Re: postfix REGEX bug ???

2012-03-29 Thread Tom Hendrikx
On 29/03/12 10:51, Женя wrote: I'm using postfix (2.7.0 on Ubuntu Linux 10.04.3) as mail relay and antispam filter. It's set up and works perfectly except one small bug. I use smtpd_client_restrictions to filter SMTP clents as following: smtpd_client_restrictions = permit_mynetworks

Re: postfix REGEX bug ???

2012-03-29 Thread Wietse Venema
: /google\.com/ OK /mail\.ru/ OK You mean: /^google\.com$/ /^mail\.ru$/ RTFM! Wietse

Re: postfix REGEX bug ???

2012-03-29 Thread Женя
That's it. Ashamed. Tricky REGEX. Thanks everyone. And thank you for great mail server. : /google\.com/ OK /mail\.ru/ OK You mean: /^google\.com$/ /^mail\.ru$/ RTFM! Wietse

OT-follow up - postfix REGEX bug ???

2012-03-29 Thread john
Could somebody recommend a good tutorial on REGEX and/or PRCE? John A On 29/03/2012 11:35 AM, Женя wrote: That's it. Ashamed. Tricky REGEX. Thanks everyone. And thank you for great mail server. : /google\.com/ OK /mail\.ru/ OK You mean: /^google\.com$/

Re: OT-follow up - postfix REGEX bug ???

2012-03-29 Thread Helder Oliveira
http://rubular.com/ a good place to test and learn... On Mar 29, 2012, at 5:42 PM, john wrote: Could somebody recommend a good tutorial on REGEX and/or PRCE? John A On 29/03/2012 11:35 AM, Женя wrote: That's it. Ashamed. Tricky REGEX. Thanks everyone. And thank you for great mail

Re: postfix REGEX bug ???

2012-03-29 Thread Noel Jones
On 3/29/2012 5:48 AM, Wietse Venema wrote: You mean: /^google\.com$/ /^mail\.ru$/ The expression must also match subdomains. /[^.]google\.com$/ /[^.]mail\.ru$/ pesky regexps... always causing trouble. -- Noel Jones

Re: postfix REGEX bug ???

2012-03-29 Thread Wietse Venema
Noel Jones: On 3/29/2012 5:48 AM, Wietse Venema wrote: You mean: /^google\.com$/ /^mail\.ru$/ The expression must also match subdomains. /[^.]google\.com$/ /[^.]mail\.ru$/ To match zero or more labels before the domain name: /^([^.]+\.)*google\.com$/

Re: postfix REGEX bug ???

2012-03-29 Thread Noel Jones
On 3/29/2012 1:15 PM, Wietse Venema wrote: Noel Jones: On 3/29/2012 5:48 AM, Wietse Venema wrote: You mean: /^google\.com$/ /^mail\.ru$/ The expression must also match subdomains. /[^.]google\.com$/ /[^.]mail\.ru$/ To match zero or more labels before the domain name:

Re: [OT] Re: found a bug on postfix 2.9.1

2012-03-07 Thread Wietse Venema
Eliezer Croitoru: On 07/03/2012 02:33, Wietse Venema wrote: Eliezer Croitoru: i dont care about any init scripts on whatever else then when there is this specific problem of mismatching binding an ip that dosnt exist to be checked using the postfix check method on terminal and not only on

found a bug on postfix 2.9.1

2012-03-06 Thread Eliezer Croitoru
OS:Gentoo latest built with kernel 3.2.1 with hardened profile POSTFIX: v 2.9.1 when i'm configuring on master.cf some listening to port on ip address that doesn't exist on any interface such as for communicating with amavis (as if my ip is 192.168.0.20 and i will put 192.168.0.21:25 ) postfix

Re: found a bug on postfix 2.9.1

2012-03-06 Thread Wietse Venema
Eliezer Croitoru: OS:Gentoo latest built with kernel 3.2.1 with hardened profile POSTFIX: v 2.9.1 when i'm configuring on master.cf some listening to port on ip address that doesn't exist on any interface such as for communicating with amavis (as if my ip is 192.168.0.20 and i will put

Re: found a bug on postfix 2.9.1

2012-03-06 Thread Wietse Venema
Wietse Venema: Eliezer Croitoru: OS:Gentoo latest built with kernel 3.2.1 with hardened profile POSTFIX: v 2.9.1 when i'm configuring on master.cf some listening to port on ip address that doesn't exist on any interface such as for communicating with amavis (as if my ip is

Re: found a bug on postfix 2.9.1

2012-03-06 Thread Jerry
and the only way i managed to make postfix work is to fix the master.cf and rebooting the machine\os. You need to provide the proper information to debug a possible bug. Start here: http://www.postfix.com/DEBUG_README.html Be sure to read this part thoroughly: http://www.postfix.com

Re: found a bug on postfix 2.9.1

2012-03-06 Thread Eray Aslan
On Tue, Mar 06, 2012 at 07:03:04AM -0500, Wietse Venema wrote: /etc/postfix/master.cf: 1.2.3.4:25 inet n - n - 1 whatever # postfix stop # postfix start # tail -3 /var/log/maillog Mar 6 06:53:25 tail postfix/master[60082]: terminating on signal 15

Re: found a bug on postfix 2.9.1

2012-03-06 Thread Wietse Venema
Eray Aslan: # postfix start postfix/postfix-script: starting the Postfix mail system # echo $? 0 As documented in the Postfix manpage: start Start the Postfix mail system. This also runs the configuration check described above. status Indicate if the Postfix mail system is

Re: found a bug on postfix 2.9.1

2012-03-06 Thread Eray Aslan
On Tue, Mar 06, 2012 at 08:40:16AM -0500, Wietse Venema wrote: start Start the Postfix mail system. This also runs the configuration check described above. status Indicate if the Postfix mail system is currently running. This does introduce a non-negligible delay in startup

Re: found a bug on postfix 2.9.1

2012-03-06 Thread Wietse Venema
Eray Aslan: On Tue, Mar 06, 2012 at 08:40:16AM -0500, Wietse Venema wrote: start Start the Postfix mail system. This also runs the configuration check described above. status Indicate if the Postfix mail system is currently running. This does introduce a non-negligible

Re: [SPAM] Re: found a bug on postfix 2.9.1

2012-03-06 Thread Stéphane MERLE
Le 06/03/2012 17:48, Wietse Venema a écrit : Eray Aslan: On Tue, Mar 06, 2012 at 08:40:16AM -0500, Wietse Venema wrote: start Start the Postfix mail system. This also runs the configuration check described above. status Indicate if the Postfix mail system is currently

Re: found a bug on postfix 2.9.1

2012-03-06 Thread Stan Hoeppner
On 3/6/2012 10:48 AM, Wietse Venema wrote: - Turning on chroot by default. Many Debian etc. users get into trouble when they make an innocuous configuration change to the SMTP daemon. Postfix has no defense for this brain damage. Is this the syslog socket issue Wietse or another issue?

Re: found a bug on postfix 2.9.1

2012-03-06 Thread Wietse Venema
Eray Aslan: On Tue, Mar 06, 2012 at 11:48:35AM -0500, Wietse Venema wrote: I think that making everyone wait would be another example of well-meaning people doing things that give Postfix a bad reputation. postfix start exits successfully but postfix doesn't work, resulting in a WTF

[OT] Re: found a bug on postfix 2.9.1

2012-03-06 Thread Michael Orlitzky
On 03/06/12 14:10, Wietse Venema wrote: Eray Aslan: On Tue, Mar 06, 2012 at 11:48:35AM -0500, Wietse Venema wrote: I think that making everyone wait would be another example of well-meaning people doing things that give Postfix a bad reputation. postfix start exits successfully but postfix

Re: [OT] Re: found a bug on postfix 2.9.1

2012-03-06 Thread Wietse Venema
Michael Orlitzky: backup2 ~ # killall -9 /usr/lib64/postfix/master backup2 ~ # /etc/init.d/postfix start * WARNING: postfix has already been started That is a bug in an init script, and is the responsibility of the OS-specific maintainer. Postfix does not provide init/upstart/systemd

Re: [OT] Re: found a bug on postfix 2.9.1

2012-03-06 Thread Eray Aslan
On Tue, Mar 06, 2012 at 02:30:59PM -0500, Michael Orlitzky wrote: either. Right now the problem is easy to understand: half of the time on Gentoo, the startup OK is meaningless. Everyone knows this, and figures out how to deal with it quickly: backup2 ~ # /etc/init.d/postfix stop *

Re: [OT] Re: found a bug on postfix 2.9.1

2012-03-06 Thread Wietse Venema
Eray Aslan: On Tue, Mar 06, 2012 at 02:30:59PM -0500, Michael Orlitzky wrote: either. Right now the problem is easy to understand: half of the time on Gentoo, the startup OK is meaningless. Everyone knows this, and figures out how to deal with it quickly: backup2 ~ #

Re: [OT] Re: found a bug on postfix 2.9.1

2012-03-06 Thread Eray Aslan
On Tue, Mar 06, 2012 at 04:01:47PM -0500, Wietse Venema wrote: So you need a way for postfix start that returns status 0 if the master(8) daemon initalizes successfully, and non-zero otherwise. Correct. I think this can be done by starting the master as a foreground process. The foreground

Re: found a bug on postfix 2.9.1

2012-03-06 Thread Eliezer Croitoru
On 06/03/2012 21:10, Wietse Venema wrote: Eray Aslan: On Tue, Mar 06, 2012 at 11:48:35AM -0500, Wietse Venema wrote: I think that making everyone wait would be another example of well-meaning people doing things that give Postfix a bad reputation. postfix start exits successfully but postfix

Re: [OT] Re: found a bug on postfix 2.9.1

2012-03-06 Thread Eliezer Croitoru
to be checked using the postfix check method on terminal and not only on log. by writing the bug i do hope this simple guy that will look for the problem will understand what could he missed. Thanks, Eliezer So the benefit is not clear-cut.

Re: [OT] Re: found a bug on postfix 2.9.1

2012-03-06 Thread Wietse Venema
Eliezer Croitoru: i dont care about any init scripts on whatever else then when there is this specific problem of mismatching binding an ip that dosnt exist to be checked using the postfix check method on terminal and not only on log. Sorry, only the master daemon knows that it can't access

Re: found a bug on postfix 2.9.1

2012-03-06 Thread Eliezer Croitoru
will say that it is still running and the only way i managed to make postfix work is to fix the master.cf and rebooting the machine\os. You need to provide the proper information to debug a possible bug. Start here: http://www.postfix.com/DEBUG_README.html will do. i will try to be more accurate next

Re: [OT] Re: found a bug on postfix 2.9.1

2012-03-06 Thread Eliezer Croitoru
On 07/03/2012 02:33, Wietse Venema wrote: Eliezer Croitoru: i dont care about any init scripts on whatever else then when there is this specific problem of mismatching binding an ip that dosnt exist to be checked using the postfix check method on terminal and not only on log. Sorry, only the

Re: [OT] Re: found a bug on postfix 2.9.1

2012-03-06 Thread Viktor Dukhovni
On Tue, Mar 06, 2012 at 04:01:47PM -0500, Wietse Venema wrote: So you need a way for postfix start that returns status 0 if the master(8) daemon initalizes successfully, and non-zero otherwise. I think this can be done by starting the master as a foreground process. The foreground master

Re: milter adding header possible bug

2012-02-02 Thread Wietse Venema
copies of these header are added to message. Problem appears only for this two headers. Can this be a bug in Postfix (for example, something with substring search)? I don't have the input before it is modified, so I need a copy of the output after it is modified. Wietse Here is excerpt from

PATCH: milter adding header possible bug

2012-02-02 Thread Wietse Venema
of these header are added to message. Problem appears only for this two headers. Can this be a bug in Postfix (for example, something with substring search)? This was caused by a length check against the wrong string (the header name that was found, instead of the header name that was wanted). I

Documentation Bug

2011-10-13 Thread sven . kieske
Hello, I found a small bug in the online documentation on this page: http://www.postfix.org/postconf.5.html The option message_size_limit is described as: The maximal size in bytes of a message[..], This is wrong and should be: The maximal size in bits of a message[..]. Regards Sven

Re: Documentation Bug

2011-10-13 Thread Wietse Venema
sven.kie...@compact.de: Hello, I found a small bug in the online documentation on this page: http://www.postfix.org/postconf.5.html The option message_size_limit is described as: The maximal size in bytes of a message[..], The documentation is correct. As the documentation says

Re: Documentation Bug

2011-10-13 Thread sven . kieske
Am 13.10.2011 14:35, schrieb wie...@porcupine.org: sven.kie...@compact.de: Hello, I found a small bug in the online documentation on this page: http://www.postfix.org/postconf.5.html The option message_size_limit is described as: The maximal size in bytes of a message

Re: Documentation Bug

2011-10-13 Thread Wietse Venema
sven.kie...@compact.de: We clearly have set up a maximum message size limit of the latter (2.5 MiB). I don't get mail out of this system bigger than that. Prove it. Show some concrete evidence. Without that, no-one can tell you what mistake you are making. As per the mailing list welcome

Re: Documentation Bug

2011-10-13 Thread Reindl Harald
Am 13.10.2011 17:00, schrieb sven.kie...@compact.de: Maybe I don't get it, or you use different representations of what is an byte or KB instead of KiB? If I'm seeing something wrong please point me to my failure. :-) you are missing the fact that e-mail is a text-only protocol and so

Re: Documentation Bug

2011-10-13 Thread Stefan Palme
On Thu, 2011-10-13 at 17:11 +0200, Reindl Harald wrote: ... depending on the attachment the overhead can be very different Base64 always encodes 3 original bytes into 4 base64-bytes, so the factor to calculate the effective size for an attachment in an email is always 4/3*original_size. Of

Re: Documentation Bug

2011-10-13 Thread Wietse Venema
Stefan Palme: On Thu, 2011-10-13 at 17:11 +0200, Reindl Harald wrote: ... depending on the attachment the overhead can be very different Base64 always encodes 3 original bytes into 4 base64-bytes, so the factor to calculate the effective size for an attachment in an email is always

Re: Documentation Bug

2011-10-13 Thread Charles Marcus
On 2011-10-13 11:00 AM, sven.kie...@compact.de sven.kie...@compact.de wrote: Maybe I don't get it, or you use different representations of what is an byte or KB instead of KiB? If I'm seeing something wrong please point me to my failure. :-) Or maybe you failed to read the welcome message when

Postfix Bug, virtual transport

2011-07-29 Thread kianoush
Hello, if you put this in file: virtual (used for virtual transport) ___ t...@example.com t...@example.com, i...@example.com ___ And you have Both Virtual Mailboxes:

Re: Postfix Bug, virtual transport

2011-07-29 Thread Wietse Venema
kianoush: [ Charset ISO-8859-1 unsupported, converting... ] Hello, if you put this in file: virtual (used for virtual transport) ___ t...@example.com t...@example.com, i...@example.com

reject_unauth_pipelining not working as I'd expect (bug?)

2011-07-07 Thread ricardus1867
Hi! While crawling trough my logs, I've noticed a couple of bots getting rejected because of Improper use of SMTP command pipelining because of the reject_unauth_pipelining in smptd_recipient_restrictions. So I decided to give the old sleep trick a try. Only for unknown hosts, ofc... The

Re: reject_unauth_pipelining not working as I'd expect (bug?)

2011-07-07 Thread Noel Jones
On 7/7/2011 11:20 PM, ricardus1867 wrote: Hi! While crawling trough my logs, I've noticed a couple of bots getting rejected because of Improper use of SMTP command pipelining because of the reject_unauth_pipelining in smptd_recipient_restrictions. So I decided to give the old sleep trick

Re: reject_unauth_pipelining not working as I'd expect (bug?)

2011-07-07 Thread ricardus1867
On 7/7/2011 11:20 PM, ricardus1867 wrote: While crawling trough my logs, I've noticed a couple of bots getting rejected because of Improper use of SMTP command pipelining because of the reject_unauth_pipelining in smptd_recipient_restrictions. So I decided to give the old sleep trick

Re: Postfix STARTTLS bug on SLES11 SP1 still unfixed ? (solved !)

2011-04-26 Thread Alexander Grüner
Hi, just for info, it has been fixed on saturday. postconf | grep mail_ver mail_version = 2.5.6 rpm -qa | grep postfix postfix-2.5.6-5.6.1 Nessus scan is fine. Best regards, Alexander

Postfix STARTTLS bug on SLES11 SP1 still unfixed ?

2011-04-15 Thread Alexander Grüner
Hello, I am running SLES 11 SP1 (SuSE Linux Enterprise Server). After all patches are applied from standard update Novell sources it seems to me that STARTTLS bug is still unfixed. postconf | grep mail_version mail_version = 2.5.6 rpm -qa | grep postfix postfix-devel-2.5.6-5.4.21 postfix

Re: Postfix STARTTLS bug on SLES11 SP1 still unfixed ?

2011-04-15 Thread Victor Duchovni
On Fri, Apr 15, 2011 at 08:57:19AM +0200, Alexander Gr?ner wrote: I am running SLES 11 SP1 (SuSE Linux Enterprise Server). After all patches are applied from standard update Novell sources it seems to me that STARTTLS bug is still unfixed. mail_version = 2.5.6 Unless they (SuSE

Re: Postfix STARTTLS bug on SLES11 SP1 still unfixed ?

2011-04-15 Thread Alexander Grüner
The right forum is a SuSE support forum. Ok, I will go there. Your server needs to be patched if either: - remote sites verify your certificate when sending email over TLS. This is the case on my server. Thanks for the answer anyway :-) Best regards, Alexander

Re: Postfix STARTTLS bug on SLES11 SP1 still unfixed ?

2011-04-15 Thread lst_hoe02
Zitat von Victor Duchovni victor.ducho...@morganstanley.com: On Fri, Apr 15, 2011 at 08:57:19AM +0200, Alexander Gr?ner wrote: I am running SLES 11 SP1 (SuSE Linux Enterprise Server). After all patches are applied from standard update Novell sources it seems to me that STARTTLS bug is still

Re: Postfix STARTTLS bug on SLES11 SP1 still unfixed ?

2011-04-15 Thread Victor Duchovni
On Fri, Apr 15, 2011 at 12:31:18PM +0200, lst_ho...@kwsoft.de wrote: This is the recommended submission setup and the most common MUAs (Thunderbird, Outlook, Evolution etc.) will not ignore certificate verification failures, no? So every public submission service correctly setup is

Re: Postfix STARTTLS bug on SLES11 SP1 still unfixed ?

2011-04-15 Thread Alexander Grüner
Hi, just learned about http://support.novell.com/security/cve/ and especially http://support.novell.com/security/cve/CVE-2011-0411.html. Just for future requests... Answer from Novell The updates for this issue are in QA and will be released to the update channels in the next week. Fine.

Re: Postfix STARTTLS bug on SLES11 SP1 still unfixed ?

2011-04-15 Thread Victor Duchovni
On Fri, Apr 15, 2011 at 01:56:05PM +0200, Alexander Gr?ner wrote: Hi, just learned about http://support.novell.com/security/cve/ and especially http://support.novell.com/security/cve/CVE-2011-0411.html. Just for future requests... Answer from Novell The updates for this issue are in QA

Re: Postfix STARTTLS bug on SLES11 SP1 still unfixed ?

2011-04-15 Thread Joe
On 04/15/2011 01:58 AM, Alexander Grüner wrote: The right forum is a SuSE support forum. Ok, I will go there. The postfix shipped in SLES is usually a bit stale anyway. I typically grab a postfix source rpm from suse factory and rebuild it on SLES. Here are some newish packages

Message id not encircled with '' and ''. Bug in postfix logs?

2011-04-11 Thread Javier Amor Garcia
will show them just straight from the mail.log file: mail.log.2:940:Mar 20 18:00:52 kif postfix/cleanup[15700]: 0097C3D8F3: message-id=5eade3eb1528ac2f59104cba582ef5e9 mail.log.2:41222:Mar 24 12:49:45 kif postfix/cleanup[808]: EFA813D790: message-id=468a9c3f8b21b9d8fe7af2181f4ddd99 This is a bug

Re: Message id not encircled with '' and ''. Bug in postfix logs?

2011-04-11 Thread Victor Duchovni
]: EFA813D790: message-id=468a9c3f8b21b9d8fe7af2181f4ddd99 This is a bug? Postfix logs the content of the message-id header. Some messages are more equal than others. -- Viktor.

Re: Message id not encircled with '' and ''. Bug in postfix logs?

2011-04-11 Thread lst_hoe02
.2:41222:Mar 24 12:49:45 kif postfix/cleanup[808]: EFA813D790: message-id=468a9c3f8b21b9d8fe7af2181f4ddd99 This is a bug? Postfix logs the content of the message-id header. Some messages are more equal than others. So it is a case of shit in, shit out?? Regards Andreas smime.p7s

Re: Message id not encircled with '' and ''. Bug in postfix logs?

2011-04-11 Thread Victor Duchovni
On Mon, Apr 11, 2011 at 05:34:46PM +0200, lst_ho...@kwsoft.de wrote: Postfix logs the content of the message-id header. Some messages are more equal than others. So it is a case of shit in, shit out?? Postfix logs the content of the Message-Id header as received. To determine whether a

Re: Message id not encircled with '' and ''. Bug in postfix logs?

2011-04-11 Thread Javier Amor Garcia
Thanks for the answer. Things are clearer now. message-id=468a9c3f8b21b9d8fe7af2181f4ddd99 This is a bug? Postfix logs the content of the message-id header. Some messages are more equal than others.

Error: close database /var/lib/postfix/postscreen_cache.db: No such file or directory (possible Berkeley DB bug)

2011-03-10 Thread Mark Alan
11:02:24 mx postfix/postscreen[9697]: cache /var/lib/postfix/postscreen_cache.db full cleanup: retained=0 dropped=0 entries Mar 10 11:04:26 mx postfix/postscreen[9697]: close database /var/lib/postfix/postscreen_cache.db: No such file or directory (possible Berkeley DB bug) Mar 10 11:12:08 mx

Re: Error: close database /var/lib/postfix/postscreen_cache.db: No such file or directory (possible Berkeley DB bug)

2011-03-10 Thread Noel Jones
On 3/10/2011 6:58 AM, Mark Alan wrote: While using Postfix 2.8.1 + Ubuntu 10.10, after enabling postscreen the system seems to be working well (sends and receives email without any apparent problems) but has sporadic errors as shown bellow (without any other errors or warnings). This has been

Re: STARTTLS bug - background story

2011-03-08 Thread Stan Hoeppner
Wietse Venema put forth on 3/7/2011 2:08 PM: CERT/CC announces a flaw today in multiple STARTTLS implementations. This problem was silently fixed in Postfix 2.8 and 2.9. Updates for Postfix 2.[4-7] are made available via the usual channels. Nice catch Wietse! Normally I'd follow that with

Re: STARTTLS bug -- [Zimbra]

2011-03-08 Thread Walter Smith
Hi there!   How severe this bug is?   I'm running few Zimbra servers and seems like it's there:     % telnet 0 25 220 myzimbra ESMTP Postfix starttls 220 2.0.0 Ready to start TLS   % telnet 0 587 220 myzimbra ESMTP Postfix starttls 220 2.0.0 Ready to start TLS     Should I disable it for now

Re: STARTTLS bug -- [Zimbra]

2011-03-08 Thread Wietse Venema
Walter Smith: Hi there! ? How severe this bug is? Please read the announcement, section overview and impact. http://www.postfix.org/CVE-2011-0411.html This is not as big a problem as it may appear to be. The reason is that many SMTP client applications don't verify server TLS certificates

Re: STARTTLS bug -- [Zimbra]

2011-03-08 Thread Quanah Gibson-Mount
--On March 8, 2011 10:20:21 AM -0800 Walter Smith whatis...@yahoo.com wrote: Hi there! How severe this bug is? The CVE gave it 1.39 out of a possible 180 points. Or 2%. It will of course be addressed in a later Zimbra release. --Quanah -- Quanah Gibson-Mount Principal Software

Re: STARTTLS bug -- [Zimbra]

2011-03-08 Thread Victor Duchovni
On Tue, Mar 08, 2011 at 06:26:47PM -0800, Quanah Gibson-Mount wrote: --On March 8, 2011 10:20:21 AM -0800 Walter Smith whatis...@yahoo.com wrote: Hi there! How severe this bug is? The CVE gave it 1.39 out of a possible 180 points. Or 2%. It will of course be addressed in a later

STARTTLS bug - background story

2011-03-07 Thread Wietse Venema
CERT/CC announces a flaw today in multiple STARTTLS implementations. This problem was silently fixed in Postfix 2.8 and 2.9. Updates for Postfix 2.[4-7] are made available via the usual channels. Wietse Plaintext injection in multiple implementations of STARTTLS

Re: STARTTLS bug - background story

2011-03-07 Thread Brad Hards
On Tue, 8 Mar 2011 07:08:09 am Wietse Venema wrote: This is a writeup about a flaw that I found recently, and that existed in multiple implementations of SMTP (Simple Mail Transfer Protocol) over TLS (Transport Layer Security) including my Postfix open source mailserver. I give an overview of

Re: STARTTLS bug - background story

2011-03-07 Thread Victor Duchovni
On Tue, Mar 08, 2011 at 12:59:15PM +1100, Brad Hards wrote: On Tue, 8 Mar 2011 07:08:09 am Wietse Venema wrote: This is a writeup about a flaw that I found recently, and that existed in multiple implementations of SMTP (Simple Mail Transfer Protocol) over TLS (Transport Layer Security)

Little bug (and resolution) in postfix-install

2011-03-04 Thread Matthieu Ambrosy
Hello all, if you specify a non default config_directory variable when using postfix-install script, you'll have this error : postfix: fatal: open /etc/postfix/main.cf: No such file or directory To solve it, in the last line of postfix-install, replace : bin/postfix post-install

Re: Little bug (and resolution) in postfix-install

2011-03-04 Thread Wietse Venema
Matthieu Ambrosy: Hello all, if you specify a non default config_directory variable when using postfix-install script, you'll have this error : postfix: fatal: open /etc/postfix/main.cf: No such file or directory This is not supported. It breaks local submission via /usr/sbin/sendmail,

Re: Little bug (and resolution) in postfix-install

2011-03-04 Thread Matthieu Ambrosy
Yeah, sendmail doesnt work anymore with other main.cf location, I noticed that so I have removed the config_directory variable. Thanks for the DEF_CONFIG_DIR tip. Regards, Matthieu. 2011/3/4 Wietse Venema wie...@porcupine.org Matthieu Ambrosy: Hello all, if you specify a non default

Bug when sending to invalid addess extension?

2011-02-14 Thread Matt Holgate
Hi, Not sure if this is a bug or not, but thought I'd mention it, as I noticed it recently when investigating an intrusion attempt (it was an attempt to exploit this vulnerability in spamassassin-milter: http://archives.neohapsis.com/archives/fulldisclosure/2010-03/0139.html) I have root

Re: Bug when sending to invalid addess extension?

2011-02-14 Thread Wietse Venema
Already fixed early 2010. You need to upgrade to Postfix 2.8 or later. I don't know if this will be back-ported to earlier releases. Wietse 20100422 Workaround (introduced: postfix-19990906 a.k.a. Postfix 0.8.0). The Postfix local delivery agent did not properly

Re: serious bug with check_client_access

2010-11-06 Thread mouss
Le 05/11/2010 10:03, Vincent Lefevre a écrit : [hash/cdb/...] - if parent_domain_matches_subdomains contains smtpd_access: here, the search list is S = ( lab1.lab2.lab3.example.com, lab2.lab3.example.com, lab3.example.com ..., com, 1.2.3.4, 1.2.3, 1.2, 1 ) so postfix will search for each

Re: serious bug with check_client_access

2010-11-06 Thread mouss
Le 05/11/2010 09:48, Vincent Lefevre a écrit : On 2010-11-04 23:36:04 -0300, Reinaldo de Carvalho wrote: On Thu, Nov 4, 2010 at 11:13 PM, Vincent Lefevrevinc...@vinc17.net wrote: Yes, it will generate *some* lookups, but it doesn't say exactly *which* lookups. That was precisely my question.

Re: serious bug with check_client_access

2010-11-05 Thread Vincent Lefevre
On 2010-11-04 23:36:04 -0300, Reinaldo de Carvalho wrote: On Thu, Nov 4, 2010 at 11:13 PM, Vincent Lefevre vinc...@vinc17.net wrote: Yes, it will generate *some* lookups, but it doesn't say exactly *which* lookups. That was precisely my question. - client hostname (reverse dns hostname) -

Re: serious bug with check_client_access

2010-11-05 Thread Vincent Lefevre
On 2010-11-05 06:21:20 +0100, mouss wrote: in short, for each map, you have multiple parameters: - the map type - the search context (check_client_access, check_sender_acces, ... transport, virtual_alias_maps, ... etc) - the list of search keys [...] Thanks a lot for this very detailed

Re: serious bug with check_client_access

2010-11-05 Thread Stan Hoeppner
Vincent Lefevre put forth on 11/5/2010 4:03 AM: Testing the tld alone seems to be excluded by the access(5) man page, which only documents domain.tld, i.e. the pattern must contain at least one dot. Is it an error in the man page (which could say domain instead, like in Section Email address

Re: serious bug with check_client_access

2010-11-04 Thread Покотиленко Костик
those two notation forms differ and why author has written one idea in two sentences. Check your English ;) And next time behavior doesn't match your expectations, you might get more sympathy if your message starts with please clarify this for me rather than serious bug. If behavior doesn't

Re: serious bug with check_client_access

2010-11-04 Thread Emmanuel Fusté
Le 04/11/2010 05:24, Noel Jones a écrit : On 11/3/2010 11:07 PM, Vincent Lefevre wrote: BTW, so, there is no way to match only subdomains (by that, I mean all possible subdomains, but not the domain itself) without changing parent_domain_matches_subdomains? That's correct with indexed tables.

Re: serious bug with check_client_access

2010-11-04 Thread lst_hoe02
on the value of parent_domain_matches_subdomains Otherwise is clearly related to the last part of the previous statement. If it is unclear, ask for clarification. Crying loud serious bug because your language interpretation is different from others is not helpful at all. Regards Andreas

Re: serious bug with check_client_access

2010-11-04 Thread Покотиленко Костик
, and not in case they think they unsterstand. Also, it's completelly unstated that .domain.tld notation doesn't work if smtpd_access_maps is listed in parent_domain_matches_subdomains. Crying loud serious bug because your language interpretation is different from others is not helpful at all

Re: serious bug with check_client_access

2010-11-04 Thread Vincent Lefevre
configuration setting. What the man page says in THIS case is: The pattern domain.tld also matches subdomains where the pattern domain.tld can be .twitter.com for instance. I don't think there is anything wrong with my reasoning. If it is unclear, ask for clarification. Crying loud serious bug

Documentation (was: serious bug with check_client_access)

2010-11-04 Thread Wietse Venema
Vincent Lefevre: On 2010-11-04 10:44:34 +0100, lst_ho...@kwsoft.de wrote: The access(5) man page says: domain.tld Matches domain.tld. The pattern domain.tld also matches subdomains, but only when the string smtpd_access_maps is listed in

Re: Documentation (was: serious bug with check_client_access)

2010-11-04 Thread /dev/rob0
On Thu, Nov 04, 2010 at 10:56:57AM -0400, Wietse Venema wrote: Vincent Lefevre: On 2010-11-04 10:44:34 +0100, lst_ho...@kwsoft.de wrote: The access(5) man page says: domain.tld Matches domain.tld. The pattern domain.tld also matches subdomains,

Re: Documentation (was: serious bug with check_client_access)

2010-11-04 Thread Vincent Lefevre
On 2010-11-04 10:28:00 -0500, /dev/rob0 wrote: On Thu, Nov 04, 2010 at 10:56:57AM -0400, Wietse Venema wrote: I can replace that Otherwise... sentence by a separate list item. domain.tld Matches domain.tld. The pattern domain.tld also matches

Re: serious bug with check_client_access

2010-11-04 Thread mouss
Le 04/11/2010 05:07, Vincent Lefevre a écrit : On 2010-11-03 22:55:59 -0500, Noel Jones wrote: I'm so sorry you lost your twitter post. Actually I might have lost other mail (though this is a bit unlikely) since I was generally using an initial dot. a good idea is to include both dotted and

THREAD KILLED: Documentation (was: serious bug with check_client_access)

2010-11-04 Thread Victor Duchovni
On Thu, Nov 04, 2010 at 05:02:25PM +0100, Vincent Lefevre wrote: I still think that it's a bit ambiguous, because I was seeing .domain.tld as a subcase of domain.tld This objection is spurious, and constitutes trolling. Please do not feed the trolls. For the record, elementary logic: If

Re: serious bug with check_client_access

2010-11-04 Thread Vincent Lefevre
On 2010-11-04 17:18:17 +0100, mouss wrote: otherwise, you can do whatever you want with pcre: /\.example\.com$/OK or with sql or ldap. For pcre, the man page is not clear. It says: Each pattern is a regular expression that is applied to the entire string being looked up.

Re: serious bug with check_client_access

2010-11-04 Thread Stan Hoeppner
Vincent Lefevre put forth on 11/4/2010 6:04 PM: On 2010-11-04 17:18:17 +0100, mouss wrote: otherwise, you can do whatever you want with pcre: /\.example\.com$/OK or with sql or ldap. For pcre, the man page is not clear. It says: Each pattern is a regular expression that is

Re: serious bug with check_client_access

2010-11-04 Thread Vincent Lefevre
On 2010-11-04 19:06:57 -0500, Stan Hoeppner wrote: check_client_access pcre:/etc/postfix/filter.pcre check_sender_access pcre:/etc/postfix/filter.pcre check_recipient_accesspcre:/etc/postfix/filter.pcre As you can see, this is defined by the smtpd_foo_restriction you target the

Re: serious bug with check_client_access

2010-11-04 Thread Wietse Venema
Vincent Lefevre: On 2010-11-04 19:06:57 -0500, Stan Hoeppner wrote: check_client_access pcre:/etc/postfix/filter.pcre check_sender_access pcre:/etc/postfix/filter.pcre check_recipient_access pcre:/etc/postfix/filter.pcre As you can see, this is defined by the smtpd_foo_restriction

Re: serious bug with check_client_access

2010-11-04 Thread Jeroen Geilman
On 11/05/2010 01:26 AM, Vincent Lefevre wrote: On 2010-11-04 19:06:57 -0500, Stan Hoeppner wrote: check_client_access pcre:/etc/postfix/filter.pcre check_sender_access pcre:/etc/postfix/filter.pcre check_recipient_access pcre:/etc/postfix/filter.pcre As you can see, this is

Re: serious bug with check_client_access

2010-11-04 Thread Vincent Lefevre
On 2010-11-04 20:33:11 -0400, Wietse Venema wrote: check_client_access searches the address and domain with ALL lookup table types. It just doesn't do the substring lookups with PCRE, REGEXP and CIDR. If I understand correctly, there's another difference: in the default table format, the

Re: serious bug with check_client_access

2010-11-04 Thread Vincent Lefevre
On 2010-11-05 01:38:37 +0100, Jeroen Geilman wrote: *REGULAR EXPRESSION TABLES* This section describes how the table lookups change when the table is given in the form of regular expressions. For a description of regular expression lookup table syntax,

Re: serious bug with check_client_access

2010-11-04 Thread Jeroen Geilman
On 11/05/2010 01:57 AM, Vincent Lefevre wrote: On 2010-11-05 01:38:37 +0100, Jeroen Geilman wrote: *REGULAR EXPRESSION TABLES* This section describes how the table lookups change when the table is given in the form of regular expressions. For a description of

Re: serious bug with check_client_access

2010-11-04 Thread Vincent Lefevre
On 2010-11-05 02:29:53 +0100, Jeroen Geilman wrote: If you combine Each pattern is a regular expression that is applied to the entire string being looked up. with * check_client_access /type:table http://www.postfix.org/DATABASE_README.html/* Search the specified access

Re: serious bug with check_client_access

2010-11-04 Thread Reinaldo de Carvalho
On Thu, Nov 4, 2010 at 10:42 PM, Reinaldo de Carvalho reinal...@gmail.com wrote: check_client_access type:table    Search the specified access database for the client hostname, parent domains, client IP address, or networks obtained by stripping least significant octets. See the access(5)

<    1   2   3   4   >