Messages are stuck in maildrop

2010-01-11 Thread Eugueny Kontsevoy
I had some issues with free disk space so I had to start the server, expand the partition and restart it again. I did the following: > postsuper -r ALL It reported that it re-queued a bunch of messages and I can see that they're sitting in maildrop queue. postqueue -p reports that queue is empty

Re: Spam Attack on my outgoing server

2010-01-11 Thread /dev/rob0
On Mon, Jan 11, 2010 at 06:15:21PM -0300, Damian Rivas wrote: > >> mynetworks = 127.0.0.0/8, 200.55.14.248/29, 190.210.52.88/29 > > >These are the hosts allowed to relay. Don't mung the IP addresses. snip > All mailing incomes seem to come from ns1.cht.com.ar, which is a > gateway for the intern

Re: Does Postfix cache resolv.conf? [SOLVED]

2010-01-11 Thread Christoph Anton Mitterer
On Tue, 2010-01-12 at 00:23 +0100, Dr. Lars Hanke wrote: > Thanks Stefan, > > The Debian packages of Postfix are running smtpd in a chroot by > > default. The files necessary for this are copied by the init script > > /etc/init.d/postfix - and amongst them is the resolv.conf you changed. > > > I

Re: Does Postfix cache resolv.conf? [SOLVED]

2010-01-11 Thread Glenn English
On Jan 11, 2010, at 4:23 PM, Dr. Lars Hanke wrote: > It's exactly this. The chroot has its own copy of (caches) resolv.conf. And the command 'postfix check' will tell you if there's a problem (my server just now): > r...@server# postfix check > postfix/postfix-script: warning: /var/spool/post

Re: Does Postfix cache resolv.conf? [SOLVED]

2010-01-11 Thread Dr. Lars Hanke
Thanks Stefan, The Debian packages of Postfix are running smtpd in a chroot by default. The files necessary for this are copied by the init script /etc/init.d/postfix - and amongst them is the resolv.conf you changed. It's exactly this. The chroot has its own copy of (caches) resolv.conf. Re

Postfix as an MTA question

2010-01-11 Thread Bucl, Casper
Hi, I'm trying to use Postfix as an MTA. I don't want to deliver any mail locally, just relay everything to an external mail server. I would also like everything that runs though this MTA to be sent as a particular user, however I don't want messages intended for users on the system such as root

Auto-whitelist policy

2010-01-11 Thread Daniel L. Miller
Does anyone have an auto-whitelisting policy daemon? I want to have a test early in sender checks that would bypass most of my other spam prevention if a sender is in the whitelist - and have that whitelist automatically updated by internal users sending to those remote senders. -- Daniel

Re: Lower-case for incoming mail

2010-01-11 Thread Noel Jones
On 1/11/2010 4:32 PM, Rick wrote: I've got the following in my /var/log/maillog while running postfix-2.3.3-2.1.centos.mysql with mysql for account information. Jan 11 16:39:57 mailserver amavis[14138]: (14138-11) ESMTP::10024 /var/amavis/tmp/amavis-20100111T163707-14138: mailto:t...@gmail.com>

Re: reject_authenticated_sender_login_mismatch

2010-01-11 Thread mouss
Michael a écrit : > As follows > > smtpd_recipient_restrictions = > reject_invalid_hostname, > reject_non_fqdn_sender, > reject_non_fqdn_recipient, > reject_unknown_sender_domain, > reject_unknown_recipient_domain, > reject_unauth_pipelining, useles

Lower-case for incoming mail

2010-01-11 Thread Rick
I've got the following in my /var/log/maillog while running postfix-2.3.3-2.1.centos.mysql with mysql for account information. Jan 11 16:39:57 mailserver amavis[14138]: (14138-11) ESMTP::10024 /var/amavis/tmp/amavis-20100111T163707-14138: -> < test...@dest.example.com> SIZE=1954 Received: from m

RE: Spam Attack on my outgoing server

2010-01-11 Thread Damian Rivas
>De: owner-postfix-us...@postfix.org [mailto:owner-postfix->us...@postfix.org] >En nombre de /dev/rob0 >Enviado el: lunes, 11 de enero de 2010 16:50 >Para: postfix-users@postfix.org >Asunto: Re: Spam Attack on my outgoing server >>On Mon, Jan 11, 2010 at 03:27:05PM -0300, Damian Rivas wrote: >>

Re: Spam Attack on my outgoing server

2010-01-11 Thread Noel Jones
On 1/11/2010 1:44 PM, Damian Rivas wrote: Damian, Please ignore the above bad advice. An OK in smtpd_sender_restrictions can not possibly make you an open relay. Likely it didn't work as expected because the mail isn's submitted via SMTP. Before you waste time on any other bad advice you

Re: Spam Attack on my outgoing server

2010-01-11 Thread /dev/rob0
On Mon, Jan 11, 2010 at 04:44:23PM -0300, Damian Rivas wrote: Noel Jones > >Post logs here if you don't know how to evaluate them. > > >My wild guess is that you have an abused web form, but check > >the logs before you go running around telling everyone your > >web server is hacked. > > Noel,

Re: Spam Attack on my outgoing server

2010-01-11 Thread /dev/rob0
On Mon, Jan 11, 2010 at 03:27:05PM -0300, Damian Rivas wrote: > I have a Postfix box basically configured to send mail from my > organization to the Internet. Today I received a warning message > telling me that the mail queue was full. Who/what sent you that warning? > It seems that some Spamm

RE: Spam Attack on my outgoing server

2010-01-11 Thread Damian Rivas
>Damian, > >Please ignore the above bad advice. An OK in >smtpd_sender_restrictions can not possibly make you an open >relay. Likely it didn't work as expected because the mail >isn's submitted via SMTP. >Before you waste time on any other bad advice you may get, >examine your logs to see w

Re: Spam Attack on my outgoing server

2010-01-11 Thread Noel Jones
On 1/11/2010 1:11 PM, Brian Evans - Postfix List wrote: On 1/11/2010 1:27 PM, Damian Rivas wrote: Hello everyone, I have a Postfix box basically configured to send mail from my organization to the Internet. Today I received a warning message telling me that the mail queue was full. It seems

Re: Spam Attack on my outgoing server

2010-01-11 Thread Noel Jones
On 1/11/2010 1:00 PM, brian moore wrote: On Mon, 11 Jan 2010 15:27:05 -0300 "Damian Rivas" wrote: Hello everyone, I have a Postfix box basically configured to send mail from my organization to the Internet. Today I received a warning message telling me that the mail queue was full. It seem

Re: TLS - Certificate not Trusted

2010-01-11 Thread LuKreme
On 11-Jan-2010, at 09:27, Dennis Putnam wrote: > I am quite familiar with the arguments but again it is not my choice. If you > want, I can give you the number of our corporate lawyers and you can try to > convince them. Perhaps you will have better luck than me. :-) I will be happy to email th

Re: TLS - Certificate not Trusted

2010-01-11 Thread Victor Duchovni
On Mon, Jan 11, 2010 at 11:36:42AM -0600, Noel Jones wrote: > According to the example in > http://www.postfix.org/TLS_README.html#client_tls_policy > the policy table should contain > > somedomain.tld encrypt > > To include subdomains of somedomain.tld also include > > .somedomain.tld

Re: Spam Attack on my outgoing server

2010-01-11 Thread Brian Evans - Postfix List
On 1/11/2010 1:27 PM, Damian Rivas wrote: > Hello everyone, > > I have a Postfix box basically configured to send mail from my organization > to the Internet. Today I received a warning message telling me that the mail > queue was full. > > It seems that some Spammer is using my server as an Open

Re: Spam Attack on my outgoing server

2010-01-11 Thread brian moore
On Mon, 11 Jan 2010 15:27:05 -0300 "Damian Rivas" wrote: > Hello everyone, > > I have a Postfix box basically configured to send mail from my organization > to the Internet. Today I received a warning message telling me that the mail > queue was full. > > It seems that some Spammer is using m

Spam Attack on my outgoing server

2010-01-11 Thread Damian Rivas
Hello everyone, I have a Postfix box basically configured to send mail from my organization to the Internet. Today I received a warning message telling me that the mail queue was full. It seems that some Spammer is using my server as an Open Relay, so I used the "check_sender_access" function

Re: Sender based relay server

2010-01-11 Thread Wietse Venema
Jack Knowlton: > On Mon, January 11, 2010 5:04 pm, David Koski wrote: > > On Monday 11 January 2010, Jack Knowlton wrote: > >> Thank you. > >> I figured out how to make a per-domain relay, but what is the format for > >> having the message directly delivered? I tried both "smtp:" and ":smtp" > >> b

Re: TLS - Certificate not Trusted

2010-01-11 Thread Noel Jones
On 1/11/2010 11:16 AM, Dennis Putnam wrote: Hi Noel, Thanks. I thing you pointed me in the right direction. Am I correct that the per_site table is different under 2.5.5 than pre 2.3? I had trouble getting that to work on the old server so I didn't change it for the migration. What I have is: .

Re: TLS - Certificate not Trusted

2010-01-11 Thread Dennis Putnam
Hi Noel, Thanks. I thing you pointed me in the right direction. Am I correct that the per_site table is different under 2.5.5 than pre 2.3? I had trouble getting that to work on the old server so I didn't change it for the migration. What I have is: .somedomain.com MUST I think it now can be

Re: TLS - Certificate not Trusted

2010-01-11 Thread Noel Jones
On 1/11/2010 10:38 AM, Dennis Putnam wrote: Upon further investigation, apparently mail is not moving. There seems to be 2 domains associated with this site but I was only asked to enforce TLS on one of them. That is why it appeared to be working. Getting back to Chris' comments, I think setting

Re: TLS - Certificate not Trusted

2010-01-11 Thread /dev/rob0
On Mon, Jan 11, 2010 at 11:53:35AM -0500, Noah Sheppard wrote: [attribution to Chris is missing] > > >> On Mon, 2010-01-11 at 11:04 -0500, Dennis Putnam wrote: > > >>> I want to enforce TLS but I don't care what certificate the > > >>> receiver uses. Thanks. > > >> Apart from the fact that enforci

Re: Sender based relay server

2010-01-11 Thread Jack Knowlton
On Mon, January 11, 2010 5:04 pm, David Koski wrote: > On Monday 11 January 2010, Jack Knowlton wrote: >> Thank you. >> I figured out how to make a per-domain relay, but what is the format for >> having the message directly delivered? I tried both "smtp:" and ":smtp" >> but none seemed to work.. >

Re: TLS - Certificate not Trusted

2010-01-11 Thread Noah Sheppard
> >> On Mon, 2010-01-11 at 11:04 -0500, Dennis Putnam wrote: > >>> I want to enforce TLS but I don't care what certificate the receiver > >>> uses. Thanks. > >> Apart from the fact that enforcing TLS with SMTP is usually a bad idea, > >> [..] Why is TLS w/ SMTP a bad idea? -- Noah Sheppard Assis

Re: TLS - Certificate not Trusted

2010-01-11 Thread Dennis Putnam
Upon further investigation, apparently mail is not moving. There seems to be 2 domains associated with this site but I was only asked to enforce TLS on one of them. That is why it appeared to be working. Getting back to Chris' comments, I think setting the security level to 'encrypt' forces ever

Re: TLS - Certificate not Trusted

2010-01-11 Thread Dennis Putnam
Hi Chris, Thanks for the reply. Please see embedded comments. On Jan 11, 2010, at 11:11 AM, Christoph Anton Mitterer wrote: > On Mon, 2010-01-11 at 11:04 -0500, Dennis Putnam wrote: >> I want to enforce TLS but I don't care what certificate the receiver >> uses. Thanks. > Apart from the fact tha

Re: re-enqueue quarantined mails

2010-01-11 Thread Noel Jones
On 1/11/2010 10:14 AM, rcolme...@libero.it wrote: hi, I have a postfix 2.3.3 with an amavis antivir. I need to resume some mails, moved into /var/virusmails from amavis, to /var/spool/postfix/incoming (I need that postfix try to resend them). If I move the single mail files (changing owner and

re-enqueue quarantined mails

2010-01-11 Thread rcolme...@libero.it
hi, I have a postfix 2.3.3 with an amavis antivir. I need to resume some mails, moved into /var/virusmails from amavis, to /var/spool/postfix/incoming (I need that postfix try to resend them). If I move the single mail files (changing owner and permission) I obtain that postfix move it into

Re: reject_authenticated_sender_login_mismatch

2010-01-11 Thread Barney Desmond
2010/1/11 Michael : > As follows > > smtpd_recipient_restrictions = > ... >        check_recipient_access hash:/etc/postfix/access, >        permit_mynetworks, >    reject_authenticated_sender_login_mismatch > mysql:/etc/postfix/mysql-sender-access.cf >        reject_unauth_destination > ... > RECE

Re: TLS - Certificate not Trusted

2010-01-11 Thread Christoph Anton Mitterer
On Mon, 2010-01-11 at 11:04 -0500, Dennis Putnam wrote: > I want to enforce TLS but I don't care what certificate the receiver > uses. Thanks. Apart from the fact that enforcing TLS with SMTP is usually a bad idea, setting the smtp_tls_security_level = encrypt should usually do what you mean, enfor

TLS - Certificate not Trusted

2010-01-11 Thread Dennis Putnam
I'm just getting started with version 2.5.5 and TLS is different that my previous version. I have everything thing working except some email will not go out because of the error "delivery temporarily suspended: Server certificate not trusted." What parameter do I have wrong that requires trusted

Re: FILTER nexthop woes

2010-01-11 Thread Wietse Venema
l...@ds.gauner.org: > Hi, > I'm trying to use header_checks in conjunction with a pcre map to > distribute certain mail traffic to certain outgoing transports. I've got a > setup like this: > > --- main.cf snip --- > header_checks = pcre:/etc/postfix/header.pcre > --- snap --- > > --- header.pcre

FILTER nexthop woes

2010-01-11 Thread lkml
Hi, I'm trying to use header_checks in conjunction with a pcre map to distribute certain mail traffic to certain outgoing transports. I've got a setup like this: --- main.cf snip --- header_checks = pcre:/etc/postfix/header.pcre --- snap --- --- header.pcre snip --- /^X-CUSTOMER-ID: ([0-9])/ FILT

Re: Limitations of smtpd_proxy_filter

2010-01-11 Thread Wietse Venema
Stefan Foerster: > * Wietse Venema : > > Stefan Foerster: > > > One of the greatest improvements in the 2.7 tree is the ability to > > > defer transmission of received messages to a SMTP proxy until the > > > message receiption completes (smtpd_proxy_options = speed_adjust). > > > > Can you be mor

Re: Anyone else had this issue with maildrop?

2010-01-11 Thread Kārlis Repsons
On Sunday 10 January 2010 14:59:11 mouss wrote: > Your maildrop needs to contact the courier authdaemon server. Make sure, > authdaemon is running and correctly configured. if you don't need it, > you'll need to rebuild maildrop without authlib support. > > anyway, this is not postfix related. mai

Re: Sender based relay server

2010-01-11 Thread Jack Knowlton
On Sat, January 9, 2010 5:34 pm, Stan Hoeppner wrote: > Jack Knowlton put forth on 1/9/2010 9:57 AM: >> Hi all. >> Our internal postfix server relays all outbound mail thru an external >> host. >> How can I set it to use a different relay server when the email comes >> from >> a specified domain? E

Re: Huge active queue and system idle, not delivering

2010-01-11 Thread Wietse Venema
Patrick Chemla: Wietse: > > OK, so you can turn back on that connection caching. Note that > > qmail creates and destroys two processes per SMTP session, so > > reusing a session is also a win from a CPU resource point of view. Patrick: > If I do so, will postfix open more than one connexion to ea

Re: Does Postfix cache resolv.conf?

2010-01-11 Thread Dr. Lars Hanke
Wietse Venema: Apparently postfix missed the switching of nameservers and did not learn of the new DNS until restart. Is this a bug or a feature? Like most programs, Postfix never reads /etc/resolv.conf. Yes, I suspected that. Instead, that file is read by the NSSWITCH system library

Re: Limitations of smtpd_proxy_filter

2010-01-11 Thread Stefan Foerster
* Wietse Venema : > Stefan Foerster: > > One of the greatest improvements in the 2.7 tree is the ability to > > defer transmission of received messages to a SMTP proxy until the > > message receiption completes (smtpd_proxy_options = speed_adjust). > > Can you be more specific about the benefits?