Re: [courier-users] Build 20170309 of Courier packages

2017-03-30 Thread Sam Varshavchik
t fell out of the C++ rewrite. Made another fix to configure.ac, which should fix this one too. Build 20170330 is there now. pgpdYaDqWsfRu.pgp Description: PGP signature -- Check out the vibrant tech community

Re: [courier-users] courier-authlib: exported symbols

2017-03-30 Thread Sam Varshavchik
Markus Wanner writes: Hello Sam, I'm about to take over maintenance of the courier-mta packages in Debian, so I'll likely have further questions. Let's start with a simple one regarding courier-authlib: Compared to 0.66.4, these three symbols have vanished from libcourierauthcommon.so.0 in

Re: [courier-users] Backtick-Problems

2017-03-30 Thread lists
Am 30.03.2017 um 13:47 schrieb li...@datenritter.de: > Could there be anything wrong with my maildrops environment? I just figured, the user maildrop is beeing executed as, has no shell... -- Check out the vibrant tech

[courier-users] courier-authlib: exported symbols

2017-03-30 Thread Markus Wanner
Hello Sam, I'm about to take over maintenance of the courier-mta packages in Debian, so I'll likely have further questions. Let's start with a simple one regarding courier-authlib: Compared to 0.66.4, these three symbols have vanished from libcourierauthcommon.so.0 in version 0.67.0: *

[courier-users] Backtick-Problems | was: Can courier sort mail for one user into multiple subfolders for imap

2017-03-30 Thread lists
Am 30.03.2017 um 13:00 schrieb Sam Varshavchik: > See above. A Perl script can validate and do a lot more things, all without > shelling out to external commands. Convincing. Still, to run that script I either need xfilter (which doesn't look like the right choice to me here) or

Re: [courier-users] SSL Report on Courier's TLS settings (includes answer)

2017-03-30 Thread Alessandro Vesely
On Thu 30/Mar/2017 12:58:26 +0200 Sam Varshavchik wrote: > Alessandro Vesely writes: > >> SSL/TLS compression Yes INSECURE (more info) >> [(more >> info)->https://community.qualys.com/blogs/securitylabs/2012/09/14/crime-information-leakage-attack-against-ssltls] >> >> >> I note the

Re: [courier-users] Build 20170309 of Courier packages

2017-03-30 Thread Alessandro Vesely
On Wed 29/Mar/2017 13:17:12 +0200 Sam Varshavchik wrote: > Alessandro Vesely writes: >> On Fri 17/Mar/2017 01:25:36 +0100 Sam Varshavchik wrote: >>> >>> This should now be fixed in 20170316. All packages rebuilt, including >>> courier-authlib which was also affected. >> >> Compiling still fails

Re: [courier-users] Can courier sort mail for one user into multiple subfolders for imap

2017-03-30 Thread Sam Varshavchik
li...@datenritter.de writes: > Maybe scrap the whole thing. Use backticks to feed the email to a Perl > script that safely parses headers. Okay... the beforementioned problems left aside, what is the advantage? You can safely implement the same functionality in Perl itself, instead of

Re: [courier-users] SSL Report on Courier's TLS settings (includes answer)

2017-03-30 Thread Sam Varshavchik
Alessandro Vesely writes: SSL/TLS compression Yes INSECURE (more info) [(more info)->https://community.qualys.com/blogs/securitylabs/ 2012/09/14/crime-information-leakage-attack-against-ssltls] I note the TLS_COMPRESSION option has gone away. Are there other TLS options worth trying

Re: [courier-users] Can courier sort mail for one user into multiple subfolders for imap

2017-03-30 Thread lists
Am 30.03.2017 um 02:46 schrieb Sam Varshavchik: >> ### BUG: This leaves LPART and DPART empty. :( ### >> LPART=`echo $MATCH1 | sed "s/\./_/g"` > > If someone were to send an email with a carefully crafted header that reads: > "X-BeenThere: ; rm -rf $HOME" you'll have a lot of

Re: [courier-users] SSL Report on Courier's TLS settings (includes answer)

2017-03-30 Thread Alessandro Vesely
Thank you Szépe, I tried that last week and it was bad enough to convince me to recompile the whole lot --something I had been procrastinating for a while. It is a Debian with OpenSSL 1.0.1t. Testing the new code, without TLS-specific settings, I got again logged on the /recent worst/ table