postfix + selinux - does it make sense ?

2017-07-11 Thread Zalezny Niezalezny
Hi, I would like to know Your opinion about selinux + postfix ? Does onyone using it ? Does it make sense to setup some policies for postfix ? Thanks in advance for your answers and suggestions. Cheers Zalezny

Re: postfix + selinux - does it make sense ?

2017-07-11 Thread Peter
On 11/07/17 19:31, Zalezny Niezalezny wrote: > I would like to know Your opinion about selinux + postfix ? > > Does onyone using it ? Does it make sense to setup some policies for > postfix ? It works as well as any other software + selinux. What policies and label contexts you have to customize

Re: postfix + selinux - does it make sense ?

2017-07-11 Thread Paul Menzel
Dear Zalezny, On 07/11/17 09:31, Zalezny Niezalezny wrote: I would like to know your opinion about selinux + postfix? Does anyone using it? Does it make sense to set up some policies for postfix? It largely depends on your threat model, but in my opinion, as it doesn’t hurt, I would say it

Re: postfix + selinux - does it make sense ?

2017-07-11 Thread Wietse Venema
Zalezny Niezalezny: > Hi, > > I would like to know Your opinion about selinux + postfix ? > > Does onyone using it ? Does it make sense to setup some policies for > postfix ? Do what you like, but I won't provide help for platform-specific features. Postfix is a cross-platform system. W

Re: postfix + selinux - does it make sense ?

2017-07-11 Thread Zalezny Niezalezny
I think that Postfix is one of the most secure servers. I will stay with basic SE settings. On Tue, Jul 11, 2017 at 1:01 PM, Wietse Venema wrote: > Zalezny Niezalezny: > > Hi, > > > > I would like to know Your opinion about selinux + postfix ? > > > > Does onyone using it ? Does it make sense t

Postfix ignoring order of smtpd_recipient_restrictions

2017-07-11 Thread Darren Share
Hi, I've posted this as a serverfault [1]question but had no bites so far. I am receiving about 50 rejected emails per day because there is a typo in the sending email address and it's hitting reject_unknown_sender_domain: Jul 10 12:21:31 serverb3 postfix/smtpd[6647]: NOQUEUE: reject: RCPT fro

Re: Postfix ignoring order of smtpd_recipient_restrictions

2017-07-11 Thread Alex JOST
Am 11.07.2017 um 17:21 schrieb Darren Share: Hi, I've posted this as a serverfault [1]question but had no bites so far. I am receiving about 50 rejected emails per day because there is a typo in the sending email address and it's hitting reject_unknown_sender_domain: Jul 10 12:21:31 serverb3 p

Re: Postfix ignoring order of smtpd_recipient_restrictions

2017-07-11 Thread Darren Share
Thanks! I will try to reorganise that grouping as well. On 11/07/2017 16:38, Alex JOST wrote: > Am 11.07.2017 um 17:21 schrieb Darren Share: > >> Hi, >> >> I've posted this as a serverfault [1]question but had no bites so far. >> >> I am receiving about 50 rejected emails per day because the

upgrade/compile options

2017-07-11 Thread techlist06
I have a functioning install of 2.10 from rpm's on Centos7. I'm trying to upgrade the postfix to 2.11. I don't use LDAP and I'm using Dovecot for SASL. I use TLS. Following the postfix docs and other's directions, I've tried to pick the correct compile options. Unfortunately for me RedHat/Cent

Re: upgrade/compile options

2017-07-11 Thread Wietse Venema
techlist06: > I have a functioning install of 2.10 from rpm's on Centos7. I'm trying to > upgrade the postfix to 2.11. > > I don't use LDAP and I'm using Dovecot for SASL. I use TLS. Following the > postfix docs and other's directions, I've tried to pick the correct compile > options. Unfortun

RE: upgrade/compile options

2017-07-11 Thread Scott Techlist
>Do "postfix reload" and see what Postfix version is being logged. Jul 11 15:58:29 tn2 postfix/postfix-script[17935]: refreshing the Postfix mail system Jul 11 15:58:29 tn2 postfix/master[17876]: reload -- version 2.11.10, configuration /etc/postfix

Re: upgrade/compile options

2017-07-11 Thread Viktor Dukhovni
On Tue, Jul 11, 2017 at 01:21:44PM -0700, techlist06 wrote: > make makefiles CCARGS=' -fPIC -DUSE_TLS -DUSE_SSL -DUSE_SASL_AUTH > -DDEF_SERVER_SASL_TYPE=\"dovecot\" -DPREFIX=\\"/usr\\" -DHAS_PCRE > -I/usr/include/openssl > -I/usr/include/dovecot > -I/usr/include' Do NOT add "/usr/include/openssl"

Re: upgrade/compile options

2017-07-11 Thread Wietse Venema
techlist06: > I have a functioning install of 2.10 from rpm's on Centos7. I'm trying to > upgrade the postfix to 2.11. > > I don't use LDAP and I'm using Dovecot for SASL. I use TLS. Following the > postfix docs and other's directions, I've tried to pick the correct compile > options. Unfortun

Re: upgrade/compile options

2017-07-11 Thread techlist06
Wietse: >If I correct your command for word-wrap breakage and spurious spaces, >but otherwise leave all the unnecessary stuff in place, it produces >a working build with Postfix 3.3 on Fedora Core 24. The reference I started with was one by Steve Jenkins for a Centos 7 system (and others). I'

Re: upgrade/compile options

2017-07-11 Thread techlist06
I removed the one Cyrus SASL path Victor pointed out. For anyone else who may come on this searching... Google "Steve Jenkins Building Postfix on RHEL / CentOS from Source" for detailed steps. Except for me I wanted TLS, Dovecot SASL (no Cyrus), the rest as normal for the distribution. On a stoc

Re: upgrade/compile options

2017-07-11 Thread Peter
On 12/07/17 08:21, techlist06 wrote: > I have a functioning install of 2.10 from rpm's on Centos7. I'm trying to > upgrade the postfix to 2.11. Why are you trying to upgrade from old to slightly less old? The current stable of postfix is 3.2.2. If you're afraid of 2.10 being EOL then don't worr

Re: upgrade/compile options

2017-07-11 Thread techlist06
Hi Peter: > Why are you trying to upgrade from old to slightly less old? The > current stable of postfix is 3.2.2. Valid question. It wasn't because of EOL concerns. I was looking to add the feature available in 2.11+: postscreen_dnsbl_whitelist_threshold Beyond that, I was just chicken of

Re: upgrade/compile options

2017-07-11 Thread Peter
On 12/07/17 15:05, techlist06 wrote: >> Why are you trying to upgrade from old to slightly less old? The >> current stable of postfix is 3.2.2. > > Valid question. It wasn't because of EOL concerns. I was looking to add > the feature available in 2.11+: > postscreen_dnsbl_whitelist_threshold >