Re: Throttling bursts of connections at postscreen? More to do here?

2017-09-11 Thread yodeller
> > > Is there anything more you could do? Not really. If you really > > > want the log lines to go away you could put in a DENY in your > > > hosts table, but if you do that you're going to be doing it A > > > LOT. I wanted to know if these were overloading Postfix. Sounds like a no. Also

Throttling bursts of connections at postscreen? More to do here?

2017-09-09 Thread yodeller
Every few hours I get bursts of these from random addresses -- always at "poneytelecom.eu" (online.net) Communicating with abuse@ online.net/poneytelecom.eu is a lost cause. They're completely useless. Is postscreen doing its "best" job here at reducing load? It's clearly not passing the

unknown mime types for some websites' postfix-3.2.2.RELEASE_NOTES & postfix-3.2.2.HISTORY?

2017-09-05 Thread yodeller
On the web site, when the links for ReleaseNotes or History are https://archive.mgm51.com/mirrors/postfix-source/official/postfix-3.2.2.RELEASE_NOTES https://archive.mgm51.com/mirrors/postfix-source/official/postfix-3.2.2.HISTORY When I click on one of these, the link doesn't

Specify DNSBL reject code in postscreen reply map?

2017-09-05 Thread yodeller
I'm trying to understand reply maps' use. Specifically postscreen's. If I set up config in main.cf as default_rbl_reply = $rbl_code [P4] Service unavailable; $rbl_class [$rbl_what] blocked using $rbl_domain${rbl_reason?; $rbl_reason} postscreen_dnsbl_reply_map =

Re: verifying per site TLS policy -- maps override?

2017-08-22 Thread yodeller
On Tue, Aug 22, 2017, at 10:19 AM, Viktor Dukhovni wrote: > > So that looks like it should work. > > Yes, but what security goal does this achieve? Just what I said above. To help working with specific senders if only to debug, etc. I'm not looking for a policy or a philosphy, I'm just

Re: verifying per site TLS policy -- maps override?

2017-08-22 Thread yodeller
On Tue, Aug 22, 2017, at 09:36 AM, /dev/rob0 wrote: > See reject_plaintext_session, and in the case as you described, > check_client_access: > > http://www.postfix.org/postconf.5.html#reject_plaintext_session > http://www.postfix.org/postconf.5.html#check_client_access >

Re: verifying per site TLS policy -- maps override?

2017-08-22 Thread yodeller
On Tue, Aug 22, 2017, at 09:13 AM, Viktor Dukhovni wrote: > > Is there an inbound per-domain TLS policy map? > > http://www.postfix.org/TLS_README.html#client_tls_limits Thanks. Okay I get that. But that reads like policy to me. It doesn't sound like it's impossible. The reason that I'm

Re: verifying per site TLS policy -- maps override?

2017-08-22 Thread yodeller
On Tue, Aug 22, 2017, at 09:00 AM, Viktor Dukhovni wrote: > The global security level set via "smtp_tls_security_level" is > optionally preƫmpted by the per-destination policy table (which > can also override selected additional TLS settings). Yeah I see the option to set the additional TLS

verifying per site TLS policy -- maps override?

2017-08-22 Thread yodeller
Hi I just want to make sure I understand per-site domain policy maps' priority. If I set up an outbound postfix instance with -o smtp_tls_security_level=may -o smtp_tls_policy_maps=lmdb:/etc/postfix/tls_policy_outbound the way that works is that both are used, right? In other words, the

Re: How do you add LOGLEVEL labels to Postfix log output?

2017-08-19 Thread yodeller
Hello, On Sat, Aug 19, 2017, at 06:58 PM, Viktor Dukhovni wrote: > That said, both regular and debug logging in Postfix are logged > at the "info" level, Postfix does not use the syslog "debug" log > level. Therefore, built-in syslog log filtering cannot isolate > just the debug messages from

How do you add LOGLEVEL labels to Postfix log output?

2017-08-19 Thread yodeller
Hello, I use Postfix's per-domain debug logging a lot. My configuration's got parent_domain_matches_subdomains = debug_peer_list debug_peer_list = pcre:/etc/postfix/debug_peer_list.pcre debug_peer_level = 1 debugger_command =