Re: posttls-finger: RFE

2013-12-15 Thread Andreas Schulze
Am 15.12.2013 22:08 schrieb Patrick Ben Koetter: > % unbound-control flush I prefer "unbound-control flush_zone " because "flush" don't flush TXT Andreas

Re: ca-constraint trust-anchor sha256 digests disabled

2013-12-15 Thread Viktor Dukhovni
On Sun, Dec 15, 2013 at 10:02:42PM +0100, Patrick Ben Koetter wrote: > This will fix the usage: > > - $port, $host, $usage, $s, $m, $a; > + $port, $host, $u, $s, $m, $a; Yes, that's the change I made to fix it. > draft-ietf-dane-ops-01 says: > >The selector field specifies wheth

Re: posttls-finger: RFE

2013-12-15 Thread Patrick Ben Koetter
* Viktor Dukhovni : > On Sun, Dec 15, 2013 at 09:33:25PM +0100, Patrick Ben Koetter wrote: > > > I am looking for a switch in posttls-finger to tell it where (read: > > nameservr) > > to lookup TLSA RRs. > > > > Problem is: I've updated my zone, but I posttls-finger doesn't seem to 'see' > > th

Re: posttls-finger: RFE

2013-12-15 Thread Viktor Dukhovni
On Sun, Dec 15, 2013 at 09:33:25PM +0100, Patrick Ben Koetter wrote: > I am looking for a switch in posttls-finger to tell it where (read: nameservr) > to lookup TLSA RRs. > > Problem is: I've updated my zone, but I posttls-finger doesn't seem to 'see' > that because my local resolver has cached

Re: ca-constraint trust-anchor sha256 digests disabled

2013-12-15 Thread Patrick Ben Koetter
* Viktor Dukhovni : > On Sun, Dec 15, 2013 at 06:49:20PM +, Viktor Dukhovni wrote: > > > What certificate public key did you fingerprint? Your root CA > > certificate, or your server certificate? Why did you specify usage 0? > > It sure looks like your TLSA RR contains the public digest of

Re: ca-constraint trust-anchor sha256 digests disabled

2013-12-15 Thread Viktor Dukhovni
On Sun, Dec 15, 2013 at 09:18:12PM +0100, Patrick Ben Koetter wrote: > tlsagen mail.state-of-mind.de.pem mail.state-of-mind.de DANE-EE CERT SHA2-256 > _25._tcp.mail.state-of-mind.de. IN TLSA 0 0 1 > 4CCFD929E7C2646022AD1A80F66B29C2F37C14D95245C0624490B90074A014A7 > > Hmmm, looking at this DANE-E

posttls-finger: RFE

2013-12-15 Thread Patrick Ben Koetter
Viktor, I am looking for a switch in posttls-finger to tell it where (read: nameservr) to lookup TLSA RRs. Problem is: I've updated my zone, but I posttls-finger doesn't seem to 'see' that because my local resolver has cached the DNS zones information. Is there an option I didn't see? A better

Re: ca-constraint trust-anchor sha256 digests disabled

2013-12-15 Thread Patrick Ben Koetter
* Viktor Dukhovni : > On Sun, Dec 15, 2013 at 06:49:20PM +, Viktor Dukhovni wrote: > > > What certificate public key did you fingerprint? Your root CA > > certificate, or your server certificate? Why did you specify usage 0? > > It sure looks like your TLSA RR contains the public digest of

Re: ca-constraint trust-anchor sha256 digests disabled

2013-12-15 Thread Viktor Dukhovni
On Sun, Dec 15, 2013 at 06:49:20PM +, Viktor Dukhovni wrote: > What certificate public key did you fingerprint? Your root CA > certificate, or your server certificate? Why did you specify usage 0? It sure looks like your TLSA RR contains the public digest of your server certificate, and yet

Re: ca-constraint trust-anchor sha256 digests disabled

2013-12-15 Thread Viktor Dukhovni
On Sun, Dec 15, 2013 at 06:41:22PM +0100, Patrick Ben Koetter wrote: > Having followed recent DANE discussions on terminology I have to agree it > isn't really intuitive and I've come to ask for help setting up > a correct TLSA RR. > > I've used your tlsagen script to create a TLSA RR and updated

ca-constraint trust-anchor sha256 digests disabled

2013-12-15 Thread Patrick Ben Koetter
Viktor (I guess..), having followed recent DANE discussions on terminology I have to agree it isn't really intuitive and I've come to ask for help setting up a correct TLSA RR. I've used your tlsagen script to create a TLSA RR and updated the ZONE. Now I get a warning that says: "warning: ca-cons

Re: postsuper -r ALL ignores virtual_alias_maps entries

2013-12-15 Thread Vasya Pupkin
That makes sense. Thanks a lot! On 15 December 2013 23:19, Wietse Venema wrote: > Vasya Pupkin: >> I had an entry in virtual_alias_maps like this: >> >> /^([A-Za-z0-9%._-]+)@comain.tld$/ spam-123123...@mailinator.com > > This replaces addresses with spam-123123...@mailinator.com. > >> /^([A-Za-z0

Re: postsuper -r ALL ignores virtual_alias_maps entries

2013-12-15 Thread Wietse Venema
Vasya Pupkin: > I had an entry in virtual_alias_maps like this: > > /^([A-Za-z0-9%._-]+)@comain.tld$/ spam-123123...@mailinator.com This replaces addresses with spam-123123...@mailinator.com. > /^([A-Za-z0-9%._-]+)@comain.tld$/ my-spam-acco...@mail.ru That does not match spam-123123...@mailinat

Re: postsuper -r ALL ignores virtual_alias_maps entries

2013-12-15 Thread Vasya Pupkin
I checked config many times, it's perfect. I also mentioned that new mail is processed correctly. So for some reason requeue is not working as intended. Anyway, here are all my config files attached. On 15 December 2013 22:48, Dominik George wrote: >> > Because oif [0]. The queue you are requeuei

Re: postsuper -r ALL ignores virtual_alias_maps entries

2013-12-15 Thread Wietse Venema
Vasya Pupkin: > Hello. > > I am using postfix 2.8.5 on ubuntu 10.04 with pcre virtual_alias_maps, > like this: > > virtual_alias_maps = pcre:/etc/postfix/virtual_alias_maps > > I had an entry in virtual_alias_maps like this: > > /^([A-Za-z0-9%._-]+)@comain.tld$/ spam-123123...@mailinator.com >

Re: postsuper -r ALL ignores virtual_alias_maps entries

2013-12-15 Thread Dominik George
> > Because oif [0]. The queue you are requeueing to simply is situated > > after the rewrite (cleanup) process. I jsut realized that in fact, -r throws the mail into maildrop, so rewriting SHOULD take place. Check (post) your config! -nik -- * concerning Mozilla code leaking assertion failure

Re: postsuper -r ALL ignores virtual_alias_maps entries

2013-12-15 Thread Vasya Pupkin
So there is no way to do what I want to do then? On 15 December 2013 22:42, Dominik George wrote: >> But for some crazy reason postfix keeps trying to deliver all mail to >> mailinator.com instrad of mail.ru. What am I doing wrong? Also, I >> tried to send new mail to t...@comain.tld and it went

Re: postsuper -r ALL ignores virtual_alias_maps entries

2013-12-15 Thread Dominik George
> But for some crazy reason postfix keeps trying to deliver all mail to > mailinator.com instrad of mail.ru. What am I doing wrong? Also, I > tried to send new mail to t...@comain.tld and it went to > my-spam-acco...@mail.ru as expected. Why does requeue ignores > virtual_alias_maps entry and keeps

postsuper -r ALL ignores virtual_alias_maps entries

2013-12-15 Thread Vasya Pupkin
Hello. I am using postfix 2.8.5 on ubuntu 10.04 with pcre virtual_alias_maps, like this: virtual_alias_maps = pcre:/etc/postfix/virtual_alias_maps I had an entry in virtual_alias_maps like this: /^([A-Za-z0-9%._-]+)@comain.tld$/ spam-123123...@mailinator.com Today mailinator.com went down and

Upcoming FreeBSD 10.0 and compilation

2013-12-15 Thread Michael Grimm
Hi -- FYI: postfix 2.10.2 runs perfectly well at FreeBSD 10.0-PRERELEASE Sure, I needed to add "FREEBSD10" in makedefs and util/sys_defs.h to get compilation going: | make -f Makefile.init makefiles DEBUG= CC='clang -Wno-comment' OPT='-O2 -pipe -fno-strict-aliasing' \ | CCARGS='-DDEF_CONFIG_DI