Re: Spammer succeeded in relaying through my server

2022-12-20 Thread Peter
On 21/12/22 20:35, Samer Afach wrote: Dear Pat: Thank you for throwing this idea, because I really thought it wasn't possible to retrieve docker logs without setup, but I dug and found the logs. I have them all. Unfortunately, I can't share them all because they're like GBs in size. Just the

Re: Spammer succeeded in relaying through my server

2022-12-20 Thread mailmary
The most common issue when using a proxy/load balancer like haproxy, is that the remote/foreign connections are being forwarded with the IP address of the haproxy machine. Thus, they all appear as "local", which makes postfix think they are "mynetworks" and as a result, postfix becomes a open

Re: Spammer succeeded in relaying through my server

2022-12-20 Thread Samer Afach
Dear Pat: Thank you for throwing this idea, because I really thought it wasn't possible to retrieve docker logs without setup, but I dug and found the logs. I have them all. Unfortunately, I can't share them all because they're like GBs in size. Just the grep on that email address is like

Re: Spammer succeeded in relaying through my server

2022-12-20 Thread Patrick Proniewski
Hello, Do you have the logs (postfix and maybe dovecot) showing the spammer interaction with the server? pat > On 21 Dec 2022, at 05:45, Samer Afach wrote: > > Thank you, Phil. Here we go. Here's postconf -n: > > > I hope this helps in better identifying how the spammer was able to use my

Re: Spammer succeeded in relaying through my server

2022-12-20 Thread Samer Afach
Thank you, Phil. Here we go. Here's postconf -n: I hope this helps in better identifying how the spammer was able to use my server to send a spam email. ``` alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases append_dot_mydomain = no biff = no broken_sasl_auth_clients = yes

Re: Spammer succeeded in relaying through my server

2022-12-20 Thread Phil Stracchino
On 12/20/22 21:39, Samer Afach wrote: I could share postconf too, but it's huge and I don't want to make this a huge burden unless necessary. 'postconf -n' is much more concise. Try it. -- Phil Stracchino Babylon Communications ph...@caerllewys.net p...@co.ordinate.org Landline:

Spammer succeeded in relaying through my server

2022-12-20 Thread Samer Afach
Dear postfix experts: So, apparently I failed at configuring my server properly after moving my whole email services to docker, and some spambot eventually was able to send a "claim prize" email through my server. The reason I think it's relay is that the account, from which the email was

Re: warning: disabling connection caching

2022-12-20 Thread Viktor Dukhovni
On Tue, Dec 20, 2022 at 06:28:21AM +0100, Fourhundred Thecat wrote: > I had this in my logs: > >postfix/master: warning: process /usr/lib/postfix/sbin/scache pid 1215 > killed by signal 11 This is the problem, not lack of connection caching. Perhaps you've replaced the OpenSSL or other

Re: Duplicate message delivery to always_bcc with dovecot and Simple Content Filter (Postfix)

2022-12-20 Thread Yanko Hernández Álvarez
On Tue, Dec 20, 2022 at 9:46 AM Yanko Hernández Álvarez wrote: > > That's a good one > > It seems possible. Let me check. The problem is the ldap query now. > I'm not sure if I can do that with ldap. mailfilter does two ldap > queries, one to lookup the "main" group/role and another to get

Re: Log Table Lookup Result

2022-12-20 Thread Wietse Venema
Mehmet Avcioglu: > On Tue, Dec 20, 2022 at 9:57 PM Wietse Venema wrote: > > > However, Postfix does make information from multiple layers available > > for policy decisions: > > Thank you. Yes I am using milter extensively, however I am trying to > influence and log transport and sender

Re: Reverse DNS record

2022-12-20 Thread Janos Dohanics
On Tue, 20 Dec 2022 10:08:51 -0600 Noel Jones wrote: > > > On Dec 20, 2022, at 9:08 AM, Janos Dohanics > > wrote: > > > > ?Hello, > > > > I have asked my customer's ISP to set reverse DNS as > > "smtp.customer.com" for the IP address the ISP newly assigned to > > them. > > > > They set the

Re: Log Table Lookup Result

2022-12-20 Thread Mehmet Avcioglu
On Tue, Dec 20, 2022 at 10:20 PM Mehmet Avcioglu wrote: > Also I know syslog_name has a max length, but couldn't find the > documentation on it. > Sorry, what I am referring to is probably a syslog limitation, not postfix.

Re: Log Table Lookup Result

2022-12-20 Thread Mehmet Avcioglu
On Tue, Dec 20, 2022 at 9:57 PM Wietse Venema wrote: > However, Postfix does make information from multiple layers available > for policy decisions: > Thank you. Yes I am using milter extensively, however I am trying to influence and log transport and sender dependent transport decisions based

Re: Log Table Lookup Result

2022-12-20 Thread Wietse Venema
Mehmet Avcioglu: > On Sun, Dec 11, 2022 at 3:27 PM Mehmet Avcioglu wrote: > > > Is it possible to log the result of a table lookup? Perhaps similar to the > > header_checks INFO option. > > I guess it is not. > > I can write a daemon that acts like a tcp map and log the results, but I >

Re: Log Table Lookup Result

2022-12-20 Thread Mehmet Avcioglu
On Sun, Dec 11, 2022 at 3:27 PM Mehmet Avcioglu wrote: > Is it possible to log the result of a table lookup? Perhaps similar to the > header_checks INFO option. > I guess it is not. I can write a daemon that acts like a tcp map and log the results, but I wouldn't be able to match those log

Re: Reverse DNS record

2022-12-20 Thread Noel Jones
> On Dec 20, 2022, at 9:08 AM, Janos Dohanics wrote: > > Hello, > > I have asked my customer's ISP to set reverse DNS as > "smtp.customer.com" for the IP address the ISP newly assigned to them. > > They set the reverse DNS as "customer.com", which will pass the > requirement set by the

Reverse DNS record

2022-12-20 Thread Janos Dohanics
Hello, I have asked my customer's ISP to set reverse DNS as "smtp.customer.com" for the IP address the ISP newly assigned to them. They set the reverse DNS as "customer.com", which will pass the requirement set by the restriction "reject_unknown_reverse_client_hostname" or similar restrictions

Re: Duplicate message delivery to always_bcc with dovecot and Simple Content Filter (Postfix)

2022-12-20 Thread Yanko Hernández Álvarez
That's a good one It seems possible. Let me check. The problem is the ldap query now. I'm not sure if I can do that with ldap. mailfilter does two ldap queries, one to lookup the "main" group/role and another to get the email address of that role. Kind of a sql join, but in two parts. Let me

Re: warning: disabling connection caching

2022-12-20 Thread Matus UHLAR - fantomas
On 20.12.22 06:28, Fourhundred Thecat wrote: postfix/master: warning: process /usr/lib/postfix/sbin/scache pid 1215 killed by signal 11 is this HW machine? Signal 11 indicates HW (usually memory) problems if it repeats. Maybe corrupt filesystem data. -- Matus UHLAR - fantomas,

Re: warning: disabling connection caching

2022-12-20 Thread Scott Kitterman
On December 20, 2022 11:40:02 AM UTC, Fourhundred Thecat <400the...@gmx.ch> wrote: >> On 2022-12-20 12:13, Wietse Venema wrote: >> Fourhundred Thecat: >> >>> Also, if I wanted to test scache, how can I trigger it? >>> >>> If I send one email to multiple email addresses on same domain, will

Re: warning: disabling connection caching

2022-12-20 Thread Fourhundred Thecat
> On 2022-12-20 12:13, Wietse Venema wrote: Fourhundred Thecat: Also, if I wanted to test scache, how can I trigger it? If I send one email to multiple email addresses on same domain, will this trigger scache? (ie, deliver multiple emails in one connection to the server?) Did you build

Re: warning: disabling connection caching

2022-12-20 Thread Wietse Venema
Fourhundred Thecat: > Hello, > > I had this in my logs: > >postfix/master: warning: process /usr/lib/postfix/sbin/scache pid > 1215 killed by signal 11 >postfix/master: warning: /usr/lib/postfix/sbin/scache: bad command > startup -- throttling >postfix/smtp: warning: problem

Re: Duplicate message delivery to always_bcc with dovecot and Simple Content Filter (Postfix)

2022-12-20 Thread raf
On Mon, Dec 19, 2022 at 12:21:02PM -0500, Yanko Hernández Álvarez wrote: > On Mon, Dec 19, 2022 at 11:36 AM Matus UHLAR - fantomas > wrote: > > >#!/bin/sh > > > > > >/usr/bin/cat | /var/spool/filter/scripts/mailfilter | > > >/usr/sbin/sendmail -G -i "$@" > > > > > >exit $? > > > >