Thanks for the response Victor...
On 4/18/2014 2:20 PM, Viktor Dukhovni wrote:
On Fri, Apr 18, 2014 at 02:06:20PM -0400, Charles Marcus wrote:
Ok, been wanting to do this for a while, and I after the Heartbleed fiasco,
the boss finally agreed to let me buy some real certs...
Until now
On 4/18/2014 3:06 PM, Viktor Dukhovni wrote:
On Fri, Apr 18, 2014 at 02:35:45PM -0400, Charles Marcus wrote:
No. The correct approach is at:
http://www.postfix.org/TLS_README.html#server_cert_key
With legacy public CA trust verification, you can omit the root
certificate from
On 4/18/2014 3:50 PM, Viktor Dukhovni wrote:
In the sample command, "server_cert.pem" is a plausible name for
a file that holds just the leaf server certificate. While
"intermediate_CA.pem" is a plausible name for a file that hold one
or more intermediate CA issuer certificates (in the right or
On 4/18/2014 5:14 PM, Viktor Dukhovni wrote:
Though many/most client implementations may not mind, the certificate
chain is not quite in the right order:
$ posttls-finger -cC -Lsummary smtp.media-brokers.com:587 |
openssl crl2pkcs7 -nocrl -certfile /dev/stdin |
openssl
On 4/19/2014 6:32 AM, Charles Marcus wrote:
Thanks again Victor, without the support on this list many of us
wanna-be admins would be in way over our heads...
One other question...
Would I be correct that the following error I'm now seeing since
changing the certs could be caused by
On 4/18/2014 6:52 PM, li...@rhsoft.net wrote:
cat whatever-filename.crt your-private.key intermediate-a.crt > your.pem
you are done, use that for*whatever* sevrer-software (httpd, postfix, ATS,
dovecot)
as key and or certificate file
Apparently not, if the certs you get are from RapidSS
On 4/19/2014 6:32 AM, Charles Marcus wrote:
Would you mind a quick check of both our smtp. and mail. (I'm guessing
that I would need to do the same thing for dovecot's cert too)?
Hi Victor,
I hate to keep imposing on you, but since I don't have the postfinger
tool, and h
e-read the
postfix docs a few times afterwards, I may actually gain a reasonable if
not rudimentary understanding of how these pieces fit together.
Hope you're having a great holiday weekend!
Charles
On 4/19/2014 12:36 PM, Viktor Dukhovni wrote:
On Sat, Apr 19, 2014 at 07:06:31AM -0400,
On 5/30/2014 3:52 PM, Tony Nelson wrote:
And for completeness, the full bounce is at the end of this message.
Try again.
Your report won't be complete until you show the full logs for this
event. The bounce notification, while not totally useless, is not necessary.
Best regards,
Charles
On 6/10/2014 1:24 PM, Kai Krakow wrote:
> And those silly autodetection of older MUAs sticks to port 25
unencrypted. So even new customers who redo
> their installations on their own silently go back to port 25.
So... why on earth are you allowing UNENCRYPTED AUTH at ALL, let alone
on port 2
On 7/31/2014 5:59 AM, li...@sbt.net.au wrote:
I have Postfix 2.11.0 with virtual domains in mysql/postfixadmin, all
working well, as per setup below
user of the mydom.tld.au has also registered mydom.tld (to prevent
cybersquating)
sometimes they make mistakes and attempt to send emails to
a_u.
On 7/31/2014 7:21 AM, li...@sbt.net.au wrote:
On Thu, July 31, 2014 8:55 pm, Charles Marcus wrote:
You have to have a 1-1 mapping for each valid user.
Postfixadmin (sql based administrative tool for managing email user
accounts for postfix) supports domain aliases out of the box (does the 1
On 7/28/2008 5:03 PM, Rich Shepard wrote:
Postfix is rejecting mail from an address that should be allowed in. The
mail log tells me:
Jul 28 13:11:58 salmo postfix/smtpd[17243]: NOQUEUE: reject: RCPT from
wsip-xx-xxx-xx-xx.ph.ph.cox.net[xx.xxx.xx.xxx]: 450 4.1.7
<[EMAIL PROTECTED]>: Sender addre
On 8/1/2008, Tait Grove ([EMAIL PROTECTED]) wrote:
Make sure your system does not accept
mail to undeliverable or invalid recipients.
How can I ensure that?
You could start by reading the answers you are getting and complying...
You apparently missed this:
For definite answers rather than
On 8/4/2008, fajar ([EMAIL PROTECTED]) wrote:
The following message to <[EMAIL PROTECTED]> was undeliverable.
The reason for the problem:
5.4.7 - Delivery expired (message too old) [Default] 451-'Sender verify
failed'
Why are you using sender verification? You should NOT use SAV for all
mess
Let me give this one a try... I *think* i see the problem...
On 8/4/2008, Nicolas KOWALSKI ([EMAIL PROTECTED]) wrote:
Aug 4 14:17:18 petole postfix/smtpd[23545]: NOQUEUE: reject: RCPT
from 225.96.68-86.rev.gaoland.net[86.68.96.225]: 554 5.7.1 Service
unavailable; Client host [86.68.96.225] bloc
On 8/4/2008 11:00 AM, oxy wrote:
i am using postfixadmin with virtual vacation script and i have a
little problem here.. after set up virtual vacation as postfixadmin
decribes i have actually two kind of problems, first:
when i set virtual vacation the mailbox sends back one 'i am on
vacation'
On 8/4/2008 9:10 PM, fajar wrote:
Why are you using sender verification? You should NOT use SAV for all
messages, only for messages destined to domains that you control or have
already gotten permission to do SAV for, or you WILL evenutally get
blacklisted.
Please post postconf -n output...
T
Hi,
I know this is simple, but I never had to do it, so wanna check myself...
For outbound mail, do transport entries supersede the relayhost
parameter in main.cf?
The reason I ask is, currently, I relay all outbound mail through our
outsourced anti-spam service (smtp.example1.com).
We are
On 8/8/2008 2:15 PM, Ralf Hildebrandt wrote:
The reason I ask is, currently, I relay all outbound mail through our
outsourced anti-spam service (smtp.example1.com).
Why? Are you afraid you're sending spam?
Nope, just another layer of security - they provide the service as part
of the stand
On 8/8/2008, Noel Jones ([EMAIL PROTECTED]) wrote:
It looks as if you already consulted the documentation and just want
to confirm your interpretation of it. That's good, but say so next
time or you'll just be pointed back to the docs.
Heh... yeah, should have said so... but thanks for reading
On 8/11/2008 6:38 AM, junior.listas wrote:
Hi all,
I have a user that receives a lot of spam mail comming from postmaster
and mailer-daemon, but they did not send this emails for this errors,
how can i block/redirect this kind of email to another account??
http://www.postfix.org/BACKSCATTER
On 8/11/2008, Charles Marcus ([EMAIL PROTECTED]) wrote:
But no need to redirect it, just block it...
That should have read 'reject', not block...
--
Best regards,
Charles
On 8/14/2008 11:54 AM, John Heim wrote:
> Get it? Somebody tries to spam [EMAIL PROTECTED] and user12 has his
> mail forwarded to his gmail account. Gmail detects the spam, rejects the
> message and my mta then generates a bounce back to the original forged
> from address.
>
> I don't see anything
On 8/14/2008, John Heim ([EMAIL PROTECTED]) wrote:
> Exactly! Except that the reason our anti-spam measures are
> ineffective is that the addresses are aliased.
?? What difference does an alias make? Either a recipient is valid or not...
> We have 2 MTAs running postfix with pre-queue spam filter
On 8/20/2008, Blake Carver ([EMAIL PROTECTED]) wrote:
> So a few other details I've grabbed didn't provide yesterday-
> These numbers don't seem to add up.
> My big question is how do I get this system upgraded without breaking it?
>
> postconf -d | grep mail_version
> mail_version = 2.4.5
>
> a
On 8/20/2008, John Baker ([EMAIL PROTECTED]) wrote:
> bmmail.cwf.org returns a valid result from a dns check. What am I
> missing here?
This: helo=
helo hostnames should be FQDN's...
--
Best regards,
Charles
On 8/25/2008, Aaron D. Bennett ([EMAIL PROTECTED]) wrote:
> html_directory = /usr/share/doc/postfix-2.1.4-documentation/html
> readme_directory = /usr/share/doc/postfix-2.0.16/README_FILES
> sample_directory = /usr/share/doc/postfix-2.0.16/samples
So what version is this?
2.0.16? 2.1.4? Something
On 8/25/2008 11:48 AM, Aaron Bennett wrote:
>> So what version is this?
>>
>> 2.0.16? 2.1.4? Something else?
>>
>> If either of those, you really should upgrade...
> no it's 2.3.2, those config statements are just cruft from a few upgrades.
Still old and worth upgrading...
--
Best regards,
Ch
On 8/26/2008, Robert Schetterer ([EMAIL PROTECTED]) wrote:
> as far i know
> blacklist reputation
> is only related to
> answering hostmaster@
> postmaster@
> abuse@
> webmaster@
> by rfc
My understanding is the RFC only requires postmaster and abuse to be
valid, NOT webmaster - and I've NEVER us
On 9/1/2008 12:15 PM, Erik Paulsen Skaalerud wrote:
> I have a postfix-pop3/imap4 server at our office who gets incoming
> smtp mail from either 2 fixed IP adresses (antispam-company), from my
> local network or from clients authenticated via SASL.
> Is it possible to restrict smtp access so that u
On 9/5/2008, Paul Cocker ([EMAIL PROTECTED]) wrote:
> I'm setting up a postfix 2.3.3 mail server
Why use something so old if you're setting up a new server?
--
Best regards,
Charles
On 9/5/2008 12:46 PM, Joakim Ohlsson wrote:
>>> This is first time I use this mailing-list, so please let me know if I do
>>> anything wrong.
>>>
>>> My problem is that I want to send bounced messages to an different mail
>>> address than the mail-address in the MAIL FROM: field.
>> This is by def
On 9/9/2008, Adam Tauno Williams ([EMAIL PROTECTED]) wrote:
> Yes, Thunderbird works with roaming profiles; albeit rather badly.
> Thunderbird has no auto-configuration mechanism so every user's
> account(s) need to be setup manually and it is prone to making HUGE
> cache files if not setup carefu
On 9/18/2008, Marcel Grandemange ([EMAIL PROTECTED]) wrote:
> I have pop-before-smtp running for relaying from outside.
This is extremely unwise.
Use smtp auth instead. popb4smtp is very insecure, and will most likely
result in your server becoming compromised - its not a matter of if, but
when.
On 9/22/2008, Victor Duchovni ([EMAIL PROTECTED]) wrote:
> By default Postfix truncates virtual(5) expansion at 1000 recipients.
> For lists this large you MUST not use virtual(5), rather use a ":include:"
> valued local alias, AND set an "owner-list" alias to make sure that
> bounces are NOT send
On 9/26/2008, Henrik K ([EMAIL PROTECTED]) wrote:
> Ok that's true. But it still doesn't make it right to have a non-working
> envelope sender.
What is 'right' and what is reality are often very different things.
--
Best regards,
Charles
On 9/26/2008, Michael Monnerie ([EMAIL PROTECTED]) wrote:
> Could/Should the behaviour of postfix be changed to just send that
> warning every 15 or 30 minutes, not per message? That would be better
> for everybody I think, as it doesn't help to get 50 or 5000 messages
> that your disk is almost
On 9/26/2008 7:56 AM, PauAmma wrote:
>>> Could/Should the behaviour of postfix be changed to just send that
>>> warning every 15 or 30 minutes, not per message? That would be better
>>> for everybody I think, as it doesn't help to get 50 or 5000 messages
>>> that your disk is almost full.
>> If 50
On 10/1/2008, Ujjval K ([EMAIL PROTECTED]) wrote:
> The geniuses at Comcast (my ISP; no, I don't have any choice) have
> suddenly decided that I am a source of spam and hence require me to
> send e-mail to port 587 instead of port 25.
Or maybe you should consider whether you ARE a source of spam.
Hello,
I probably am using bad terminology, but...
I have set the delay_warning_time to 15m on my system (boss demanded
it), and now the boss wants more than just the one notification...
Is there any way to configure postfix to send more than just the
one/first 'problem' notification to the send
On 10/6/2008 12:40 PM, Wietse Venema wrote:
>> I probably am using bad terminology, but...
>>
>> I have set the delay_warning_time to 15m on my system (boss demanded
>> it), and now the boss wants more than just the one notification...
> This is not implemented.
Bummer...
> However, Postfix 2.3+
Hello,
I've been tasked with adding a few more domains for handling mail. This
server has been running flawlessly for about 5 years (and survived many
updates), but this will be my first implementation of virtual hosting,
so before I actually start changing config settings, I thought I'd ask
for c
On 10/6/2008 2:29 PM, mouss wrote:
>> Currently, I simply have our one domain referenced in mydomain, and
>> have the hostname set accordingly (see postconf -n below), and am
>> not using virtual_mailbox_domains.
> currently, you have domains in mydestination even if you didn't specify
> that. you
On 10/6/2008, Brian Evans - Postfix List ([EMAIL PROTECTED]) wrote:
>> I'm going to be writing up instructions for users who will be using
>> these new domains how to set up their mail clients (Thunderbird mainly,
>> but I also include instructions for the Microsoft clients)... so I
>> wanted to co
On 10/6/2008, Jorey Bump ([EMAIL PROTECTED]) wrote:
> If the name resolves, they'll connect to your server. However, if you're
> going to offer STARTTLS, you have a problem. How are you going to
> support all of these different domains in a single certificate?
> Currently, you can't, so you'll need
On 10/7/2008, Wietse Venema ([EMAIL PROTECTED]) wrote:
>> But the virtual how-to says the opposite... "never list a
>> virtual_mailbox_domain in mydestination"...
> If you list smtp.example.com as a virtual domain, then do not list
> it in mydestination.
Ok... more confusion...
1. 'smtp.example.
On 10/7/2008 9:26 AM, Ralf Hildebrandt wrote:
>> Does the default:
>>
>> delay_warning_time = 0h
>>
>> really mean that the sender would get the warning immediately if the
>> message wasn't able to be delivered immediately?
> Please read the docs carefully:
>
> To enable this feature, specify a n
On 10/6/2008 7:18 PM, Wietse Venema wrote:
>> Can I set up DNS (and MX records) for several different domains to
>> point to the same postfix instance/host/IP address and reference
>> that same postfix instance/host/IP by different DNS host names
>> (smtp.example1.com, smtp.example2.com, etc), and
Hi,
What is probably a *very* obvious question...
Does the default:
delay_warning_time = 0h
really mean that the sender would get the warning immediately if the
message wasn't able to be delivered immediately?
--
Best regards,
Charles
On 10/7/2008 3:09 PM, mouss wrote:
>> but, example.com (the domain, not the hostname) is also listed in
>> virtual_mailbox_domains via the mysql lookup...
>>
>> Is this OK/normal? I'm thinking yes, because:
> yes, it's ok.
Ok, good... :)
> Note that both smtp.example.com and example.com are FQDN
On 10/7/2008, Victor Duchovni ([EMAIL PROTECTED]) wrote:
> This is false. DNS allows SOA, NS and A (or ) records to exist at
> the same level (for the same domain name). So a delegated domain name
> (zone cut) can also be a host. What is not legal is CNAME records in
> combination with NS or SO
On 10/7/2008, Lists ([EMAIL PROTECTED]) wrote:
> I like the setup that allows the client to use pop details to
> authenticate - I even managed to get that working ;)
If you're talking about pop-b4-smtp, then you should know that it is
insecure and likely to cause you trouble.
Just go with smtpau
On 10/8/2008, Lists ([EMAIL PROTECTED]) wrote:
> I mean where the person in the mail client checks my server requires
> authentication and then selects use same credentials as pop server
> (thereby using username and password)
Ok then... just making sure... :)
--
Best regards,
Charles
On 10/10/2008 8:21 AM, Ralf Hildebrandt wrote:
>> Is there a simple way to test the returned value of a mysql based
>> virtual mailbox map from the command line using the postconf command or
>> something similar?
> man postmap (option -q)
I'm blind... thanks Ralf...
--
Best regards,
Charles
Hi,
Currently my virtual_mailbox_maps are being accessed by:
virtual_mailbox_domains = mysql:/etc/postfix/mysql_vmd.cf
virtual_mailbox_maps = mysql:/etc/postfix/mysql_vmm.cf
It has been said here many times that it is better to use proxy:mysql:
instead, but I'm confused about implementation...
On 10/10/2008, Stephen Liu ([EMAIL PROTECTED]) wrote:
> # postmap -q [EMAIL PROTECTED]
> /etc/postfix/mysql-virtual_mailbox_limit_maps.cf
> postmap: fatal: open database
> /etc/postfix/mysql-virtual_mailbox_limit_maps.cf.db: No such file or
> directory
Fix this...
If mysql-virtual_mailbox_limit_m
On 10/10/2008 9:19 AM, Brian Evans - Postfix List wrote:
> No.. it should be 'postmap -q
> mysql:/etc/postfix/mysql-virtual_mailbox_limit_maps.cf'
>
> It goes type:table, not path/type:table.
Right, sorry for the noise...
--
Best regards,
Charles
On 10/10/2008, Wietse Venema ([EMAIL PROTECTED]) wrote:
>> Is it simply a matter of adding the proxy: prefix to the map
>> location?
> Yes. I thought that the examples are sufficient. But if you are more
> comfortable with more formal Backus-Naur syntax then I suppose could
> provide that too.
No
Hello,
Googling didn't reveal the answer (I probably didn't hit the right terms)...
Is there a simple way to test the returned value of a mysql based
virtual mailbox map from the command line using the postconf command or
something similar?
--
Best regards,
Charles
Hello,
Currently my virtual users are not organized by domain, and the
directory layout is:
/var/virtual/mail/[EMAIL PROTECTED]
with the following query to get the mailbox locations for virtual users:
query = SELECT maildir FROM mailbox WHERE username='%s'
I am planning on migrating everything
On 10/13/2008, Joey ([EMAIL PROTECTED]) wrote:
> Somewhere government ( which I dont want them to control, but is the
> only one that can step in ) has to step in and setup hard and fast
> laws and rules based on a committee of knowledgable people ( Wietse
> etc ) to create a system which requires
On 10/13/2008 5:33 PM, Joey wrote:
>> I prefer the animating contest of freedom (and that includes learning
>> how to deal with spam), rather than give over absolute despotic control
>> of the internet to any government agency, which is what you are in
>> essence 'pipe-dreaming' about.
> Agreed, h
Wrong list... this has absolutely zero to do with postfix.
On 10/16/2008 4:38 AM, Gejo Paul wrote:
> Dear All,
>
> I am using postfix + perdition + courier + ldap+ maildir (mail quota)
> on my mail servers.most of my clients are using squirrelmail for
> checking mails.
> All the functions are
On 10/20/2008, Joey ([EMAIL PROTECTED]) wrote:
> Running spamassasin on every domain we support will kill the server
> CPU wise and again as in my messages before it's about reducing
> overhead. I am abusing some RBL's in some cases so I need to reduce
> connections.
I highly recommend checking o
On 10/20/2008 Linux Addict wrote:
mynetworks = /etc/postfix/network_table
Contents of this file could be instructive...
postconf -n?
--
Best regards,
Charles
On 10/29/2008, Joe Sloan ([EMAIL PROTECTED]) wrote:
> All our production boxes are 100% reiserfs, and have been for some
> years, based on performance testing. They have been rock solid, and most
> of them have 800 day uptimes at this point. I did some performance
> comparisons a few months ago and
On 10/31/2008, Asai ([EMAIL PROTECTED]) wrote:
> smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks,
> reject_non_fqdn_sender, reject_unknown_sender_domain, permit
I do believe this makes you an open relay...
--
Best regards,
Charles
On 10/31/2008 12:37 PM, Charles Marcus wrote:
> On 10/31/2008, Asai ([EMAIL PROTECTED]) wrote:
>> smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks,
>> reject_non_fqdn_sender, reject_unknown_sender_domain, permit
> I do believe this makes you an open re
On 10/31/2008 12:54 PM, Brian Evans - Postfix List wrote:
> Charles Marcus wrote:
>> On 10/31/2008, Asai ([EMAIL PROTECTED]) wrote:
>>
>>> smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks,
>>> reject_non_fqdn_sender, reject_unknown_sende
On 11/4/2008, Lluis Ribes ([EMAIL PROTECTED]) wrote:
> If I want to avoid that the spammer wouldn't receive a response like this:
>
> "but it was rejected by the recipient domain. We recommend contacting
> the other email provider for further information about the cause of
> this error. The error
On 11/7/2008 3:59 AM, Josep M. wrote:
> I have Postfix running since some years ago and always ok, now when
> upgraded to Debian Lenny started giving to me these error messages when
> tested port 465
>
> Nov 7 09:15:57 140 postfix/smtpd[26674]: fatal: bad boolean
> configuration: smtpd_tls_auth_o
601 - 673 of 673 matches
Mail list logo
