Logging of users trying auth on auth-disabled port?

2012-04-25 Thread tobi
Hi list I have disabled SMTP-Auth on my port 25. so this port is only uses to receive emails for my domains but no relaying is possible. Now I have bots that try to auth on port 25 by issue Out: 250 DSN In: AUTH LOGIN Out: 503 5.5.1 Error: authentication not enabled the problem is that I cannot

Log Client smtp connection to MySql

2012-04-25 Thread Franck MAHE
Dear List, I'd like to log all the client smtp connection to MySQL to create my own reputation. I found mysqmail-postfix-logger, but it is not available on my system. At the beginning, I thought about something equivalent to sqlgrey, but before to start something, I'd like to have some advice f

Re: STARTTLS problems

2012-04-25 Thread Mark Alan
On Tue, 24 Apr 2012 19:42:20 -0400 (EDT), Wietse Venema wrote: > So, TLSv1.2 is giving trouble. > ... > Works with OpenSSL 1.0.1a with "smtp_tls_protocols = !TLSv1.2": > ... > So it is a good thing that I put out those updates today. > ... > Which leaves me wondering how other MTAs deal with this

Postfix and LDAP, take 2

2012-04-25 Thread Igmar Palsenberg
Hi, I'm still confused how Postfix and map lookups work. Especially when a lookup happens. According to the docs, when a domain is in virtual_alias_domains, it is considered local, so it shouldn't bounce. First : postconf -n : disable_vrfy_command = yes home_mailbox = Maildir/ in_flow_dela

Re: STARTTLS problems

2012-04-25 Thread Mark Alan
On Wed, 25 Apr 2012 10:07:19 +0100, Mark Alan wrote: > While the postfix updates do not get into into each distribution > repositories, should we use the following? > > postconf -e 'smtpd_tls_protocols = !SSLv2, !TLSv1.2' > postconf -e 'smtp_tls_protocols = !SSLv2, !TLSv1.2' Never mind. I have

Re: STARTTLS problems

2012-04-25 Thread Wietse Venema
Mark Alan: > On Tue, 24 Apr 2012 19:42:20 -0400 (EDT), Wietse Venema > wrote: > > > So, TLSv1.2 is giving trouble. > > ... > > Works with OpenSSL 1.0.1a with "smtp_tls_protocols = !TLSv1.2": > > ... > > So it is a good thing that I put out those updates today. > > ... > > Which leaves me wonderin

Re: Logging of users trying auth on auth-disabled port?

2012-04-25 Thread Wietse Venema
tobi: > Hi list > > I have disabled SMTP-Auth on my port 25. so this port is only uses to > receive emails for my domains but no relaying is possible. Now I have > bots that try to auth on port 25 by issue > > Out: 250 DSN > In: AUTH LOGIN > Out: 503 5.5.1 Error: authentication not enabled > >

Re: OpenSSL 1.0.1 workaround: Postfix 2.9.2, 2.8.10, 2.7.9, and 2.6.15

2012-04-25 Thread Wietse Venema
The Doctor: > > If the BSD/OS 4.x compiler dies on #ifdefs in an argument list > > like this: > > > > SSL_set_options(TLScontext->con, > >((protomask & TLS_PROTOCOL_TLSv1) ? SSL_OP_NO_TLSv1 : 0L) > > #ifdef SSL_OP_NO_TLSv1_1 > > | ((protomask & TLS_PROTOCOL

Re: STARTTLS problems

2012-04-25 Thread Noel Jones
On 4/25/2012 4:07 AM, Mark Alan wrote: > While the postfix updates do not get into into each distribution > repositories, should we use the following? > > postconf -e 'smtpd_tls_protocols = !SSLv2, !TLSv1.2' > postconf -e 'smtp_tls_protocols = !SSLv2, !TLSv1.2' It seems this is a reasonable sett

Re: OpenSSL 1.0.1 workaround: Postfix 2.9.2, 2.8.10, 2.7.9, and 2.6.15

2012-04-25 Thread The Doctor
On Wed, Apr 25, 2012 at 07:18:07AM -0400, Wietse Venema wrote: > The Doctor: > > > If the BSD/OS 4.x compiler dies on #ifdefs in an argument list > > > like this: > > > > > > SSL_set_options(TLScontext->con, > > >((protomask & TLS_PROTOCOL_TLSv1) ? SSL_OP_NO_TLSv1 : >

Re: Postfix and LDAP, take 2

2012-04-25 Thread Noel Jones
On 4/25/2012 5:49 AM, Igmar Palsenberg wrote: [please post in plain-text only; no HTML] > Hi, > > I'm still confused how Postfix and map lookups work. Especially when > a lookup happens. > > According to the docs, when a domain is in virtual_alias_domains, it > is considered local, so it should

Re: IPv6 to IPv4 fallback mechanism

2012-04-25 Thread Fernando Gozalo
Hi, Fernando Gozalo: Hi, does the postfix smtp client implement the IPv6 to IPv4 fallback mechanism as browsers do? Postfix implements the MX fallback strategy as defined in the SMTP RFC (5321). In addition, Postfix implements this: smtp_address_preference (default: any) The address typ

Re: IPv6 to IPv4 fallback mechanism

2012-04-25 Thread Wietse Venema
Fernando Gozalo: > Hi, > > > Fernando Gozalo: > >> Hi, > >> > >> does the postfix smtp client implement the IPv6 to IPv4 fallback > >> mechanism as browsers do? > > > > Postfix implements the MX fallback strategy as defined in the SMTP > > RFC (5321). In addition, Postfix implements this: > > > >

Re: IPv6 to IPv4 fallback mechanism

2012-04-25 Thread Fernando Gozalo
Hi, does the postfix smtp client implement the IPv6 to IPv4 fallback mechanism as browsers do? Postfix implements the MX fallback strategy as defined in the SMTP RFC (5321). In addition, Postfix implements this: smtp_address_preference (default: any) The address type ("ipv6", "ipv4" or "

Re: IPv6 to IPv4 fallback mechanism

2012-04-25 Thread Fernando Gozalo
El 25/04/12 14:27, Wietse Venema escribió: Fernando Gozalo: Hi, Fernando Gozalo: Hi, does the postfix smtp client implement the IPv6 to IPv4 fallback mechanism as browsers do? Postfix implements the MX fallback strategy as defined in the SMTP RFC (5321). In addition, Postfix implements thi

Re: IPv6 to IPv4 fallback mechanism

2012-04-25 Thread Wietse Venema
Fernando Gozalo: > Hi, > > does the postfix smtp client implement the IPv6 to IPv4 fallback > mechanism as browsers do? > >>> > >>> Postfix implements the MX fallback strategy as defined in the SMTP > >>> RFC (5321). In addition, Postfix implements this: > >>> > >>> smtp_address_preferen

header_checks hell

2012-04-25 Thread Patrick Ben Koetter
I'm having trouble with a simple header check running in a pre-queue amavis setup. The filter should DISCARD any Subject that begins with "SPAM-Verdacht CUSTOMERNAME:" # Pattern Aktion /^Subject:\ (SPAM-Verdacht CUSTOMERNAME:\ .*)$/ DISCARD $1 Postfix may read the

Re: header_checks hell

2012-04-25 Thread Ralf Hildebrandt
* Patrick Ben Koetter : > I'm having trouble with a simple header check running in a pre-queue amavis > setup. > > The filter should DISCARD any Subject that begins with "SPAM-Verdacht > CUSTOMERNAME:" > > # Pattern Aktion > /^Subject:\ (SPAM-Verdacht CUSTOMERNAME:\

Re: header_checks hell

2012-04-25 Thread Wietse Venema
Patrick Ben Koetter: > I'm having trouble with a simple header check running in a pre-queue amavis > setup. > > The filter should DISCARD any Subject that begins with "SPAM-Verdacht > CUSTOMERNAME:" > > # Pattern Aktion > /^Subject:\ (SPAM-Verdacht CUSTOMERNAME:\ .*)

Re: header_checks hell

2012-04-25 Thread Patrick Ben Koetter
* Ralf Hildebrandt : > * Patrick Ben Koetter : > > I'm having trouble with a simple header check running in a pre-queue amavis > > setup. > > > > The filter should DISCARD any Subject that begins with "SPAM-Verdacht > > CUSTOMERNAME:" > > > > # Pattern Aktion > > /^S

Log Client smtp connection to MySql

2012-04-25 Thread Franck MAHE
Dear List, I'd like to log all the client smtp connection to MySQL to create my own reputation. I found mysqmail-postfix-logger, but it is not available on my system. At the beginning, I thought about something equivalent to sqlgrey, but before to start something, I'd like to have some advice f

Re: header_checks hell

2012-04-25 Thread Ralf Hildebrandt
> Not that I am aware of: > > # == > # service type private unpriv chroot wakeup maxproc command + args > # (yes) (yes) (yes) (never) (100) > # ==

Re: header_checks hell

2012-04-25 Thread Christian Rößner
Hi, > # == > # service type private unpriv chroot wakeup maxproc command + args > # (yes) (yes) (yes) (never) (100) > # == > smtp

Re: header_checks hell

2012-04-25 Thread Patrick Ben Koetter
* Wietse Venema : > Patrick Ben Koetter: > > I'm having trouble with a simple header check running in a pre-queue amavis > > setup. > > > > The filter should DISCARD any Subject that begins with "SPAM-Verdacht > > CUSTOMERNAME:" > > > > # Pattern Aktion > > /^Subject

Re: header_checks hell

2012-04-25 Thread Patrick Ben Koetter
* Ralf Hildebrandt : > > Not that I am aware of: > > > > # == > > # service type private unpriv chroot wakeup maxproc command + args > > # (yes) (yes) (yes) (never) (100) > > # =

Re: header_checks hell

2012-04-25 Thread Wietse Venema
Patrick Ben Koetter: > * Ralf Hildebrandt : > > > Not that I am aware of: > > > > > > # > > > == > > > # service type private unpriv chroot wakeup maxproc command + args > > > # (yes) (yes) (yes) (neve

Re: header_checks hell

2012-04-25 Thread Christian Rößner
>> That's the problem. The smtpd shown above never queues the mail, so no >> cleanup there. Enable them on reentry. > > Sorry, but I don't believe so. The master.cf I test with has > "receive_override_options=no_unknown_recipient_checks" on re-entry and > specifies header_checks for the re-entry i

SOLVED: Re: header_checks hell

2012-04-25 Thread Patrick Ben Koetter
* Wietse Venema : > Patrick Ben Koetter: > > * Ralf Hildebrandt : > > > > Not that I am aware of: > > > > > > > > # > > > > == > > > > # service type private unpriv chroot wakeup maxproc command + args > > > > #

Re: Log Client smtp connection to MySql

2012-04-25 Thread Noel Jones
On 4/25/2012 8:27 AM, Franck MAHE wrote: > Dear List, > > > > I'd like to log all the client smtp connection to MySQL to create my own > reputation. I found mysqmail-postfix-logger, but it is not available on my > system. At the beginning, I thought about something equivalent to sqlgrey, > but

Re: Logging of users trying auth on auth-disabled port?

2012-04-25 Thread tobi
On 25.04.2012 13:13, Wietse Venema wrote: tobi: Hi list I have disabled SMTP-Auth on my port 25. so this port is only uses to receive emails for my domains but no relaying is possible. Now I have bots that try to auth on port 25 by issue Out: 250 DSN In: AUTH LOGIN Out: 503 5.5.1 Error: authe

Re: Logging of users trying auth on auth-disabled port?

2012-04-25 Thread Wietse Venema
tobi: [ Charset ISO-8859-1 unsupported, converting... ] > On 25.04.2012 13:13, Wietse Venema wrote: > > tobi: > >> Hi list > >> > >> I have disabled SMTP-Auth on my port 25. so this port is only uses to > >> receive emails for my domains but no relaying is possible. Now I have > >> bots that try to

Re: STARTTLS problems

2012-04-25 Thread Viktor Dukhovni
On Wed, Apr 25, 2012 at 06:25:06AM -0500, Noel Jones wrote: > On 4/25/2012 4:07 AM, Mark Alan wrote: > > > While the postfix updates do not get into into each distribution > > repositories, should we use the following? > > > > postconf -e 'smtpd_tls_protocols = !SSLv2, !TLSv1.2' > > postconf -e

Re: Timeout after DATA with postfix

2012-04-25 Thread Wietse Venema
Alex: > Hi, > > >> I have a few postfix-2.8.7 systems on fedora15 that connect with > >> another postfix-2.8.7 system. I'm receiving the following messages > >> periodically in the logs: > >> > >> Apr 24 16:24:43 mailrelay postfix/smtpd[8814]: timeout after DATA > >> (9832 bytes) from mail02.examp

PATCH: OpenSSL 1.0.1 workaround for 10-year old gcc bugs

2012-04-25 Thread Wietse Venema
This week's inter-operability workaround for OpenSSL 1.0.1 does not compile on 10+ year old gcc compilers (gcc 2.95.3 on Solaris 9, gcc 3.2.3 on BSD/OS 4). The patch below should work with the latest snapshot, stable, and supported legacy releases. Wietse [20120425-tls-gcc-

Re: Timeout after DATA with postfix

2012-04-25 Thread Patrick Domack
Quoting Alex : Hi, I have a few postfix-2.8.7 systems on fedora15 that connect with another postfix-2.8.7 system. I'm receiving the following messages periodically in the logs: Apr 24 16:24:43 mailrelay postfix/smtpd[8814]: timeout after DATA (9832 bytes) from mail02.example.com[68.XXX.YYY.4

Re: Logging of users trying auth on auth-disabled port?

2012-04-25 Thread tobi
On 25.04.2012 17:31, Wietse Venema wrote: Logging every command is a great way to spam the logfile with random junk. Maybe my subject was misleading. I do not need the content of the command. I would just like to find a way to get a line like "from xxx.xxx.xxx.xxx Error: authentication not en

Re: How to extend smtpd_sender_restrictions to DISCARD mail for all recipients if just one matches in a hash table?

2012-04-25 Thread Benny Pedersen
Den 2012-04-17 20:20, n756...@50mail.com skrev: smtpd_sender_restrictions=check_recipient_access,hash:/etc/postfix/lists/traps ,hash remove the , before hash this test is not testing To: but only envelope recipient if you want to test To: then you need header_acccess testing, milter-regex

message in etc/var/mail

2012-04-25 Thread Jon Miller
I'm experiencing a problem in my mail logs that keeps showing the following message: Apr 26 11:33:41 mmtlnx postfix/qmgr[2798]: warning: connect to transport smtp-amavis: Connection refused I've gone through every file in /etc/postfix and cannot find any reference of this message, I've checked chk

Re: IPv6 to IPv4 fallback mechanism

2012-04-25 Thread Fernando Gozalo
Hi, does the postfix smtp client implement the IPv6 to IPv4 fallback mechanism as browsers do? Postfix implements the MX fallback strategy as defined in the SMTP RFC (5321). In addition, Postfix implements this: smtp_address_preference (default: any) The address type ("ipv6", "ipv4" or

Re: message in etc/var/mail

2012-04-25 Thread Ansgar Wiechers
On 2012-04-26 Jon Miller wrote: > I'm experiencing a problem in my mail logs that keeps showing the > following message: > Apr 26 11:33:41 mmtlnx postfix/qmgr[2798]: warning: connect to > transport smtp-amavis: Connection refused > > I've gone through every file in /etc/postfix and cannot find any