Re: When milter (opendkim) is behind a proxy/relay, how to give it the original client IP?

2014-06-25 Thread li...@rhsoft.net
Am 25.06.2014 03:01, schrieb Thomas R.: OpenDKIM bases its decision whether mail can be signed on, among other things, the connecting IP. However this only works if there has been no SMTP relay or proxy prior to the mail reaching the milter. If there has been, OpenDKIM sees the IP

Re: When milter (opendkim) is behind a proxy/relay, how to give it the original client IP?

2014-06-25 Thread Wietse Venema
Thomas R.: Hello, OpenDKIM bases its decision whether mail can be signed on, among other things, the connecting IP. However this only works if there has been no SMTP relay or proxy prior to the mail reaching the milter. If there has been, OpenDKIM sees the IP address of the relay/proxy

valid names for postfix services

2014-06-25 Thread A. Schulze
Hello, I have to setup a special transport to send messages to a broken system. If I name the transport foo, I could add transport specific setting in main.cf as foo_destination_rate_delay for example. Does that work too if I name the service foo_smtp so the settig must be named

Re: logging when message_size_limit is exceeded

2014-06-25 Thread Wietse Venema
smtpd_delay_reject applies only to the configurable policies. smtpd_delay_reject does not apply to invalid SMTP commands such as syntax errors, parameter errors such as SIZE, commands out of order, and the like. Wietse

Re: valid names for postfix services

2014-06-25 Thread li...@rhsoft.net
Am 25.06.2014 13:13, schrieb A. Schulze: I have to setup a special transport to send messages to a broken system. If I name the transport foo, I could add transport specific setting in main.cf as foo_destination_rate_delay for example. Does that work too if I name the service foo_smtp so

Re: valid names for postfix services

2014-06-25 Thread A. Schulze
lists _at_ rhsoft dot net: use foo_outgoing that's the point: the underscore in the service name It may be worth to think about not naming it _smtp but I just do that and have no problems. I'm only unsure if setting parameters ${transportname}_mumble in main.cf work if ${transportname}

Re: When milter (opendkim) is behind a proxy/relay, how to give it the original client IP?

2014-06-25 Thread li...@rhsoft.net
why respond off-list? not able to handle a MUA but maintain mailservers. Am 25.06.2014 13:27, schrieb Thomas R.: why not change the order? a contentfilter is anyways expensive and should be the last one nad so only face messages which made it trough all the cheaper tests and filters

Re: valid names for postfix services

2014-06-25 Thread Wietse Venema
A. Schulze: I'm only unsure if setting parameters ${transportname}_mumble in main.cf work if ${transportname} contain a underscore itself. Postfix takes the master.cf service name field and appends _mumble. Wietse

Re: When milter (opendkim) is behind a proxy/relay, how to give it the original client IP?

2014-06-25 Thread Thomas R.
On 25/06/2014 9:41 PM, li...@rhsoft.net wrote: why respond off-list? not able to handle a MUA but maintain mailservers. An accident. You're quite rude. Your email looked like a list email and I didn't catch my mistake. *both* are before-queue and so only the order matters

Re: When milter (opendkim) is behind a proxy/relay, how to give it the original client IP?

2014-06-25 Thread Wietse Venema
Thomas Rutter: Use XCLIENT! XFORWARD is for LOGGING. XCLIENT is for IMPERSONATION. Thank you! I don't know why I haven't looked into this already. Postfix supports client IP address forwarding with haproxy (uses their protocol) and with nginx (uses XCLIENT). Wietse

status=deferred (Server certificate not trusted) - but why?

2014-06-25 Thread Ralf Hildebrandt
Jun 25 15:12:23 albatross postfix/smtp[16480]: Untrusted TLS connection established to mail.lastmikoi.net[212.83.147.35]:25: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits) Jun 25 15:12:23 albatross postfix/smtp[16480]: 3gz3jG3v0Mz7LjZ: to=...@lastmikoi.net,

Restricting Intra-Office Receiving

2014-06-25 Thread Asai
Greetings, I've worked out how to restrict intra-office sending from a user to a user, but I'm a bit stumped on how to restrict intra-office receiving; restricting from who a user can receive mail. This is what I have at this point: smtpd_recipient_restrictions = permit_sasl_authenticated,

Re: Restricting Intra-Office Receiving

2014-06-25 Thread Asai
I think I got it: smtpd_relay_restrictions = permit_mynetworks, check_recipient_access mysql:/etc/postfix/mysql_restricted_recipients.cf, permit_sasl_authenticated, defer_unauth_destination I moved check_recipient_access from smtpd_recipient_restrictions to

Re: Restricting Intra-Office Receiving

2014-06-25 Thread Viktor Dukhovni
On Wed, Jun 25, 2014 at 09:46:33AM -0700, Asai wrote: I think I got it: smtpd_relay_restrictions = permit_mynetworks, check_recipient_access mysql:/etc/postfix/mysql_restricted_recipients.cf, permit_sasl_authenticated, defer_unauth_destination I moved

Re: Limit number of deliveries for pipe delivery

2014-06-25 Thread Julian Mehnle
Wietse Venema wrote: Julian Mehnle: I have a transport foo defined in master.cf that delivers messages via a pipe command. In an edge case Postfix is receiving messages with multiple recipients (multiple RCPT TO commands). I'm looking for a way to have such messages delivered to the pipe

Re: Limit number of deliveries for pipe delivery

2014-06-25 Thread Viktor Dukhovni
On Wed, Jun 25, 2014 at 01:54:21PM -0700, Julian Mehnle wrote: That is exactly what Postfix does by default, without any tweaking of destination recipient settings. Great! Now, if it currently *doesn't* (i.e., it invokes the pipe command once per RCPT TO, not once per message), what's

Re: Limit number of deliveries for pipe delivery

2014-06-25 Thread Julian Mehnle
Thanks for your replies so far! Viktor Dukhovni wrote: On Wed, Jun 25, 2014 at 01:54:21PM -0700, Julian Mehnle wrote: That is exactly what Postfix does by default, without any tweaking of destination recipient settings. Great! Now, if it currently *doesn't* (i.e., it invokes the pipe

Updated note for Postfix maintainers

2014-06-25 Thread Wietse Venema
In response to maintainer feedback, I have cleaned up Postfix shared-library and database plugin support. The result of several iterations is postfix-2.12-20140625. See RELEASE_NOTES and INSTALL for an updated introduction. What has changed: - Non-executable files are no longer installed

AOL delivery issues

2014-06-25 Thread Paul C
Hey all, has anyone seen this happen with postfix ... delivery temporarily suspended: connect to mailin-01.mx.aol.com[64.12.88.132]:25: Connection timed out I realize it probably some lag going on somewhere, just taking too long to finish the smtp convo with aol, but its only happening with aol

Re: AOL delivery issues

2014-06-25 Thread Wietse Venema
Paul C: Hey all, has anyone seen this happen with postfix ... delivery temporarily suspended: connect to mailin-01.mx.aol.com[64.12.88.132]:25: Connection timed out S**t happens... I realize it probably some lag going on somewhere, just taking too long to finish the smtp convo with aol,

Re: AOL delivery issues

2014-06-25 Thread Paul C
Yes s**t does happen lol. I've had delivery issues in the past, they always respond with 421 or some type of error code, not time outs, but here's what I am seeing in some tests: If it starts timing out, every single message does, I have a multiple ip set up and it happens across the board on

Re: Limit number of deliveries for pipe delivery

2014-06-25 Thread Viktor Dukhovni
On Wed, Jun 25, 2014 at 02:31:18PM -0700, Julian Mehnle wrote: You may be misreading the logs. What evidence do you have that in fact there is a separate delivery for each recipient. LOGS! Here's a log excerpt: Jun 25 00:17:14 etl-qa-00 postfix/qmgr[19911]: 8830140409E9E:

email sent to bad address, is it possible to change recipient

2014-06-25 Thread Robert Fantini
Hello due to a bug in some other software we have mail occasionally get stuck in the queue. I've tried editing /var/spool/postfix/defer/1/176CD2193E to fix the address, but after running 'postfix flush' , that files reverts to its original recipient. I could not find another file to edit..

Re: Limit number of deliveries for pipe delivery

2014-06-25 Thread Julian Mehnle
Viktor Dukhovni wrote: On Wed, Jun 25, 2014 at 02:31:18PM -0700, Julian Mehnle wrote: Here's a log excerpt: Jun 25 00:17:14 etl-qa-00 postfix/qmgr[19911]: 8830140409E9E: from=mailer-dae...@athena.vistabroadband.net, size=3023, nrcpt=2 (queue active) Jun 25 00:44:26 etl-qa-00

Re: Limit number of deliveries for pipe delivery

2014-06-25 Thread Viktor Dukhovni
On Wed, Jun 25, 2014 at 03:30:26PM -0700, Julian Mehnle wrote: Yes, this is two deliveries, for two recipient records in the queue file, that are in fact the same recipient address? Why does this message have to identical envelope recipients? The pipe(8) pid would be the same for a

Re: Limit number of deliveries for pipe delivery

2014-06-25 Thread Julian Mehnle
Viktor Dukhovni wrote: On Wed, Jun 25, 2014 at 03:30:26PM -0700, Julian Mehnle wrote: The original RCPT TO addresses are actually different, but they resolve to the same destination internally. If there was a way to make Postfix collapse them into a single delivery, that would solve my

Re: Limit number of deliveries for pipe delivery

2014-06-25 Thread Viktor Dukhovni
On Wed, Jun 25, 2014 at 03:45:30PM -0700, Julian Mehnle wrote: You'd need to use virtual(5) aliases and transport(5), not local aliases(5) and mailbox_transport to multiple recipients in one delivery. Awesome, that's a very clear pointer in the right direction. I will work on changing