Re: SMTP hangs when MySQL is down

2011-12-09 Thread lst_hoe02
Zitat von Sebastian Wiesinger postfix-us...@ml.karotte.org: * lst_ho...@kwsoft.de lst_ho...@kwsoft.de [2011-12-08 14:46]: And I had hoped that perhaps this would be an improvement to postfix. Sadly it seems it was some kind of blasphemy to question the way postfix does handle this stuff. No,

Re: Switching to 587 submission

2011-12-09 Thread Reindl Harald
Am 09.12.2011 03:44, schrieb Philip Prindeville: On 12/8/11 5:33 PM, Reindl Harald wrote: Got it. I misunderstood you before. May I ask why using 465 for Thunderbird and Squirrelmail would be better than 587 for Thunderbird and 25 for Squirrelmail talking to localhost? there is no

Limit number of sent messages to specified domain

2011-12-09 Thread Amira Othman
Hi all I am using postfix 2.8 and I want to limit number of messages that will be sent to certain domain as yahoo or hotmail. How can I do that? Regards

Re: Limit number of sent messages to specified domain

2011-12-09 Thread Kirill Bychkov
Use the search of this list, repeatedly discussed On 9 December 2011 13:32, Amira Othman a.oth...@cairosource.com wrote: Hi all I am using postfix 2.8 and I want to limit number of messages that will be sent to certain domain as yahoo or hotmail. How can I do that? ** **

Two postfix on two IP on same host

2011-12-09 Thread Frank Bonnet
Hello I actually have one instance running on a host running as send only with SASL/TLS to let users relay their emails from external world, it runs on one IP adress. The host has two IP addresses on two ethernet interfaces and I would like to run another postfix instance on the OTHER IP

strange sender_access_maps issue

2011-12-09 Thread Tom Kinghorn
Good afternoon List. Apologies for posting again. I have a strange issue with my sender_access_maps where the DISCARD REJECTS work as expected, yet a hold does not I am seeing this in the logs. Dec 9 12:57:39 mx1 postfix/smtpd[395]:

Re: Two postfix on two IP on same host

2011-12-09 Thread Duane Hill
On Friday, December 09, 2011 at 10:46:48 UTC, f.bon...@esiee.fr confabulated: Hello I actually have one instance running on a host running as send only with SASL/TLS to let users relay their emails from external world, it runs on one IP adress. The host has two IP addresses on two

Re: SMTP hangs when MySQL is down

2011-12-09 Thread Wietse Venema
lst_ho...@kwsoft.de: I don't know the Postfix internals but if it where easy *and* safe to implement it would have been done already from someone feeling the need to do so. A quick search shows that trivial-rewrite server has no fatal errors - it reports all errors that it can detect to

Re: strange sender_access_maps issue

2011-12-09 Thread Noel Jones
On 12/9/2011 5:05 AM, Tom Kinghorn wrote: Good afternoon List. Apologies for posting again. I have a strange issue with my sender_access_maps where the DISCARD REJECTS work as expected, yet a hold does not I am seeing this in the logs. Dec 9 12:57:39 mx1 postfix/smtpd[395]:

Re: SMTP hangs when MySQL is down

2011-12-09 Thread Sebastian Wiesinger
* Wietse Venema wie...@porcupine.org [2011-12-09 13:47]: A quick search shows that trivial-rewrite server has no fatal errors - it reports all errors that it can detect to the client (in this case smtpd(8)). However there is one low-level library module (match_ops) that exits the program

Re: Switching to 587 submission

2011-12-09 Thread Grant
You can use SquirrelMail on 587. It doesn't work right now because of your smtpd_security_level=encrypt.  You could change your submission restrictions to something like  -o smtpd_security_level=may  -o mynetworks=127.0.0.1  -o smtpd_tls_auth_only=yes  -o

Re: Switching to 587 submission

2011-12-09 Thread Charles Marcus
On 2011-12-09 10:07 AM, Grant emailgr...@gmail.com wrote: master.cf: submission inet n - n - - smtpd -o smtpd_sasl_auth_enable=yes -o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject You should also have:

Re: Switching to 587 submission

2011-12-09 Thread Noel Jones
On 12/9/2011 10:04 AM, Charles Marcus wrote: On 2011-12-09 10:07 AM, Grant emailgr...@gmail.com wrote: master.cf: submission inet n - n - - smtpd -o smtpd_sasl_auth_enable=yes -o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject

Re: Switching to 587 submission

2011-12-09 Thread Grant
master.cf: submission inet n       -       n       -       -       smtpd -o smtpd_sasl_auth_enable=yes -o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject You should also have: smtpd_tls_security_level=encrypt for the submission service... Thank you but

Re: Switching to 587 submission

2011-12-09 Thread Grant
master.cf: submission inet n       -       n       -       -       smtpd -o smtpd_sasl_auth_enable=yes -o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject You should also have: smtpd_tls_security_level=encrypt for the submission service... Normally

Re: Switching to 587 submission

2011-12-09 Thread Charles Marcus
On 2011-12-09 11:12 AM, Grant emailgr...@gmail.com wrote: Thank you but if I do that I won't be able to connect from Squirrelmail which does not currently support STARTTLS. Squirrelmail is on the same machine as postfix so TLS isn't necessary there anyway. Which is why it was repeatedly

Re: Switching to 587 submission

2011-12-09 Thread Grant
Thank you but if I do that I won't be able to connect from Squirrelmail which does not currently support STARTTLS.  Squirrelmail is on the same machine as postfix so TLS isn't necessary there anyway. Which is why it was repeatedly suggested to you to continue to use port 465 (smtps) for

Re: Switching to 587 submission

2011-12-09 Thread Charles Marcus
On 2011-12-09 11:25 AM, Grant emailgr...@gmail.com wrote: It was also repeatedly suggested that I switch to exactly the arrangement that I've switched to. No, that was only presented as an option (there is always more than one way to skin a cat). Doing it the way you did it makes your

Re: Switching to 587 submission

2011-12-09 Thread Grant
It was also repeatedly suggested that I switch to exactly the arrangement that I've switched to. No, that was only presented as an option (there is always more than one way to skin a cat). Doing it the way you did it makes your primary submission port *less* secure, *just* so you can let

Re: Switching to 587 submission

2011-12-09 Thread Noel Jones
On 12/9/2011 10:15 AM, Grant wrote: master.cf: submission inet n - n - - smtpd -o smtpd_sasl_auth_enable=yes -o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject You should also have: smtpd_tls_security_level=encrypt for the

Re: Switching to 587 submission

2011-12-09 Thread Grant
master.cf: submission inet n       -       n       -       -       smtpd -o smtpd_sasl_auth_enable=yes -o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject You should also have: smtpd_tls_security_level=encrypt for the submission service... Normally

Re: Switching to 587 submission

2011-12-09 Thread Philip Prindeville
On 12/9/11 8:07 AM, Grant wrote: I should add that I took Noel's advice and Thunderbird is connecting remotely to 587 and Squirrelmail is connecting locally to 587 without encryption or authentication. The above config pertains to that arrangement. - Grant Now whenever you upgrade

Re: Switching to 587 submission

2011-12-09 Thread Philip Prindeville
On 12/9/11 2:26 AM, Reindl Harald wrote: well, as long thunderbird offers STARTTLS or SSL and for SSL 465 as default and as long 465 does not eat anybodys children It kicked my dog once...

Re: Switching to 587 submission

2011-12-09 Thread Grant
I should add that I took Noel's advice and Thunderbird is connecting remotely to 587 and Squirrelmail is connecting locally to 587 without encryption or authentication.  The above config pertains to that arrangement. - Grant Now whenever you upgrade Squirrelmail to something current, you

Re: CISCO breaks DKIM on their ASA/PIX (again)

2011-12-09 Thread Jeroen Geilman
On 2011-12-08 09:53, Ralf Hildebrandt wrote: Over the last few days I discussed SMTP delivery problems with a czech site which was using Postfix and a CISCO ASA with smtp protocol fixup enabled. smtp fixup is evil and should have died out years ago. People who still use it have no clue how to

Re: CISCO breaks DKIM on their ASA/PIX (again)

2011-12-09 Thread Ralf Hildebrandt
* Jeroen Geilman jer...@adaptr.nl: On 2011-12-08 09:53, Ralf Hildebrandt wrote: Over the last few days I discussed SMTP delivery problems with a czech site which was using Postfix and a CISCO ASA with smtp protocol fixup enabled. smtp fixup is evil and should have died out years ago. No

Re: CISCO breaks DKIM on their ASA/PIX (again)

2011-12-09 Thread Jeroen Geilman
On 2011-12-09 19:57, Ralf Hildebrandt wrote: * Jeroen Geilmanjer...@adaptr.nl: On 2011-12-08 09:53, Ralf Hildebrandt wrote: Over the last few days I discussed SMTP delivery problems with a czech site which was using Postfix and a CISCO ASA with smtp protocol fixup enabled. smtp fixup is evil

RE: CISCO breaks DKIM on their ASA/PIX (again)

2011-12-09 Thread Alfonso Alejandro Reyes Jimenez
As far as I know it just limit the commands that you can send to the mail server, you just have to be sure if you are using ESMTP or SMTP. Here's the link explaining how it works. All the customers of our company uses that inspect, the common issue is with proofpoint. Every other MTA is

Re: CISCO breaks DKIM on their ASA/PIX (again)

2011-12-09 Thread Wietse Venema
Alfonso Alejandro Reyes Jimenez: As far as I know it just limit the commands that you can send to the mail server, you just have to be sure if you are using ESMTP or SMTP. Here's the link explaining how it works. Well, that is how it is supposed to work. In reality, the code has a history of

Re: CISCO breaks DKIM on their ASA/PIX (again)

2011-12-09 Thread Ralf Hildebrandt
* Jeroen Geilman jer...@adaptr.nl: I am in no way implying that you did anything wrong! I wholeheartedly agree with your last posting :) It's just that I cringe every time I see this enabled and when I ask after it the answer is usually a variant on oh it's a security option offered by a

Re: Switching to 587 submission

2011-12-09 Thread Philip Prindeville
On 12/9/11 11:39 AM, Grant wrote: I should add that I took Noel's advice and Thunderbird is connecting remotely to 587 and Squirrelmail is connecting locally to 587 without encryption or authentication. The above config pertains to that arrangement. - Grant Now whenever you upgrade

Re: Switching to 587 submission

2011-12-09 Thread /dev/rob0
On Friday 09 December 2011 14:23:01 Philip Prindeville wrote: On 12/9/11 11:39 AM, Grant wrote: Philip: Now whenever you upgrade Squirrelmail to something current, you can pass your free time trying to figure out how to get it to do STARTTLS. :-) No need. Squirrelmail connects to 587

Re: Switching to 587 submission

2011-12-09 Thread Philip Prindeville
On 12/9/11 1:36 PM, /dev/rob0 wrote: On Friday 09 December 2011 14:23:01 Philip Prindeville wrote: On 12/9/11 11:39 AM, Grant wrote: Philip: Now whenever you upgrade Squirrelmail to something current, you can pass your free time trying to figure out how to get it to do STARTTLS. :-) No

Re: SMTP hangs when MySQL is down

2011-12-09 Thread Viktor Dukhovni
On Fri, Dec 09, 2011 at 07:47:08AM -0500, Wietse Venema wrote: lst_ho...@kwsoft.de: I don't know the Postfix internals but if it where easy *and* safe to implement it would have been done already from someone feeling the need to do so. A quick search shows that trivial-rewrite

Re: SMTP hangs when MySQL is down

2011-12-09 Thread Wietse Venema
Viktor Dukhovni: On Fri, Dec 09, 2011 at 07:47:08AM -0500, Wietse Venema wrote: lst_ho...@kwsoft.de: I don't know the Postfix internals but if it where easy *and* safe to implement it would have been done already from someone feeling the need to do so. A quick search shows

Re: memcache client for Postfix

2011-12-09 Thread Wietse Venema
Wietse Venema: This week I implemented a memcache client for Postfix in the hope that it would be useful to share postscreen(8) or verify(8) caches among multiple MTAs. The implementation is based on libmemcache. This was not too much work, given a few examples (libmemcache is