Hello,
i try to figure out how to restrict ACCESS to the SMTP daemon.
With that, i mean something like the tcpwrapper for SMTP/SMTPS ...
For what?
I have several root-Servers, vServer and Xen domains - only one is the
mail system and should be available for mail from the internet.
The others
Thomas wrote:
Hello,
i try to figure out how to restrict ACCESS to the SMTP daemon.
With that, i mean something like the tcpwrapper for SMTP/SMTPS ...
I found that about a similar solution:
http://archives.neohapsis.com/archives/postfix/2007-05/0343.html
There, the following is written
Wietse Venema wrote:
http://www.postfix.org/SMTPD_ACCESS_README.html
http://www.postfix.org/access.5.html
http://www.postfix.org/cidr_table.5.html
/etc/postfix/main.cf
smtpd_client_restrictions = check_client_access
cidr:/etc/postfix/client_access
/etc/postfix/client_access
192.168.0.0/2
maddae...@gmail.com wrote:
I've been asked to build a mail server for the purpose of sending mail
from various machines within a LAN to anywhere on the Net. I'm
guessing that this would be considered a "relay" in a sense, since the
server will not be receiving mail from the outside, but please c
I never had a problem to do exactly this ...
For what do you need the hostname of the server?
My main.cf does not contain a hostname - it can easily be used over an
NFS share:
mkdir /data
mount server:/data /data
/etc/init.d/postfix stop
cp -rp /etc/postfix /data/postfix_nfs
mv /etc/postfix /e
secSwami wrote:
So after trying and trying other methods of making postfix send emails
for the SASL authenticated users to work, I am trying to now use
dovecot sasl config.
My main purpose is that I should be able to SEND email from anywhere
on the internet using my POSTFIX mail server. There
secSwami wrote:
Thanks for you suggestion, could you please me get your dovecot.conf
info too? and do you startup "saslauthd" service?
As you wish:
grep -v ^\# dovecot.conf | grep -v "^ *\#" | grep -v ^$
protocols =imaps
disable_plaintext_auth = yes
log_timestamp = "%Y-%m-%d %H:%M:%S "
ssl_ce
secSwami wrote:
Thanks for you suggestion, could you please me get your dovecot.conf
info too? and do you startup "saslauthd" service?
As you wish:
grep -v ^\# dovecot.conf | grep -v "^ *\#" | grep -v ^$
protocols =imaps
disable_plaintext_auth = yes
log_timestamp = "%Y-%m-%d %H:%M:%S "
ssl_ce
secSwami wrote:
Thanks a bunch Thomas!!
One more thing do you create users on the system itself or use users
and password from a file?
Thanks again...much much appreciated.
So far, i only use regular Unix users from /etc/passswd, nothing virtual ...
Does it work for you?
I do not realy understand the problem here ...
When a mail is send to a remote SMTP server, wrong addresses get
rejected with 550 ...
But that IS of course a Mail that returns to the send - it has the title
"Undelivered Mail Returned to Sender" and contains a message like
"Recipient address
Wietse Venema wrote:
Accepting mail for a non-existent user and then dropping the bounce
is the wrong solution for the wrong problem.
I will fight tooth and nail against the idiots that encourage such
preposterous configuration.
I know that :)
I was just saying that there ARE numerous mai
I think, this is going offtopic ...
Also, don´t assume, that i want to do something like this - i just say,
the OP is free to do so.
mouss wrote:
check_parameter()
{
postconf $1 2>&1 | grep -vq "unknown parameter"
return $?
}
or
check_parameter()
{
postconf $1 2>/dev/null | grep -q =
return $?
}
Then, you need an exit-code wrapper for "grep" too, it seems :)
check_result() {
RESULT=$( grep "${1}" "${2}" 2>/d
Thomas Ackermann wrote:
So, does anybody know what technically is the difference between the
use with and without the signs?
I mean, what network things may happen or not happen?
Nobody knows the technical differences?
:-(
J.P. Trosclair wrote:
This is really off topic, but grep already returns a success and
failure code based on if there were any matches which mouss's code
uses from what I can tell. There's really no reason to look at grep's
stdout, if it has a match the return code is 0, it doesn't it's != 0.
Duane Hill wrote:
Care to take a look at the Postfix documentation?
http://www.postfix.org/postconf.5.html#relayhost
As i wrote, i read the documentation i found - it was exactly this small
entry about relayhost!
The answer from Noel Jones contains quite some more and deeper
information -
Noel Jones wrote:
... more likely nobody cares, because postfix behavior is documented.
When the relayhost is a hostname enclosed by "[ ]" brackets, postfix
asks for an A record and does not ask for an MX record.
If relayhost is an IP address enclosed by brackets, postfix uses that
IP with n
mouss wrote:
what version of grep do you use?
http://www.opengroup.org/onlinepubs/7990989775/xcu/grep.html
...
-q
Quiet. Do not write anything to the standard output, regardless of
matching lines. Exit with zero status if an input line is selected.
...
That again begins to go offtopic
MountainX wrote:
You need to set mydomain yourself!
Othwise, mydomain defaults to the string "localdomain":
postconf -d mydomain
mydomain = localdomain
Just set mydomain correctly and then use "myorigin = $mydomain":
mydomain = my-own-domain.com
myorigin = $mydomain
Nothing more needed :)
And NO, you do not need a myhostname entry!
Hello,
the command "postconf smtpd_client_restrictions
smtpd_sender_restrictions" shows the following:
smtpd_client_restrictions = reject_invalid_hostname check_client_access
hash:/etc/postfix/client_access
smtpd_sender_restrictions = reject_unknown_address check_sender_access
hash:/etc/postf
Thomas wrote:
But if i try to send a mail to an address listed in client_access, it
get happily queued and delivered :-(
I suspect that i used the wrong restriction, the wrong hash/... thing
or whatever ...
Could you give a hint in the right direction?
Found it
ghe wrote:
James Berwick wrote:
From the documentation:
check_client_access type:table
Search the specified access database for the client hostname, parent
domains, client IP address, or networks obtained by stripping least
significant octets. See the access(5) manual page for details.
Yo
Victor Duchovni wrote:
If you do that, you will notice that there is no documentation for
"reject_unknown_address", hence you should not use it (there is
no such restriction, if that is not clear by now).
Uh.
Thanx!
I changed to the following:
smtpd_sender_restrictions = check_sender_acces
Ansgar Wiechers schrieb:
$myhostname and localhost.$mydomain should go into $mydestination, not
into $relay_domains. You can forward all mail to valid local addresses
to your internal host via entries in $alias_maps.
I changed than, thank you!
Also, i moved "localhost" to $mydestination, which
Noel Jones schrieb:
data_directory = /var/lib/postfix
then type:
# mkdir /var/lib/postfix
# chown postfix /var/lib/postfix
Changed that too ...
Although i dont realy understand, why /var/lib/postfix should be better
than /var/spool/postfix
What shall i do with the old stuff in var/spool/po
r/sbin/sendmail
setgid_group = _postdrop
smtp_sasl_auth_enable = yes
smtp_sasl_mechanism_filter = login
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options =
unknown_local_recipient_reject_code = 550
Any help appreciated.
thanks,
Thomas
> forget that and set $smtp_sasl_mechanism_filter to filter GSSAPI away and
> choose from the remaining mechanisms.
Thanks, this was indeed the problem. Adding the
smtp_sasl_mechanism_filter with the appropriate mechanisms fixed it.
Thomas
Hey,
[..]
Yes, I use that too - but I like a quick summary on demand.
See: <http://www.mikecappella.com/logwatch/>
You can use the scripts _without_ logwatch and get an instant summary of
your mail.log.
Cheers,
Thomas
to handle this case in LDAP_README (which is a very
good doc by the way) because the example doesn't include this particular
case. Or is it my damn cataract ?
Cheers,
Thomas
--
rfc822member = memberaddr in LDAP_README
dnmember = memberdm in LDAP_README
bute = mail
A solution would be to put rfc822member as a special result attribute.
special_result_attribute = dnmember, rfc822member
But I don't know if it's /clean/ do to that.
BTW, I'm using postfix 2.5.5 (Debian Lenny)
Cheers,
Thomas
"from such operators:
" matter that communication has chosen the unencrypted e-mail
communication with all its dangers ..."
Thanks
Thomas
Hello,
I habe a problem to understand function of
# /etc/aliases
# /etc/postfix/access_recipient
It seemed to be that aliases is OK for receive emails for recipients.
But what it make sence to use additional access_recipient or whats
function of access_recipient.
thanks
Thomas
Hallo,
ich sende ab und an etwas an Ämter vorab. Die kommen mittlerweile sogar
mit pdf zurecht!
Vorab per Email (früher vorab per FAX), steht auch so im Briefkopf und
dann zusätzlich als normalen Brief. Manchmal eben auch per Einschreiben
statt Brief, kommt auf die Üblichkeit/Wichtigkeit an.
oh, sorry, I wanted to send my question to german mailing list.
Thomas
Am 23.05.20 um 14:17 schrieb Claus Assmann:
Please use an address for which you can receive at least non delivery
status information.
Otherwise, why do you expect the recipient to handle your non-replyable
address in any
<> USE LETTER AND STAMP
or
that her understand if he receive my Email, and second I should use 5XX
if he answer if he will not understand?
best regards
Thomas
Am 24.05.20 um 17:19 schrieb @lbutlr:
On 23 May 2020, at 08:52, Thomas wrote:
or
The norm is to use an address along the lines you describe there. I use
no-reply@. Emails to that address are accepted and discarded. Do not
use a fake domain or someone else's domain, of course. Yo
Am 24.05.20 um 17:19 schrieb @lbutlr:
On 23 May 2020, at 08:52, Thomas wrote:
or
The norm is to use an address along the lines you describe there. I use
no-reply@. Emails to that address are accepted and discarded. Do not
use a fake domain or someone else's domain, of course. Yo
Am 27.05.20 um 17:20 schrieb @lbutlr:
As I said, use a valid domain THAT YOU CONTROL.
Hi,
I of cource use my own domain where I pay for.
thanks
Am 25.05.20 um 16:17 schrieb Jaroslaw Rafa:
Dnia 25.05.2020 o godz. 14:33:36 Thomas pisze:
FAX is much better because FAX is same as letter and working
digital, nearly 100% yes or no. Email I did not know if it is
arrived,
[...]
What do you actually want to achieve? Because from your
Am 28.05.20 um 23:48 schrieb @lbutlr:
On 28 May 2020, at 15:29, Thomas wrote:
I of cource use my own domain where I pay for.
Yes, but read the rest of what I wrote, especially the parts I've highlighted:
Do not create a fake address with someone else's domain. Do not use
mu
Am 23.05.20 um 18:00 schrieb Ralph Seichter:
From: Thomas Mustermann
with the address nore...@domain.tld being *unknown* on your MX. That
should result in a generic 5xx rejection. If you want more control over
the rejection message, you can use something like the following:
# /etc
Postfix can't send email to gsuite's MTA via IPV6 interface.
But if I change this item to:
inet_protocols = ipv4
It works.
Can you help explain this?
Thank you.
No I don't have reverse DNS record for IPv6. I will try that. thank you.
On Mon, Mar 1, 2021, at 4:44 PM, Erwan David wrote:
> Le 01/03/2021 à 07:01, Philip a écrit :
> >
> > If IPv4 works then maybe IPv6 isn't set up?
> >
> > ping6 ipv6.google.com
>
Please see this description which is similar to mine:
https://serverfault.com/questions/655250/gmail-bouncing-mail-sent-over-ipv6-ipv4-working
And the answers look interesting.
Regards.
Hi,
i am pretty new to postfix,
i have set up a postfix sever that forwards mail over a relay host
(gmail.com), which comes from another external server with fetchmail.
That all works, but what i want to do is to forward only mail from
certain sender adresses(whitelist).
So where do i have to
Hi,
i am pretty new to postfix,
i have set up a postfix sever that forwards mail over a relay host
(gmail.com), which comes from another external server with fetchmail.
That all works, but what i want to do is to forward only mail from
certain sender adresses(whitelist).
So where do i have to
in" settings on
office.example.com a little, but I think I'm completely wrong there since
Postfix keeps complaining about unknown local users.
What would be the correct way to set up such a relaying?
--
Thomas
REDIRECT foo.example.org
to the check_sender_access lookup table, but Postfix will ignore this and
deliver the mail to the original recipient.
--
Thomas
Rocco Scappatura schrieb:
myhostname =
mydomain =
If the hostname is not valid, postfix fails to start. It have to be
resolved by DNS and the IP must be the IP of one of the interface of
the server which run Postfix.
So I have to use a name that is resolved in many different IPs,
Hello,
i use the recipient_delimiter (with a ".") quite often.
Some of those sub-recipients(?) of accounts are already spammed.
I would like to reject Mails to them ...
For example:
name.post...@$mydomain would be OK, while
name.s...@$mydomain should be rejected ...
What is the best way to con
Hello,
i seem to be unable to set the "smtpd_client_restrictions" Variable!
In master.cf, there is an option for smtps that sets this to
"permit_sasl_authenticated,reject".
In main.cf, i try to set this to "reject_invalid_hostname".
In "postconf -n" the variable is empty!
So, i assume that th
Ralf Hildebrandt schrieb:
postconf -n shows main.cf settings, not master.cf settings
Why not use:
postconf -e "smtpd_client_restrictions=reject_invalid_hostname"
But as far as i understand, this just sets the variable in main.cf - and
there, it is already included!
To show this:
r...@l
Brian Evans - Postfix List schrieb:
'Postconf -d' means "show me the DEFAULTS not what is current".
Uh..
I already feared a realy stupid mistake on my side :)
I used it in this sense, so far - but assumed that this default will be
overwritten (and displayed) when actually set in main.cf
S
Hello,
normally, you can say "relayhost = domain" and postfix searches the MX
record for that domain in DNS to get the list of relayhosts.
For domains where no MX record is configured into the DNS, i would need
to use more than one relayhost ...
Is that possible?
The configuration seems not
Maybe i should better explain the reasons behind this question:
We have some domains, where the mail-relay is mapped to several
IP-Adresses (and servers) over an DNS entry.
That is, we have ONE mailrelay that can be configured as relayhost.
So far, so good.
BUT, we also have systems without D
Eddy Beliveau schrieb:
I know that I can try to find all individual combinations
and write them in some reject file to be used in check_recipient_access
Is there some way to define a rule based on phonetic
or another solution which detect mispelled words ?
I would recommend against that idea :
Wietse Venema schrieb:
That is a bug in your operating system.
That made me test all of them :)
I used several runs of "ping" against the hostname after including it
with two entries into /etc/hosts
Cannot use "getaddrinfo" ...
Solaris 8 and 9:
Only uses the first IP in /etc/hosts (with "
As older postfix installations have a "fallback_relay" variable and
newer installations have a "smtp_fallback_relay", i wanted to use
postconf to check, which version is supported.
Usally, i would expect a program to return with a non-zero exit-code at
such a failure:
r...@localhost# postcon
Hello,
i read the documentation about the usage of "[" and "]" in relayhost
entries ...
I still not quite sure what happens or not happens when using an IP with
or without such signs...
relayhost = 1.2.3.4
may use MX records from DNS?
What if there is no nameserver configured? Will there be
Victor Duchovni schrieb:
I can't honestly recommend anything other than start with the
default:
I suspect, you are right :)
After another check of my logfiles, i reduced my restriction lists
to the following:
smtpd_client_restrictions = reject_unknown_reverse_client_hostname,
check_clien
es a double bounce.
I just deleted 15 messages on each of our mail relays and 2 on
erld671x. Can someone explain me what goes wrong here and if it is a
configuration problem or a known problem of postfix version 2.1.1?
Thomas
Hello Wietse,
* Wietse Venema [090210 14:55]:
> Thomas Glanzmann:
> > Out: 220 erld671x.erlf.siemens.de ESMTP Postfix
> > In: EHLO erld603x.erlf.siemens.de
> > Out: 250-erld671x.erlf.siemens.de
> > Out: 250-PIPELINING
> > Out: 250-SIZE 104857600
>
later? Again this was with postfix version 2.1.1.
> Not if you turn on postmaster notification for resource problems.
I was unaware of that option. Thank you for explicitly mention it:
(erld603x) [~] postconf | grep -i notify
notify_classes = resource, software
Thomas
OK.. How about this one:
I have had good luck blocking SPAM email which has a MAIL FROM:
address in my own domain, by blocking all email from my domain in an
access map on 'smtpd_sender_restrictions', and then listing
'permit_mynetworks' and 'permit_sasl_authenticated' first.
I call this
/ )
to $MAILDIR/.Unsure
to $MAILDIR/
There's a lot more there to put mail from various mailing
lists into the appropriate folder, but this should give
you an idea.
Thomas
27;d like to be able to tack on a header which shows full list of
recipients including BCC addresses.
Anyone else come up with a solution for this?
--
__
Thomas Ledbetter http://www.revel
Refering to the earlier subjects on RPMs and 2.6:
I have Suse 11.1 which includes Postfix 2.5.5. It is not easy to
uninstall that (YAST wants to replace it with EXIM or SENDMAIL) due to
dependencies. Is it possible to just upgrade it if I manually compile
2.6.1 and replace the old one? Or do
On 1/4/2010 5:40 PM, Roman Gelfand wrote:
Well, it looks like, perhaps, I found the missing link. After adding
s25r rules and HELO response verification in main.cf, no spam has
siped through.
I think that mostly it was HELO response verification that did it.
BTW, is there a reason not block ema
>
> I'm pretty sure I already know the answer , just need confirmation.
>
> Is this statement true or false? You cannot restrict sending mail to
> authenticated sessions without also restricting incoming mail as well.
>
>
False
On Jun 12, 2010, at 3:20 AM, Thomas Polliard wrote:
>>
>> I'm pretty sure I already know the answer , just need confirmation.
>>
>> Is this statement true or false? You cannot restrict sending mail to
>> authenticated sessions without also restricting incomi
6c PT.TO:.ORCPT=rfc82
How can I solve this problem ?
Thanks in advance.
--
Thomas Poindessous
HISTORY, 20061207:
Compatibility with Postfix < 2.3: undo the change to bounce
instead of defer after pipe-to-command delivery fails with
a signal. File: global/pipe_command.c.
Part 1: http://article.gmane.org/gmane.mail.postfix.user/154616
Part 2 (tested with Postfix 2.6.6):
--- src/
On Jul 13, 2010, at 7:03 PM, Wietse Venema wrote:
> What are the symptoms of the problem?
postfix/pipe[22169]: 5991748: to=, relay=dovecot, delay=1.9,
delays=1.8/0.05/0/0.03, dsn=5.3.0, status=bounced (Command died with signal 7:
"/usr/libexec/dovecot/deliver")
postfix/bounce[22171]: 5991748: s
Jeroen Geilman adaptr.nl> writes:
> I completely agree that non-delivery to a (presumably dependable) MDA
> should never error out, but I thought a soft solution would be better
> than choosing the more extreme route (of altering working code).
I believe the code is not working as intended and
Victor Duchovni morganstanley.com> writes:
> Wietse, if I understand correctly, wants to ensure that the issue is
> clearly defined, so we don't solve the wrong one, and is worth fixing.
Naturally.
> Why does your Dovecot intermittently SIGBUS?
It doesn't. The deliver binary was truncated, maki
27;t break anything while failing. However I
would like to know if there is configuration option that tells postfix
to do not automatically reload it's configuration file.
Thomas
Hello,
> > a way to tell postfix to don't re-read the config files
> No. By design Postfix daemons periodically commit suicide and, when
> restarted, have no option but to read the configuration files.
I thought so. Thanks a lot.
Thomas
rday, trying
to figure out what it is I'm doing wrong.
Regards,
Thomas
On Thu, Nov 25, 2010 at 2:06 PM, /dev/rob0 wrote:
> Alan's a good ol' boy and friend and colleague of mine, but I told
> him that hardcoding the version into those pathnames is a bad idea.
> Sure enough, he won't listen to me. :)
I got rid of all the versioning stuff, cleaned out the old package
ith no clear answers.
ATRN/ODMR is afaik not provided by Postfix, you could give a quick look
at http://plonk.de/sw/odmr/ - however I never tried it.
Regards,
Thomas Gelf
I assume you're using this certificate for TLS, so the answer is NO, no
single mails will be encrypted - TLS is "only" there to allow MTA's to
encrypt their transport layer. If no restrictions are configured this
happens automagically if both endpoints support TLS.
Best
but that's mostly as of disaster recovery
and failover reasons - you could handle similar traffic also on a single
host (using recent server hardware).
A certain percentage of queries could of course be avoided if Postfix
where optimized for DB usage. As we know it isn't - this design choice
however keeps it flexible and simple.
Best regards,
Thomas Gelf
Clunk Werclick wrote:
> That is very reassuring Thomas, thank you.
>
> Now I don't know if I should stay with SQL or drop to maps ? It is
> easier to configure with SQL from a web based front end - but to get SQL
> to dump to flat files and Postmap is also only a few Perl lin
Clunk Werclick wrote:
> Thank you Thomas. I stick with Mysql and worry if I ever have to set up
> a server so big it fails. If that happens I have lots of £$£ and pay
> someone else to do it whilst I sit on beach sipping wine.
Once that happens: let me know! I'll join you at
to your main.cd to read
> 220 I think ESMTP is a prehistorical protocol
Lay back and wait for some nerd having fun with your response. Or save
the time, enjoy the weekend, drink some beer, do some sport - get a
live ;-)
Cheers,
Thomas
meet missconfigured hosts, and be prepared to add
exceptions to your config (Hash file, DB, whatever). Many public
entities are running badly configured systems - they'll NOT fix them
and your customers will insist on receiving their mail. Therefore you
will need a "whitelist"-feature.
Best regards,
Thomas Gelf
ite is behaving wrong, you are just
enforcing MTAs to respect a small subset of current standards.
Regards,
Thomas Gelf
brian moore wrote:
> There is always the "AOL Rule".
Yeah, we are sometimes also using AOL as an example, even if where I
live nearly nobody is using it...
> (Hotmail and Gmail have similar rules, I just don't know where they
> spell them out.)
Hotmail: http://postmaster.msn.com/Guidelines.aspx
LuKreme wrote:
> On Aug 4, 2009, at 3:42, Thomas Gelf wrote:
>
>> the person who did not correctly set up the network is to be blamed,
>> if you have equipment acting as MTA it should be configured the right
>> way, otherwise use a relay server
>
> SHOULD be b
specifying an alternative to
> syslog. Is there any way to do this?
You should keep syslog, there are many reasons why it is better than
"just a file". But replace your syslogd with syslog-ng or rsyslog, and
then write logs for your parser to a pipe.
Best regards,
Thomas Gelf
http://www.google.com
http://www.altavista.com/
http://www.bing.com
http://www.yahoo.com
http://en.wikipedia.org/wiki/Web_search_engine
fake...@fakessh.eu wrote:
> how to have amavisd-new dkimproxy , and implemented
> in master.cf and main.cf
hose X-Info-MessageID
headers in his mail headers, what he wants is Postfix to do is writing
them to syslog.
While this would probably be pretty easy with Amavis, I have no idea if
and how he could do so using Postfix only.
Best regards,
Thomas Gelf
Thomas Gelf schrieb:
> If I didn't missunderstand him he already has those X-Info-MessageID
> headers in his mail headers, what he wants is Postfix to do is writing
> them to syslog.
That's what happens if you're at phone while writing :-/
It should read: "...alrea
-Info-Messageid: l6oL1rHPRUyklkQzdkW3kg from
> client.example.com[192.168.1.123]; from=
> to= proto=ESMTP helo=<[192.168.1.123]>
Does it automagically log the whole matching header? Or do I need to
add some backreference to "WARN optional text..."?
Regards,
Thomas
Noel Jones wrote:
> The entire header (up to a sanity limit) is logged; no further action is
> necessary.
Great, thanks again!
n the table. It is important that the To: header of the mail
contains the expanded address, not the original one so that the resulting
mails looks exactly as if the user would have send them individually to each
recipient.
Thanks for your time!
Thomas Koch, http://www.koch.ro
t is needed to folks starting to use
> DKIM. Actually, at least, i needed that progress (reading RFCs) ;;
I did so. I've entirely read RFC 4871, 5617, 5672, many others and
also current drafts regarding DKIM deployments. I can confirm that
the answer to his question is not to be found in any
;s going on. Stream handling in PHP can be
a mess ;-)
Cheers,
Thomas
--
mail: tho...@gelf.net
web: http://thomas.gelf.net/
Wietse Venema wrote:
> This is an output buffering problem. You need to flush output
> after each reply, perhaps by calling the flush() function.
Good catch, I guess this could most likely be his problem!
--
mail: tho...@gelf.net
web: http://thomas.gelf.net/
1 - 100 of 336 matches
Mail list logo
