Re: Delivery to command in aliases ignored ?

2013-03-27 Thread Kajetan Dolinar
Hi, Viktor, Thank you very much for your answer. I did run the command, as you suggested, but the result may be seen ... # postmap -q test hash:/var/lib/mailman/data/aliases |/usr/lib/mailman/mail/mailman post test this is exactly what i would like to have ... the delivery of mail intended for

Re: dictionary-attack

2013-03-27 Thread Lima Union
On Tue, Mar 26, 2013 at 4:16 PM, Wietse Venema wie...@porcupine.org wrote: Lima Union: [ Charset ISO-8859-1 unsupported, converting... ] Am 26.03.2013 19:36, schrieb Lima Union: Wietse, ok, I'll disable the fqrdns check for now and check the chroot configuration after I return from

Fw: Distributed Postfix

2013-03-27 Thread Gaby L
Thanks I have refered to split only postfix functions,but for it ,is need create coherent users system. For example if I create one user in gmail system,this user physical is stored only one central machine then is accesed through diverse distribute mechanism (same DNS),or is replicate in

Re: dictionary-attack

2013-03-27 Thread Wietse Venema
Lima Union: Mar 26 15:56:34 relay1 postfix/smtpd[2021]: warning: 64.191.105.74: hostname 64-191-105-74.static.hostnoc.net verification failed: Name or service not known Yes, broken DNS happens. Instead of reject_unknown_client_hostname you could use

Re: check_recipient_access, regexp and case sensitivity

2013-03-27 Thread Fabio Sangiovanni
Wietse Venema wietse at porcupine.org writes: Viktor Dukhovni: src/smtpd/smtpd_resolve.c: lowercase(STR(reply-recipient)); /* XXX */ This may have escaped the code cleanup when forced lowercase was removed from access maps. Wietse Thanks for your

Re: check_recipient_access, regexp and case sensitivity

2013-03-27 Thread Wietse Venema
Viktor Dukhovni: src/smtpd/smtpd_resolve.c: lowercase(STR(reply-recipient)); /* XXX */ Wietse Venema: This may have escaped the code cleanup when forced lowercase was removed from access maps. Fabio Sangiovanni: Thanks for your answer, Wietse. Should we then expect a

Re: dictionary-attack

2013-03-27 Thread Stan Hoeppner
On 3/27/2013 7:30 AM, Lima Union wrote: Wietse, there's something I don't understand. I've commented out the check_reverse_client_hostname_access, Re-enable it. reloaded postfix and am still finding those DNS warnings (ie: hostname 77-121-229-206.dhcp.kram-city.net verification failed:

Re: dictionary-attack

2013-03-27 Thread Stan Hoeppner
On 3/26/2013 1:29 PM, Lima Union wrote: No ipv6 here and pdnsd is using 8.8.8.8 as DNS server. Instead of using a caching DNS proxy daemon querying Google's public DNS servers, I recommend you run a recursing caching resolver on your Postfix host, such as PowerDNS recursor (I've been using it

Re: dictionary-attack

2013-03-27 Thread Matthew Hall
Hello, I ran into a bit of an issue trying out fqrdns.pcre as recommended here in this thread. The header in the file recommended adding it into smtpd_client_restrictions. However if I place it there, I end up rejecting mail even from SASL authenticated client devices, if they also match a rule

AW: dictionary-attack

2013-03-27 Thread Uwe Drießen
Im Auftrag von Matthew Hall Hello, I ran into a bit of an issue trying out fqrdns.pcre as recommended here in this thread. The header in the file recommended adding it into smtpd_client_restrictions. However if I place it there, I end up rejecting mail even from SASL authenticated client

Re: dictionary-attack

2013-03-27 Thread Noel Jones
On 3/27/2013 5:11 PM, Matthew Hall wrote: Hello, I ran into a bit of an issue trying out fqrdns.pcre as recommended here in this thread. The header in the file recommended adding it into smtpd_client_restrictions. However if I place it there, I end up rejecting mail even from SASL

Re: dictionary-attack

2013-03-27 Thread Stan Hoeppner
On 3/27/2013 5:11 PM, Matthew Hall wrote: I ran into a bit of an issue trying out fqrdns.pcre as recommended here in this thread. The header in the file recommended adding it into smtpd_client_restrictions. The instructions I provide are examples, not a concise how-to. As with any

Re: dictionary-attack

2013-03-27 Thread /dev/rob0
On Wed, Mar 27, 2013 at 05:56:03PM -0500, Stan Hoeppner wrote: Frankly I'm surprised anyone still uses the old multi-section restrictions configuration these days. Sometimes it's necessary for complex restrictions, but I think the worst I've ever needed was 2-3 mumbles of

Re: dictionary-attack

2013-03-27 Thread Stan Hoeppner
On 3/27/2013 5:39 PM, Noel Jones wrote: One could argue the example included in the file should be clearer I'm open to suggestions. As long as the doc section doesn't end up longer than the expression list. (and it's missing the required '='). Fixed. Thanks for catching this oversight

Re: dictionary-attack

2013-03-27 Thread Matthew Hall
On Wed, Mar 27, 2013 at 3:56 PM, Stan Hoeppner s...@hardwarefreak.com wrote: It seems pretty clear you need to convert to putting everything under smtpd_recipient_restrictions. Makes things a lot easier. I give an example of this in the instructions as well. Doing so gives you precise

Re: dictionary-attack

2013-03-27 Thread Matthew Hall
I altered the restrictions according to the new advice: relay_restrictions - removed smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, reject_invalid_hostname, reject_non_fqdn_hostname, reject_non_fqdn_sender,

Re: dictionary-attack

2013-03-27 Thread Noel Jones
On 3/27/2013 6:15 PM, Stan Hoeppner wrote: On 3/27/2013 5:39 PM, Noel Jones wrote: One could argue the example included in the file should be clearer I'm open to suggestions. As long as the doc section doesn't end up longer than the expression list. I would suggest a fully-working

Re: dictionary-attack

2013-03-27 Thread Noel Jones
On 3/27/2013 7:07 PM, Matthew Hall wrote: smtpd_relay_restrictions = permit_sasl_authenticated, permit_mynetworks, #check_reverse_client_hostname_access pcre:/etc/postfix/fqrdns.pcre, reject_unauth_destination The above is wrong in two ways. First, anti-spam access lists

Re: dictionary-attack

2013-03-27 Thread Noel Jones
On 3/27/2013 7:18 PM, Matthew Hall wrote: I altered the restrictions according to the new advice: relay_restrictions - removed there's no reason to remove the safety net. smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated reject_unauth_destination Yes, these are

Re: compile and path

2013-03-27 Thread Mohsen Pahlevanzadeh
hi, sorry for late. i merged CCARGS as : / make -f Makefile.init makefiles 'CCARGS=-DHAS_MYSQL -I/usr/include/mysql/ -DUSE_SASL_AUTH -DDEF_SERVER_SASL_TYPE=\dovecot\ -DUSE_TLS -I/usr/include/openssl/' 'AUXLIBS=-L/usr/lib64/mysql -L/usr/lib -lmysqlclient -lz -lm -lssl

Re: dictionary-attack

2013-03-27 Thread Matthew Hall
On Wed, Mar 27, 2013 at 7:20 PM, Noel Jones njo...@megan.vbhcs.org wrote: On 3/27/2013 7:18 PM, Matthew Hall wrote: I altered the restrictions according to the new advice: relay_restrictions - removed there's no reason to remove the safety net. Makes sense. Corrected. Your

Re: dictionary-attack

2013-03-27 Thread Noel Jones
On 3/27/2013 10:07 PM, Matthew Hall wrote: One other question here. So, if I have a host which matches permit_sasl_authenticated, but also matches one of the rejections present in check_reverse_client_hostname_access, but permit_sasl_authenticated comes first in recipient_restrictions, then