Re: STARTTLS and mailservers who choke on it

[Robert Schetterer]

Am 29.03.2012 08:34, schrieb Per Jessen:
> I'm wondering how others handle this.  We offer TLS for all inbound
> traffic, which works fine 99% of the time.  Every other day though I
> notice one or two mailservers who simply cannot cope with it.  They try,
> but they keep getting a timeout.  Something is clearly not working on
> their side and the email will eventually not get delivered. (I'm pretty
> certain they're all MSEX, but that's just a hunch).
> 
> To prevent this I check our logs regularly and use 
> smtpd_discard_ehlo_keyword_address_maps to disable starttls for those
> servers that have a problem.  It's a bit of a hassle, so I was wondering 
> how others handle it? 

beside other problems i.e network firewalls etc that maybe are envolved
i do it like you do

> 
> 
> thanks
> Per
> 
> 


-- 
Best Regards

MfG Robert Schetterer

Germany/Munich/Bavaria

STARTTLS and mailservers who choke on it

[Per Jessen]

I'm wondering how others handle this.  We offer TLS for all inbound
traffic, which works fine 99% of the time.  Every other day though I
notice one or two mailservers who simply cannot cope with it.  They try,
but they keep getting a timeout.  Something is clearly not working on
their side and the email will eventually not get delivered. (I'm pretty
certain they're all MSEX, but that's just a hunch).

To prevent this I check our logs regularly and use 
smtpd_discard_ehlo_keyword_address_maps to disable starttls for those
servers that have a problem.  It's a bit of a hassle, so I was wondering 
how others handle it? 


thanks
Per


-- 
Per Jessen, Zürich (7.9°C)

RE: FW: Postfix delivery to openldap users

[Priscilla V]

Postmap -q  ldap:/etc/postfix/ldap.cf

Is not giving any output.
It returns silently.

Regards
Priscilla

-Original Message-
From: owner-postfix-us...@postfix.org [mailto:owner-postfix-us...@postfix.org] 
On Behalf Of Brian Evans - Postfix List
Sent: Wednesday, March 28, 2012 6:24 PM
To: postfix-users@postfix.org
Subject: Re: FW: Postfix delivery to openldap users

On 3/28/2012 5:19 AM, Priscilla V wrote:
> We have configured to consider ldap users also in /etc/nsswitch.conf.

I'm not an LDAP expert, but it seems as if you are looking up a full email 
address.
Please be aware that alias_maps lookups only send the bare user name.

Queries targeting "j...@example.com" will fail.

>
> : files ldap nisplus
> shadow: files ldap nisplus
> group : files ldap nisplus
>
> So virtual  aliases need not be configured.
> Alias_maps alone is sufficient.
>
> Here is the configuration of ldap.cf
>
> server_host = 
> server_port = 389
> search_base = 
> scope = sub
> bind = yes
> bind_dn = 
> bind_pw = 
> version = 3
> start_tls = no
> query_filter = (mail=%s)
> result_attribute = uid
[snip]
> If all the above are OK for your case, what does "postmap -q ldapuseralias 
> ldap:/etc/postfix/ldap.cf" output (where ldapuseralias is one of your ldap 
> users)?

This is good advice for testing and you should follow it.
Just be sure to test the bare user name, like joe from my previous example.

Brian

Re: Next day

[Daniele Nicolodi]

On 28/03/12 16:43, lst_ho...@kwsoft.de wrote:
> Zitat von   :
> 
>> I use Postfix and is great. Thank you W!
>>
>> I send this becoz I got worried: If Wietse suddenly gets tired, retired etc
>> what happens to Postfix? Any team/guys knowing Postfix well enough to keep
>> dev on with W's blessings?
> 
> Well, that's the real power of Open Source. If there is enough  
> interest/invest in, for sure someone will step up and take over  
> responsibility. With some knowledge in C you can even do it yourself  
> to some extend.

That's true, however, as far as I know, differently than most of other
open source software, there isn't a public source code repository for
the development of Postfix. Wieste, can you comment on this choice?

Thank you. Cheers,
-- 
Daniele

Re: Next day

[lst_hoe02]

Zitat von   :


I use Postfix and is great. Thank you W!

I send this becoz I got worried: If Wietse suddenly gets tired, retired etc
what happens to Postfix? Any team/guys knowing Postfix well enough to keep
dev on with W's blessings?


Well, that's the real power of Open Source. If there is enough  
interest/invest in, for sure someone will step up and take over  
responsibility. With some knowledge in C you can even do it yourself  
to some extend.



I ask becoz I want to feel more safe.


To "feel safe" is a personal point of view so maybe there is nothing  
the people on this list can do about ;-)



Sth more: Is there a ticketing system for Postfix bug reports & feature
requests?


There once was a developer mailing list, but not sure if it still  
exist. You might also post here to get started.


Regards

Andreas




smime.p7s
Description: S/MIME Cryptographic Signature

Re: Enabled SMTP AUTH but mails from external networks still being rejected

[Reindl Harald]

Am 28.03.2012 15:31, schrieb Phill Edwards:
> I have had a Postfix SMTP server on my LAN for a long time and it works 
> really well for delivering my email via
> relayhost = smtp.example.com  (replaced my actuals 
> ISP's SMTP server here).
> 
> I have now set up SMTP AUTH and it's working when sening emails from PCs on 
> my LAN. But when I send emails from
> outside (eg from my mobile phone) I get these errors:
> 
> Mar 29 00:04:32 zrf postfix/smtpd[624]: warning: xx.xxx.180.193: hostname 
> paxx-xxx-180-193.pa.nsw.optusnet.com.au
>  verification failed: Name or 
> service not known
> Mar 29 00:04:32 zrf postfix/smtpd[624]: connect from unknown[xx.xxx.180.193]
> Mar 29 00:04:33 zrf postfix/smtpd[624]: NOQUEUE: reject: RCPT from 
> unknown[xx.xxx.180.193]: 554 5.7.1
> : Client host rejected: Access denied; 
> from=mailto:m...@example.com>>
> to=mailto:some...@example.com>> proto=ESMTP 
> helo= >
> Mar 29 00:04:33 zrf postfix/smtpd[624]: disconnect from 
> unknown[xx.xxx.180.193]

where do you see here any authentication try?
connect -> reject

let me guess - this is a iPhone?

these stupid phones are forgot randomly the auth setting, do not
inform the user about the problem and the winner was a iphone
trying over 6 months to send the same message without authentication
_

this is how a authentication looks like in maillog

Mar 28 15:34:58 mail postfix/smtpd[28115]: connect from xx[10.0.0.xx]
Mar 28 15:34:58 mail postfix/smtpd[28115]: 9340B91: client=xx[10.0.0.xx], 
sasl_method=PLAIN,
sasl_username=c.pi...@thelounge.net
Mar 28 15:34:58 mail postfix/cleanup[987]: 9340B91: 
message-id=<07e64489-a24e-4952-9ae3-2ee943a37...@thelounge.net>




signature.asc
Description: OpenPGP digital signature

Re: postscreen on rhel6/postfix-2.6.6

[Wietse Venema]

postscreen is supported on Postfix stable releases 2.9 and 2.8.
Earlier postscreen versions are not part of a stable release, and
are therefore not supported.

There are plenty resources that provide RPMs for Postfix 2.9,
or how to build your own. These are discussed frequently on 
this mailing list.

Wietse

Re: FW: Postfix delivery to openldap users

[Wietse Venema]

Brian Evans - Postfix List:
> On 3/28/2012 5:19 AM, Priscilla V wrote:
> > We have configured to consider ldap users also in /etc/nsswitch.conf.
> 
> I'm not an LDAP expert, but it seems as if you are looking up a full
> email address.
> Please be aware that alias_maps lookups only send the bare user name.
> 
> Queries targeting "j...@example.com" will fail.

However, you can use such queries in virtual_alias_maps ***even if
you don't have virtual domains***. This is documented.

Wietse

Re: FW: Postfix delivery to openldap users

[Brian Evans - Postfix List]

On 3/28/2012 5:19 AM, Priscilla V wrote:
> We have configured to consider ldap users also in /etc/nsswitch.conf.

I'm not an LDAP expert, but it seems as if you are looking up a full
email address.
Please be aware that alias_maps lookups only send the bare user name.

Queries targeting "j...@example.com" will fail.

>
> : files ldap nisplus
> shadow: files ldap nisplus
> group : files ldap nisplus
>
> So virtual  aliases need not be configured.
> Alias_maps alone is sufficient.
>
> Here is the configuration of ldap.cf
>
> server_host = 
> server_port = 389
> search_base = 
> scope = sub
> bind = yes
> bind_dn = 
> bind_pw = 
> version = 3
> start_tls = no
> query_filter = (mail=%s)
> result_attribute = uid
[snip]
> If all the above are OK for your case, what does "postmap -q ldapuseralias 
> ldap:/etc/postfix/ldap.cf" output (where ldapuseralias is one of your ldap 
> users)?

This is good advice for testing and you should follow it.
Just be sure to test the bare user name, like joe from my previous example.

Brian

Re: Mail delivery for local mailbox

[Simone Caruso]

On 28/03/2012 13:54, Andrea Cappelli wrote:
> Il 28/03/2012 13:47, Ansgar Wiechers ha scritto:
>> Well, don't make gmail.com a local domain when it isn't a local domain.
>> Problem solved. Regards Ansgar Wiechers 
> 
> There are some cases in which I need to, for example when I migrate the domain
> to my server, so the domain will be local but for some time (until the DNS
> change) it is still on another server.
> 
> In this situation I create the mailboxes for incoming user, but I have the
> drawback that I can't write to them anymore, because the delivery became 
> local (
> assuming I'm using the same SMTP server), so in this case I would Postfix 
> check
> the MX record (which is still pointing to the other server) before check local
> mailbox.
> 
> It's possible? Or the are better way to accomplish this?
> 
try using a sql map for virtual mailboxes/domains

-- 
Simone Caruso
IT Consultant
+39 349 65 90 805

postscreen on rhel6/postfix-2.6.6

[Jan-Frode Myklebust]

I'm quite locked to running the distributions version of postfix
(currently 2.6.6), but also would very much to take advantage of
postscreen for turning away zombies. I saw in the postfix-2.7.0
announcement that it would be possible to use postscreen from v2.8
with postfix v2.7, and also the POSTSCREEN_README.html mentions
running postfix 2.6.

So, should it be ok to run postscreen with postfix-2.6.6, and does
anybody have any information for how to do this? Just build the
postscreen binary from latest v2.7 or v2.8 and point to it in
master.cf?



  -jf

Re: Difference in Return-Path (envelope) and From: (header) - spam messages, how to react?

[Reindl Harald]

Am 28.03.2012 14:06, schrieb Rafał Radecki:
> Hi all.
> 
> Currently we have some amount of spam with different Return-Path and From 
> fields. What to do to filter it? Should
> it be done in postfix (at mta level) or maybe in spamassassin? I think that 
> SPF could be used but what about
> domains which do not have proper spf records?

this differences are totally normal (mailing-lists, SRS...)
on the MTA side "From:" does not matter in any way

in other words: you can NOT reject a message because of this
difference alone because you would reejct also some legit mail




signature.asc
Description: OpenPGP digital signature

Difference in Return-Path (envelope) and From: (header) - spam messages, how to react?

[Rafał Radecki]

Hi all.

Currently we have some amount of spam with different Return-Path and From
fields. What to do to filter it? Should it be done in postfix (at mta
level) or maybe in spamassassin? I think that SPF could be used but what
about domains which do not have proper spf records?

Best regards,
Rafal.

Re: Mail delivery for local mailbox

[Andrea Cappelli]

Il 28/03/2012 13:47, Ansgar Wiechers ha scritto:
Well, don't make gmail.com a local domain when it isn't a local 
domain. Problem solved. Regards Ansgar Wiechers 


There are some cases in which I need to, for example when I migrate the 
domain to my server, so the domain will be local but for some time 
(until the DNS change) it is still on another server.


In this situation I create the mailboxes for incoming user, but I have 
the drawback that I can't write to them anymore, because the delivery 
became local ( assuming I'm using the same SMTP server), so in this case 
I would Postfix check the MX record (which is still pointing to the 
other server) before check local mailbox.


It's possible? Or the are better way to accomplish this?

--
Ing. Andrea Cappelli
Asidev s.r.l.
Viale Rinaldo Piaggio, 32 - 56025 Pontedera (Pisa) @CERFITT
Via Osteria Bianca, 108/6A 50053 Empoli (Firenze)
Tel. (+39) 333 60 18 258   Fax. (+39) 0587 97 01 20
E-mail: a.cappe...@asidev.com   Web: http://www.asidev.com
Skype: a.cappelli

Re: Mail delivery for local mailbox

[Ansgar Wiechers]

On 2012-03-28 Andrea Cappelli wrote:
> I have a Postfix (2.7.1) with local mailboxes delivered through
> Dovecot agent (which is also used as pop3/imap server)
> 
> The same server is also used to send mail for SASL authenticad users,
> without relay on any external server
> 
> When a user send a mail to another "local" mailbox, the mail get
> delivered without check for the MX of the domain, so if I put the
> gmail.com domain as local I will never able to send mail di Gmail
> users anymore.

Well, don't make gmail.com a local domain when it isn't a local domain.
Problem solved.

Regards
Ansgar Wiechers
-- 
"Abstractions save us time working, but they don't save us time learning."
--Joel Spolsky

Mail delivery for local mailbox

[Andrea Cappelli]

Hi list,
I have a Postfix (2.7.1) with local mailboxes delivered through Dovecot 
agent (which is also used as pop3/imap server)


The same server is also used to send mail for SASL authenticad users, 
without relay on any external server


When a user send a mail to another "local" mailbox, the mail get 
delivered without check for the MX of the domain, so if I put the 
gmail.com domain as local I will never able to send mail di Gmail users 
anymore.


There is a way to force Postefix check the real MX of a domain before 
verify if the mailbxo is local?


I' need this configuration to support user migration, both in and out, 
from my server, during migration there is a window in which the mailbox 
is up on both servers


Thank you

--
Ing. Andrea Cappelli
Asidev s.r.l.
Viale Rinaldo Piaggio, 32 - 56025 Pontedera (Pisa) @CERFITT
Via Osteria Bianca, 108/6A 50053 Empoli (Firenze)
Tel. (+39) 333 60 18 258   Fax. (+39) 0587 97 01 20
E-mail: a.cappe...@asidev.com   Web: http://www.asidev.com
Skype: a.cappelli

Re: Next day

[Γεώργιος Δεδούσης]

2012/3/28 Nerijus Kislauskas 


> Or even will die one day?
>
>
Well, we want W here for a LONG time, and we do wish MANY LONG HEALTHY
YEARS, but no one is immortal...

GD

RE: Postfix delivery to openldap users

[Priscilla V]

The issue is not yet solved.

Regards
Priscilla

-Original Message-
From: owner-postfix-us...@postfix.org [mailto:owner-postfix-us...@postfix.org] 
On Behalf Of Nikolaos Milas
Sent: Wednesday, March 28, 2012 2:56 PM
To: postfix-users@postfix.org
Subject: Re: Postfix delivery to openldap users

On 28/3/2012 12:10 μμ, Priscilla V wrote:

> We have configured to consider ldap users also in /etc/nsswitch.conf.
>
> ...
>
> So virtual  aliases need not be configured.
> Alias_maps alone is sufficient.

Hmm, I am not sure if adding ldap local authentication at the OS level, 
automatically makes ldap accounts local in terms of accessibility by the
*local* postfix agent...

Someone more knowledgeable on this should advise you.

I have setup my domain(s) in Postfix as virtual rather than as local.

Good luck!
Nick

Re: Next day

[Nerijus Kislauskas]

On 03/28/2012 02:15 PM, Γεώργιος Δεδούσης wrote:
> If Wietse suddenly gets tired, retired

Or even will die one day?
-- 
Sincerely,
Nerijus Kislauskas

Next day

[Γεώργιος Δεδούσης]

I use Postfix and is great. Thank you W!

I send this becoz I got worried: If Wietse suddenly gets tired, retired etc
what happens to Postfix? Any team/guys knowing Postfix well enough to keep
dev on with W's blessings?

I ask becoz I want to feel more safe.

Sth more: Is there a ticketing system for Postfix bug reports & feature
requests?

Cheers
GD

Re: Postfix as smarthost for local netwok

[Pierre-Gilles RAYNAUD]

On 27/03/12 21:13, Peter wrote:
> On 28/03/12 07:59, Pierre-Gilles RAYNAUD wrote:
>> 450 4.1.8 : Sender address rejected: Domain not 
>> found;
>>
>> smtpd_sender_restrictions = check_sender_access
>> hash:/etc/postfix/sender-checks, reject_unknown_sender_domain,
>> reject_non_fqdn_sender,
> Your emails are getting rejected by the reject_unknown_sender_domain
> restriction above due to the domain serv002.domain.com returning
> NXDOMAIN for a DNS query of A and MX records (see postconf(5)).
>
>
> Peter
Thank you, it works fine

PGR

Re: Postscreen Exchanger policy Question

[Wietse Venema]

Marko Weber:
> hi list,
> 
> 
> Under MAIL EXCHANGER POLICY TESTS
> i see this:
> 
>   By  listening  on  both  primary  and backup MX addresses,

As the text says, for this feature to work, postscreen listens on
both the primary and the backup IP address.

If the primary and the backup IP address belong to different MTAs,
these MTAs would have to share the postscreen cache; currently,
that is supported only with memcache databases.

Cache sharing between MTAs has obvious scaling limits. The MX
exchanger policy enforcement feature is not meant for large
corporate networks. It works well for small sites like mine.

Wietse

Postscreen Exchanger policy Question

[Marko Weber]

hi list,


Under MAIL EXCHANGER POLICY TESTS
i see this:

 By  listening  on  both  primary  and backup MX addresses,
   postscreen(8) can deny the temporary whitelist  status  to
   clients that connect only to backup MX hosts.

I dont get it at "all".
When my backup MX is not on the same Server as postfix,
how can it listen to the backup mx adress?

or do i get this totally wrong?

marko

Re: Postfix delivery to openldap users

[Nikolaos Milas]

On 28/3/2012 12:10 μμ, Priscilla V wrote:


We have configured to consider ldap users also in /etc/nsswitch.conf.

...

So virtual  aliases need not be configured.
Alias_maps alone is sufficient.


Hmm, I am not sure if adding ldap local authentication at the OS level, 
automatically makes ldap accounts local in terms of accessibility by the 
*local* postfix agent...


Someone more knowledgeable on this should advise you.

I have setup my domain(s) in Postfix as virtual rather than as local.

Good luck!
Nick

FW: Postfix delivery to openldap users

[Priscilla V]

-Original Message-
From: Priscilla V [mailto:prisci...@bheltry.co.in] 
Sent: Wednesday, March 28, 2012 2:40 PM
To: 'Nikolaos Milas'; 'postfix-users@postfix.org'
Subject: RE: Postfix delivery to openldap users

We have configured to consider ldap users also in /etc/nsswitch.conf.

: files ldap nisplus
shadow: files ldap nisplus
group : files ldap nisplus

So virtual  aliases need not be configured.
Alias_maps alone is sufficient.

Here is the configuration of ldap.cf

server_host = 
server_port = 389
search_base = 
scope = sub
bind = yes
bind_dn = 
bind_pw = 
version = 3
start_tls = no
query_filter = (mail=%s)
result_attribute = uid

Regards
Priscilla

-Original Message-
From: owner-postfix-us...@postfix.org [mailto:owner-postfix-us...@postfix.org] 
On Behalf Of Nikolaos Milas
Sent: Wednesday, March 28, 2012 2:05 PM
To: postfix-users@postfix.org
Subject: Re: Postfix delivery to openldap users

On 28/3/2012 11:07 πμ, Priscilla V wrote:

> We have not configured any virtual domains.

If you only use alias_maps, then you simply define a mapping between
("virtual") ldap users and *local* users; alias_maps defines "the alias 
databases that are used for *local* delivery". Your local users must already 
exist. In essence, your ldap users are simply aliases.

If all the above are OK for your case, what does "postmap -q ldapuseralias 
ldap:/etc/postfix/ldap.cf" output (where ldapuseralias is one of your ldap 
users)?

Also, you may want to post the content of ldap:/etc/postfix/ldap.cf.

Have you read: http://www.postfix.org/VIRTUAL_README.html ?

Nick

Re: Postfix delivery to openldap users

[Nikolaos Milas]

On 28/3/2012 11:07 πμ, Priscilla V wrote:


We have not configured any virtual domains.


If you only use alias_maps, then you simply define a mapping between 
("virtual") ldap users and *local* users; alias_maps defines "the alias 
databases that are used for *local* delivery". Your local users must 
already exist. In essence, your ldap users are simply aliases.


If all the above are OK for your case, what does "postmap -q 
ldapuseralias ldap:/etc/postfix/ldap.cf" output (where ldapuseralias is 
one of your ldap users)?


Also, you may want to post the content of ldap:/etc/postfix/ldap.cf.

Have you read: http://www.postfix.org/VIRTUAL_README.html ?

Nick

RE: Postfix delivery to openldap users

[Priscilla V]

We have not configured any virtual domains.

Output of postconf -n:

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/postfix/aliases, ldap:/etc/postfix/ldap.cf
command_directory = /usr/sbin
config_directory = /etc/postfix
content_filter = smtp-amavis:[127.0.0.1]:10024
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
debug_peer_level = 2
html_directory = no
inet_interfaces = all
mail_owner = postfix
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
mydomain = 
myhostname = 
mynetworks = 127.0.0.0/8, 
myorigin = $mydomain
newaliases_path = /usr/bin/newaliases.postfix
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix-2.6.6/README_FILES
sample_directory = /usr/share/doc/postfix-2.6.6/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
unknown_local_recipient_reject_code = 550

Regards
Priscilla

-Original Message-
From: owner-postfix-us...@postfix.org [mailto:owner-postfix-us...@postfix.org] 
On Behalf Of Nikolaos Milas
Sent: Wednesday, March 28, 2012 1:25 PM
To: postfix-users@postfix.org
Subject: Re: Postfix delivery to openldap users

On 28/3/2012 10:44 πμ, Priscilla V wrote:

> Here is the configuration included to lookup openldap users in main.cf.
>
> alias_maps = hash:/etc/postfix/aliases, ldap:/etc/postfix/ldap.cf
>

Place your lookup tables in the following settings: virtual_alias_maps (for 
aliases) and virtual_mailbox_maps (for users).

Make sure you have configured correctly: virtual_mailbox_domains and 
virtual_mailbox_base

Post the output of postconf -n

Read: http://www.postfix.org/VIRTUAL_README.html

Nick

Re: Postfix delivery to openldap users

[Nikolaos Milas]

On 28/3/2012 10:44 πμ, Priscilla V wrote:


Here is the configuration included to lookup openldap users in main.cf.

alias_maps = hash:/etc/postfix/aliases, ldap:/etc/postfix/ldap.cf



Place your lookup tables in the following settings: virtual_alias_maps 
(for aliases) and virtual_mailbox_maps (for users).


Make sure you have configured correctly: virtual_mailbox_domains and 
virtual_mailbox_base


Post the output of postconf -n

Read: http://www.postfix.org/VIRTUAL_README.html

Nick

Postfix delivery to openldap users

[Priscilla V]

Hi all,

I am trying to deliver emails to openldap users through postfix.

 

Here is the configuration included to lookup openldap users in main.cf.

 

alias_maps = hash:/etc/postfix/aliases, ldap:/etc/postfix/ldap.cf

 

Here is the configuration of ldap.cf

 

server_host = 

server_port = 389

search_base = 

scope = sub

bind = yes

bind_dn = 

bind_pw = 

version = 3

start_tls = no

query_filter = (mail=%s)

result_attribute = uid

 

I get an unknown user error message whenever I send an email to an openldap
user.

I am using postfix-2.8.9 and openldap 2.4.23.

 

Kindly help to resolve this issue.

 

Regards

Priscilla