Re: smtp restrictions

2013-05-31 Thread Stan Hoeppner
On 5/30/2013 11:43 PM, James Zee wrote: I was hoping someone could take a quick glance at my smtpd_*_restrictions configurations. While I've read and (re-)read the SMTPD_ACCESS_README file a few times over I would be greatly appreciative if someone could sanity check my work. Reviewing

Re: smtp restrictions

2013-05-31 Thread Mikael Bak
Stan, On 05/31/2013 08:49 AM, Stan Hoeppner wrote: On 5/30/2013 11:43 PM, James Zee wrote: I was hoping someone could take a quick glance at my smtpd_*_restrictions configurations. While I've read and (re-)read the SMTPD_ACCESS_README file a few times over I would be greatly appreciative if

Re: smtp restrictions

2013-05-31 Thread Stan Hoeppner
On 5/31/2013 4:09 AM, Mikael Bak wrote: Stan, On 05/31/2013 08:49 AM, Stan Hoeppner wrote: On 5/30/2013 11:43 PM, James Zee wrote: I was hoping someone could take a quick glance at my smtpd_*_restrictions configurations. While I've read and (re-)read the SMTPD_ACCESS_README file a few

Re: smtp restrictions

2013-05-31 Thread Charles Marcus
On 2013-05-31 6:04 AM, Stan Hoeppner s...@hardwarefreak.com wrote: It is a waste of everyone's time including the poster and readers to go spell check main.cf files on the mailing list. Wietse Venema 12/09/2010 Stan, I certainly don't read that as saying people cannot ask for a sanity check

Problems with OpenSSL 1.0.1c - WAS: Re: ssl errors in log. error on remote or local side?

2013-05-31 Thread Charles Marcus
On 2013-05-22 1:45 PM, Quanah Gibson-Mount qua...@zimbra.com wrote: I would read the CHANGES file shipped with OpenSSL. They didn't document the changes between 1.0.1d and 1.0.1e, but you can see the changes between 1.0.1c and 1.0.1d. I read them, but nothing jumped out at me (didn't see

Re: postscreen and Google

2013-05-31 Thread Wietse Venema
LuKreme: Don't enable the after 220 tests, or wait until whitelisting is stable. Given that Google has many servers, manual whitelisting is not a long-term solution. After looking at my log files I?ve disabled all the ?after 220? test for now. Looking forward to the stable whitelisting

Re: smtp restrictions

2013-05-31 Thread /dev/rob0
On Fri, May 31, 2013 at 12:43:51AM -0400, James Zee wrote: I was hoping someone could take a quick glance at my smtpd_*_restrictions configurations. While I've read and (re-)read the SMTPD_ACCESS_README file a few times over I would be greatly appreciative if someone could sanity check my

Re: Timeouts sending to a particular server

2013-05-31 Thread Nikolaos Milas
On 30/5/2013 11:17 πμ, Ralf Hildebrandt wrote: I usually disable ESMTP when encountering those problems: transport_maps: cospico.gr noesmtp: noesmtp being defined in master.cf as: noesmtp unix - - - - - smtp -o smtp_never_send_ehlo=yes -o smtp_always_send_ehlo=no Thank you Wietse and Ralf

Re: Timeouts sending to a particular server

2013-05-31 Thread Viktor Dukhovni
On Fri, May 31, 2013 at 03:49:44PM +0300, Nikolaos Milas wrote: On 30/5/2013 11:17 ??, Ralf Hildebrandt wrote: I usually disable ESMTP when encountering those problems: transport_maps: cospico.gr noesmtp: noesmtp being defined in master.cf as: noesmtp unix - - - - - smtp -o

List rules (was: smtp restrictions)

2013-05-31 Thread Wietse Venema
Stan Hoeppner: What I stated above is Wietse's policy: It is a waste of everyone's time including the poster and readers to go spell check main.cf files on the mailing list. To place the quote in context: Stan: This is exactly why I wanted to see your main.cf. It's a total mess. I'll

Re: smtp restrictions

2013-05-31 Thread James Zee
On Fri, May 31, 2013 at 8:09 AM, /dev/rob0 r...@gmx.co.uk wrote: On Fri, May 31, 2013 at 12:43:51AM -0400, James Zee wrote: I was hoping someone could take a quick glance at my smtpd_*_restrictions configurations. While I've read and (re-)read the SMTPD_ACCESS_README file a few times over I

Re: Virtual User Aliases

2013-05-31 Thread Simon B
On 30 May 2013 22:44, Wietse Venema wie...@porcupine.org wrote: Simon B: That's what I thought. I did your suggestion and postfix did not complain. Not doing postfix stop/start or even /etc/init.d/postfix start/stop.. So, now I'm stumped. There are other master.cf on the system, but I'm

upgrade concerns

2013-05-31 Thread Dean Guenther
This week I upgraded postfix from a RHEL 3 box to a new install with CentOS 6.2 and Postfix 2.6.6 and Dovecot 2.0.9 Most things are working (logging in, sending mail, etc). But I'm having some issues receiving mail. But not all accounts are having this trouble. My setup is that I have /home

Re: upgrade concerns

2013-05-31 Thread Brian Evans
On 5/31/2013 12:51 PM, Dean Guenther wrote: I suspect I'm just missing something when converting from the earlier postfix to the newer postfix (and dovecot). Why am I getting these tmp and new files under /home/user/mail? This is a sign you are saving in maildir format. Its probably not

Is the absence of smtpd_relay_restrictions directive in Postfix versions = 2.10 a security risk in some default configurations?

2013-05-31 Thread Ben Johnson
I seem to be able to setup a desktop email client and send email to my server, from any external network, and the email will be accepted for delivery as long as a) the sender uses any from address (local part) @my.real-domain.com, and b) the recipient has a mailbox @my.real-domain.com. The only

Re: upgrade concerns

2013-05-31 Thread Dean Guenther
Thanks Brian!!! Commenting out home_mailbox took care of the problem. I appreciate the help -- Dean On Fri, 2013-05-31 at 13:21 -0400, Brian Evans wrote: On 5/31/2013 12:51 PM, Dean Guenther wrote: I suspect I'm just missing something when converting from the earlier postfix to the newer

Re: Is the absence of smtpd_relay_restrictions directive in Postfix versions = 2.10 a security risk in some default configurations?

2013-05-31 Thread Noel Jones
On 5/31/2013 12:22 PM, Ben Johnson wrote: I seem to be able to setup a desktop email client and send email to my server, from any external network, and the email will be accepted for delivery as long as a) the sender uses any from address (local part) @my.real-domain.com, and b) the recipient

Re: Virtual User Aliases

2013-05-31 Thread Wietse Venema
Simon B: On 30 May 2013 22:44, Wietse Venema wie...@porcupine.org wrote: Simon B: That's what I thought. I did your suggestion and postfix did not complain. Not doing postfix stop/start or even /etc/init.d/postfix start/stop.. So, now I'm stumped. There are other master.cf on the

Re: Virtual User Aliases

2013-05-31 Thread Viktor Dukhovni
On Fri, May 31, 2013 at 06:46:50PM +0200, Simon B wrote: smtp inet n - - - - smtpd -v -o receive_override_options= cleanup unix n - - - 0 cleanup -v #Stop Postfix from cleaning emails before sending to amavis

Re: Is the absence of smtpd_relay_restrictions directive in Postfix versions = 2.10 a security risk in some default configurations?

2013-05-31 Thread Ben Johnson
On 5/31/2013 2:39 PM, Noel Jones wrote: On 5/31/2013 12:22 PM, Ben Johnson wrote: I seem to be able to setup a desktop email client and send email to my server, from any external network, and the email will be accepted for delivery as long as a) the sender uses any from address (local part)

Re: Virtual User Aliases

2013-05-31 Thread Simon B
On 31 May 2013 21:07, Viktor Dukhovni postfix-us...@dukhovni.org wrote: On Fri, May 31, 2013 at 06:46:50PM +0200, Simon B wrote: smtp inet n - - - - smtpd -v -o receive_override_options= cleanup unix n - - - 0 cleanup

Re: Is the absence of smtpd_relay_restrictions directive in Postfix versions = 2.10 a security risk in some default configurations?

2013-05-31 Thread Noel Jones
On 5/31/2013 2:06 PM, Ben Johnson wrote: Okay. I understand. The implication here is that it doesn't matter whether the user-agent connects directly to my server via SMTP to delivery mail to my users, or he connects through his ISP's SMTP server to do the same. Correct? Correct. By default,

Re: Is the absence of smtpd_relay_restrictions directive in Postfix versions = 2.10 a security risk in some default configurations?

2013-05-31 Thread /dev/rob0
On Fri, May 31, 2013 at 03:06:38PM -0400, Ben Johnson wrote: On 5/31/2013 2:39 PM, Noel Jones wrote: On 5/31/2013 12:22 PM, Ben Johnson wrote: Postfix postfinger output for this server (prior to closing this hole): http://pastebin.com/QGE3cah5 ... mail_version = 2.7.0 This

Re: Is the absence of smtpd_relay_restrictions directive in Postfix versions = 2.10 a security risk in some default configurations?

2013-05-31 Thread Ben Johnson
On 5/31/2013 3:52 PM, Noel Jones wrote: On 5/31/2013 2:06 PM, Ben Johnson wrote: Okay. I understand. The implication here is that it doesn't matter whether the user-agent connects directly to my server via SMTP to delivery mail to my users, or he connects through his ISP's SMTP server to

Re: Is the absence of smtpd_relay_restrictions directive in Postfix versions = 2.10 a security risk in some default configurations?

2013-05-31 Thread Ben Johnson
On 5/31/2013 4:11 PM, /dev/rob0 wrote: On Fri, May 31, 2013 at 03:06:38PM -0400, Ben Johnson wrote: On 5/31/2013 2:39 PM, Noel Jones wrote: On 5/31/2013 12:22 PM, Ben Johnson wrote: Postfix postfinger output for this server (prior to closing this hole): http://pastebin.com/QGE3cah5 ...

Re: Virtual User Aliases

2013-05-31 Thread Viktor Dukhovni
On Fri, May 31, 2013 at 09:23:40PM +0200, Simon B wrote: Last entry wins. Brilliant, thanks Victor Wietse. So, comment the virtual_alias_maps in pre-clean-up until I get amavis back up and running..? Be a bit more confident, you don't need to ask. -- Viktor.

Re: smtp restrictions

2013-05-31 Thread /dev/rob0
On Fri, May 31, 2013 at 11:15:05AM -0400, James Zee wrote: On Fri, May 31, 2013 at 8:09 AM, /dev/rob0 r...@gmx.co.uk wrote: On Fri, May 31, 2013 at 12:43:51AM -0400, James Zee wrote: snip Also, you really should separate submission from your inbound port 25. I only allow relaying on the

Challenges of an internal relay server

2013-05-31 Thread Jason Price
Background: Internal Mail Relay server. Connections from the internet are not possible. The vast majority of messages are going to Google Apps. Problem one: How to properly 'blacklist' certain To: addresses. I am currently using: header_checks = pcre:/etc/postfix/header_checks where

Is it time for 2.x.y - x.y?

2013-05-31 Thread Wietse Venema
After the confusion that Postfix 2.10 is not Postfix 2.1, maybe it is time to change the release numbering scheme. We could to the Linux thing where 2.mumble was followed by 3.mumble. or we could do it like Sun. After releasing Solaris 2.0 .. 2.6, they changed the numbering scheme with Solaris 7

Re: Challenges of an internal relay server

2013-05-31 Thread Wietse Venema
Jason Price: *May 30 12:38:23 rmail3b01 postfix/error[6485]: DD01F7B0: to=acre...@aa.com, relay=none, delay=403, delays=0.01/403/0/0, dsn=4.4.2, status=deferred (delivery temporarily suspended: conversation However, while watching tcpdump output very carefully, I can find no evidence

Re: Is it time for 2.x.y - x.y?

2013-05-31 Thread Christoph Anton Mitterer
Hi. I think the best is major.minor.patch, with major being really ground breaking changes, or those that add major incompatibilities... e.g. getting rid of all kind of legacy config option names or such... Minor being used for all other feature releases (which do not add major incompatibilities

Re: Is the absence of smtpd_relay_restrictions directive in Postfix versions = 2.10 a security risk in some default configurations?

2013-05-31 Thread Noel Jones
On 5/31/2013 3:19 PM, Ben Johnson wrote: Also, you're right; I had confused Postfix version 2.10 with 2.1. I now realize that the directive smtpd_relay_restrictions is not yet available with respect to my version of Postfix. Thanks again, -Ben probably combined with the (perhaps

Re: Is it time for 2.x.y - x.y?

2013-05-31 Thread /dev/rob0
On Fri, May 31, 2013 at 04:56:11PM -0400, Wietse Venema wrote: After the confusion that Postfix 2.10 is not Postfix 2.1, maybe it is time to change the release numbering scheme. The 2.10=2.1 confusion is something we commonly see in IRC. On the plus side, it shows that the person was reading

Re: Challenges of an internal relay server

2013-05-31 Thread Jason Price
I've reviewed the pcap file, looking for ip.addr == 173.194.65.27 for all times between 12:31:39 (when postfix received the message), and 12:48:22 (when it was successfully delivered), and there are no frames that mention 'acrespo' at all (except the initial reception, and the final delivery).

Re: Is it time for 2.x.y - x.y?

2013-05-31 Thread Quanah Gibson-Mount
--On Friday, May 31, 2013 4:43 PM -0500 /dev/rob0 r...@gmx.co.uk wrote: My wish is that Postfix 3.0, should it ever happen, would be a rewrite which sacrifices backward compatibility and the easy upgradability. Many things were learned over the course of Postfix 1.x/2.x development, and a

Re: Is it time for 2.x.y - x.y?

2013-05-31 Thread Noel Jones
On 5/31/2013 3:56 PM, Wietse Venema wrote: After the confusion that Postfix 2.10 is not Postfix 2.1, maybe it is time to change the release numbering scheme. We could to the Linux thing where 2.mumble was followed by 3.mumble. or we could do it like Sun. After releasing Solaris 2.0 .. 2.6,

Re: Challenges of an internal relay server

2013-05-31 Thread Noel Jones
On 5/31/2013 4:54 PM, Jason Price wrote: I've reviewed the pcap file, looking for ip.addr == 173.194.65.27 for all times between 12:31:39 (when postfix received the message), and 12:48:22 (when it was successfully delivered), and there are no frames that mention 'acrespo' at all (except the

Re: upgrade concerns

2013-05-31 Thread LuKreme
On 31 May 2013, at 11:27 , Dean Guenther dean.guent...@wsu.edu wrote: Thanks Brian!!! Commenting out home_mailbox took care of the problem. I appreciate the help -- Dean Suggest, in the strongest possible terms, that you do not use mbox format. Maildir is far more robust and is also much more

Re: Is it time for 2.x.y - x.y?

2013-05-31 Thread LuKreme
On 31 May 2013, at 14:56 , Wietse Venema wie...@porcupine.org wrote: After the confusion that Postfix 2.10 is not Postfix 2.1, maybe it is time to change the release numbering scheme. The amount of confusion doesn't seem worth changing to me. I know that some people will see 2.1.1 and think

Re: Is it time for 2.x.y - x.y?

2013-05-31 Thread Christoph Anton Mitterer
On Fri, 2013-05-31 at 16:43 -0500, /dev/rob0 wrote: My wish is that Postfix 3.0, should it ever happen, would be a rewrite which sacrifices backward compatibility and the easy upgradability. Many things were learned over the course of Postfix 1.x/2.x development, and a Postfix 3.0 (in my

Re: Is it time for 2.x.y - x.y?

2013-05-31 Thread Robert Lopez
On Fri, 2013-05-31 at 16:43 -0500, /dev/rob0 wrote: My wish is that Postfix 3.0, should it ever happen, would be a rewrite which sacrifices backward compatibility and the easy upgradability. Many things were learned over the course of Postfix 1.x/2.x development, and a Postfix 3.0 (in my

Re: upgrade concerns

2013-05-31 Thread Steve Jenkins
On Fri, May 31, 2013 at 3:33 PM, LuKreme krem...@kreme.com wrote: Suggest, in the strongest possible terms, that you do not use mbox format. Maildir is far more robust and is also much more efficient, requiring far fewer resources on your machine. From one Cougar (BYU) to another (WSU), may

Microsoft asking for input on Exchange Server 2013 and Outlook 2013

2013-05-31 Thread Jerry
Microsoft is actually publicly asking for feedback on its Exchange Server and Outlook Standards. This might be a good time to tell them specific problems you have with those two products and what changes are needed to make them more compatible with FOSS products. This pertains to Exchange Server

Re: Is it time for 2.x.y - x.y?

2013-05-31 Thread Larry Stone
On May 31, 2013, at 5:48 PM, LuKreme krem...@kreme.com wrote: I know that some people will see 2.1.1 and think that's exactly the same thing as 2.10.1, But why should they? As a number, 2.1 and 2.10 are the same thing (except for implied precision). And I can see possible confusion there.

Re: Is it time for 2.x.y - x.y?

2013-05-31 Thread Scott Kitterman
On Friday, May 31, 2013 04:56:11 PM Wietse Venema wrote: After the confusion that Postfix 2.10 is not Postfix 2.1, maybe it is time to change the release numbering scheme. We could to the Linux thing where 2.mumble was followed by 3.mumble. or we could do it like Sun. After releasing

Re: Is it time for 2.x.y - x.y?

2013-05-31 Thread Bryan Irvine
On Fri, May 31, 2013 at 1:56 PM, Wietse Venema wie...@porcupine.org wrote: After the confusion that Postfix 2.10 is not Postfix 2.1, maybe it is time to change the release numbering scheme. We could to the Linux thing where 2.mumble was followed by 3.mumble. or we could do it like Sun.

Re: Is it time for 2.x.y - x.y?

2013-05-31 Thread Christoph Anton Mitterer
On Fri, 2013-05-31 at 17:33 -0700, Bryan Irvine wrote: I've always found the OpenBSD method the easiest. after 2.9 comes 3.0 then 3.13.9 then 4.0. Guess that depends on how one interprets version numbers Is it a plain number? Then the model as also used by OpenBSD makes sense as 3.1 ==

Re: Is it time for 2.x.y - x.y?

2013-05-31 Thread Peter
On 06/01/2013 08:56 AM, Wietse Venema wrote: After the confusion that Postfix 2.10 is not Postfix 2.1, maybe it is time to change the release numbering scheme. I would take the confusion with a grain of salt, and I think that changing the numbering scheme will generate even more confusion.

Re: Is it time for 2.x.y - x.y?

2013-05-31 Thread Mike.
On 5/31/2013 at 4:56 PM wie...@porcupine.org wrote: |After the confusion that Postfix 2.10 is not Postfix 2.1, = In 20/20 hindsight, perhaps Postfix 2.1 should have been Postfix 2.01, allowing 100 minor versions before the major version was forced to change. I have a similar

Re: Is it time for 2.x.y - x.y?

2013-05-31 Thread Jim Wright
On May 31, 2013, at 3:56 PM, wie...@porcupine.org (Wietse Venema) wrote: After the confusion that Postfix 2.10 is not Postfix 2.1, maybe it is time to change the release numbering scheme. If they can't figure it out, they shouldn't be running a mail server. There is nothing wrong with the

Re: Is it time for 2.x.y - x.y?

2013-05-31 Thread Mike.
On 5/31/2013 at 10:23 PM Jim Wright wrote: |On May 31, 2013, at 3:56 PM, wie...@porcupine.org (Wietse Venema) wrote: | | After the confusion that Postfix 2.10 is not Postfix 2.1, maybe it is |time to change the release numbering scheme. | |If they can't figure it out, they shouldn't be running

Re: Challenges of an internal relay server

2013-05-31 Thread Jason Price
On Friday, May 31, 2013, Noel Jones wrote: Please don't top-post. When postfix logs delivery temporarily suspended, it means no attempt was made to deliver this message. The destination has been marked as down due to multiple prior failures. -- Noel Jones Thank you. That explains

Re: Is it time for 2.x.y - x.y?

2013-05-31 Thread David Benfell
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 05/31/2013 08:30 PM, Mike. wrote: On 5/31/2013 at 10:23 PM Jim Wright wrote: |On May 31, 2013, at 3:56 PM, wie...@porcupine.org (Wietse Venema) wrote: | | After the confusion that Postfix 2.10 is not Postfix 2.1, maybe it is |time to