On 16-11-10 13:19, Wietse Venema wrote:
>>
>> RFC5782 says that an operational whitelist MUST contain an entry for
>> 127.0.0.2 and MUST NOT contain one for 127.0.0.1, and whitelist users
>> MUST periodically check this to see if the list is still active.
>
> I don't think it is a good idea to automatically disable DNWSL
> lookup in Postfix just because some DNSWL check failed during a
> network outage, whether the outage is local or remote.
>
The proposed implementation would only disable lookups for a
particular DNSWL if it is known to be declared dead by its operator,
i.e. only if the lookup for 127.0.0.1 succeeds. The RFC5782 check
requires two lookups and exactly one of them must produce a positive
result, otherwise no meaningful conclusion can be reached. In case of a
network outage, no decision can/should/will be taken as to the
"deadness" of the list.
Anyhow, if a DNSWL is queried while the network is out for lunch, no
reply will come and no client will be whitelisted. For all practical
purposes, this is already equivalent to "automatically disabling" the
DNSWL for the duration of the network outage.
Likewise, if a DNSWL is discontinued (with or without implementing
the RFC5782 mechanism), it will contain no entries for real clients. The
continued lookups are just wasting cycles and bandwidth, and here again
the list would effectively be "disabled".
Therefore, as far as day-to-day mail server operation is concerned,
the proposed sanity checks would make no difference whatsoever.
The difference comes only when the D2NSWL (= Dead DNSWL) operator
finally gets tired of the continued queries from non-RFC5782-compliant
installations and starts whitelisting the entire globe (as I am
considering for be.whitelist.skopos.be ...).
However, it's not only about preventing cowboy admins from shooting
themselves in the foot, it's also about reducing the need for
shepherding of a mail server setup in general. Only masochist (or macho)
admins would object to that, I suppose.
And from the viewpoint of the list operator, the automatic disabling
of D2NSWLs would make Postfix a better network citizen.
> Maybe someone can donate a 20-line Perl script that scans "postconf
> -n" output for the names of known DNSWLS and that pokes those DNSWLs
> for liveness. Such a script could be run from a cron job that
> mails the result to the system administrator.
This would certainly help. It is more or less equivalent to adding
this functionality to "postfix check" (step 1 in the proposal).
One advantage of such a Perl script is that the result would be
mailed, not just written to the logs. No big deal, I'd say. I did send
mails to 'postmaster' (and some other addresses) for the most active
"offending" servers and as far as I can tell nobody has ever bothered to
read them. Those admins that can read tend to have log monitoring tools
in place anyway.
One disadvantage of the Perl solution would be that it requires a
separate install from Postfix, and (as far as I know) it would be
dependent on additional modules. Again no big deal, except maybe that
the people that would benefit most would be least likely to activate it
(unless the Postfix packagers give them a hand, of course).
What if somebody donated a 21-line patch to "postfix check" ?
Note: I haven't looked at the Postfix sources in a long time, so
please don't shoot me if turns out to take 2[2..99] lines instead of 21 ...
Of course, both of these solutions still require manual intervention
from the admin, whereas this is a task that could easily be handled
automagically by the server.
Luc
