[no subject]

2015-01-05 Thread Koldo Navarro
Hello, I am sending this message after searching for a solution on the Internet. Unfortunately I haven't been able to find a valid way to deal with my problem. My question is about address rewriting in Postfix. I have a bunch of users using internal addresses (p.e. user@mydomain.local). Some of

TLS issues with old Exchange Servers

2015-01-05 Thread Matthias Schneider
Hello, I noticed that many Exchange Servers nowadays have problems with TLS. Is there a way to make a fallback to plain if there is a timeout on MAIL FROM? I currently use smtp_tls_security_level=may I found some 100's domains on different IPs which have this problems right now, here is a

copying mail with non-local recipient

2015-01-05 Thread Wietse Venema
Koldo Navarro: [using sender_bcc_maps] user@mydomain.localregistry@mydomain.local then I get copy of all emails, both internal and outgoing ones. But I don't want to keep a copy of internal emails as there are too many of them, and I wouldn't want to have to set filters in the mail client

Re: copying mail with non-local recipient

2015-01-05 Thread Koldo Navarro
Hello, thanks for your answer, but copy depends only on sender. All outgoing emails must be copied, regardless the recipient. Greetings On 5 January 2015 at 14:16, Wietse Venema wie...@porcupine.org wrote: Koldo Navarro: [using sender_bcc_maps] user@mydomain.local

Re: copying mail with non-local recipient

2015-01-05 Thread Wietse Venema
Greetings Koldo Navarro: thanks for your answer, but copy depends only on sender. All outgoing emails must be copied, regardless the recipient. So it depends on sender *and* destination (you want to copy all remote mail from a specific sender). In that case, you need the second part of my

Re: TLS issues with old Exchange Servers

2015-01-05 Thread Robert Schetterer
Am 05.01.2015 um 15:10 schrieb Matthias Schneider: Hello, I noticed that many Exchange Servers nowadays have problems with TLS. Is there a way to make a fallback to plain if there is a timeout on MAIL FROM? I currently use smtp_tls_security_level=may I found some 100's domains on

Re: TLS issues with old Exchange Servers

2015-01-05 Thread Viktor Dukhovni
On Mon, Jan 05, 2015 at 03:10:49PM +0100, Matthias Schneider wrote: I noticed that many Exchange Servers nowadays have problems with TLS. Is there a way to make a fallback to plain if there is a timeout on MAIL FROM? Postfix 2.12 (almost released, but for now 2.12-20141228 is the latest

Re: TLS issues with old Exchange Servers

2015-01-05 Thread DTNX Postmaster
On 05 Jan 2015, at 15:52, Viktor Dukhovni postfix-us...@dukhovni.org wrote: On Mon, Jan 05, 2015 at 03:10:49PM +0100, Matthias Schneider wrote: I noticed that many Exchange Servers nowadays have problems with TLS. Is there a way to make a fallback to plain if there is a timeout on MAIL FROM?

Re: TLS issues with old Exchange Servers

2015-01-05 Thread Viktor Dukhovni
On Mon, Jan 05, 2015 at 06:01:03PM +0100, DTNX Postmaster wrote: With RC4-SHA early enough for the 11-year old Microsoft Exchange servers. Sadly, older Exchange servers (2003 at least) will favour 3DES over RC4 for TLS connections, IIRC. This is not correct. I don't have the fix we

Re: TLS issues with old Exchange Servers

2015-01-05 Thread li...@rhsoft.net
Am 05.01.2015 um 18:47 schrieb Viktor Dukhovni: On Mon, Jan 05, 2015 at 06:01:03PM +0100, DTNX Postmaster wrote: With RC4-SHA early enough for the 11-year old Microsoft Exchange servers. Sadly, older Exchange servers (2003 at least) will favour 3DES over RC4 for TLS connections, IIRC.

Re: TLS issues with old Exchange Servers

2015-01-05 Thread DTNX Postmaster
On 05 Jan 2015, at 18:47, Viktor Dukhovni postfix-us...@dukhovni.org wrote: On Mon, Jan 05, 2015 at 06:01:03PM +0100, DTNX Postmaster wrote: With RC4-SHA early enough for the 11-year old Microsoft Exchange servers. Sadly, older Exchange servers (2003 at least) will favour 3DES over RC4

Re: TLS issues with old Exchange Servers

2015-01-05 Thread DTNX Postmaster
On 05 Jan 2015, at 18:59, li...@rhsoft.net wrote: Am 05.01.2015 um 18:47 schrieb Viktor Dukhovni: On Mon, Jan 05, 2015 at 06:01:03PM +0100, DTNX Postmaster wrote: With RC4-SHA early enough for the 11-year old Microsoft Exchange servers. Sadly, older Exchange servers (2003 at least) will

Re: TLS issues with old Exchange Servers

2015-01-05 Thread Per Thorsheim
Den 05.01.2015 18:59, skrev li...@rhsoft.net: Am 05.01.2015 um 18:47 schrieb Viktor Dukhovni: On Mon, Jan 05, 2015 at 06:01:03PM +0100, DTNX Postmaster wrote: With RC4-SHA early enough for the 11-year old Microsoft Exchange servers. Sadly, older Exchange servers (2003 at least) will

Re: TLS issues with old Exchange Servers

2015-01-05 Thread DTNX Postmaster
On 05 Jan 2015, at 19:18, Viktor Dukhovni postfix-us...@dukhovni.org wrote: On Mon, Jan 05, 2015 at 06:59:06PM +0100, li...@rhsoft.net wrote: No, this is a bad idea, it is in fact 3DES that is broken with such servers Shouldn't we start to disable RC4 as well as DES-CBC3-SHA for that

Re: TLS issues with old Exchange Servers

2015-01-05 Thread li...@rhsoft.net
Am 05.01.2015 um 19:43 schrieb DTNX Postmaster: On 05 Jan 2015, at 19:18, Viktor Dukhovni postfix-us...@dukhovni.org wrote: On Mon, Jan 05, 2015 at 06:59:06PM +0100, li...@rhsoft.net wrote: No, this is a bad idea, it is in fact 3DES that is broken with such servers Shouldn't we start to

Re: TLS issues with old Exchange Servers

2015-01-05 Thread DTNX Postmaster
On 05 Jan 2015, at 19:33, Per Thorsheim p...@thorsheim.net wrote: Den 05.01.2015 18:59, skrev li...@rhsoft.net: Am 05.01.2015 um 18:47 schrieb Viktor Dukhovni: On Mon, Jan 05, 2015 at 06:01:03PM +0100, DTNX Postmaster wrote: With RC4-SHA early enough for the 11-year old Microsoft Exchange

Re: TLS issues with old Exchange Servers

2015-01-05 Thread DTNX Postmaster
On 05 Jan 2015, at 19:51, li...@rhsoft.net wrote: Gmail's outbound servers prefers RC4-SHA if offered by the SMTP server, when Gmail drops RC4 support, these domains will finally feel real pressure to either disable or fix their TLS stack. Gmail prefers ECDHE-RSA-AES256-SHA, and has for

Re: TLS issues with old Exchange Servers

2015-01-05 Thread li...@rhsoft.net
Am 05.01.2015 um 20:23 schrieb DTNX Postmaster: On 05 Jan 2015, at 19:51, li...@rhsoft.net wrote: Gmail's outbound servers prefers RC4-SHA if offered by the SMTP server, when Gmail drops RC4 support, these domains will finally feel real pressure to either disable or fix their TLS stack.

Re: copying mail with non-local recipient

2015-01-05 Thread Koldo Navarro
Yes... I didn't see it that way. I was more on Postfix to apply the bcc_maps rules based on the sender's external addresses. I had already tried some rules based on disregarding emails with local recipients, but there may be a mixture of local and external ones in the same email, and it didn't

Re: using 521 responses instead of default 554 -- why NOT use them for all known spam?

2015-01-05 Thread Noel Jones
On 1/4/2015 5:43 PM, rogt3...@proinbox.com wrote: My question is about usage. Is there a reason NOT to simply use the 521 hangup coes for ALL the spamhaus hits from 127.0.0.2-11 ? It seems to me like all of those would be good candidates. The 521 response code is a fairly recent

Re: using 521 responses instead of default 554 -- why NOT use them for all known spam?

2015-01-05 Thread Bill Cole
On 4 Jan 2015, at 18:43, rogt3...@proinbox.com wrote: Reading Postfix's docs re Disconnect suspicious SMTP clients http://www.postfix.org/STRESS_README.html#hangup in the example there it says To hang up connections from blacklisted zombies, you can set specific Postfix SMTP server reject