Re: Cannot get sasl auth working on ubuntu 18.04

2019-02-21 Thread Dominic Raferd
On Thu, 21 Feb 2019 at 19:59, Ski Kacoroski wrote: > > I still have the problem though, that sasl is working fine via > testsaslauthd, but I cannot get it to work with postfix. > > Does anyone have ideas on how to debug the postfix - sasl interface (I > am using cyrus sasl). swaks is a useful

Re: How to protect against compromised email account password

2019-02-21 Thread Gary
Just to be clear here, if you submit logs to Digital Ocean, they will contact the droplet owner. OVH however does appear to be bullet proof hosting. No replies to complaints. Buyvm/Frantech is another bullet proof host. I do block them, but I get hacking attempts where their Las Vegas server

Re: Cannot get sasl auth working on ubuntu 18.04 - SOLVED

2019-02-21 Thread Ski Kacoroski
Hi, Figured out that the problem was I did not completely fill out the /etc/postfix/sasl/smtpd.conf file. I only had: saslauthd_path: /var/run/saslauthd/mux I needed to have: saslauthd_path: /var/run/saslauthd/mux pwcheck_method: saslauthd mech_list: LOGIN PLAIN works like a charm now.

Re: How to protect against compromised email account password

2019-02-21 Thread Walter Doekes
On 21-02-19 16:33, Dominic Raferd wrote: > On Thu, 21 Feb 2019 at 15:23, John Stoffel wrote: >> Unfortunately, some big ISPs have now blocked all Digital Ocean IP >> Blocks, and wont' accept email, even though my domain is locked down, >> doesn't spam, etc. They took the big hammer approach.

Re: Troubleshooting postscreen/dnsblog

2019-02-21 Thread Wietse Venema
Charles Sprickman: > Hi all, > > Looking for some help on troubleshooting postscreen? > > I was recently reworking the list of rbls that I use with postscreen and > realized that quite a bit of spam that was getting through was in fact on > enough blacklists to hit my postscreen threshold. I?m

Troubleshooting postscreen/dnsblog

2019-02-21 Thread Charles Sprickman
Hi all, Looking for some help on troubleshooting postscreen… I was recently reworking the list of rbls that I use with postscreen and realized that quite a bit of spam that was getting through was in fact on enough blacklists to hit my postscreen threshold. I’m not seeing anything obvious in

Re: Cannot get sasl auth working on ubuntu 18.04

2019-02-21 Thread Ski Kacoroski
Thanks for all the replies. This for an internal relay only with access from a limited set of IPs so I am not concerned about security. And yes, I blew on on the encrypted password - should have just out the entire thing. I am using port 465 just as an alternate port to 25 for only the

Re: How to protect against compromised email account password

2019-02-21 Thread Ignacio García
El 21/02/2019 a las 16:33, Dominic Raferd escribió: On Thu, 21 Feb 2019 at 15:23, John Stoffel wrote: ... Unfortunately, some big ISPs have now blocked all Digital Ocean IP Blocks, and wont' accept email, even though my domain is locked down, doesn't spam, etc. They took the big hammer

Re: Old linux / postfix version - how add DKIM ?

2019-02-21 Thread Robert Schetterer
Am 21.02.19 um 17:03 schrieb Matus UHLAR - fantomas: On 21.02.19 10:36, Edouard Guigné wrote: My mail server is intalled in a old deprecated linux version (debian 5.0) with postfix 2.5.5 oh...  debian 7.0 is not supported for (nearly) a year, 6.0 for three years, 5.0 for seven years (debian

Re: Old linux / postfix version - how add DKIM ?

2019-02-21 Thread Matus UHLAR - fantomas
On 21.02.19 10:36, Edouard Guigné wrote: My mail server is intalled in a old deprecated linux version (debian 5.0) with postfix 2.5.5 oh... debian 7.0 is not supported for (nearly) a year, 6.0 for three years, 5.0 for seven years (debian didn't havee LTS before 6.0) I wonder it hasn't been

Re: Old linux / postfix version - how add DKIM ?

2019-02-21 Thread Wietse Venema
Edouard Guign?: > Hello, > > My mail server is intalled in a old deprecated linux version (debian > 5.0) with postfix 2.5.5 > > I did not installed this linux box, only managing it. I plan to change > this server with an other solution (e.g. Zimbra), but this is not the > today priority. > >

Re: How to protect against compromised email account password

2019-02-21 Thread Dominic Raferd
On Thu, 21 Feb 2019 at 15:23, John Stoffel wrote: ... > Unfortunately, some big ISPs have now blocked all Digital Ocean IP > Blocks, and wont' accept email, even though my domain is locked down, > doesn't spam, etc. They took the big hammer approach. Which sucks > for me. > > So the question

Re: How to protect against compromised email account password

2019-02-21 Thread John Stoffel
Gary> What ISP specifically bans Digital Ocean? Charter/Spectrum. Gary> What you need is some other email account, say proton, to start Gary> the dialog with the ISP that bans your Digital Ocean account. Or Gary> you look for some online form or forum. I had this problem with Gary> SBC (AT)

Re: How to protect against compromised email account password

2019-02-21 Thread Gary
What ISP specifically bans Digital Ocean? What you need is some other email account, say proton, to start the dialog with the ISP that bans your Digital Ocean account. Or you look for some online form or forum. I had this problem with SBC (AT) and eventually got whitelisted by IP address. I

Re: How to protect against compromised email account password

2019-02-21 Thread John Stoffel
> "Gary" == Gary writes: Gary> Number 4 is immensely useful. When I had a hosted service, I got hacked from someone in Morocco via a Round Cube exploit that wasn't patched. (My PayPal account subsequently hacked, though I had the account suspended.) Gary> I saw two problems. One, I only

Old linux / postfix version - how add DKIM ?

2019-02-21 Thread Edouard Guigné
Hello, My mail server is intalled in a old deprecated linux version (debian 5.0) with postfix 2.5.5 I did not installed this linux box, only managing it. I plan to change this server with an other solution (e.g. Zimbra), but this is not the today priority. I succeed to configure SPF

Re: How to protect against compromised email account password

2019-02-21 Thread Leonardo Rodrigues
Em 19/02/2019 23:39, Bill Cole escreveu: Nothing is absolutely perfect but there are useful approaches, some external to Postfix proper: 1. Rate limiting. Postfix has some of this (smtpd_client_*_limit parameters) but you may be able to get more effective and subtle limits via external

Re: Feature Request: Allow Rejecting UTF BOM in MAIL FROM

2019-02-21 Thread Andrey Repin
Greetings, Viktor Dukhovni! >> Makes sense, thank you. >> >> So, next question is, do you want it to be mentioned in "Enabling Postfix >> SMTPUTF8 support" [2] or separately? >> >> [2] http://www.postfix.org/SMTPUTF8_README.html#enabling > My guess would be under: >

Re: How to protect against compromised email account password

2019-02-21 Thread Matus UHLAR - fantomas
Am 19.02.2019 um 12:23 schrieb Christos Chatzaras: We wrote a shell script that runs hourly and notifies us for SASL authentications with IPs for at least 2 different countries in the previous hour. In the future we plan to automatically change the password if SASL authentications are from 3

Re: How to protect against compromised email account password

2019-02-21 Thread Christos Chatzaras
> On 21 Feb 2019, at 01:53, Benny Pedersen wrote: > > Matus UHLAR - fantomas skrev den 2019-02-20 10:59: >>> Christos Chatzaras skrev den 2019-02-19 12:23: Also we use Postfix relays with Rspamd checking the From header (we don't allow users to spoof From address) and doing rate

Re: Cannot get sasl auth working on ubuntu 18.04

2019-02-21 Thread Matus UHLAR - fantomas
On 20.02.19 15:34, Ski Kacoroski wrote: I have installed the sasl packages and configured sasl so testsaslauthd works perfectly with the ldap backend. I then set up postfix to have this on port 465 in master.cf: smtps inet n - n - - smtpd -v -o

Re: How to protect against compromised email account password

2019-02-21 Thread Matus UHLAR - fantomas
Matus UHLAR - fantomas skrev den 2019-02-20 10:59: Christos Chatzaras skrev den 2019-02-19 12:23: Also we use Postfix relays with Rspamd checking the From header (we don't allow users to spoof From address) and doing rate limits (500 e-mails / hour). If someones tries to send more e-mails then