spa

Re: 'Linux 5' support in Postfix Stable Release 3.4.1 ?

2019-03-08 Thread Marek Kozlowski
:-) ArchLinux? It's a rolling release one. Install any version then run `pacman -Suy' for upgrade to the most recent packages in repos. Quick and simple (but it is a systemd Linux :-( ) Best regards, Marek On 3/8/19 1:26 PM, Wietse Venema wrote: Which distro ships with Linux 5.x kernels? I

Re: 'Linux 5' support in Postfix Stable Release 3.4.1 ?

2019-03-08 Thread Marek Kozlowski
:-) Or instead of downloading and installing download a qemu image of ArchLinux: http://pages.mini.pw.edu.pl/~kozlowskim/archv.qcow2 It' s an up-to-date qemu image prepared for my students. Best regards, Marek On 3/8/19 1:32 PM, Marek Kozlowski wrote: :-) ArchLinux? It's a rolli

Postfix+spamassassin - how can I test LMTP dovecot?

2019-03-16 Thread Marek Kozlowski
:-) My postfix configuration is quite complex with a lot of special cases and rules. However I'd like to make an anti-spam configuration as simple and lightweight as possible (KISS). /etc/postfix/master.cf smtp inet

Disable spamassassin scan in there is a virtual for the recipient

2019-03-18 Thread Marek Kozlowski
:-) I have the standard, commonly mentioned spamassassin configuration for postfix: /etc/postfix/master.cf smtp inet n - n - - smtpd -o content_filter=spamassassin spamassassin unix