Re: Speaking of Firefox and HTTP^H^H^H^HFTP...

[Wietse Venema]

This thread has wandered off topic. Please take it elsewhere.

Wietse

Antonio Leding:
> ??FTP lets me PUT files into a location??
> 
> Maybe I?m not tracking this correctly but I?ve never even considered 
> doing FTP upload in a browser - I just don?t see the benefit to going 
> that route.  Seems to me there are far easier and more functional tools 
> that do not require any script.
> 
> An example of the most basic - as someone mentioned earlier, we have 
> Finder on macOS and for Windows, I?m pretty sure Windows Explorer 
> supports FTP all the up to v10?
> 
> But as with most things app\OS related, to each their own - the 
> ?right? way is the one that works for you?
> 
> - - -
> 
> On 23 Apr 2021, at 13:58, Cooper, Robert A wrote:
> 
> > Because FTP lets me PUT files into a location without the hassle of 
> > setting up some kind of upload script, where you have to filter and 
> > tinker with permissions, so that you don't allow a malicious 
> > executable to be uploaded that can simply be run by visiting said file 
> > in a browser?  Granted, a lot of that has been replaced by SFTP/SCP, 
> > but ftp is still useful.
> >
> >
> > RobertC
> >
> >
> > 
> > From: owner-postfix-us...@postfix.org 
> >  on behalf of Antonio Leding 
> > 
> > Sent: Friday, April 23, 2021 15:45
> > To: Wietse Venema
> > Cc: postfix-users@postfix.org
> > Subject: Re: Speaking of Firefox and HTTP^H^H^H^HFTP...
> >
> >
> > Exactly - I?ve always wondered why the fascination + hangup with FTP 
> > when one can just dump the exact same files into a directory (or even 
> > the same one) and serve it as http or https - a file is a file is a 
> > file - the protocol doesn?t care?
> >
> > 
> >
> > On 23 Apr 2021, at 7:58, Wietse Venema wrote:
> >
> > Viktor Dukhovni:
> >
> > I just updated Firefox to version 88, and now "ftp://; support is
> > disabled by default, and the plan is to remove support in Firefox 90.
> >
> > I've re-enabled it, will have to enjoy it to the max while it lasts...
> >
> > [ Wietse's upstream FTP site for Postfix source tarballs will soon no
> > longer be browser-accessible. :-( ]
> >
> > Available since just about forever:
> > http://ftp.porcupine.org/mirrors/postfix-release/index.html
> >
> > Wietse
> 
> 

Re: Speaking of Firefox and HTTP^H^H^H^HFTP...

[Antonio Leding]

“…FTP lets me PUT files into a location…”

Maybe I’m not tracking this correctly but I’ve never even considered 
doing FTP upload in a browser - I just don’t see the benefit to going 
that route.  Seems to me there are far easier and more functional tools 
that do not require any script.


An example of the most basic - as someone mentioned earlier, we have 
Finder on macOS and for Windows, I’m pretty sure Windows Explorer 
supports FTP all the up to v10…


But as with most things app\OS related, to each their own - the 
“right” way is the one that works for you…


- - -

On 23 Apr 2021, at 13:58, Cooper, Robert A wrote:

Because FTP lets me PUT files into a location without the hassle of 
setting up some kind of upload script, where you have to filter and 
tinker with permissions, so that you don't allow a malicious 
executable to be uploaded that can simply be run by visiting said file 
in a browser?  Granted, a lot of that has been replaced by SFTP/SCP, 
but ftp is still useful.



RobertC



From: owner-postfix-us...@postfix.org 
 on behalf of Antonio Leding 


Sent: Friday, April 23, 2021 15:45
To: Wietse Venema
Cc: postfix-users@postfix.org
Subject: Re: Speaking of Firefox and HTTP^H^H^H^HFTP...


Exactly - I’ve always wondered why the fascination + hangup with FTP 
when one can just dump the exact same files into a directory (or even 
the same one) and serve it as http or https - a file is a file is a 
file - the protocol doesn’t care…




On 23 Apr 2021, at 7:58, Wietse Venema wrote:

Viktor Dukhovni:

I just updated Firefox to version 88, and now "ftp://; support is
disabled by default, and the plan is to remove support in Firefox 90.

I've re-enabled it, will have to enjoy it to the max while it lasts...

[ Wietse's upstream FTP site for Postfix source tarballs will soon no
longer be browser-accessible. :-( ]

Available since just about forever:
http://ftp.porcupine.org/mirrors/postfix-release/index.html

Wietse

Re: Speaking of Firefox and HTTP^H^H^H^HFTP...

[Cooper, Robert A]

Because FTP lets me PUT files into a location without the hassle of setting up 
some kind of upload script, where you have to filter and tinker with 
permissions, so that you don't allow a malicious executable to be uploaded that 
can simply be run by visiting said file in a browser?  Granted, a lot of that 
has been replaced by SFTP/SCP, but ftp is still useful.


RobertC



From: owner-postfix-us...@postfix.org  on 
behalf of Antonio Leding 
Sent: Friday, April 23, 2021 15:45
To: Wietse Venema
Cc: postfix-users@postfix.org
Subject: Re: Speaking of Firefox and HTTP^H^H^H^HFTP...


Exactly - I’ve always wondered why the fascination + hangup with FTP when one 
can just dump the exact same files into a directory (or even the same one) and 
serve it as http or https - a file is a file is a file - the protocol doesn’t 
care…



On 23 Apr 2021, at 7:58, Wietse Venema wrote:

Viktor Dukhovni:

I just updated Firefox to version 88, and now "ftp://; support is
disabled by default, and the plan is to remove support in Firefox 90.

I've re-enabled it, will have to enjoy it to the max while it lasts...

[ Wietse's upstream FTP site for Postfix source tarballs will soon no
longer be browser-accessible. :-( ]

Available since just about forever:
http://ftp.porcupine.org/mirrors/postfix-release/index.html

Wietse

Re: Speaking of Firefox and HTTP^H^H^H^HFTP...

[Antonio Leding]

Exactly - I’ve always wondered why the fascination + hangup with FTP 
when one can just dump the exact same files into a directory (or even 
the same one) and serve it as http or https - a file is a file is a file 
- the protocol doesn’t care…


- - -

On 23 Apr 2021, at 7:58, Wietse Venema wrote:


Viktor Dukhovni:

I just updated Firefox to version 88, and now "ftp://; support is
disabled by default, and the plan is to remove support in Firefox 90.

I've re-enabled it, will have to enjoy it to the max while it 
lasts...


[ Wietse's upstream FTP site for Postfix source tarballs will soon no
  longer be browser-accessible. :-( ]


Available since just about forever:
http://ftp.porcupine.org/mirrors/postfix-release/index.html

Wietse

Re: Certificate Postfix.org missing?

[Jos Chrispijn]

IL Ka:


I believe this is about http://www.postfix.org/ 
There is no https there.


That's the one I meant, sorry I didn't include the www subdomain.
I expexted www always to be included as a subdomain name as you can't 
predict which URL users will type in their browser's URL bar.


Best, Jos

-- With both feet on the ground you can't make any step forward

AW: AW: AW: Change default reject message

[rudolf]

right, because the alias is only rewritten in the cleanup, but the service
check already takes place in smtpd or?

i store the alias and the local user in the database , through the user
query the postfix can ask the dovecot for both.

Mit freundlichen Grüßen
Yours sincerely 
Pascal Rudolf



-Ursprüngliche Nachricht-
Von: owner-postfix-us...@postfix.org  Im
Auftrag von Wietse Venema
Gesendet: Freitag, 23. April 2021 20:39
An: Postfix users 
Betreff: Re: AW: AW: Change default reject message

rud...@padaru.de:
> Since Postfix rewrites all alias email addresses to the local users, 
> this works perfectly.

Postfix calls Dovecot quota before Postfix aliases the recipient to a local
user. How does Dovecot know what mailbox Postfix is asking about?

Wietse

Re: AW: AW: Change default reject message

[Wietse Venema]

rud...@padaru.de:
> Since Postfix rewrites all alias email addresses to the local users, this
> works perfectly.

Postfix calls Dovecot quota before Postfix aliases the recipient
to a local user. How does Dovecot know what mailbox Postfix is
asking about?

Wietse

Re: AW: Change default reject message

[Wietse Venema]

rud...@padaru.de:
> Thank you for that explanaition, i appreciate that.
> 
> So i need a quota check, before dovecot touch the mail, so that the
> mail-client cant deliver the mail to postfix if that quota check isnt
> succesfully.
> 
> Something like that i have forced, as i explored postfix work flow, i have
> add the smtpd_recipient_restrictions ans '-o' parameter tot he smtpd module
> in the master.cf => this has caused postfix to accept the mail only if the
> quota check is completed successfully. The disadvantage was that I could not
> send mails to external anymore, because postfix could not check the external
> recipients.
> 
> This solution would be perfect, if it weren't for the problem that I can't
> send the mails to external...

/etc/postfix/main.cf:
smtpd_recipient_restrictions =
...
check_recipient_access inline:{
{ example.com = check_policy_service inet:host:port }
{ other.examnple = check_policy_service inet:host:port }
}
...

applies the quota check only for example.com or other.example.

But, this is a lot more complicated than just making a call to a
quota service.

It does not look good for adding such a policy check to the pickup
daemon.

Wietse

AW: Change default reject message

[rudolf]

Argh..it's getting late..

I mean: before postfix touch the message: " So i need a quota check, before
dovecot touch the mail "

Sry for spam

Mit freundlichen Grüßen
Yours sincerely 
Pascal Rudolf 



-Ursprüngliche Nachricht-
Von: owner-postfix-us...@postfix.org  Im
Auftrag von rud...@padaru.de
Gesendet: Freitag, 23. April 2021 20:19
An: 'Postfix users' 
Betreff: AW: Change default reject message

Thank you for that explanaition, i appreciate that.

So i need a quota check, before dovecot touch the mail, so that the
mail-client cant deliver the mail to postfix if that quota check isnt
succesfully.

Something like that i have forced, as i explored postfix work flow, i have
add the smtpd_recipient_restrictions ans '-o' parameter tot he smtpd module
in the master.cf => this has caused postfix to accept the mail only if the
quota check is completed successfully. The disadvantage was that I could not
send mails to external anymore, because postfix could not check the external
recipients.

This solution would be perfect, if it weren't for the problem that I can't
send the mails to external...

Mit freundlichen Grüßen
Yours sincerely
Pascal Rudolf 



-Ursprüngliche Nachricht-
Von: owner-postfix-us...@postfix.org  Im
Auftrag von Viktor Dukhovni
Gesendet: Freitag, 23. April 2021 19:59
An: Postfix users 
Betreff: Re: Change default reject message

> On Apr 23, 2021, at 1:33 PM,   wrote:
> 
> Is it possible to check the quota status from the receiver in the 
> pickup module with a sql query or something else to get the same 
> behavior as when the mail passes the smtpd module?

No, pickup(8) needs to enqueue the message, it can then be bounced if not
deliverable.  Milters, content_filters, ... can arrange for the message to
bounce...

> Is it at all possible to create extended acceptance criteria for a 
> locally delivered mail?

Not at submission time, because there's no way to return a useful error
indication via just a command-line exit code, and programs that run
sendmail(1) don't expect failure and typically don't have any useful
recovery strategies.

Failure of local submission happens asynchronously, after the message is
queued, if delivery cannot complete, the message is bounced.

-- 
Viktor.

AW: AW: Change default reject message

[rudolf]

The user management is done by Dovecot, so as soon as a user logs in, the
user / password query is sent to a database, which also queries the quota.

Since Postfix rewrites all alias email addresses to the local users, this
works perfectly.

Dovecot manages the local users + the quota in the database and can tell
Postfix via service check if the quota is reached or not.

Mit freundlichen Grüßen
Yours sincerely 
Pascal Rudolf



-Ursprüngliche Nachricht-
Von: owner-postfix-us...@postfix.org  Im
Auftrag von Wietse Venema
Gesendet: Freitag, 23. April 2021 20:09
An: Postfix users 
Betreff: Re: AW: Change default reject message

rud...@padaru.de:
> Is it possible to check the quota status from the receiver in the 
> pickup module with a sql query or something else to get the same 
> behavior as when the mail passes the smtpd module?

There currenly is no such feaure, but I think that one could be added in
Postfix 3.6.

How does Dovecot know what mailbox quota to check, when all your recipients
are aliased?

Wietse

AW: Change default reject message

[rudolf]

Thank you for that explanaition, i appreciate that.

So i need a quota check, before dovecot touch the mail, so that the
mail-client cant deliver the mail to postfix if that quota check isnt
succesfully.

Something like that i have forced, as i explored postfix work flow, i have
add the smtpd_recipient_restrictions ans '-o' parameter tot he smtpd module
in the master.cf => this has caused postfix to accept the mail only if the
quota check is completed successfully. The disadvantage was that I could not
send mails to external anymore, because postfix could not check the external
recipients.

This solution would be perfect, if it weren't for the problem that I can't
send the mails to external...

Mit freundlichen Grüßen
Yours sincerely 
Pascal Rudolf 



-Ursprüngliche Nachricht-
Von: owner-postfix-us...@postfix.org  Im
Auftrag von Viktor Dukhovni
Gesendet: Freitag, 23. April 2021 19:59
An: Postfix users 
Betreff: Re: Change default reject message

> On Apr 23, 2021, at 1:33 PM,   wrote:
> 
> Is it possible to check the quota status from the receiver in the 
> pickup module with a sql query or something else to get the same 
> behavior as when the mail passes the smtpd module?

No, pickup(8) needs to enqueue the message, it can then be bounced if not
deliverable.  Milters, content_filters, ... can arrange for the message to
bounce...

> Is it at all possible to create extended acceptance criteria for a 
> locally delivered mail?

Not at submission time, because there's no way to return a useful error
indication via just a command-line exit code, and programs that run
sendmail(1) don't expect failure and typically don't have any useful
recovery strategies.

Failure of local submission happens asynchronously, after the message is
queued, if delivery cannot complete, the message is bounced.

-- 
Viktor.

Re: AW: Change default reject message

[Wietse Venema]

rud...@padaru.de:
> Is it possible to check the quota status from the receiver in the pickup
> module with a sql query or something else to get the same behavior as when
> the mail passes the smtpd module?

There currenly is no such feaure, but I think that one could be
added in Postfix 3.6.

How does Dovecot know what mailbox quota to check, when all your
recipients are aliased?

Wietse

Re: Change default reject message

[Viktor Dukhovni]

> On Apr 23, 2021, at 1:33 PM,   wrote:
> 
> Is it possible to check the quota status from the receiver in the pickup
> module with a sql query or something else to get the same behavior as when
> the mail passes the smtpd module?

No, pickup(8) needs to enqueue the message, it can then be bounced if not
deliverable.  Milters, content_filters, ... can arrange for the message
to bounce...

> Is it at all possible to create extended acceptance criteria for a locally
> delivered mail?

Not at submission time, because there's no way to return a useful error
indication via just a command-line exit code, and programs that run
sendmail(1) don't expect failure and typically don't have any useful
recovery strategies.

Failure of local submission happens asynchronously, after the message
is queued, if delivery cannot complete, the message is bounced.

-- 
Viktor.

AW: Change default reject message

[rudolf]

Is it possible to check the quota status from the receiver in the pickup
module with a sql query or something else to get the same behavior as when
the mail passes the smtpd module?

is it at all possible to create extended acceptance criteria for a locally
delivered mail?

Mit freundlichen Grüßen
Yours sincerely 
Pascal Rudolf



-Ursprüngliche Nachricht-
Von: owner-postfix-us...@postfix.org  Im
Auftrag von Wietse Venema
Gesendet: Freitag, 23. April 2021 17:24
An: Postfix users 
Betreff: Re: Change default reject message

Viktor Dukhovni:
> > On Apr 23, 2021, at 11:10 AM, Wietse Venema 
wrote:
> > 
> > Indeed. The reason is that email should not be lost when Postfix is 
> > down (system is booting up, or Postfix is down for maintenance).
> > 
> > We could certainly add a policy callout for local submission. But 
> > that is too much change for Postfix 3.6.0 which should be released 
> > soon.
> 
> A multi-instance null-client with delivery handled by a back-end full 
> MTA instance can support a local SMTP hop, and still reliably queue 
> local submission into the null client.

Yes we can, but to me this looks like a non-obvious solution for an obvious
problem (enforce some policy check on inbound email).

Wietse

Re: Change default reject message

[Wietse Venema]

Viktor Dukhovni:
> > On Apr 23, 2021, at 11:10 AM, Wietse Venema  wrote:
> > 
> > Indeed. The reason is that email should not be lost when Postfix
> > is down (system is booting up, or Postfix is down for maintenance).
> > 
> > We could certainly add a policy callout for local submission. But
> > that is too much change for Postfix 3.6.0 which should be released
> > soon.
> 
> A multi-instance null-client with delivery handled by a back-end
> full MTA instance can support a local SMTP hop, and still reliably
> queue local submission into the null client.

Yes we can, but to me this looks like a non-obvious solution for
an obvious problem (enforce some policy check on inbound email).

Wietse

Re: Change default reject message

[Viktor Dukhovni]

> On Apr 23, 2021, at 11:10 AM, Wietse Venema  wrote:
> 
> Indeed. The reason is that email should not be lost when Postfix
> is down (system is booting up, or Postfix is down for maintenance).
> 
> We could certainly add a policy callout for local submission. But
> that is too much change for Postfix 3.6.0 which should be released
> soon.

A multi-instance null-client with delivery handled by a back-end
full MTA instance can support a local SMTP hop, and still reliably
queue local submission into the null client.

-- 
Viktor.

Re: AW: AW: AW: Change default reject message

[Wietse Venema]

Wietse:
> So this needs a quota check before Postfix expands aliases and other address
> mappings.
> 
> How does the Postfix SMTP server find out that a user is over quota?
> Does it use check_policy_service, or does it use a transport map that
> returns something like "error:user is over quota"?

rud...@padaru.de:
> check_policy_service inet:localhost:12340,
> 
> But postfix dont use these recipient_restrictions because the local mails
> dont pass the smtpd.

Indeed. The reason is that email should not be lost when Postfix
is down (system is booting up, or Postfix is down for maintenance).

We could certainly add a policy callout for local submission. But
that is too much change for Postfix 3.6.0 which should be released
soon.

Wietse

Re: Speaking of Firefox and HTTP^H^H^H^HFTP...

[Wietse Venema]

Viktor Dukhovni:
> I just updated Firefox to version 88, and now "ftp://; support is
> disabled by default, and the plan is to remove support in Firefox 90.
> 
> I've re-enabled it, will have to enjoy it to the max while it lasts...
> 
> [ Wietse's upstream FTP site for Postfix source tarballs will soon no
>   longer be browser-accessible. :-( ]

Available since just about forever:
http://ftp.porcupine.org/mirrors/postfix-release/index.html

Wietse

Re: Certificate Postfix.org missing?

[Kris Deugau]

Sven Schwedas wrote:

On 23.04.21 08:36, Nicky Thomassen wrote:
But there is no need for that on a read-only site like Postfix'. In my 
opinion,

anyway.


It's only a read-only site as long as there's no man in the middle 
attack injecting malicious code into the connection. There's too few 
people who disable things like Javascript by default, and that battle is 
well and truly lost as far as the general public is concerned, so we 
need defence in depth measures to protect people from their own laziness.


This.

It's not just inserting malicious JS;  some of the big US providers have 
inserted ads (or overridden a site's existing ad slots, effectively 
stealing such revenue as may or may not have been made by the visited 
site), and did so at the pure HTML content level.  HTTPS at least 
protects the end user against their own ISP or any other unethical 
fingers with access to the connection path.


Dedicated tin-foil-hat-wearers can no doubt spin off far more sinister 
possibilities for this kind of in-flight alteration of web content.


-kgd

Re: Certificate Postfix.org missing?

[Phil Stracchino]

On 4/23/21 9:26 AM, Jaroslaw Rafa wrote:
> Dnia 23.04.2021 o godz. 08:27:31 Phil Stracchino pisze:
>> On 4/23/21 5:15 AM, Jaroslaw Rafa wrote:
>>> However, "thanks" to Google and other
>>> big e-mail providers who started to enforce that EVERY email send to them
>>> must pass SPF/DMARC check - as a method of "antispam protection" (which it
>>> isn't, because spammer can have a perfectly valid SPF/DMARC setup) - 
>>
>> Well, yes, they can, but they can't send mail to you claiming to be from
>> your bank's domain without it failing SPF and/or DMARC checks.  So it IS
>> a perfectly valid anti-spam measure.
> 
> Anti-spoofing, not anti-spam. That's exactly what I wrote.


OK, point.


-- 
  Phil Stracchino
  Babylon Communications
  ph...@caerllewys.net
  p...@co.ordinate.org
  Landline: +1.603.293.8485
  Mobile:   +1.603.998.6958

Re: Certificate Postfix.org missing?

[Richard Damon]

On 4/23/21 9:26 AM, Jaroslaw Rafa wrote:
>
> All these emails can - and usually do - perfectly pass SPF/DMARC check. So
> it is a huge mistake to treat SPF/DMARC as an anti-spam measure and a
> positive SPF/DMARC check as an indicator that the message is not spam. It
> has nothing to do with the message being spam/non-spam.

My comment to this is that yes, if they setup their system to pass
SPF/DMARC, then it will pass that test. But then you can use classic
reputation of domain to decide that this is likely some unknown spammer,
and maybe even after a bit (since it has SOME cost to setup the domains,
they will tend to reuse them) you can be sure those messages are spam.
It also says that user side 'block' lists become usable again, as every
message won't have a totally new domain.

Yes, positive SPF/DMARC check by itself doesn't mean a lot, just that it
allows other tests to means something.

-- 
Richard Damon

timed server greeting

[natan]

Hi
I have a some problem with one user

user have a sieve and forwarded all to own external server

In log I found:
status=deferred (delivery temporarily suspended: conversation with
mta.domain.ltd[193.239.xxx.xxx] timed out while receiving the initial
server greeting)

for test I send him e-mail via echo "asd" |mail u...@external-server.pl
and I get this same timeout

for test I send (this same method) from old server (debian8 postfix
2.11.x) and works ok

next test i try from my server:
telnet external-server.pl 25
~5 sec left
connected

Any idea ? Or what I missing ? Maby I need to change some timeout ?




--

Re: Certificate Postfix.org missing?

[Jaroslaw Rafa]

Dnia 23.04.2021 o godz. 08:27:31 Phil Stracchino pisze:
> On 4/23/21 5:15 AM, Jaroslaw Rafa wrote:
> > However, "thanks" to Google and other
> > big e-mail providers who started to enforce that EVERY email send to them
> > must pass SPF/DMARC check - as a method of "antispam protection" (which it
> > isn't, because spammer can have a perfectly valid SPF/DMARC setup) - 
> 
> 
> Well, yes, they can, but they can't send mail to you claiming to be from
> your bank's domain without it failing SPF and/or DMARC checks.  So it IS
> a perfectly valid anti-spam measure.

Anti-spoofing, not anti-spam. That's exactly what I wrote.

SPF/DMARC does nothing to a typical spammer that does not pretend that he's
someone else than he is, but just uses spam as a shitty method to advertise
their product, whatever it is. And huge majority of the thousands of spams I
have ever seen in my life fall into that category. They try to sell crappy
SEO services, "shady" financial services for companies, they are selling
e-mail addresses lists for another wannabe spammers etc. "Regular" products,
like for example car accessories or fashion, are also advertised this way. I
have even seen a spam advertising... antispam software! (it was probably not
worth giving a try ;)). Of course, there are also straightforward frauds
like "Nigerian" scheme or "Russian woman looking for husband". But all those
people do not try to use someone else's email address, they usually use
existing e-mail addresses created specifically for the purpose of spamming,
because they want to get replies from their "targets".

All these emails can - and usually do - perfectly pass SPF/DMARC check. So
it is a huge mistake to treat SPF/DMARC as an anti-spam measure and a
positive SPF/DMARC check as an indicator that the message is not spam. It
has nothing to do with the message being spam/non-spam.

SPF/DMARC protects from impersonation. Negative SPF/DMARC check is a sign
that the message may be (but not necessarily actually is) not really coming
from the sender it claims to come. Only that. Therefore - as I wrote - it
should be used to protect email from selected domains. One important
requirement should be that these domains send mail *only directly to their
customers*. Usually this applies to automated, "transactional" email like
signup confirmations, password change links, purchase notifications from
e-shops, bank account statements etc. It should *not* be used for domains
that have real, human e-mail users who can for example participate in
mailing lists.

This topic has been already discussed millions of times, but - as said -
"big" providers are forcing it their own way. They are viewing the entire
Internet as a world of e-commerce. From that point of view, if all websites
are e-commerce, then the encryption on each website is necessary. If all
e-mails are transactional (sent only as a result of e-commerce activites),
then SPF/DMARC on any e-mail is necessary. But in reality the Internet is
not as they imagine it to be. Not yet. But by forcing us to adopt the
practices they "invented" they are more and more pushing towards that vision
- Internet being a huge marketplace only, nothing else. :(
-- 
Regards,
   Jaroslaw Rafa
   r...@rafa.eu.org
--
"In a million years, when kids go to school, they're gonna know: once there
was a Hushpuppy, and she lived with her daddy in the Bathtub."

Re: Certificate Postfix.org missing?

[Phil Stracchino]

On 4/23/21 5:15 AM, Jaroslaw Rafa wrote:
> However, "thanks" to Google and other
> big e-mail providers who started to enforce that EVERY email send to them
> must pass SPF/DMARC check - as a method of "antispam protection" (which it
> isn't, because spammer can have a perfectly valid SPF/DMARC setup) - 


Well, yes, they can, but they can't send mail to you claiming to be from
your bank's domain without it failing SPF and/or DMARC checks.  So it IS
a perfectly valid anti-spam measure.


-- 
  Phil Stracchino
  Babylon Communications
  ph...@caerllewys.net
  p...@co.ordinate.org
  Landline: +1.603.293.8485
  Mobile:   +1.603.998.6958

Re: Milters and policy

[Simon Wilson]

Pypolicyd-spf then tags what has driven the result for later use:
E.g.
Apr  3 11:19:23 emp87 policyd-spf[1336326]: prepend  
Authentication-Results: mail.simonandkate.net; spf=pass (mailfrom)
Apr  2 12:32:51 emp87 policyd-spf[1255235]: prepend  
Authentication-Results: mail.simonandkate.net; spf=pass (helo)


Just out of curiosity, how do you get policyd-spf to prepend 2  
headers? Have you created two separate entries in master.cf, each  
using separate configuration files (i.e. one configured to only do  
HELO checks and the other configured to do MAILFROM)?


Or some other trickery? (AFAIK each invocation of a policy server  
can only return a single action?)




Hi Nick,

Those are two lines from two different emails - even my slow system  
doesn't take 24 hours to process an email :-D


Unless I am misunderstanding your question?

Simon.

--
Simon Wilson
M: 0400 12 11 16

Re: Milters and policy

[Benny Pedersen]

On 2021-04-23 11:44, Nick Tait wrote:

On 3/04/21 3:14 pm, Simon Wilson wrote:

Pypolicyd-spf then tags what has driven the result for later use:
E.g.
Apr  3 11:19:23 emp87 policyd-spf[1336326]: prepend 
Authentication-Results: mail.simonandkate.net; spf=pass (mailfrom)
Apr  2 12:32:51 emp87 policyd-spf[1255235]: prepend 
Authentication-Results: mail.simonandkate.net; spf=pass (helo)


Just out of curiosity, how do you get policyd-spf to prepend 2
headers? Have you created two separate entries in master.cf, each
using separate configuration files (i.e. one configured to only do
HELO checks and the other configured to do MAILFROM)?

Or some other trickery? (AFAIK each invocation of a policy server can
only return a single action?)


read policyd-spf docs, to add both headers simply run policyd-spf with 2 
spawned configs


and yes it needs to add multiline in one policyd-spf if its possible in 
check_policy_service in postfix


i think it have low priotet when check_policy_service is ligth testing 
sompared to milters that can wait for data

Re: Milters and policy

[Nick Tait]

On 3/04/21 3:14 pm, Simon Wilson wrote:

Pypolicyd-spf then tags what has driven the result for later use:
E.g.
Apr  3 11:19:23 emp87 policyd-spf[1336326]: prepend 
Authentication-Results: mail.simonandkate.net; spf=pass (mailfrom)
Apr  2 12:32:51 emp87 policyd-spf[1255235]: prepend 
Authentication-Results: mail.simonandkate.net; spf=pass (helo)


Just out of curiosity, how do you get policyd-spf to prepend 2 headers? 
Have you created two separate entries in master.cf, each using separate 
configuration files (i.e. one configured to only do HELO checks and the 
other configured to do MAILFROM)?


Or some other trickery? (AFAIK each invocation of a policy server can 
only return a single action?)


Thanks,
Nick.

AW: Change default reject message

[rudolf]

I dont know if there a way to build an no-smtp milter.

The local mails come from different users with different domains, this ones
stay on my local mashine right, but my customers only know the 'real
e-mail-adress' also the alias from the recipient and not the internal local
username, so i cant create bounce messages which contain the local username,
the sender would be confused.

If mails come from external - the internet - the
smtpd-recipitient-restrictions work fine and bounce a pretty postfix error
message with the correct recipient mail-adress in there.

Mit freundlichen Grüßen
Yours sincerely
Pascal Rudolf



-Ursprüngliche Nachricht-
Von: owner-postfix-us...@postfix.org  Im
Auftrag von Jaroslaw Rafa
Gesendet: Freitag, 23. April 2021 11:28
An: postfix-users@postfix.org
Betreff: Re: Change default reject message

Dnia 23.04.2021 o godz. 09:36:50 rud...@padaru.de pisze:
> I agree with you, i dont want produce late bounces. And thats my problem.
> 
> For mails, who handeld by the smtpd ist works fine. But local Mails 
> bypass the smtpd module, so also the smtpd_recipient_restrictions.

But the local mails come from existing accounts in your own domain, right?
What other source could they come from?

So you will be not sending bounces out to the Internet. They will stay at
your local machine.
--
Regards,
   Jaroslaw Rafa
   r...@rafa.eu.org
--
"In a million years, when kids go to school, they're gonna know: once there
was a Hushpuppy, and she lived with her daddy in the Bathtub."

Re: Certificate Postfix.org missing?

[Sven Schwedas]

On 23.04.21 08:36, Nicky Thomassen wrote:

But there is no need for that on a read-only site like Postfix'. In my opinion,
anyway.


It's only a read-only site as long as there's no man in the middle 
attack injecting malicious code into the connection. There's too few 
people who disable things like Javascript by default, and that battle is 
well and truly lost as far as the general public is concerned, so we 
need defence in depth measures to protect people from their own laziness.


Setting up HTTPS is trivial to anyone technically competent, and browser 
vendors *know* they cannot require them to cost money, so they're 
overall a net positive.




OpenPGP_signature
Description: OpenPGP digital signature

Re: Change default reject message

[Jaroslaw Rafa]

Dnia 23.04.2021 o godz. 09:36:50 rud...@padaru.de pisze:
> I agree with you, i dont want produce late bounces. And thats my problem.
> 
> For mails, who handeld by the smtpd ist works fine. But local Mails bypass
> the smtpd module, so also the smtpd_recipient_restrictions.

But the local mails come from existing accounts in your own domain, right?
What other source could they come from?

So you will be not sending bounces out to the Internet. They will stay at
your local machine.
-- 
Regards,
   Jaroslaw Rafa
   r...@rafa.eu.org
--
"In a million years, when kids go to school, they're gonna know: once there
was a Hushpuppy, and she lived with her daddy in the Bathtub."

Re: AW: AW: Change default reject message

[Jaroslaw Rafa]

Dnia 23.04.2021 o godz. 08:32:06 rud...@padaru.de pisze:
> 
> But postfix dont use these recipient_restrictions because the local mails
> dont pass the smtpd.

Is there something that can check the quota and runs as a milter and not a
policy service?
Because you could use such a thing in non_smtpd_milters=.
-- 
Regards,
   Jaroslaw Rafa
   r...@rafa.eu.org
--
"In a million years, when kids go to school, they're gonna know: once there
was a Hushpuppy, and she lived with her daddy in the Bathtub."

Re: Certificate Postfix.org missing?

[Jaroslaw Rafa]

Dnia 23.04.2021 o godz. 08:36:36 Nicky Thomassen pisze:
> 
> With the risk of going off-topic, I do not see the reason for encrypting
> everything on the internet from a more practical point of view, as it just 
> gives
> overhead: It takes time to set up and maintain, takes processing power on both
> ends, and in the case of Postfix, makes no sense since there is nothing to
> protect.
> 
> Encryption gives (ideally) authenticity, confidentiality and integrity
> https://en.wikipedia.org/wiki/Information_security#Basic_principles
> 
> But there is no need for that on a read-only site like Postfix'. In my 
> opinion,
> anyway.

You are totally right, but I think the main reason for encrypting everything
is just the pressure from browser developers trying to enforce this. For me,
it is like someone started to imagine ALL websites being e-commerce (or
similar) websites, where you have to process your private data, so
encryption is needed. Like someone forgot about existence of publicly
available, purely information-oriented websites, where there is nothing to
encrypt...
(For example, the Wikipedia link you quoted above is HTTPS. What is there on
publicly available site like Wikipedia - except maybe your login
credentials, if you have an account there - that needs encryption? ;))

Going back on-topic :), I think that somewhat similar situation is with use
of SPF and/or DMARC. To my knowledge, SPF/DMARC was never meant for
"general" use. It has been invented as a way to protect particular
"sensitive" sender domains (eg. the domain from which you get e-mails from
your bank) from being easily spoofed. However, "thanks" to Google and other
big e-mail providers who started to enforce that EVERY email send to them
must pass SPF/DMARC check - as a method of "antispam protection" (which it
isn't, because spammer can have a perfectly valid SPF/DMARC setup) - people
were forced to adopt it universally, whether necessary or not (which for
example causes problems with mailing lists).
-- 
Regards,
   Jaroslaw Rafa
   r...@rafa.eu.org
--
"In a million years, when kids go to school, they're gonna know: once there
was a Hushpuppy, and she lived with her daddy in the Bathtub."

Re: Speaking of Firefox and HTTP^H^H^H^HFTP...

[Chris Green]

On Fri, Apr 23, 2021 at 12:36:29AM -0400, Viktor Dukhovni wrote:
> On Thu, Apr 22, 2021 at 10:41:14PM -0400, John Levine wrote:
> > It appears that Viktor Dukhovni  said:
> > >[ Wietse's upstream FTP site for Postfix source tarballs will soon no
> > >  longer be browser-accessible. :-( ]
> > 
> > If you use a Mac, FTP is built into the Finder.  Who needs a browser?
> 
> Yes, but it is rather a lot slower to produce a listing, because it
> wants to treat FTP as a filesystem... :-(
> 
Following the Unix (and Linux?) philosophy of small programs that do
one thing well I've always used [nc]ftp on Unix and Linux systems.

-- 
Chris Green

AW: Change default reject message

[rudolf]

Here you see my problem, i have enabled 'local'´s verbose mode in the
master.cf

postfix/local[28092]: queue_name: active
 postfix/local[28092]: queue_id: 1290D2F001C3
 postfix/local[28092]: offset: 829
 postfix/local[28092]: sender: 
 postfix/local[28092]: recipient: 
 postfix/local[28092]: domain: 
 postfix/local[28092]: local: 
 postfix/local[28092]: user: 
 postfix/local[28092]: extension: null
 postfix/local[28092]: unmatched: null
 postfix/local[28092]: owner: null
 postfix/local[28092]: delivered: 
 postfix/local[28092]: relay: local
 postfix/local[28092]: exp_type: 0
 postfix/local[28092]: exp_from: null
 postfix/local[28092]: why: buffer
 postfix/local[28092]: deliver_switch[2]: local 
recip  exten  deliver
 exp_from
 postfix/local[28092]: deliver_alias[3]: local 
recip  exten  deliver
 exp_from
 postfix/local[28092]: deliver_alias:
hash:/etc/aliases(0,lock|no_regsub|no_proxy|no_unauth|fold_fix|utf8_request)
:  not found
 postfix/local[28092]: deliver_dotforward[3]: local  recip  exten
deliver  exp_from
 postfix/local[28092]: deliver_dotforward[3]: set user_attr: 
 postfix/local[28092]: set_eugid: euid 1312 egid 1000
 postfix/local[28092]: set_eugid: euid 108 egid 113
 postfix/local[28092]: deliver_dotforward: path /var/mail//.forward expand_status 0 look_status -1
 postfix/local[28092]: deliver_mailbox[3]: local 
recip  exten  deliver
 exp_from
 postfix/local[28092]: been_here: mailbox : 0
 postfix/local[28092]: deliver_mailbox[3]: set user_attr: 
 postfix/local[28092]: deliver_command[4]: local 
recip  exten  deliver
 exp_from
 postfix/local[28092]: been_here: command :1312
/usr/bin/procmail: 0
 dovecot[28218]: lda()<28218>: sieve:
msgid=<20210423073645.1290D2F001C3@>: failed to store into
mailbox 'INBOX': Quota exceeded (mailbox for user is full)
 dovecot[28218]: lda()<28218>:
msgid=<20210423073645.1290D2F001C3@>: rejected: Quota
exceeded (mailbox for user is full)


The local module rewrite the senders e-mail-adress with
 , then he want to deliver the mail directly to
dovecot-lda who says, there is no space in recipients mailbox.

Then the dovecot produce an late bounce with the false mailadress in the
error report.


Mit freundlichen Grüßen
Yours sincerely


Pascal Rudolf | Geschäftsführer
PADARU-IT | Bielebohstraße 10 | 02736  Beiersdorf
@: rud...@padaru.de | www: padaru.de
mobil: +49 (0) 17 772 595 32



-Ursprüngliche Nachricht-
Von: owner-postfix-us...@postfix.org  Im
Auftrag von @lbutlr
Gesendet: Freitag, 23. April 2021 09:24
An: Postfix users 
Betreff: Re: Change default reject message

On 22 Apr 2021, at 12:49, Wietse Venema  wrote:
> rud...@padaru.de:
>> Good evening,
>> Unfortunately, I have to revisit my topic from back in the day
>> 
>> Sending the proper reject-messages through the postfix works wonderfully,
as long as it is an external sender.
>> 
>> But now if a local sender sends an email to the full mailbox, again the
Dovecot replies, or the program what generates the message mentioned at the
beginning:
>> 
>> ##
>> Your message to  was automatically discarded:
>> ##
> 
> Why discard over-quota email? If you allow Dovecot to reject delivery, 
> then the local sender will receive a proper delivery status notification.

Also, discarding email that you accepted is evil. IMO, off course, but I
would immediately stop using an mail address in which email that was
delivered was deleted by the service. In fact, I have.

Either you accept the message and deliver it or you reject the message,
anything else is unacceptable.

--
Do you have any idea how expensive wool is in Transylvania? Because of the
euro.

AW: Change default reject message

[rudolf]

I agree with you, i dont want produce late bounces. And thats my problem.

For mails, who handeld by the smtpd ist works fine. But local Mails bypass
the smtpd module, so also the smtpd_recipient_restrictions.

Whats the way to cofigure postfix 'local' module to check the recipients
quota bevore it accept the local mail?

Mit freundlichen Grüßen
Yours sincerely
Pascal Rudolf



-Ursprüngliche Nachricht-
Von: owner-postfix-us...@postfix.org  Im
Auftrag von @lbutlr
Gesendet: Freitag, 23. April 2021 09:24
An: Postfix users 
Betreff: Re: Change default reject message

On 22 Apr 2021, at 12:49, Wietse Venema  wrote:
> rud...@padaru.de:
>> Good evening,
>> Unfortunately, I have to revisit my topic from back in the day
>> 
>> Sending the proper reject-messages through the postfix works wonderfully,
as long as it is an external sender.
>> 
>> But now if a local sender sends an email to the full mailbox, again the
Dovecot replies, or the program what generates the message mentioned at the
beginning:
>> 
>> ##
>> Your message to  was automatically discarded:
>> ##
> 
> Why discard over-quota email? If you allow Dovecot to reject delivery, 
> then the local sender will receive a proper delivery status notification.

Also, discarding email that you accepted is evil. IMO, off course, but I
would immediately stop using an mail address in which email that was
delivered was deleted by the service. In fact, I have.

Either you accept the message and deliver it or you reject the message,
anything else is unacceptable.

--
Do you have any idea how expensive wool is in Transylvania? Because of the
euro.

Re: Change default reject message

[@lbutlr]

On 22 Apr 2021, at 12:49, Wietse Venema  wrote:
> rud...@padaru.de:
>> Good evening,
>> Unfortunately, I have to revisit my topic from back in the day
>> 
>> Sending the proper reject-messages through the postfix works wonderfully, as 
>> long as it is an external sender.
>> 
>> But now if a local sender sends an email to the full mailbox, again the 
>> Dovecot replies, or the program what generates the message mentioned at the 
>> beginning:
>> 
>> ##
>> Your message to  was automatically discarded:
>> ##
> 
> Why discard over-quota email? If you allow Dovecot to reject delivery,
> then the local sender will receive a proper delivery status notification.

Also, discarding email that you accepted is evil. IMO, off course, but I would 
immediately stop using an mail address in which email that was delivered was 
deleted by the service. In fact, I have.

Either you accept the message and deliver it or you reject the message, 
anything else is unacceptable.

-- 
Do you have any idea how expensive wool is in Transylvania? Because
of the euro.

Re: Speaking of Firefox and HTTP^H^H^H^HFTP...

[Luciano Mannucci]

On Thu, 22 Apr 2021 21:56:13 -0400
Viktor Dukhovni  wrote:

> I just updated Firefox to version 88, and now "ftp://; support is
> disabled by default, and the plan is to remove support in Firefox 90.
Palemoon forever! :) (Or any other browser you may fancy :)

Luciano.
-- 
 /"\ /Via A. Salaino, 7 - 20144 Milano (Italy)
 \ /  ASCII RIBBON CAMPAIGN / PHONE : +39 02485781 FAX: +39 0248028247
  X   AGAINST HTML MAIL/  E-MAIL: posthams...@sublink.sublink.org
 / \  AND POSTINGS/   WWW: http://www.lesassaie.IT/

Re: Certificate Postfix.org missing?

[Nicky Thomassen]

Thu, 22 Apr 2021 19:26:57 +0200 skrev Claus Assmann
:

> It would be nice if the people who write browsers don't try to force
> their kind of "standards" on others... ("but you can get a free cert"
> -- what happens when those browsers do not "accept" those free certs
> anymore?)

With the risk of going off-topic, I do not see the reason for encrypting
everything on the internet from a more practical point of view, as it just gives
overhead: It takes time to set up and maintain, takes processing power on both
ends, and in the case of Postfix, makes no sense since there is nothing to
protect.

Encryption gives (ideally) authenticity, confidentiality and integrity
https://en.wikipedia.org/wiki/Information_security#Basic_principles

But there is no need for that on a read-only site like Postfix'. In my opinion,
anyway.


The best

AW: AW: AW: Change default reject message

[rudolf]

Thank you for your time and replies.

Actually i use the dovecot quota service:

Dovecot conf:

service quota-status {
executable = quota-status -p postfix
inet_listener {
port = 12340
}
client_limit = 1
}

Postfix main.cf
smtpd_recipient_restrictions =
reject_unauth_pipelining,
check_policy_service inet:localhost:12340,
reject_non_fqdn_sender,
reject_non_fqdn_recipient,
permit_sasl_authenticated,
reject_unknown_sender_domain,
reject_unknown_recipient_domain,
reject_unauth_destination,
check_recipient_access hash:/etc/postfix/recipient_access,
check_recipient_access hash:/etc/postfix/recipient_restrictions,
permit

But postfix dont use these recipient_restrictions because the local mails
dont pass the smtpd.

Thats the reason, why i believe that every mail have to pass through the
smtpd.

Mit freundlichen Grüßen
Yours sincerely
Pascal Rudolf 



-Ursprüngliche Nachricht-
Von: owner-postfix-us...@postfix.org  Im
Auftrag von Wietse Venema
Gesendet: Donnerstag, 22. April 2021 22:29
An: Postfix users 
Betreff: Re: AW: AW: Change default reject message

rud...@padaru.de:
> In the message from the dovecot the @ is written, 
> this information is of no use to the sender, because he does not know 
> the local user name of the receiver.
> 
> The bounce mail must therefore contain the e-mail address that the 
> sender has addressed, the virtual address so to speak.

So this needs a quota check before Postfix expands aliases and other address
mappings.

How does the Postfix SMTP server find out that a user is over quota?
Does it use check_policy_service, or does it use a transport map that
returns something like "error:user is over quota"?

Wietse

Re: Specific DNS server

[Erwan David]

Le 22/04/2021 à 21:14, Sonic a écrit :

You could run Postfix in a container (LXC) on the host. It would have
it's own IP and it's own resolv.conf.



Would'nt the chroot feature built in postfix sufficient for this ?