TLS Question, untrusted connection

2013-03-26 Thread Marko Weber | ZBF
i sometimes mail with the deutschebank. when i send mails i use a tls_policy_map: db.com secure match=loninmrp23.uk.db.com:nyjinsmp07.us.db.com:loninmrp22.uk.db.com:loninmrp14.uk.db.com:nyginsmp02.us.db.com:nyjinsmp01.us.db.com .db.com secure

Re: Dont add the $myorigin domain to the FROM header field

2013-03-26 Thread Marko Weber | ZBF
Am 2013-03-22 18:50, schrieb Noel Jones: On 3/22/2013 11:44 AM, Victor d'Agostino wrote: Hi all, I use postfix as relay server to several internal domains. xxx is the main one. postconfig | grep domain prints : append_dot_mydomain = no mydomain = xxx myorigin = $mydomain relay_domains =

Re: TLS Question, untrusted connection

2013-03-26 Thread Reindl Harald
Am 26.03.2013 09:44, schrieb Marko Weber|ZBF: Mar 25 14:04:35 mail postfix/smtpd[31103]: Untrusted TLS connection established from loninmrp15.uk.db.com[160.83.44.131]: TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits) why is on incoming mails the TLS connection untrusted?

Re: check_recipient_access, regexp and case sensitivity

2013-03-26 Thread Fabio Sangiovanni
Viktor Dukhovni postfix-users at dukhovni.org writes: On Mon, Mar 25, 2013 at 05:44:45PM +0100, Fabio Sangiovanni wrote: $ postmap -q 'test at domain.tld' \ regexp:/etc/postfix/check_recipient_access.regexp REJECT wrong format while: $ postmap -q 'tEsT at domain.tld' \

Re: TLS Question, untrusted connection

2013-03-26 Thread Marko Weber | ZBF
Am 2013-03-26 10:30, schrieb Reindl Harald: Am 26.03.2013 09:44, schrieb Marko Weber|ZBF: Mar 25 14:04:35 mail postfix/smtpd[31103]: Untrusted TLS connection established from loninmrp15.uk.db.com[160.83.44.131]: TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits) why is on incoming mails

Re: TLS Question, untrusted connection

2013-03-26 Thread Reindl Harald
Am 26.03.2013 10:53, schrieb Marko Weber|ZBF: Am 2013-03-26 10:30, schrieb Reindl Harald: Am 26.03.2013 09:44, schrieb Marko Weber|ZBF: Mar 25 14:04:35 mail postfix/smtpd[31103]: Untrusted TLS connection established from loninmrp15.uk.db.com[160.83.44.131]: TLSv1 with cipher

Re: TLS Question, untrusted connection

2013-03-26 Thread Simon Brereton
On 26 March 2013 10:53, Marko Weber | ZBF we...@zackbummfertig.de wrote: Am 2013-03-26 10:30, schrieb Reindl Harald: Am 26.03.2013 09:44, schrieb Marko Weber|ZBF: Mar 25 14:04:35 mail postfix/smtpd[31103]: Untrusted TLS connection established from loninmrp15.uk.db.com[160.83.44.131]:

Distributed Postfix

2013-03-26 Thread Gaby L
Hi My teoretic question is how configure multiple (distributed) postfix mail servers for one domain,which can load balance tasks? (e.g gmail),but all servers same (unique) users list,alias,rules for one domain? Thanks gaby

Re: Dont add the $myorigin domain to the FROM header field

2013-03-26 Thread Wietse Venema
Marko Weber | ZBF: http://www.postfix.org/ADDRESS_REWRITING_README.html#william http://www.postfix.org/postconf.5.html#remote_header_rewrite_domain When you're using a content_filter, it's often useful to set: # main.cf remote_header_rewrite_domain = domain.invalid What is the goal

Re: dictionary-attack

2013-03-26 Thread Lima Union
On Mon, Mar 25, 2013 at 10:52 AM, Noel Jones njo...@megan.vbhcs.org wrote: On 3/25/2013 7:55 AM, Lima Union wrote: On Sat, Mar 23, 2013 at 11:31 AM, Benny Pedersen m...@junc.eu wrote: Ejaz skrev den 2013-03-23 11:49: ... are you missing http://www.hardwarefreak.com/fqrdns.pcre ? :) very

Re: Distributed Postfix

2013-03-26 Thread Wietse Venema
Gaby L: Hi My teoretic question is how configure multiple (distributed) postfix mail servers for one domain,which can load balance tasks? Multiple DNS MX records, multiple DNS A records, or a TCP-level load balancer. but all servers same (unique) users list,alias,rules for one

Re: Distributed Postfix

2013-03-26 Thread Victor d'Agostino
2013/3/26 Gaby L g...@autoglobus2000.ro ** Hi My teoretic question is how configure multiple (distributed) postfix mail servers for one domain,which can load balance tasks? (e.g gmail),but all servers same (unique) users list,alias,rules for one domain? Thanks gaby Hi, First, you

Re: Distributed Postfix

2013-03-26 Thread Victor d'Agostino
see attachment 2013/3/26 Victor d'Agostino d.agostino.vic...@gmail.com 2013/3/26 Gaby L g...@autoglobus2000.ro ** Hi My teoretic question is how configure multiple (distributed) postfix mail servers for one domain,which can load balance tasks? (e.g gmail),but all servers same

Re: Distributed Postfix

2013-03-26 Thread Bill Cole
On 26 Mar 2013, at 6:51, Gaby L wrote: Hi My teoretic question is how configure multiple (distributed) postfix mail servers for one domain,which can load balance tasks? (e.g gmail),but all servers same (unique) users list,alias,rules for one domain? As Dr. Venema's answer implies,

Re: dictionary-attack

2013-03-26 Thread Noel Jones
On 3/26/2013 7:04 AM, Lima Union wrote: On Mon, Mar 25, 2013 at 10:52 AM, Noel Jones njo...@megan.vbhcs.org wrote: On 3/25/2013 7:55 AM, Lima Union wrote: On Sat, Mar 23, 2013 at 11:31 AM, Benny Pedersen m...@junc.eu wrote: Ejaz skrev den 2013-03-23 11:49: ... are you missing

Re: dictionary-attack

2013-03-26 Thread Stan Hoeppner
On 3/26/2013 7:04 AM, Lima Union wrote: ... ok, it seems that for some reason the check is not being triggered (#847) after a postfix reload and 24 hours of operation in a busy server, any ideas? So when you grep Please relay via ISP against your mail log you get nothing? Do you have any

Re: TLS Question, untrusted connection

2013-03-26 Thread Viktor Dukhovni
On Tue, Mar 26, 2013 at 09:44:12AM +0100, Marko Weber | ZBF wrote: Mar 22 10:34:52 mail postfix/smtp[13970]: smtp2.db.com[160.83.77.178]:25: Matched subjectAltName: nyginsmp02.us.db.com Mar 22 10:34:52 mail postfix/smtp[13970]: smtp2.db.com[160.83.77.178]:25 CommonName nyginsmp02.us.db.com

Re: dictionary-attack

2013-03-26 Thread Lima Union
On Tue, Mar 26, 2013 at 1:17 PM, Stan Hoeppner s...@hardwarefreak.com wrote: On 3/26/2013 7:04 AM, Lima Union wrote: ... ok, it seems that for some reason the check is not being triggered (#847) after a postfix reload and 24 hours of operation in a busy server, any ideas? So when you grep

Re: check_recipient_access, regexp and case sensitivity

2013-03-26 Thread Viktor Dukhovni
On Tue, Mar 26, 2013 at 09:35:40AM +, Fabio Sangiovanni wrote: This behaviour is correct, but I can't get it using the restriction in postfix. The Postfix table layer is at the mercy of any upstream rewriting. Are you sure your input address is not mapped to lower case upstream?

Re: dictionary-attack

2013-03-26 Thread Benny Pedersen
Lima Union skrev den 2013-03-26 13:04: 853 #reject_unverified_recipient, postconf -n not just content listning from main.cf your error might just be that you have # at random lines

Re: dictionary-attack

2013-03-26 Thread Benny Pedersen
Lima Union skrev den 2013-03-26 18:59: what can I check? dig +trace ipv4.google.com are the trace with hostnames all places ? if you are on ipv6 change ipv4 to ipv6 are you using forwarders that does not support dnssec ? is it working if you use nameserver 8.8.8.8 in resolv.conf ?

Re: dictionary-attack

2013-03-26 Thread Wietse Venema
Lima Union: working. This MTA is behing a firewall, in a DMZ with a bidirectional mapping (1:1). I issued a grep ': connect from' and everything shown is 'connect from unknown[ip.add.re.ss]'. I'm using pdnsd for caching purposes. My resolv.conf points to 127.0.0.1 and seems to be working

Re: dictionary-attack

2013-03-26 Thread Lima Union
On Tue, Mar 26, 2013 at 3:14 PM, Benny Pedersen m...@junc.eu wrote: Lima Union skrev den 2013-03-26 13:04: 853 #reject_unverified_recipient, postconf -n not just content listning from main.cf your error might just be that you have # at random lines ok, here it's (hostname/ip

Re: dictionary-attack

2013-03-26 Thread Lima Union
On Tue, Mar 26, 2013 at 3:20 PM, Benny Pedersen m...@junc.eu wrote: Lima Union skrev den 2013-03-26 18:59: what can I check? dig +trace ipv4.google.com are the trace with hostnames all places ? if you are on ipv6 change ipv4 to ipv6 are you using forwarders that does not support dnssec

Re: dictionary-attack

2013-03-26 Thread Lima Union
On Tue, Mar 26, 2013 at 3:21 PM, Wietse Venema wie...@porcupine.org wrote: Lima Union: working. This MTA is behing a firewall, in a DMZ with a bidirectional mapping (1:1). I issued a grep ': connect from' and everything shown is 'connect from unknown[ip.add.re.ss]'. I'm using pdnsd for caching

Re: dictionary-attack

2013-03-26 Thread Reindl Harald
Am 26.03.2013 19:36, schrieb Lima Union: On Tue, Mar 26, 2013 at 3:21 PM, Wietse Venema wie...@porcupine.org wrote: A common mistake is to turn on chroot operation in the master.cf file without going through all the necessary steps to set up a chroot environment. This causes Postfix daemon

Re: dictionary-attack

2013-03-26 Thread Lima Union
Am 26.03.2013 19:36, schrieb Lima Union: Wietse, ok, I'll disable the fqrdns check for now and check the chroot configuration after I return from holidays this is ONE char in the master.cf and if i where you i would not make holidays as long a production server is known misconfigured ok,

Re: dictionary-attack

2013-03-26 Thread Wietse Venema
Lima Union: [ Charset ISO-8859-1 unsupported, converting... ] Am 26.03.2013 19:36, schrieb Lima Union: Wietse, ok, I'll disable the fqrdns check for now and check the chroot configuration after I return from holidays this is ONE char in the master.cf and if i where you i would not

Re: check_recipient_access, regexp and case sensitivity

2013-03-26 Thread Fabio Sangiovanni
Viktor Dukhovni postfix-users at dukhovni.org writes: Sorry, I don't do pastebins. If you want help include the relevant information in your message. Relevant (long piece of) information included at the end of this message :) Addresses used in access checks are case folded in Postfix

Re: check_recipient_access, regexp and case sensitivity

2013-03-26 Thread Viktor Dukhovni
On Tue, Mar 26, 2013 at 08:25:43PM +0100, Fabio Sangiovanni wrote: Addresses used in access checks are case folded in Postfix upstream of the access table. The original address goes into the queue file, but access checks use case folded addresses. Is it maybe the case to update the

Re: check_recipient_access, regexp and case sensitivity

2013-03-26 Thread Wietse Venema
Viktor Dukhovni: src/smtpd/smtpd_resolve.c: lowercase(STR(reply-recipient)); /* XXX */ This may have escaped the code cleanup when forced lowercase was removed from access maps. Wietse

Vaction for Virtual Domains?

2013-03-26 Thread craig . postfix
Hi, Product: postfix-2.6.6-2.2.el6_1.x86_64 We used to use the old vacation package for ages http://sourceforge.net/projects/vacation/. However since moving to virtual domains, I've had to move away from this product (as virtual domains don't support .forward files). Has anyone else found a

Re: Vaction for Virtual Domains?

2013-03-26 Thread Reindl Harald
Am 27.03.2013 00:03, schrieb craig.post...@noboost.org: Product: postfix-2.6.6-2.2.el6_1.x86_64 We used to use the old vacation package for ages http://sourceforge.net/projects/vacation/. However since moving to virtual domains, I've had to move away from this product (as virtual

Delivery to command in aliases ignored ?

2013-03-26 Thread Kajetan Dolinar
Greetings to everyone, I have a working Postfix + Cyrus system tested (has got some history of usage) but I want to add the Mailman system to it. However, it seems that I cannot get mail through to the Mailman system past the Mailman's aliases, i.e. the delivery to commands which Mailman uses to

Re: Delivery to command in aliases ignored ?

2013-03-26 Thread Viktor Dukhovni
On Wed, Mar 27, 2013 at 12:26:36AM +0100, Kajetan Dolinar wrote: Greetings to everyone, I have a working Postfix + Cyrus system tested (has got some history of usage) but I want to add the Mailman system to it. However, it seems that I cannot get mail through to the Mailman system past the