Re: [PATCH 2.11/2.12] connection cache issue correlated with "SSL23_GET_SERVER_HELLO:tlsv1 alert decode error"?

2014-05-06 Thread Viktor Dukhovni
On Wed, May 07, 2014 at 12:26:09AM -0400, Sahil Tandon wrote: > > I cannot say definitively without more complete log analysis, but that > > is my hunch. And, the issue does not seem to occur as a result of the > > initial cleartext fallback, but later ... once on-demand caching has > > kicked in.

Configure postfix to reject forged mail?

2014-05-06 Thread Sebastian Nielsen
I tried with the following: smtpd_relay_restrictions = reject_unlisted_sender, permit_mynetworks, reject_unauth_destination But didnt work, mail from “unlisted” domains are accepted through. My domain is sebbe.eu The result Im out after, is the following: MAIL FROM: t...@test.com RCPT TO: some

Re: connection cache issue correlated with "SSL23_GET_SERVER_HELLO:tlsv1 alert decode error"?

2014-05-06 Thread Sahil Tandon
On Tue, 2014-05-06 at 23:57:41 -0400, Sahil Tandon wrote: > On Wed, 2014-05-07 at 03:31:13 +, Viktor Dukhovni wrote: > > > On Tue, May 06, 2014 at 10:49:20PM -0400, Sahil Tandon wrote: > > > > > We are experiencing a problem that seems to manifest *only* when > > > delivering to MXs that exh

Re: connection cache issue correlated with "SSL23_GET_SERVER_HELLO:tlsv1 alert decode error"?

2014-05-06 Thread Sahil Tandon
On Wed, 2014-05-07 at 03:31:13 +, Viktor Dukhovni wrote: > On Tue, May 06, 2014 at 10:49:20PM -0400, Sahil Tandon wrote: > > > We are experiencing a problem that seems to manifest *only* when > > delivering to MXs that exhibit the SSL problem described by Viktor[1] > > AND connection caching

Re: connection cache issue correlated with "SSL23_GET_SERVER_HELLO:tlsv1 alert decode error"?

2014-05-06 Thread Viktor Dukhovni
On Tue, May 06, 2014 at 10:49:20PM -0400, Sahil Tandon wrote: > We are experiencing a problem that seems to manifest *only* when > delivering to MXs that exhibit the SSL problem described by Viktor[1] > AND connection caching is enabled on demand. That is when TLS handshakes fail and cleartext co

connection cache issue correlated with "SSL23_GET_SERVER_HELLO:tlsv1 alert decode error"?

2014-05-06 Thread Sahil Tandon
We are experiencing a problem that seems to manifest *only* when delivering to MXs that exhibit the SSL problem described by Viktor[1] AND connection caching is enabled on demand. I am still reviewing the logs to understand this, but at first glance, it appears that we try to deliver mail to MXs th

Delivery issue? warning: dict_nis_init: NIS domain name not set - NIS lookups disabled

2014-05-06 Thread Chris
Hello, I've setup my Debian/Postfix Server similar like this: http://johnny.chadda.se/article/mail-server-howto-postfix-and-dovecot-with-mysql-and-tlsssl-postgrey-and-dspam/ If I want to send an email I'm getting: May 7 03:26:36 nudin3 postfix/smtpd[755]: warning: dict_nis_init: NIS domain nam

Re: custom filter and mailer-daemon

2014-05-06 Thread mancyb...@gmail.com
On Mon, 5 May 2014 20:19:50 -0400 (EDT) wie...@porcupine.org (Wietse Venema) wrote: > mancyb...@gmail.com: > > But with real traffic I can see in the syslog that the filter > > doesn't get triggered. > > > > My gut suggests me that emails generated by postfix itself: > > mailer-dae...@linuxmailser

Re: Getting DKIM to work with Mailman and Postfix

2014-05-06 Thread James B. Byrne
On Tue, May 6, 2014 10:53, Wietse Venema wrote: > James B. Byrne: >> >> This is my MSA configuration in Master.cf >> >> >> >> submission inet n - n - - smtpd -v > [...] > > Wietse: > [have you ever used this with mailman before?] > > James B. Byrne: >> I never tried b

Re: Getting DKIM to work with Mailman and Postfix

2014-05-06 Thread Wietse Venema
James B. Byrne: > >> This is my MSA configuration in Master.cf > >> > >> submission inet n - n - - smtpd -v [...] Wietse: [have you ever used this with mailman before?] James B. Byrne: > I never tried before this incident and that attempt failed as I previously > rep

Re: Getting DKIM to work with Mailman and Postfix

2014-05-06 Thread James B. Byrne
On Tue, May 6, 2014 10:20, Wietse Venema wrote: > James B. Byrne: >> > Well nothing works without correct configuration. Is your SMTP >> > server correctly set up to sign local submissions on 127.0.0.1 >> > and the TCP port that mailman is talking to? >> > >> > You'd have to verify that first. On

Re: Getting DKIM to work with Mailman and Postfix

2014-05-06 Thread Wietse Venema
James B. Byrne: > > Well nothing works without correct configuration. Is your SMTP > > server correctly set up to sign local submissions on 127.0.0.1 > > and the TCP port that mailman is talking to? > > > > You'd have to verify that first. Only then does it make sense > > to try to make signing wo

Re: Getting DKIM to work with Mailman and Postfix

2014-05-06 Thread James B. Byrne
On Mon, May 5, 2014 17:50, Wietse Venema wrote: > > Well nothing works without correct configuration. Is your SMTP > server correctly set up to sign local submissions on 127.0.0.1 > and the TCP port that mailman is talking to? > > You'd have to verify that first. Only then does it make sense > t

Re: Getting DKIM to work with Mailman and Postfix

2014-05-06 Thread James B. Byrne
On Mon, May 5, 2014 22:23, Sahil Tandon wrote: > On Mon, 2014-05-05 at 13:11:31 -0400, James B. Byrne wrote: > >> I am wrestling with the issues arising from Yahoo.com, and now >> AOL.com, enforcing dkim for their addresses. Specifically we run a >> small number of mailing lists using Mailman whi