Re: Overriding transport_maps with sender_dependent

2021-08-10 Thread Matt Corallo
Oh, and if its possible, is it also possible to specify the original domains as "any domain with an MX of $REGEX" instead of only "any recipient domain of $REGEX"? Thanks, Matt On 8/10/21 22:34, Matt Corallo wrote: I have a need to map some destination domains to a specific smtp nexthop, but

Overriding transport_maps with sender_dependent

2021-08-10 Thread Matt Corallo
I have a need to map some destination domains to a specific smtp nexthop, but need to override that nexthop on a sender_dependent basis. I've tried a few things and all with no luck: * transport_maps specifying the nexthop can't be overridden at all, it seems (and doesn't support

Re: ALPACA writeup

2021-08-10 Thread raf
On Tue, Aug 10, 2021 at 07:54:35PM -0400, Viktor Dukhovni wrote: > On Wed, Aug 11, 2021 at 09:48:24AM +1000, raf wrote: > > > If you want postfix to reject a connection immediately > > after the first SMTP protocol error it encounters, > > without the need to construct in advance a list of all

Re: ALPACA writeup

2021-08-10 Thread Viktor Dukhovni
On Wed, Aug 11, 2021 at 09:48:24AM +1000, raf wrote: > If you want postfix to reject a connection immediately > after the first SMTP protocol error it encounters, > without the need to construct in advance a list of all > possible errors, just set smtpd_hard_error_limit = 0. > >

Re: ALPACA writeup

2021-08-10 Thread raf
On 2021-08-10 16:07:48, Mono DHS wrote: > And the right to reject non-SMTP input follows from operating an > SMTP MTA on the well-known TCP port 25, while at the same time holding > up the fundamental principle upon which the success of the Internet is > based, namely of being liberal in what one

Re: AW: Postfix 3.4.14 - Dovecot SASL - strange/buggy behavior in combination with compatibility_level

2021-08-10 Thread Wietse Venema
Podskubka, Stefan: > Wietse Venema: > > The error happened because the hostname "dovecot" did not resolve. > > > > This may be affected by how compatibility_level is set, because > > compatibility_level is processed before Postfix's chroot feature makes some > > files inaccessible. > > Wow, I

Re: ALPACA writeup

2021-08-10 Thread raf
On Tue, Aug 10, 2021 at 02:45:06PM -0400, Wietse Venema wrote: > Wietse Venema: > > I see. We're splitting hairs the difference between 'not implemented' > > versus 'not recognized'. In that light, the patch looks correct to me. > > Implemented :-) > > Wietse That'll be a relief to

AW: Postfix 3.4.14 - Dovecot SASL - strange/buggy behavior in combination with compatibility_level

2021-08-10 Thread Podskubka, Stefan
Wietse Venema: > The error happened because the hostname "dovecot" did not resolve. > > This may be affected by how compatibility_level is set, because > compatibility_level is processed before Postfix's chroot feature makes some > files inaccessible. Wow, I was completely thrown off the right

Re: Postfix 3.4.14 - Dovecot SASL - strange/buggy behavior in combination with compatibility_level

2021-08-10 Thread Wietse Venema
Podskubka, Stefan: > Aug 10 19:39:14 4097ff109d16 postfix/smtpd[112]: > xsasl_dovecot_server_connect: Connecting > Aug 10 19:39:14 4097ff109d16 postfix/smtpd[112]: fatal: host/service > dovecot/666 not found: Device or resource busy This error message is from inet_connect(): if ((parse_err

Postfix 3.4.14 - Dovecot SASL - strange/buggy behavior in combination with compatibility_level

2021-08-10 Thread Podskubka, Stefan
Dear Postfix experts! Although I have found a solution/workaround for the problem mentioned here, for what it's worth, I still wanted to make the effort to report it as a possible bug. Summary === I have a test setup on my local machine where I am running Postfix and Dovecot, each in a

Re: ALPACA writeup

2021-08-10 Thread Wietse Venema
Wietse Venema: > I see. We're splitting hairs the difference between 'not implemented' > versus 'not recognized'. In that light, the patch looks correct to me. Implemented :-) Wietse

Re: logging from scripts executed by pipe

2021-08-10 Thread A. Schulze
Wietse Venema: A. Schulze: Is there a recommended/any way to log messages from a script via postfix? Not at this time. Making the postlog command setgid requires a security analysis and that may require some code restructuring before this can be done without opening up a security hole.

Re: ALPACA writeup

2021-08-10 Thread Mono DHS
Hello, On 2021-08-10, at 07:39 (UTC-0700), Stephen Satchell had the following to say: : On 8/10/21 7:00 AM, Mono DHS wrote: : > Are there plans to revisit the SMTP command parsing and handling logic : > in the server in one form or another? Are people making active use of : > the

Re: ALPACA writeup

2021-08-10 Thread Wietse Venema
Viktor Dukhovni: > On Tue, Aug 10, 2021 at 10:50:56AM -0400, Wietse Venema wrote: > > > A reasonable person would agree that the parameter syntax of an > > unimplemented command cannot be validated. > > FWIW, the pedantically standards-compliant response to an unknown > SMTP command is in fact

Re: ALPACA writeup

2021-08-10 Thread Viktor Dukhovni
On Tue, Aug 10, 2021 at 10:50:56AM -0400, Wietse Venema wrote: > A reasonable person would agree that the parameter syntax of an > unimplemented command cannot be validated. FWIW, the pedantically standards-compliant response to an unknown SMTP command is in fact 500, rather than 502:

Re: logging from scripts executed by pipe

2021-08-10 Thread Wietse Venema
A. Schulze: > Hello, > > I've to rebuild a service: messages to an address are delivered via postfix > pipe to a script. > This script use syslog to write it's messages. That worked well for years. > > Now, postfix run in a different way, supervised via "postfix start-fg" > (docker) >

Re: ALPACA writeup

2021-08-10 Thread Wietse Venema
Mono DHS: > First, upon receiving input consisting of the three tokens "POST", > "/", and "HTTP/1.0", the server should have recognised that such a > token sequence does not constitute a valid SMTP command line. >From the server's point of view, the POST command is unimplemented. It could have

Re: ALPACA writeup

2021-08-10 Thread Stephen Satchell
On 8/10/21 7:00 AM, Mono DHS wrote: Are there plans to revisit the SMTP command parsing and handling logic in the server in one form or another? Are people making active use of the smtpd_forbidden_commands parameter? Short answer: yes Longer answer: See this shell sequence: # postconf

Re: EHLO argument validation

2021-08-10 Thread Mono DHS
Hello, On 2021-08-09, at 16:33 (UTC+0200), Matus UHLAR - fantomas had the following to say: : I don't know where you got that address is not allowed in helo/ehlo - it is. The (current) standard says that it is for EHLO and it is not for HELO [1]. Thanks, Mono [1]

Re: ALPACA writeup

2021-08-10 Thread Mono DHS
Hello again, On 2021-08-09, at 09:39 (UTC-0400), Wietse Venema had the following to say: : There was a Postfix-users thread that led to this. : https://marc.info/?t=11012289581=1=2 Uh, oh. The example conversation is noteworthy for two reasons. First, upon receiving input consisting of

logging from scripts executed by pipe

2021-08-10 Thread A. Schulze
Hello, I've to rebuild a service: messages to an address are delivered via postfix pipe to a script. This script use syslog to write it's messages. That worked well for years. Now, postfix run in a different way, supervised via "postfix start-fg" (docker) Essentially the is no syslogd. My idea