Re: problem, pass bad header thru amavis and dont quarantine them

2013-05-17 Thread Marko Weber | ZBF
Hi Patrick, Am 2013-05-17 00:20, schrieb Patrick Ben Koetter: Marko, * Marko Weber | ZBF we...@zackbummfertig.de: hello, i set in amavid.conf : $final_bad_header_destiny = D_PASS; but in logs i see this lines; May 16 23:22:11 mail amavis[15703]: (15703-13) Passed BAD-HEADER-1

Re: problem, pass bad header thru amavis and dont quarantine them

2013-05-17 Thread Marko Weber | ZBF
Hi Patrick, i did it like described in your blog. (bit changed for my structure) @local_domains_maps = ( .$mydomain, read_hash('/etc/postfix/lookups/hash/virtual_domains_amavis') ); # list of all local domains # ### weber stop the result in logfile is now: May 17 09:57:05 mail

Re: Tweaking DNS timeouts

2013-05-17 Thread /dev/rob0
On Thu, May 16, 2013 at 07:48:24PM -0400, Wietse Venema wrote: /dev/rob0: In the time since I've been running this, I saw the first thing that might be seen as a problem: dnsblog timing out on one of the DNSBL lookups: May 16 21:51:44 harrier postfix/postscreen[29502]: CONNECT from

Re: Tweaking DNS timeouts

2013-05-17 Thread Viktor Dukhovni
On Fri, May 17, 2013 at 12:26:13PM -0500, /dev/rob0 wrote: Increasing the greet-wait to 10+ seconds could result in legitimate clients hanging up, so I would not recommend that. Do we have any testing to validate this? I'm pretty sure I recall from a few years back on the old original

Re: problem, pass bad header thru amavis and dont quarantine them

2013-05-17 Thread Patrick Ben Koetter
* Marko Weber | ZBF we...@zackbummfertig.de: Hi Patrick, i did it like described in your blog. (bit changed for my structure) @local_domains_maps = ( .$mydomain, read_hash('/etc/postfix/lookups/hash/virtual_domains_amavis') ); # list of all local domains # ### weber stop the result

Re: virtual user (unknown user)

2013-05-17 Thread Benny Pedersen
postfi...@fuckaround.org skrev den 2013-05-16 14:10: fuckaround postfix/local[5595]: ADDFD758237: to=f...@fuckaround.org, relay=local, delay=0.06, delays=0.03/0.01/0/0.02, dsn=5.1.1, status=bounced (unknown user: fred) useradd fred fred is not yet an unix user :=) -- senders that put my

Re: Tweaking DNS timeouts

2013-05-17 Thread /dev/rob0
On Fri, May 17, 2013 at 05:53:47PM +, Viktor Dukhovni wrote: On Fri, May 17, 2013 at 12:26:13PM -0500, /dev/rob0 wrote: Wietse: Increasing the greet-wait to 10+ seconds could result in legitimate clients hanging up, so I would not recommend that. Do we have any testing to validate

Re: Tweaking DNS timeouts

2013-05-17 Thread Wietse Venema
/dev/rob0: I guess this says that postscreen_dnsbl_action fires at the end of the greet pause when postscreen_dnsbl_threshold is met, but postscreen_dnsbl_whitelist_threshold is not calculated. Here's the [begin background material] I mis-understood how postscreen works (I do not

Re: postfix ssl errors in log, what does they mean?

2013-05-17 Thread Wietse Venema
Marko Weber | ZBF: hello , i find many of these in my mail.log: May 16 14:27:33 mail opendkim[2926]: 119CA2FB20: s=dktest d=porcupine.org SSL error:04091068:rsa routines:INT_RSA_VERIFY:bad signature is my openssl broken or something else glitchy? or does this mean the dkim from

Re: postfix ssl errors in log, what does they mean?

2013-05-17 Thread Wietse Venema
Wietse Venema: Marko Weber | ZBF: hello , i find many of these in my mail.log: May 16 14:27:33 mail opendkim[2926]: 119CA2FB20: s=dktest d=porcupine.org SSL error:04091068:rsa routines:INT_RSA_VERIFY:bad signature is my openssl broken or something else glitchy? or does this

Snapshot 20130517 (was: Tweaking DNS timeouts)

2013-05-17 Thread Wietse Venema
Wietse Venema: I can change postscreen to also use partial scores for whitelisting of non-DNS tests, and thereby make whitelisting of non-DNS tests consistent with DNS-based blocking (that's one less WTF factor). This requires minor code duplication. Released as snapshot 20130517

Re: Snapshot 20130517

2013-05-17 Thread /dev/rob0
). This requires minor code duplication. Released as snapshot 20130517. For testing I reenabled PSBL, and I'll see what comes in overnight. I thought I could make my own pseudo-DNSBL on a random IP address with blocked ports 53, but I need to set up an NS record to point to that. I'll do that tomorrow