Ongoing trusted_networks confusion

2006-12-18 Thread Bart Schaefer
Maybe the name of that config option should be changed to "truthful_networks".

Re: trusted_networks confusion--simple case

2006-07-03 Thread Ross Boylan
On Sat, 2006-07-01 at 03:55 -0400, Daryl C. W. O'Shea wrote: ... > > Hopefully I've clarified any remaining questions about this. If I > haven't maybe Matt, Bowie, Kelson or someone else will take a whack at > it. I'm four hours into a public holiday so I now get to bill you twice > as much!

Re: [OT} silliness wasRe: trusted_networks confusion--simple case

2006-07-02 Thread Daryl C. W. O'Shea
jdow wrote: Is there a local workaholics annonymous branch near you? Oh I'm sure not to be anonymous about it. I guess one upside to insomnia is that I don't spend time working that could be better spent sleeping.

[OT} silliness wasRe: trusted_networks confusion--simple case

2006-07-01 Thread jdow
From: "Daryl C. W. O'Shea" <[EMAIL PROTECTED]> ... Hopefully I've clarified any remaining questions about this. If I haven't maybe Matt, Bowie, Kelson or someone else will take a whack at it. I'm four hours into a public holiday so I now get to bill you twice as much! Is there a local work

Re: trusted_networks confusion--simple case

2006-07-01 Thread Daryl C. W. O'Shea
On 6/30/2006 10:19 PM, Ross Boylan wrote: On Fri, 2006-06-30 at 18:00 -0400, Daryl C. W. O'Shea wrote: Ross Boylan wrote: Well, I've obviously missed something. In this message I will focus exclusively on the question of whether a host that receives messages from dial-up hosts should go on

Re: trusted_networks confusion--authentication

2006-07-01 Thread Daryl C. W. O'Shea
On 6/30/2006 10:46 PM, Ross Boylan wrote: Now for the "3 tests" as they apply to my non-hypothetical case. On Wed, 2006-06-28 at 01:45 -0400, Daryl C. W. O'Shea wrote: You can not add your MSA to your internal_networks unless you can do one of the following: - have all your MSA users use SM

Re: trusted_networks confusion--simple case (clarification)

2006-06-30 Thread Daryl C. W. O'Shea
On 6/30/2006 11:08 PM, Ross Boylan wrote: To clear up an ambiguity in my original: On Fri, 2006-06-30 at 19:19 -0700, Ross Boylan wrote: Does a machine that is not part of my domain qualify as a client? Suppose my MTA is contacted by a dial-up IP for somewhere.com (not my domain), and that I do

Re: trusted_networks confusion--simple case (clarification)

2006-06-30 Thread Ross Boylan
To clear up an ambiguity in my original: On Fri, 2006-06-30 at 19:19 -0700, Ross Boylan wrote: > Does a machine that is not part of my domain qualify as a client? > Suppose my MTA is contacted by a dial-up IP for somewhere.com (not my > domain), and that I do want to accept such mail. The human c

Re: trusted_networks confusion--authentication

2006-06-30 Thread Ross Boylan
Now for the "3 tests" as they apply to my non-hypothetical case. On Wed, 2006-06-28 at 01:45 -0400, Daryl C. W. O'Shea wrote: [..] > Mail Submission Agent... accepts mail from your own clients' MUAs (also > known as UAs). > > > >> You can not add your MSA to your internal_networks unless you can

Re: trusted_networks confusion--simple case

2006-06-30 Thread Ross Boylan
On Fri, 2006-06-30 at 18:00 -0400, Daryl C. W. O'Shea wrote: > I'm going to skip to the end pretty quick... where I tell you exactly > the config YOU need (except I don't know your IPs, so you'll have to > fill that in). My setup is a bit more complex than the one described here; I said "assume f

Re: trusted_networks confusion

2006-06-30 Thread jdow
From: "Daryl C. W. O'Shea" <[EMAIL PROTECTED]> This inspired me to make a brute force test. Something has changed in the machine's configuration that allows me to remove all references to internal or trusted networks and still run without ALL_TRUSTED coming up and bugging me. Maybe those entrie

Re: trusted_networks confusion

2006-06-30 Thread Daryl C. W. O'Shea
jdow wrote: From: "Daryl C. W. O'Shea" <[EMAIL PROTECTED]> jdow wrote: From: "Daryl C. W. O'Shea" <[EMAIL PROTECTED]> jdow wrote: From: "Daryl C. W. O'Shea" <[EMAIL PROTECTED]> The Earthlink mail servers are ABSODAMNLUTELY not part of my internal network. But if I do not list them with tr

Re: trusted_networks confusion

2006-06-30 Thread Daryl C. W. O'Shea
I'm going to skip to the end pretty quick... where I tell you exactly the config YOU need (except I don't know your IPs, so you'll have to fill that in). Ross Boylan wrote: Well, I've obviously missed something. In this message I will focus exclusively on the question of whether a host that r

Re: trusted_networks confusion

2006-06-30 Thread Daryl C. W. O'Shea
Ben Wylie wrote: No. Internal only if it's not directly accepting mail from client IPs that you WANT to accept mail from. MXes and everything (internal relays) after them are ALWAYS in both trusted and internal networks. > > This is what tells SA that mail was sent directly from "questionab

Re: trusted_networks confusion

2006-06-30 Thread Ross Boylan
Well, I've obviously missed something. In this message I will focus exclusively on the question of whether a host that receives messages from dial-up hosts should go on internal_networks. Assume for simplicity I have a mail domain b.c. The MX records point to a.b.c. I'm running SA on a.b.c for m

Re: trusted_networks confusion

2006-06-30 Thread Ben Wylie
No. Internal only if it's not directly accepting mail from client IPs that you WANT to accept mail from. MXes and everything (internal relays) after them are ALWAYS in both trusted and internal networks. > > This is what tells SA that mail was sent directly from "questionable > IPs" to your sy

Re: trusted_networks confusion

2006-06-29 Thread jdow
From: "Daryl C. W. O'Shea" <[EMAIL PROTECTED]> jdow wrote: From: "Daryl C. W. O'Shea" <[EMAIL PROTECTED]> Bart Schaefer wrote: On 6/29/06, Daryl C. W. O'Shea <[EMAIL PROTECTED]> wrote: EVERYTHING after an MX MUST be listed as BOTH trusted and internal networks. Under what circumstances w

Re: trusted_networks confusion

2006-06-29 Thread Daryl C. W. O'Shea
jdow wrote: From: "Daryl C. W. O'Shea" <[EMAIL PROTECTED]> jdow wrote: From: "Bart Schaefer" <[EMAIL PROTECTED]> On 6/29/06, Daryl C. W. O'Shea <[EMAIL PROTECTED]> wrote: EVERYTHING after an MX MUST be listed as BOTH trusted and internal networks. Under what circumstances would one list

Re: trusted_networks confusion

2006-06-29 Thread jdow
From: "Daryl C. W. O'Shea" <[EMAIL PROTECTED]> jdow wrote: From: "Bart Schaefer" <[EMAIL PROTECTED]> On 6/29/06, Daryl C. W. O'Shea <[EMAIL PROTECTED]> wrote: EVERYTHING after an MX MUST be listed as BOTH trusted and internal networks. Under what circumstances would one list something as

Re: trusted_networks confusion

2006-06-29 Thread Daryl C. W. O'Shea
jdow wrote: From: "Daryl C. W. O'Shea" <[EMAIL PROTECTED]> Bart Schaefer wrote: On 6/29/06, Daryl C. W. O'Shea <[EMAIL PROTECTED]> wrote: EVERYTHING after an MX MUST be listed as BOTH trusted and internal networks. Under what circumstances would one list something as internal but not trus

Re: trusted_networks confusion

2006-06-29 Thread Daryl C. W. O'Shea
jdow wrote: From: "Bart Schaefer" <[EMAIL PROTECTED]> On 6/29/06, Daryl C. W. O'Shea <[EMAIL PROTECTED]> wrote: EVERYTHING after an MX MUST be listed as BOTH trusted and internal networks. Under what circumstances would one list something as internal but not trusted? One example is when

Re: trusted_networks confusion

2006-06-29 Thread jdow
From: "John D. Hardin" <[EMAIL PROTECTED]> On Thu, 29 Jun 2006, Daryl C. W. O'Shea wrote: Bart Schaefer wrote: > > Under what circumstances would one list something as internal but not > trusted? NEVER. Newer versions of SA won't even allow you to make that misconfiguration. What, you

Re: trusted_networks confusion

2006-06-29 Thread jdow
From: "Daryl C. W. O'Shea" <[EMAIL PROTECTED]> Bart Schaefer wrote: On 6/29/06, Daryl C. W. O'Shea <[EMAIL PROTECTED]> wrote: EVERYTHING after an MX MUST be listed as BOTH trusted and internal networks. Under what circumstances would one list something as internal but not trusted? NEVER.

Re: trusted_networks confusion

2006-06-29 Thread jdow
From: "Bart Schaefer" <[EMAIL PROTECTED]> On 6/29/06, Daryl C. W. O'Shea <[EMAIL PROTECTED]> wrote: EVERYTHING after an MX MUST be listed as BOTH trusted and internal networks. Under what circumstances would one list something as internal but not trusted? One example is when you are using

Re: trusted_networks confusion

2006-06-29 Thread jdow
From: "Daryl C. W. O'Shea" <[EMAIL PROTECTED]> Ross Boylan wrote: ... Maybe it will help to be concrete. I'll use made up names to foil spambots: People send me mail at [EMAIL PROTECTED] b.edu has an MX record. I use fetchmail to pull my mail off a.b.edu, the actual host machine the MX re

Re: trusted_networks confusion

2006-06-29 Thread John D. Hardin
On Thu, 29 Jun 2006, Daryl C. W. O'Shea wrote: > Bart Schaefer wrote: > > > > Under what circumstances would one list something as internal but not > > trusted? > > NEVER. Newer versions of SA won't even allow you to make that > misconfiguration. What, you *trust* all your users? :) -- Joh

Re: trusted_networks confusion

2006-06-29 Thread Daryl C. W. O'Shea
Bart Schaefer wrote: On 6/29/06, Daryl C. W. O'Shea <[EMAIL PROTECTED]> wrote: Bart Schaefer wrote: > > Under what circumstances would one list something as internal but not > trusted? NEVER. Newer versions of SA won't even allow you to make that misconfiguration. Ah, good. That's as I expe

Re: trusted_networks confusion

2006-06-29 Thread Bart Schaefer
On 6/29/06, Daryl C. W. O'Shea <[EMAIL PROTECTED]> wrote: Bart Schaefer wrote: > > Under what circumstances would one list something as internal but not > trusted? NEVER. Newer versions of SA won't even allow you to make that misconfiguration. Ah, good. That's as I expected. (So why doesn't

Re: trusted_networks confusion

2006-06-29 Thread Daryl C. W. O'Shea
Bart Schaefer wrote: On 6/29/06, Daryl C. W. O'Shea <[EMAIL PROTECTED]> wrote: EVERYTHING after an MX MUST be listed as BOTH trusted and internal networks. Under what circumstances would one list something as internal but not trusted? NEVER. Newer versions of SA won't even allow you to ma

Re: trusted_networks confusion

2006-06-29 Thread Bart Schaefer
On 6/29/06, Daryl C. W. O'Shea <[EMAIL PROTECTED]> wrote: EVERYTHING after an MX MUST be listed as BOTH trusted and internal networks. Under what circumstances would one list something as internal but not trusted?

Re: trusted_networks confusion

2006-06-29 Thread Daryl C. W. O'Shea
Ross Boylan wrote: On Wed, Jun 28, 2006 at 01:45:52AM -0400, Daryl C. W. O'Shea wrote: Ross Boylan wrote: For 99% of systems there's no need to worry about listing systems that aren't a part of your mail network in your trusted_networks (and never list them in your internal_networks). Keep

Re: trusted_networks confusion

2006-06-27 Thread Daryl C. W. O'Shea
Nothing trimmed in an attempt to keep things somewhat coherent... Ross Boylan wrote: Thank you for your very clear answers. I have a few follow-up questions below. On Fri, 2006-06-23 at 23:44 -0400, Daryl C. W. O'Shea wrote: On 6/21/2006 4:39 PM, Ross Boylan wrote: After reading the Mail::Sp

Re: trusted_networks confusion

2006-06-27 Thread Ross Boylan
Thank you for your very clear answers. I have a few follow-up questions below. On Fri, 2006-06-23 at 23:44 -0400, Daryl C. W. O'Shea wrote: > On 6/21/2006 4:39 PM, Ross Boylan wrote: > > After reading the Mail::SpamAssassin::Conf (spamassassin 3.1.3-1 on > > Debian) I was unclear about trusted vs

Re: trusted_networks confusion

2006-06-23 Thread Daryl C. W. O'Shea
On 6/21/2006 4:39 PM, Ross Boylan wrote: After reading the Mail::SpamAssassin::Conf (spamassassin 3.1.3-1 on Debian) I was unclear about trusted vs internal networks. After reviewing previous emails on this list, here's what I think it is: trusted_networks for hosts I trust to put good info in t

trusted_networks confusion

2006-06-21 Thread Ross Boylan
After reading the Mail::SpamAssassin::Conf (spamassassin 3.1.3-1 on Debian) I was unclear about trusted vs internal networks. After reviewing previous emails on this list, here's what I think it is: trusted_networks for hosts I trust to put good info in the Received headers. internal_networks for