How to block offering SASL auth to clients based on RBL

2014-06-07 Thread Kai Krakow
Hello list! Is there a way to prevent postfix from offering SASL auth (and that includes denying open relaying) to clients based on DNS RBL lookups? I've discovered the option smtpd_sasl_exceptions_networks which allows to do that by adding static subnet entries or adding a hash map. The

Re: How to block offering SASL auth to clients based on RBL

2014-06-07 Thread Wietse Venema
Kai Krakow: Hello list! Is there a way to prevent postfix from offering SASL auth (and that includes denying open relaying) to clients based on DNS RBL lookups? I've discovered the option smtpd_sasl_exceptions_networks which allows to do that by adding static subnet entries or adding a

Re: How to block offering SASL auth to clients based on RBL

2014-06-07 Thread Kai Krakow
Wietse Venema wie...@porcupine.org schrieb: Kai Krakow: Hello list! Is there a way to prevent postfix from offering SASL auth (and that includes denying open relaying) to clients based on DNS RBL lookups? I've discovered the option smtpd_sasl_exceptions_networks which allows to do that by

Re: How to block offering SASL auth to clients based on RBL

2014-06-07 Thread Wietse Venema
Kai Krakow: How is one supposed to automatically block such hijacked accounts within postfix? A simple heuristic could be detecting unusual high mail volume for that account, probably by detecting the always repeating or similar subjects. Typically, this is done with postfwd (a third-party

Re: How to block offering SASL auth to clients based on RBL

2014-06-07 Thread Noel Jones
On 6/7/2014 8:33 AM, Kai Krakow wrote: Wietse Venema wie...@porcupine.org schrieb: Kai Krakow: Hello list! Is there a way to prevent postfix from offering SASL auth (and that includes denying open relaying) to clients based on DNS RBL lookups? I've discovered the option

Re: How to block offering SASL auth to clients based on RBL

2014-06-07 Thread li...@rhsoft.net
Am 07.06.2014 17:25, schrieb Noel Jones: I wonder why you're just trying to stop SASL from those client... Why not just use reject_rbl_client (and maybe other restrictions) before permit_sasl_authenticated to reject all mail from them? If you're unwilling to accept SASL credentials, why

Re: How to block offering SASL auth to clients based on RBL

2014-06-07 Thread LuKreme
On 07 Jun 2014, at 09:53 , li...@rhsoft.net wrote: i condsidered that but it would take weeks and months to explain all customers that they have to fix their client configs and i see even new configured clients using 25 because the idiotic MUA's still default to 25 and burrie the port

Re: How to block offering SASL auth to clients based on RBL

2014-06-07 Thread li...@rhsoft.net
Am 07.06.2014 18:29, schrieb LuKreme: On 07 Jun 2014, at 09:53 , li...@rhsoft.net wrote: i condsidered that but it would take weeks and months to explain all customers that they have to fix their client configs and i see even new configured clients using 25 because the idiotic MUA's

Re: How to block offering SASL auth to clients based on RBL

2014-06-07 Thread Robert Schetterer
Am 07.06.2014 09:59, schrieb Kai Krakow: Hello list! Is there a way to prevent postfix from offering SASL auth (and that includes denying open relaying) to clients based on DNS RBL lookups? I've discovered the option smtpd_sasl_exceptions_networks which allows to do that by adding

Re: How to block offering SASL auth to clients based on RBL

2014-06-07 Thread Noel Jones
On 6/7/2014 10:53 AM, li...@rhsoft.net wrote: Am 07.06.2014 17:25, schrieb Noel Jones: I wonder why you're just trying to stop SASL from those client... Why not just use reject_rbl_client (and maybe other restrictions) before permit_sasl_authenticated to reject all mail from them? If

Re: How to block offering SASL auth to clients based on RBL

2014-06-07 Thread LuKreme
On 07 Jun 2014, at 10:39 , li...@rhsoft.net wrote: Am 07.06.2014 18:29, schrieb LuKreme: On 07 Jun 2014, at 09:53 , li...@rhsoft.net wrote: i condsidered that but it would take weeks and months to explain all customers that they have to fix their client configs and i see even new

Re: How to block offering SASL auth to clients based on RBL

2014-06-07 Thread li...@rhsoft.net
Am 07.06.2014 22:53, schrieb LuKreme: On 07 Jun 2014, at 10:39 , li...@rhsoft.net wrote: Am 07.06.2014 18:29, schrieb LuKreme: On 07 Jun 2014, at 09:53 , li...@rhsoft.net wrote: i condsidered that but it would take weeks and months to explain all customers that they have to fix their