Re: Convert all envelope ids to lowercase

2013-11-07 Thread Ansgar Wiechers
On 2013-11-07 Ram wrote: Is there a simple way I can configure postfix to convert all Envelope From and To addresses to lowercase, before delivery I believe postfix internally converts all ids to-lowercase while doing hash map lookups I need this because that will save all unnecessary

Re: Convert all envelope ids to lowercase

2013-11-07 Thread li...@rhsoft.net
Am 07.11.2013 11:32, schrieb Ansgar Wiechers: On 2013-11-07 Ram wrote: Is there a simple way I can configure postfix to convert all Envelope From and To addresses to lowercase, before delivery I believe postfix internally converts all ids to-lowercase while doing hash map lookups I need

postfix 2.7.1 debian - does not query DNS

2013-11-07 Thread Simon Loewenthal
Hi, I have a postfix instance on Debian 6 that has never performed DNS lookups with version number 2.7.1-1+squeeze1. The mail.log lists all connections like Nov 6 17:40:54 lo postfix/smtpd[10283]: 4AD4292: client=unknown[82.2.1.3], sasl_method=PLAIN, sasl_username=exam...@example.com Nov

Re: force startssl/tls/ssl on sasl login

2013-11-07 Thread Manuel Bieling
On 2013.11.07 08:38:36 +0100, nik600 wrote: reading your answer i've understand that the service on 465 is already configured to force encryption, but i can't to that on port 25 because this port is used also for standard delivery from other mailserver which is not encrypted. '-o

Re: postfix 2.7.1 debian - does not query DNS

2013-11-07 Thread DTNX Postmaster
On 07 Nov 2013, at 12:19, Simon Loewenthal si...@klunky.co.uk wrote: I have a postfix instance on Debian 6 that has never performed DNS lookups with version number 2.7.1-1+squeeze1. The mail.log lists all connections like Nov 6 17:40:54 lo postfix/smtpd[10283]: 4AD4292:

Re: force startssl/tls/ssl on sasl login

2013-11-07 Thread Wietse Venema
nik600: Thanks all for the information. I try to explain better what is my goal: i want to force all my sasl users to use SSL, so i've given them 2 option: you can auth using STARTSSL on standard port 25 you can auth using TLS/SSL on standard port 465 Mail servers connect to port 25

Re: postfix 2.7.1 debian - does not query DNS

2013-11-07 Thread Wietse Venema
Simon Loewenthal: I have a postfix instance on Debian 6 that has never performed DNS lookups with version number 2.7.1-1+squeeze1. The mail.log lists all connections like Nov 6 17:40:54 lo postfix/smtpd[10283]: 4AD4292: client=unknown[82.2.1.3], sasl_method=PLAIN,

Re: postfix 2.7.1 debian - does not query DNS

2013-11-07 Thread Simon Loewenthal
Hi Wietse, Chroot was not turned on. # == # service type private unpriv chroot wakeup maxproc command + args # (yes) (yes) (yes) (never) (100) # ==

Re: postfix 2.7.1 debian - does not query DNS

2013-11-07 Thread Charles Marcus
On 2013-11-07 6:39 AM, Simon Loewenthal si...@klunky.co.uk wrote: Chroot was not turned on Look again... # == # service type private unpriv chroot wakeup maxproc command + args # (yes) (yes) (yes)

Re: postfix 2.7.1 debian - does not query DNS

2013-11-07 Thread Wietse Venema
Simon Loewenthal: # service typeprivate unpriv chroot ... # (yes) (yes) (yes) ... # == smtpinetn - - ... Turn off the damned chroot. Wietse

Re: postfix 2.7.1 debian - does not query DNS

2013-11-07 Thread Simon Loewenthal
Damned chroot now turned off, and lookups now work like they should have done :D And this nicely solved my RDNS_NONE scoring issue with SA, of course! Nov 7 12:49:16 lo postfix/smtpd[15712]: 32FD892: client=english-breakfast.cloud9.net[168.100.1.7] Thanks, I did not think that chroot had

Non-domain based conditional routing

2013-11-07 Thread Chris Visser
Hi, I'm looking for pointers on how to do conditional routing on non-domain related information in Postfix. For example: I currently have an Exim MTA configured to query a LDAP server for the physicalDeliveryOfficeName field. It returns a value for the branch to route the message to e.g. Cape

Re: Non-domain based conditional routing

2013-11-07 Thread Patrick Ben Koetter
* Chris Visser chris.vis...@rtt.co.za: Hi, I'm looking for pointers on how to do conditional routing on non-domain related information in Postfix. For example: I currently have an Exim MTA configured to query a LDAP server for the physicalDeliveryOfficeName field. It returns a value

Re: postfix 2.7.1 debian - does not query DNS

2013-11-07 Thread DTNX Postmaster
On 07 Nov 2013, at 12:53, Simon Loewenthal si...@klunky.co.uk wrote: Damned chroot now turned off, and lookups now work like they should have done :D And this nicely solved my RDNS_NONE scoring issue with SA, of course! Nov 7 12:49:16 lo postfix/smtpd[15712]: 32FD892:

Re: postfix 2.7.1 debian - does not query DNS

2013-11-07 Thread li...@rhsoft.net
Am 07.11.2013 12:53, schrieb Simon Loewenthal: Damned chroot now turned off, and lookups now work like they should have done :D And this nicely solved my RDNS_NONE scoring issue with SA, of course! Nov 7 12:49:16 lo postfix/smtpd[15712]: 32FD892:

Re: Convert all envelope ids to lowercase

2013-11-07 Thread Benny Pedersen
Ram skrev den 2013-11-07 08:06: Is there a simple way I can configure postfix to convert all Envelope From and To addresses to lowercase, before delivery hmp, is there another underlaying problem you like postfix to solve ? unix accounts with mixed case ?, virtual users with mixed case ? if

Re: force startssl/tls/ssl on sasl login

2013-11-07 Thread Peter
On 11/07/2013 08:38 PM, nik600 wrote: you can auth using STARTSSL on standard port 25 Port 25 should be for MX to MX communication, not for submission. you can auth using TLS/SSL on standard port 465 Port 465 is SMTPS which is deprecated. You should be using the submission port (587) with

Connection Limit

2013-11-07 Thread Roman Gelfand
Is there a limit on a number of connections or number of emails could be sent from an ip? The reason why I am asking is... There is this workstation which is able to connect to other ports of the postfix server and, at the same time, other workstations could connect to postfixes smtp port. Any

Re: Connection Limit

2013-11-07 Thread Noel Jones
On 11/7/2013 1:27 PM, Roman Gelfand wrote: Is there a limit on a number of connections or number of emails could be sent from an ip? Postfix does have some limits. If a client exceeds the limits, postfix will no longer accept mail from the client, and the offense is noted in the logs. Some of

Postfix 2.9.6-2 on debian wheezy with a mysql problem?

2013-11-07 Thread Tobi
Hi list I really got a weird problem with one of my postfix installations and the mysql lookup. The weird thing is that it works on two of my three postfix installtions. Have the following .cnf file for the mysql lookup hosts = 192.168.200.113 port = 3308 user = postfix password = XX

Re: Postfix 2.9.6-2 on debian wheezy with a mysql problem?

2013-11-07 Thread Wietse Venema
Tobi: Hi list I really got a weird problem with one of my postfix installations and the mysql lookup. The weird thing is that it works on two of my three postfix installtions. Have the following .cnf file for the mysql lookup Copy the same config file to different machines and try:

Working around TLS limitations in Windows 2003 Exchange servers.

2013-11-07 Thread Viktor Dukhovni
On Wed, Oct 16, 2013 at 01:59:51PM +, Viktor Dukhovni wrote: exchangerelay unix - - n - - smtp -o smtp_sasl_mechanism_filter=!gssapi,login To support Exchange MSAs on Windows 2003 generically (less critical state in per-relay policy entries): exchangerelay unix - - n - -

Re: Postfix 2.9.6-2 on debian wheezy with a mysql problem?

2013-11-07 Thread Tobi
Am 07.11.2013 23:02, schrieb Wietse Venema: Tobi: Hi list I really got a weird problem with one of my postfix installations and the mysql lookup. The weird thing is that it works on two of my three postfix installtions. Have the following .cnf file for the mysql lookup Copy the same config

Re: Postfix 2.9.6-2 on debian wheezy with a mysql problem?

2013-11-07 Thread Viktor Dukhovni
On Thu, Nov 07, 2013 at 11:21:15PM +0100, Tobi wrote: Copy the *SAME* config file to different machines and try: $ postmap -q '192.167.34.21' mysql:/path/to/config-file Are the results different? Yes they are. On the two other machines the file works root@mail1:~# postmap -q

explicit cipher list

2013-11-07 Thread li...@rhsoft.net
Hi http://www.postfix.org/TLS_README.html#server_tls am i overlooking something or is it not possible to list explcit offered ciphers and their order like dovecot/httpd fro smtpd? i am speaking here about non-MX servers only for submission what i most appreciate in this way of configuration is

Re: explicit cipher list

2013-11-07 Thread Viktor Dukhovni
On Thu, Nov 07, 2013 at 11:31:03PM +0100, li...@rhsoft.net wrote: http://www.postfix.org/TLS_README.html#server_tls Am I overlooking something or is it not possible to list explicit offered ciphers and their order like dovecot/httpd for smtpd? Postfix provides a more natural user interface

Re: Postfix 2.9.6-2 on debian wheezy with a mysql problem?

2013-11-07 Thread Tobi
Am 07.11.2013 23:26, schrieb Viktor Dukhovni: On Thu, Nov 07, 2013 at 11:21:15PM +0100, Tobi wrote: Copy the *SAME* config file to different machines and try: $ postmap -q '192.167.34.21' mysql:/path/to/config-file Are the results different? Yes they are. On the two other machines the file

Re: Postfix 2.9.6-2 on debian wheezy with a mysql problem?

2013-11-07 Thread Viktor Dukhovni
On Thu, Nov 07, 2013 at 11:46:43PM +0100, Tobi wrote: If the ip/port are different, it is not the *SAME* configuration. I know but it's not possible otherwise. The two other server reach the mysql-cluster via other ips/ports. Do double-check that 3rd configuration file, make sure it contains

Re: Dspam integration order

2013-11-07 Thread Jeroen Geilman
On 11/07/2013 08:43 AM, Matthew Brown wrote: Hi all, I’m trying to integrate dspam into my mail flow and have got some conflict configuration suggestions. Regarding on incoming mail what are the advantages of using dspam as a content filter (and then reinjecting into postfix)[1] vs postfix

Re: explicit cipher list

2013-11-07 Thread li...@rhsoft.net
thank you for your feedback Am 07.11.2013 23:45, schrieb Viktor Dukhovni: Postfix provides a more natural user interface in terms of cipher grades (null, export, low, medium, high). These have sensibly easy to reason about security properties. I've seen many subtle and not so-subtle errors

Multiple outgoing smtp servers

2013-11-07 Thread Roman Gelfand
I am looking to load balance and distribute outgoing load. I read that all you need to do is add the following dns entries for each postfix box.. mxr IN A 192.168.1.121 mxr IN A 192.168.1.131 mxr IN A 192.168.1.141 mxr IN A 192.168.1.151 mxr IN A 192.168.1.161 and the following line in main.cf

Re: explicit cipher list

2013-11-07 Thread Viktor Dukhovni
On Fri, Nov 08, 2013 at 12:27:13AM +0100, li...@rhsoft.net wrote: If you MUST muck around with raw OpenSSL cipherlists, the underlying tls_grade_cipherlist parameters are present and documented, along with appropriate warnings to not go there. Note that Postfix will still

Re: explicit cipher list

2013-11-07 Thread li...@rhsoft.net
Am 08.11.2013 00:50, schrieb Viktor Dukhovni: On Fri, Nov 08, 2013 at 12:27:13AM +0100, li...@rhsoft.net wrote: If you MUST muck around with raw OpenSSL cipherlists, the underlying tls_grade_cipherlist parameters are present and documented, along with appropriate warnings to not go

Re: postfix 2.7.1 debian - does not query DNS

2013-11-07 Thread Stan Hoeppner
On 11/7/2013 5:53 AM, Simon Loewenthal wrote: Damned chroot now turned off, and lookups now work like they should have done :D The default Postfix chroot environment in Debian 6 Squeeze works fine out of the box, as did Lenny. You have to go back to Etch or Sarge to find it broken. I'd

Re: Multiple outgoing smtp servers

2013-11-07 Thread Benny Pedersen
Roman Gelfand skrev den 2013-11-08 00:46: I am looking to load balance and distribute outgoing load. no point I read that all you need to do is add the following dns entries for each postfix box.. link ? mxr IN A 192.168.1.121 mxr IN A 192.168.1.131 mxr IN A 192.168.1.141 mxr IN A

Re: explicit cipher list

2013-11-07 Thread Viktor Dukhovni
On Fri, Nov 08, 2013 at 01:05:33AM +0100, li...@rhsoft.net wrote: Note that Postfix will still apply implicit and configured exclusions to these based on context (!aNULL when verifying peer certificates) READ THE ABOVE Note carefully. The exclusions are applied on top of the cipher

Re: Multiple outgoing smtp servers

2013-11-07 Thread Wietse Venema
Roman Gelfand: I am looking to load balance and distribute outgoing load. I read that all you need to do is add the following dns entries for each postfix box.. mxr IN A 192.168.1.121 mxr IN A 192.168.1.131 mxr IN A 192.168.1.141 mxr IN A 192.168.1.151 mxr IN A 192.168.1.161 and the

Re: explicit cipher list

2013-11-07 Thread li...@rhsoft.net
thank you very much for all that informations i will add this message to my documentation archive and have a look how hard it is really needed to tweak here - also saw consumer grade routers breaking TLS until restart them somehow i do not expect that Outllok 2010 on Windows 8 has more problems

RE: Multiple outgoing smtp servers

2013-11-07 Thread Roman Gelfand
Wouldn't the server be chosen round robin as opposed to random? From: Wietse Venema Sent: 11/7/2013 8:21 PM To: Postfix users Cc: postfix users list; u...@porcupine.org Subject: Re: Multiple outgoing smtp servers Roman Gelfand: I am looking to load balance and distribute outgoing load. I read

Re: explicit cipher list

2013-11-07 Thread Viktor Dukhovni
On Fri, Nov 08, 2013 at 01:17:54AM +, Viktor Dukhovni wrote: With smtpd(8) there are no implicit exclusions so you can build the full list yourself if you want. For example with opportunistic TLS (may): One minor correction, with either of: smtpd_tls_ask_ccert = yes

Re: Multiple outgoing smtp servers

2013-11-07 Thread Stan Hoeppner
On 11/7/2013 7:52 PM, Roman Gelfand wrote: Wouldn't the server be chosen round robin as opposed to random? This would require too much complex code for what is a simple Postfix operation. Your example is poor man's round robin. That's the best Postfix can do without serious code changes. But

Re: Multiple outgoing smtp servers

2013-11-07 Thread Viktor Dukhovni
On Thu, Nov 07, 2013 at 08:58:47PM -0600, Stan Hoeppner wrote: On 11/7/2013 7:52 PM, Roman Gelfand wrote: Wouldn't the server be chosen round robin as opposed to random? This would require too much complex code for what is a simple Postfix operation. Your example is poor man's round