Re: lots of connections that make no sense

2019-11-14 Thread Dominic Raferd
On Fri, 15 Nov 2019 at 05:26, Fourhundred Thecat <400the...@gmx.ch> wrote: > On 15/11/2019 05.51, Viktor Dukhovni wrote: > > On Fri, Nov 15, 2019 at 04:47:55AM +0100, Fourhundred Thecat wrote: > > > >> I am wondering what is the purpose of connections like these: > >> > >> postfix/smtpd[5147]:

Re: lots of connections that make no sense

2019-11-14 Thread Fourhundred Thecat
On 15/11/2019 05.51, Viktor Dukhovni wrote: > On Fri, Nov 15, 2019 at 04:47:55AM +0100, Fourhundred Thecat wrote: > >> I am wondering what is the purpose of connections like these: >> >> postfix/smtpd[5147]: connect from unknown[193.56.28.121] >> postfix/smtpd[5147]: disconnect from unknown[1

Re: lots of connections that make no sense

2019-11-14 Thread Fourhundred Thecat
On 15/11/2019 06.06, Jeffrey 'jf' Lim wrote: > > ok then this makes sense. I've seen bots retry multiple passwords at > one go in the past; Fourhundred are all of these "auth=0/1"? yes, all are "auth=0/1". I have disabled auth on port 25, and I am using non-standard port for client authentication

Re: lots of connections that make no sense

2019-11-14 Thread Jeffrey 'jf' Lim
On Fri, Nov 15, 2019 at 12:52 PM Viktor Dukhovni wrote: > > On Fri, Nov 15, 2019 at 04:47:55AM +0100, Fourhundred Thecat wrote: > > > I am wondering what is the purpose of connections like these: > > > > postfix/smtpd[5147]: connect from unknown[193.56.28.121] > > postfix/smtpd[5147]: discon

Re: lots of connections that make no sense

2019-11-14 Thread Viktor Dukhovni
On Fri, Nov 15, 2019 at 04:47:55AM +0100, Fourhundred Thecat wrote: > I am wondering what is the purpose of connections like these: > > postfix/smtpd[5147]: connect from unknown[193.56.28.121] > postfix/smtpd[5147]: disconnect from unknown[193.56.28.121] ehlo=1 > auth=0/1 rset=1 quit=1 com

Re: lots of connections that make no sense

2019-11-14 Thread Fourhundred Thecat
On 15/11/2019 05.06, Jeffrey 'jf' Lim wrote: > On Fri, Nov 15, 2019 at 11:49 AM Fourhundred Thecat <400the...@gmx.ch> wrote: >> >> Also, judging by the fact that IP does not resolve to hostname, I assume >> these are not mail servers. Are these just some bots that are scanning >> the Internet for m

lots of connections that make no sense

2019-11-14 Thread Fourhundred Thecat
Hello, I am wondering what is the purpose of connections like these: postfix/smtpd[5147]: connect from unknown[193.56.28.121] postfix/smtpd[5147]: disconnect from unknown[193.56.28.121] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4 I have lots of these in my logs, from different IP addresses.

Re: Making Postfix know and use UNIX UIDs of local processes sending mail to localhost:25

2019-11-14 Thread Viktor Dukhovni
> On Nov 13, 2019, at 6:58 AM, Wietse Venema wrote: > > Implementations of the IDENT protocol (RFC 931) have been around > for decennia. Sure, but here's a comment from the source code of Debian's "pidentd": * We have observed Debian identd (on a fairly busy dual-CPU machine) * sometimes repo

Re: mime header check false positive

2019-11-14 Thread Rajesh M
thankyou very much it worked. rajesh - Original Message - From: Noel Jones [mailto:njo...@megan.vbhcs.org] To: postfix-users@postfix.org Sent: Thu, 14 Nov 2019 13:04:13 -0600 Subject: On 11/14/2019 12:56 PM, Rajesh M wrote: > hi, > > i am trying to block bad mime attachments (bat com ex

Re: mime header check false positive

2019-11-14 Thread Noel Jones
On 11/14/2019 12:56 PM, Rajesh M wrote: hi, i am trying to block bad mime attachments (bat com exe etc) at the smtp level itself. i used this guide http://www.cyberciti.biz/tips/postfix-block-mime-attachment-files.html /name=[^>]*\.(bat|com|exe|dll|vbs)/ REJECT however the above rules scans

mime header check false positive

2019-11-14 Thread Rajesh M
hi, i am trying to block bad mime attachments (bat com exe etc) at the smtp level itself. i used this guide http://www.cyberciti.biz/tips/postfix-block-mime-attachment-files.html /name=[^>]*\.(bat|com|exe|dll|vbs)/ REJECT however the above rules scans the entire file name instead of just the f

Re: Postfix web interface for log analysis

2019-11-14 Thread Patrick Proniewski
Hi Emanuel, > Is there any web interface exists for postfix email log analysis? What I > need is to see all the logs through web interface, see the reports of > rejection, deferred, bounces, success etc. w.r.t. datetime and/or domain > filter etc. If you have a moderate volume of logs (less than

Re: Postfix web interface for log analysis

2019-11-14 Thread Benny Pedersen
Emanuel skrev den 2019-11-14 16:35: I try to use sendmail analyzer, but I could not process gz files, and not find any help in the documentation, any ideas for this? zcat ? zcat foo.gz | analyzor-script | less

Re: Postfix web interface for log analysis

2019-11-14 Thread Emanuel
I try to use sendmail analyzer, but I could not process gz files, and not find any help in the documentation, any ideas for this? El 14/11/19 a las 10:42, Enrico Morelli escribió: On Thu, 14 Nov 2019 09:46:52 -0300 Emanuel wrote: Hi all, Is there any web interface exists for postfix email l

Re: Postfix web interface for log analysis

2019-11-14 Thread Enrico Morelli
On Thu, 14 Nov 2019 09:46:52 -0300 Emanuel wrote: > Hi all, > > Is there any web interface exists for postfix email log analysis? > What I need is to see all the logs through web interface, see the > reports of rejection, deferred, bounces, success etc. w.r.t. datetime > and/or domain filter etc

Postfix web interface for log analysis

2019-11-14 Thread Emanuel
Hi all, Is there any web interface exists for postfix email log analysis? What I need is to see all the logs through web interface, see the reports of rejection, deferred, bounces, success etc. w.r.t. datetime and/or domain filter etc. Thanks in advance for your guidance.