Re: RBL problem?

2010-02-26 Thread Stan Hoeppner
David Schraeder put forth on 2/26/2010 2:13 PM:
> How are you guys getting those stats on the blocks?

Alternatively, try pflogsumm:

http://jimsun.linxnet.com/postfix_contrib.html

If you use Debian you can install pflogsumm via aptitude.

-- 
Stan



Re: bogus HELO name used

2010-02-26 Thread Stan Hoeppner
Daniel Morgan put forth on 2/26/2010 12:04 AM:
>> myhostname = apac3.apac.org.ni
> 
> In DNS: apac3.apac.org.ni = 165.98.119.11
> BUT
> 165.98.119.11 != apac3.apac.org.ni
> 165.98.119.11 == pppleon11.ibw.com.ni.

Post the rejected transaction(s) from your logs please.  It's likely they
are rejecting your mail due to the presence of "ppp" in the rDNS name, which
typically indicates consumer broadband IP space.  I block smtp connections
based on such rDNS names myself, as do many admins.

If you are sending mail from dynamic IP consumer space, I recommend reading
this document:

http://www.hardwarefreak.com/postfix-adsl-relay-config.txt

-- 
Stan




postmulti: inet_interfaces for each instance ?

2010-02-26 Thread David Touzeau
Dear

I would like to implement multiple instances on my 2.7 postfix.

After read the documentation (perhaps my english is very poor) i need to
have a confirmation.

did i need to disable master_service_disable and specify an IP address
for each instance in inet_interfaces token ?

Or

Is there a kind of "hub" that listen a single IP and is in charge of
routing mails to the right instance ?
If yes how to specify this hub ? Is the main postfix
process /etc/postfix is able to be the hub ?

Best regards.







Re: Listing relay_domains in a file

2010-02-26 Thread Victor Duchovni
On Fri, Feb 26, 2010 at 10:09:06PM +0100, Wolfgang Zeikat wrote:

> Thanks for the replies, Wietse and Victor.
>
> Victor Duchovni wrote:
>
>>> Would "/file/name" contain one domain per line?
>>>
>>> And would changes require "postfix reload"?
>> Yes, and yes. If you use an indexed table (cdb, hash, btree, ...) instead,
>> the reload is not required, the trivial-rewrite service in reasonably
>> recent Postfix releases will detect the change within ~10 seconds.
>
> So far, I have only used indexed tables with entry pairs like
>
> something something_else
>
> I understand that I could simply "postmap" a file with one domain per line, 
> correct?

Not quite, you need a "dummy" value for each lookup key:

example.com is a relay domain
example.org is a relay domain

the lookup value is ignored, but must be present.

-- 
Viktor.

P.S. Morgan Stanley is looking for a New York City based, Senior Unix
system/email administrator to architect and sustain our perimeter email
environment.  If you are interested, please drop me a note.


Re: RBL problem?

2010-02-26 Thread Wietse Venema
David Schraeder:
> How are you guys getting those stats on the blocks?

awk '
/blocked using [^;]+;/ { stats[$20]++ }
END { for (name in stats) print name, " ", stats[name] }
' /var/log/maillog

Wietse


Re: Listing relay_domains in a file

2010-02-26 Thread Wolfgang Zeikat

Thanks for the replies, Wietse and Victor.

Victor Duchovni wrote:


Would "/file/name" contain one domain per line?

And would changes require "postfix reload"?


Yes, and yes. If you use an indexed table (cdb, hash, btree, ...) instead,
the reload is not required, the trivial-rewrite service in reasonably
recent Postfix releases will detect the change within ~10 seconds.


So far, I have only used indexed tables with entry pairs like

something something_else

I understand that I could simply "postmap" a file with one domain per 
line, correct?


Regards,

wolfgang




Re: RBL problem?

2010-02-26 Thread David Schraeder
How are you guys getting those stats on the blocks?


Re: RBL problem?

2010-02-26 Thread d . hill

Quoting listserv.traf...@sloop.net:


Recently, I've noticed a lot more spam. In checking the logs I find
that zen.spamhaus.org has really lost ground in terms of rejections.

I use zen and bl.spamcop.net. In the past, zen had >10 times the
number of hits that bl.spamcop.net did.

zen doesn't seem to have blocked me, because I can hand-query them,
and I'm still getting some rejections with zen.

But either something's broken - which I can't find, or zen isn't
nearly as effective as it once was.

For example:
Over a few days, I get

15025 zen rejects
26558 bl.spamcop.net rejects

(Like I said, in the past, zen would be way higher than
bl.spamcop.net. Plus it's first in the reject list, so I think bl
only gets hits if zen doesn't.)

---
Here's how I have my RBL's configured.

smtpd_recipient_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
reject_non_fqdn_sender,
reject_non_fqdn_recipient,
reject_unknown_sender_domain,
reject_unknown_recipient_domain,
reject_unauth_destination,
check_recipient_access pcre:/etc/postfix/recipient_checks.pcre,
check_helo_access hash:/etc/postfix/helo_checks,
check_sender_access hash:/etc/postfix/sender_checks,
check_client_access hash:/etc/postfix/client_checks,
check_client_access pcre:/etc/postfix/client_checks.pcre,
reject_rbl_client zen.spamhaus.org,
reject_rbl_client bl.spamcop.net,
permit

---

Oh, and I'm running Poxfix 2.3.3

So, any ideas why things have changed? (Or am I imagining things...)


So far today zen.spamhaus 94,752 and bl.spamcop 1,132.

%postconf -d mail_version
mail_version = 2.6.5

I have spamhaus listed before spamcop.



Re: Listing relay_domains in a file

2010-02-26 Thread Victor Duchovni
On Fri, Feb 26, 2010 at 08:05:38PM +0100, Wolfgang Zeikat wrote:

> The relay_domains documentation says:
> Specify a list of host or domain names, "/file/name" patterns ...
>
> Would "/file/name" contain one domain per line?
>
> And would changes require "postfix reload"?

Yes, and yes. If you use an indexed table (cdb, hash, btree, ...) instead,
the reload is not required, the trivial-rewrite service in reasonably
recent Postfix releases will detect the change within ~10 seconds.

-- 
Viktor.

P.S. Morgan Stanley is looking for a New York City based, Senior Unix
system/email administrator to architect and sustain our perimeter email
environment.  If you are interested, please drop me a note.


Re: Listing relay_domains in a file

2010-02-26 Thread Wietse Venema
Wolfgang Zeikat:
> The relay_domains documentation says:
> Specify a list of host or domain names, "/file/name" patterns ...
> 
> Would "/file/name" contain one domain per line?

Zero or more patterns per line, with patterns separated by one or
more space, tab, carriage return or newline characters, and allowing
for leading and trailing separators.

> And would changes require "postfix reload"?

Yes. Like pcre, regexp and cidr, the file is read into memory.

Wietse


Listing relay_domains in a file

2010-02-26 Thread Wolfgang Zeikat

The relay_domains documentation says:
Specify a list of host or domain names, "/file/name" patterns ...

Would "/file/name" contain one domain per line?

And would changes require "postfix reload"?

Best regards,

wolfgang



Re: sender name from /etc/passwd

2010-02-26 Thread Victor Duchovni
On Fri, Feb 26, 2010 at 02:20:06PM +0100, Pavel Urban wrote:

> open(OUTFILE,"|$Config{'mailer'}") or die "Can't execute
> $Config{'mailer'}: $!\n";
> print OUTFILE "To: $Config{'mailto'}\n";
> print OUTFILE "From: $Config{'mailfrom'}\n";
> print OUTFILE "Subject: Logwatch for $Config{'hostname'} (${OStitle})\n";
> 
> , when $Config{'mailfrom'} is 'root' and $Config{'mailer'} is 'sendmail
> -t'. Anybody knows what could make the final substitution, then?

Postfix does not rewrite the "From:" header if it is already present.
To get the default "From:" header, don't supply one at all.

-- 
Viktor.

P.S. Morgan Stanley is looking for a New York City based, Senior Unix
system/email administrator to architect and sustain our perimeter email
environment.  If you are interested, please drop me a note.


RBL problem?

2010-02-26 Thread listserv . traffic

Recently, I've noticed a lot more spam. In checking the logs I find
that zen.spamhaus.org has really lost ground in terms of rejections.

I use zen and bl.spamcop.net. In the past, zen had >10 times the
number of hits that bl.spamcop.net did.

zen doesn't seem to have blocked me, because I can hand-query them,
and I'm still getting some rejections with zen.

But either something's broken - which I can't find, or zen isn't
nearly as effective as it once was.

For example:
Over a few days, I get

15025 zen rejects
26558 bl.spamcop.net rejects

(Like I said, in the past, zen would be way higher than
bl.spamcop.net. Plus it's first in the reject list, so I think bl
only gets hits if zen doesn't.)

---
Here's how I have my RBL's configured.

smtpd_recipient_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
reject_non_fqdn_sender,
reject_non_fqdn_recipient,
reject_unknown_sender_domain,
reject_unknown_recipient_domain,
reject_unauth_destination,
check_recipient_access pcre:/etc/postfix/recipient_checks.pcre,
check_helo_access hash:/etc/postfix/helo_checks,
check_sender_access hash:/etc/postfix/sender_checks,
check_client_access hash:/etc/postfix/client_checks,
check_client_access pcre:/etc/postfix/client_checks.pcre,
reject_rbl_client zen.spamhaus.org,
reject_rbl_client bl.spamcop.net,
permit

---

Oh, and I'm running Poxfix 2.3.3

So, any ideas why things have changed? (Or am I imagining things...)


-Greg



VS: Recipient limit..but where?

2010-02-26 Thread Niemi Hannu
All right. I try to pinpoint the problem from somewhere else.

Thank you

hannu


Lähettäjä: Wietse Venema [wie...@porcupine.org]
Lähetetty: 26. helmikuuta 2010 15:30
Vastaanottaja: Niemi Hannu
Kopio: postfix-users@postfix.org
Aihe: Re: Recipient limit..but where?

Niemi Hannu:
> Feb 26 08:41:43 listserv postfix/smtpd[32326]: < unknown[10.0.17.127]: RCPT 
> TO:
> Feb 26 08:41:43 listserv postfix/smtpd[32326]: > unknown[10.0.17.127]: 250 
> 2.1.5 Ok
> Feb 26 08:41:43 listserv postfix/smtpd[32326]: < unknown[10.0.17.127]: RSET
> Feb 26 08:41:43 listserv postfix/smtpd[32326]: > unknown[10.0.17.127]: 250 
> 2.0.0 Ok
> Feb 26 08:41:43 listserv postfix/smtpd[32326]: < unknown[10.0.17.127]: QUIT
> Feb 26 08:41:43 listserv postfix/smtpd[32326]: > unknown[10.0.17.127]: 221 
> 2.0.0 Bye
>
> 
>
> Sorry, forgot to add the error message, as shown by Thunderbird.
>
> It is now on
> http://appz.kunnat.net/postfix/index.html

That pop-up has an error message of:

4.5.3 Too many recipients

That is not a Postfix error message, and of course this message
does not show up in SMTP logging. Postfix would have replied with
"452 4.5.3 Error: too many recipients".

You have some piece of antivirus software.

Wietse

Re: Recipient limit..but where?

2010-02-26 Thread Wietse Venema
Niemi Hannu:
> Feb 26 08:41:43 listserv postfix/smtpd[32326]: < unknown[10.0.17.127]: RCPT 
> TO:
> Feb 26 08:41:43 listserv postfix/smtpd[32326]: > unknown[10.0.17.127]: 250 
> 2.1.5 Ok
> Feb 26 08:41:43 listserv postfix/smtpd[32326]: < unknown[10.0.17.127]: RSET
> Feb 26 08:41:43 listserv postfix/smtpd[32326]: > unknown[10.0.17.127]: 250 
> 2.0.0 Ok
> Feb 26 08:41:43 listserv postfix/smtpd[32326]: < unknown[10.0.17.127]: QUIT
> Feb 26 08:41:43 listserv postfix/smtpd[32326]: > unknown[10.0.17.127]: 221 
> 2.0.0 Bye
> 
> 
> 
> Sorry, forgot to add the error message, as shown by Thunderbird. 
> 
> It is now on
> http://appz.kunnat.net/postfix/index.html

That pop-up has an error message of:

4.5.3 Too many recipients

That is not a Postfix error message, and of course this message
does not show up in SMTP logging. Postfix would have replied with
"452 4.5.3 Error: too many recipients".

You have some piece of antivirus software.

Wietse


Re: sender name from /etc/passwd

2010-02-26 Thread Pavel Urban
On 02/26/2010 01:25 PM, Wietse Venema wrote:
> Pavel Urban:
>> Hello,
>>
>> I've tried to migrate some 90 servers from Sendmail to Postfix, trying
>> to keep the behavior as similar as possible. They were all simple null
>> clients, sending mail via relayhost only. After some time I've noticed
>> that some servers are sending their daily logwatch outputs with
>>
>> From: "r...@n2rhps88.localdomain" 
>>
>> , while others have
>>
>> From: Root n2rhps23 PGRLF 
> 
> Postfix does NOT CREATE these headers. 
> 
> Postfix RECEIVES these headers.
> 
> Postfix-generated headers look like
> 
> From: u...@example.com (fullname)
> 
> This non-standard format will eventually be fixed when I have time.
> 
>   Wietse
> 

That's strange. It seems like logwatch invokes 'sendmail -t' and creates
headers like:

open(OUTFILE,"|$Config{'mailer'}") or die "Can't execute
$Config{'mailer'}: $!\n";
print OUTFILE "To: $Config{'mailto'}\n";
print OUTFILE "From: $Config{'mailfrom'}\n";
print OUTFILE "Subject: Logwatch for $Config{'hostname'} (${OStitle})\n";

, when $Config{'mailfrom'} is 'root' and $Config{'mailer'} is 'sendmail
-t'. Anybody knows what could make the final substitution, then?


-- 
***
Pavel Urban (pavel.urban (at) o2bs.com)
O2 BS system disaster
Telefonica O2 Business Solutions, spol. s r.o. - www.o2bs.com
***
   Vegetables should not operate electronic equipment.
  Computer Stupidities, http://rinkworks.com/stupid/
***


RE: Recipient limit..but where?

2010-02-26 Thread Niemi Hannu
-Original Message-
From: Wietse Venema [mailto:wie...@porcupine.org] 
Sent: 26. helmikuuta 2010 14:21
To: Niemi Hannu
Cc: postfix-users@postfix.org
Subject: Re: Recipient limit..but where?

Niemi Hannu:
> Hello I have now tried to form a log file that contains both happy case (500 
> recipients) and unhappy one (501 recipients)
> 
> To debug the case I created 999 bogus users with username 
> us...@listserv.kuntaliitto.fi to user...@listserv.kuntaliitto.fi
> 
> Because the log file is quite a big one (run with -vvv level of verbosity) I 
> decided to put it to a web server.

The client VOLUNTARILY aborts the session after 500 recipients. 

If you see any responses from Postfix that force the client to
stop, then you are welcome to point out where that happens.

Wietse

Feb 26 08:41:42 listserv postfix/smtpd[32326]: < unknown[10.0.17.127]: RCPT 
TO:
Feb 26 08:41:42 listserv postfix/smtpd[32326]: > unknown[10.0.17.127]: 250 
2.1.5 Ok
Feb 26 08:41:42 listserv postfix/smtpd[32326]: < unknown[10.0.17.127]: RCPT 
TO:
Feb 26 08:41:42 listserv postfix/smtpd[32326]: > unknown[10.0.17.127]: 250 
2.1.5 Ok
Feb 26 08:41:42 listserv postfix/smtpd[32326]: < unknown[10.0.17.127]: RCPT 
TO:
Feb 26 08:41:43 listserv postfix/smtpd[32326]: > unknown[10.0.17.127]: 250 
2.1.5 Ok
Feb 26 08:41:43 listserv postfix/smtpd[32326]: < unknown[10.0.17.127]: RCPT 
TO:
Feb 26 08:41:43 listserv postfix/smtpd[32326]: > unknown[10.0.17.127]: 250 
2.1.5 Ok
Feb 26 08:41:43 listserv postfix/smtpd[32326]: < unknown[10.0.17.127]: RCPT 
TO:
Feb 26 08:41:43 listserv postfix/smtpd[32326]: > unknown[10.0.17.127]: 250 
2.1.5 Ok
Feb 26 08:41:43 listserv postfix/smtpd[32326]: < unknown[10.0.17.127]: RSET
Feb 26 08:41:43 listserv postfix/smtpd[32326]: > unknown[10.0.17.127]: 250 
2.0.0 Ok
Feb 26 08:41:43 listserv postfix/smtpd[32326]: < unknown[10.0.17.127]: QUIT
Feb 26 08:41:43 listserv postfix/smtpd[32326]: > unknown[10.0.17.127]: 221 
2.0.0 Bye



Sorry, forgot to add the error message, as shown by Thunderbird. 

It is now on
http://appz.kunnat.net/postfix/index.html

Then again, it IS possible that Thunderbird lies to me :)

And the very same problem is with Outlook, quite a coincidence it's just the 
same number of recipients. Further after looking from Exchange logs I KNOW 
Outlook at least never gave up but Exchange reported it "Can't do it, too many 
recipients".

Thanks for help so far, anyway :)

hannu



Re: sender name from /etc/passwd

2010-02-26 Thread Wietse Venema
Pavel Urban:
> Hello,
> 
> I've tried to migrate some 90 servers from Sendmail to Postfix, trying
> to keep the behavior as similar as possible. They were all simple null
> clients, sending mail via relayhost only. After some time I've noticed
> that some servers are sending their daily logwatch outputs with
> 
> From: "r...@n2rhps88.localdomain" 
> 
> , while others have
> 
> From: Root n2rhps23 PGRLF 

Postfix does NOT CREATE these headers. 

Postfix RECEIVES these headers.

Postfix-generated headers look like

From: u...@example.com (fullname)

This non-standard format will eventually be fixed when I have time.

Wietse


Re: Recipient limit..but where?

2010-02-26 Thread Wietse Venema
Niemi Hannu:
> Hello I have now tried to form a log file that contains both happy case (500 
> recipients) and unhappy one (501 recipients)
> 
> To debug the case I created 999 bogus users with username 
> us...@listserv.kuntaliitto.fi to user...@listserv.kuntaliitto.fi
> 
> Because the log file is quite a big one (run with -vvv level of verbosity) I 
> decided to put it to a web server.

The client VOLUNTARILY aborts the session after 500 recipients. 

If you see any responses from Postfix that force the client to
stop, then you are welcome to point out where that happens.

Wietse

Feb 26 08:41:42 listserv postfix/smtpd[32326]: < unknown[10.0.17.127]: RCPT 
TO:
Feb 26 08:41:42 listserv postfix/smtpd[32326]: > unknown[10.0.17.127]: 250 
2.1.5 Ok
Feb 26 08:41:42 listserv postfix/smtpd[32326]: < unknown[10.0.17.127]: RCPT 
TO:
Feb 26 08:41:42 listserv postfix/smtpd[32326]: > unknown[10.0.17.127]: 250 
2.1.5 Ok
Feb 26 08:41:42 listserv postfix/smtpd[32326]: < unknown[10.0.17.127]: RCPT 
TO:
Feb 26 08:41:43 listserv postfix/smtpd[32326]: > unknown[10.0.17.127]: 250 
2.1.5 Ok
Feb 26 08:41:43 listserv postfix/smtpd[32326]: < unknown[10.0.17.127]: RCPT 
TO:
Feb 26 08:41:43 listserv postfix/smtpd[32326]: > unknown[10.0.17.127]: 250 
2.1.5 Ok
Feb 26 08:41:43 listserv postfix/smtpd[32326]: < unknown[10.0.17.127]: RCPT 
TO:
Feb 26 08:41:43 listserv postfix/smtpd[32326]: > unknown[10.0.17.127]: 250 
2.1.5 Ok
Feb 26 08:41:43 listserv postfix/smtpd[32326]: < unknown[10.0.17.127]: RSET
Feb 26 08:41:43 listserv postfix/smtpd[32326]: > unknown[10.0.17.127]: 250 
2.0.0 Ok
Feb 26 08:41:43 listserv postfix/smtpd[32326]: < unknown[10.0.17.127]: QUIT
Feb 26 08:41:43 listserv postfix/smtpd[32326]: > unknown[10.0.17.127]: 221 
2.0.0 Bye


Re: timeout after CONNECT

2010-02-26 Thread Martijn de Munnik
On Thu, 2010-02-25 at 15:43 +0100, Zoltan Balogh wrote:
> Hi List,
> 
> I have an old postfix install where I am getting "timeout after
> CONNECT from" error messages upon e-mails being send from one
> particular host. The user is complaining that he is not able to send
> out any e-mail. Other users from the same system are sending mail
> happily without errors. User claims to use MS Outlook client. He was
> trying to send an e-mail with about 500 recipients in one mail (no
> comment) but he says before it was processed without problems. Now he
> claims to have only one outgoing email in his Outbox (others including
> one with 500 recipients was removed).
> 
> I do not really understand why Outlook makes so many SMTP connections
> to send out a single mail. Of course I recommended to check for
> viruses or spambots on his computer - client computer seems to be
> clean. I am guessing this is a client problem, but may be there is
> something I am missing in my postfix config. If you have any idea,
> please let me know.
Stop all Outlook instances on the client computer and check if the
computer is still making SMTP connections. If so then a virus or a
spambot is likely to be installed.

> 
> Here is a snip from /var/log/mail/info:
> Feb 25 14:07:53 ns postfix/smtpd[1642]: connect from
> adsl-d128.84-47-53.t-com.sk[84.47.53.128]
> Feb 25 14:08:09 ns postfix/smtpd[1649]: connect from
> adsl-d128.84-47-53.t-com.sk[84.47.53.128]
> Feb 25 14:08:10 ns postfix/smtpd[1695]: connect from
> adsl-d128.84-47-53.t-com.sk[84.47.53.128]
> Feb 25 14:09:15 ns postfix/smtpd[1924]: connect from
> adsl-d128.84-47-53.t-com.sk[84.47.53.128]
> Feb 25 14:09:15 ns postfix/smtpd[1925]: connect from
> adsl-d128.84-47-53.t-com.sk[84.47.53.128]
> Feb 25 14:10:16 ns postfix/smtpd[3172]: connect from
> adsl-d128.84-47-53.t-com.sk[84.47.53.128]
> Feb 25 14:10:16 ns postfix/smtpd[1667]: connect from
> adsl-d128.84-47-53.t-com.sk[84.47.53.128]
> Feb 25 14:11:07 ns postfix/smtpd[32530]: timeout after CONNECT from
> adsl-d128.84-47-53.t-com.sk[84.47.53.128]
> Feb 25 14:11:07 ns postfix/smtpd[32530]: disconnect from
> adsl-d128.84-47-53.t-com.sk[84.47.53.128]
> Feb 25 14:11:07 ns postfix/smtpd[17571]: timeout after CONNECT from
> adsl-d128.84-47-53.t-com.sk[84.47.53.128]
> Feb 25 14:11:07 ns postfix/smtpd[17571]: disconnect from
> adsl-d128.84-47-53.t-com.sk[84.47.53.128]
> Feb 25 14:11:07 ns postfix/smtpd[16099]: timeout after CONNECT from
> adsl-d128.84-47-53.t-com.sk[84.47.53.128]
> Feb 25 14:11:07 ns postfix/smtpd[16099]: disconnect from
> adsl-d128.84-47-53.t-com.sk[84.47.53.128]
> Feb 25 14:11:19 ns postfix/smtpd[32530]: connect from
> adsl-d128.84-47-53.t-com.sk[84.47.53.128]
> Feb 25 14:11:19 ns postfix/smtpd[16099]: connect from
> adsl-d128.84-47-53.t-com.sk[84.47.53.128]
> Feb 25 14:11:21 ns postfix/smtpd[15515]: timeout after CONNECT from
> adsl-d128.84-47-53.t-com.sk[84.47.53.128]
> Feb 25 14:11:21 ns postfix/smtpd[15515]: disconnect from
> adsl-d128.84-47-53.t-com.sk[84.47.53.128]
> Feb 25 14:11:21 ns postfix/smtpd[15816]: timeout after CONNECT from
> adsl-d128.84-47-53.t-com.sk[84.47.53.128]
> Feb 25 14:11:21 ns postfix/smtpd[15816]: disconnect from
> adsl-d128.84-47-53.t-com.sk[84.47.53.128]
> 
> .. such log messages are appearing constantly for the past 2 days.
> 
> Of course reguraly I get the following:
> Feb 25 14:13:40 ns postfix/anvil[21586]: statistics: max connection
> rate 9/60s for (smtp:84.47.53.128) at Feb 25 14:07:07
> Feb 25 14:13:40 ns postfix/anvil[21586]: statistics: max connection
> count 19 for (smtp:84.47.53.128) at Feb 25 14:10:16
> 
> There are always 5 to 15 SMTP connects hanging from the same IP.
> # netstat -ap
> tcp0  0 *:smtp  *:*
> LISTEN  1519/smtpd
> tcp0 24 ns.myhost.sk:smtp   adsl-d128.84-47-5:23729
> ESTABLISHED 16165/smtpd
> tcp0 24 ns.myhost.sk:smtp   adsl-d128.84-47-5:23732
> ESTABLISHED 1519/smtpd
> tcp0 24 ns.myhost.sk:smtp   adsl-d128.84-47-5:23682
> ESTABLISHED 1667/smtpd
> tcp0 24 ns.myhost.sk:smtp   adsl-d128.84-47-5:23681
> ESTABLISHED 3172/smtpd
> tcp0 24 ns.myhost.sk:smtp   adsl-d128.84-47-5:23710
> ESTABLISHED 32530/smtpd
> tcp0 24 ns.myhost.sk:smtp   adsl-d128.84-47-5:23711
> ESTABLISHED 16099/smtpd
> tcp0 24 ns.myhost.sk:smtp   adsl-d128.84-47-5:23662
> ESTABLISHED 1925/smtpd
> tcp0 24 ns.myhost.sk:smtp   adsl-d128.84-47-5:23661
> ESTABLISHED 1924/smtpd
> 
> In the following my server host domain is forged to "myhost.sk":
> 
> # postconf -n
> alias_database = hash:/usr/local/postfix/conf/aliases
> alias_maps = hash:/usr/local/postfix/conf/aliases
> body_checks = regexp:/usr/local/postfix/conf/body_checks
> command_directory = /usr/local/postfix-2.2.3/bin
> config_directory = /usr/local/postfix-2.2.3/conf
> content_filter = smtp-amavis:[127.0.0.1]:10024
> daemon_directory = /usr/local/postfix-2.2.3/libexec
> debug_peer_level = 

sender name from /etc/passwd

2010-02-26 Thread Pavel Urban
Hello,

I've tried to migrate some 90 servers from Sendmail to Postfix, trying
to keep the behavior as similar as possible. They were all simple null
clients, sending mail via relayhost only. After some time I've noticed
that some servers are sending their daily logwatch outputs with

From: "r...@n2rhps88.localdomain" 

, while others have

From: Root n2rhps23 PGRLF 

. I prefer the second variant; the problem is that configurations are
the same... The "comment" field in this record comes from /etc/passwd.

[r...@n2rhps88 ~]# postconf -n
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/libexec/postfix
debug_peer_level = 2
disable_dns_lookups = yes
html_directory = no
inet_interfaces = localhost
mail_owner = postfix
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
mydestination = $myhostname, localhost.$mydomain, localhost
mydomain = localdomain
newaliases_path = /usr/bin/newaliases.postfix
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix-2.3.3/README_FILES
relayhost = [mailrelay.cms1]
sample_directory = /usr/share/doc/postfix-2.3.3/samples
sender_canonical_classes = envelope_sender
sender_canonical_maps = pcre:/etc/postfix/sender
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
unknown_local_recipient_reject_code = 550

[r...@n2rhps88 ~]# uname -a
Linux n2rhps88 2.6.18-164.el5 #1 SMP Tue Aug 18 15:51:48 EDT 2009 x86_64
x86_64 x86_64 GNU/Linux
[r...@n2rhps88 ~]# cat /etc/redhat-release
Red Hat Enterprise Linux Server release 5.4 (Tikanga)
[r...@n2rhps88 ~]# rpm -q postfix
postfix-2.3.3-2.1.el5_2

[r...@n2rhps23 ~]# uname -a
Linux n2rhps23 2.6.9-67.ELsmp #1 SMP Wed Nov 7 13:58:04 EST 2007 i686
i686 i386 GNU/Linux
[r...@n2rhps23 ~]# cat /etc/redhat-release
Red Hat Enterprise Linux ES release 4 (Nahant Update 6)
[r...@n2rhps23 ~]# rpm -q postfix
postfix-2.2.10-1.1.el4

[r...@n2rhps88 ~]# cat /etc/postfix/sender
/\@/u...@o2bs.com
//  MAILER-DAEMON

-- 
***
Pavel Urban (pavel.urban (at) o2bs.com)
O2 BS system disaster
Telefonica O2 Business Solutions, spol. s r.o. - www.o2bs.com
***
   Vegetables should not operate electronic equipment.
  Computer Stupidities, http://rinkworks.com/stupid/
***