Re: Table Lookup - Database Injections?

2021-10-13 Thread raf
On Wed, Oct 13, 2021 at 03:35:22PM -0400, post...@ptld.com wrote: > > Also since this is table lookup and AFAIK postfix doesn't have to > > write anything on it, so you can give SELECT only right. > > Least privileges are the key... > > > > So even if there is a clever guy that found a way to

Re: UTF-8 Encoding for MySQL

2021-10-13 Thread Viktor Dukhovni
On Wed, Oct 13, 2021 at 03:38:47PM -0400, post...@ptld.com wrote: > > You might want to use a UTF-8 encoding when creating the database and > > choose the same on the client end. > > Between character sets utf8mb3 and utf8mb4 does postfix work better with > one over the other or are they same

UTF-8 Encoding for MySQL

2021-10-13 Thread postfix
You might want to use a UTF-8 encoding when creating the database and choose the same on the client end. Between character sets utf8mb3 and utf8mb4 does postfix work better with one over the other or are they same same?

Re: Table Lookup - Database Injections?

2021-10-13 Thread postfix
Also since this is table lookup and AFAIK postfix doesn't have to write anything on it, so you can give SELECT only right. Least privileges are the key... So even if there is a clever guy that found a way to escape and send SQL injection he can never insert something.. end of the game for this

Re: Table Lookup - Database Injections?

2021-10-13 Thread Xavier Beaudouin
>> You might want to use a UTF-8 encoding when creating the database and >> choose the same on the client end. > > Thank for the pointer. Also since this is table lookup and AFAIK postfix doesn't have to write anything on it, so you can give SELECT only right. Least privileges are the key...

Re: Table Lookup - Database Injections?

2021-10-13 Thread postfix
You might want to use a UTF-8 encoding when creating the database and choose the same on the client end. Thank for the pointer.

Re: Table Lookup - Database Injections?

2021-10-13 Thread Viktor Dukhovni
On Wed, Oct 13, 2021 at 12:27:30PM -0400, post...@ptld.com wrote: > I received the following logged errors > > query failed: Illegal mix of collations >(latin1_swedish_ci,IMPLICIT) and > (utf8mb4_general_ci,COERCIBLE) for operation '=' > > query = SELECT email FROM aliases WHERE

Table Lookup - Database Injections?

2021-10-13 Thread postfix
I received the following logged errors postfix/smtpd[126515]: connect from mx1.testo.tel[52.39.45.118] postfix/proxymap[126516]: warning: mysql:/etc/postfix/mysql_email_aliases: query failed: Illegal mix of collations (latin1_swedish_ci,IMPLICIT) and (utf8mb4_general_ci,COERCIBLE) for

Re: knocking - still exist - how to block?

2021-10-13 Thread Benny Pedersen
On 2021-10-13 10:29, Maurizio Caloro wrote: please how i can block this knocking on the door, try with this example. postscreen_access_list = permit_mynetworks, hash:/etc/postfix/senderdomain, postscreen cant block sender domain only ip is supportede in postscreen

Re: knocking - still exist - how to block?

2021-10-13 Thread Matus UHLAR - fantomas
On 13.10.21 10:29, Maurizio Caloro wrote: please how i can block this knocking on the door*, try with this example. * *postscreen_access_list = permit_mynetworks,     hash:/etc/postfix/senderdomain, what's this? postscreen does not support domains.

knocking - still exist - how to block?

2021-10-13 Thread Maurizio Caloro
please how i can block this knocking on the door*, try with this example. * *postscreen_access_list = permit_mynetworks,     hash:/etc/postfix/senderdomain, hash:/etc/postfix/whitelistIP,     cidr:/etc/postfix/whitelistCIDR* * * *cat ***/etc/postfix/whitelistIP**

Re: turning off spamass-milter for authenticated submissions? SPF for submitted emails?

2021-10-13 Thread Matus UHLAR - fantomas
On 12.10.21 08:17, Carl Brewer wrote: I'm trying to sort out a spamassassin issue, using spamass-milter, submitted email is failing SPF checks, as spamassassin is seeing the IP address of the mail client and - it fails SPF as you'd expect. I think this is due to a mis-configuration of my