[pfx] Re: smtp_header_checks and opendkim

2023-11-18 Thread Wietse Venema via Postfix-users
Danil Smirnov via Postfix-users: > Hi all, > > I want to manipulate the headers (add and replace) of the outgoing mail > before the message is signed by Opendkim. If using smtp_header_checks I see > that the signature is broken - probably because Opendkim has signed the > message earlier in the

[pfx] Re: Get rid of unsolicited email

2023-11-18 Thread Wietse Venema via Postfix-users
Ga?l Lalire via Postfix-users: > To do so smtp server should manage a list of email which are human. > - First you will populate this list with your address book and then > each time you send a mail it will add each ` to addresses ' to > this human list. > - If you receive a mail where ` from

[pfx] Re: Return-path: == From:

2023-11-17 Thread Wietse Venema via Postfix-users
Viktor Dukhovni via Postfix-users: > On Fri, Nov 17, 2023 at 07:19:31PM +0100, Steffen Nurpmeso via Postfix-users > wrote: > > >Remarks: many MTA installations and sites disallow setting an > >explicit reverse-path, but for members of dedicated user > >groups, or after

[pfx] Re: LMTP delivery failing for all backend during single backend failure

2023-11-14 Thread Wietse Venema via Postfix-users
seena--- via Postfix-users: > we have a single lmtp end point which is pointing load balancer . > > Lmtp endpoint ---> Load balance --> Dovecot director --> Dovecot > backend What is an endpoint: TCP socket, UNIX-domain socket, avian carriers, and how is Postfix configured to CONNECT TO that

[pfx] Re: Replacing ancient Qmail with Postfix.

2023-11-09 Thread Wietse Venema via Postfix-users
Wietse Venema via Postfix-users: > Shaun Erickson via Postfix-users: > > mailserver.fd.com : > > Accepts all mail from our servers (including itself). > > If the mail is destined for fd.com , it is - with the exception > > of ab...@fd.com , postmas...@fd.com , and r...@

[pfx] Re: Replacing ancient Qmail with Postfix.

2023-11-09 Thread Wietse Venema via Postfix-users
Shaun Erickson via Postfix-users: > mailserver.fd.com : > Accepts all mail from our servers (including itself). > If the mail is destined for fd.com , it is - with the exception > of ab...@fd.com , postmas...@fd.com , and r...@fd.com - sent > straight to /dev/null. > /etc/postfix/main.cf:

[pfx] Re: build with mariadb

2023-11-09 Thread Wietse Venema via Postfix-users
Levente Birta via Postfix-users: > Hello > > I'm building the latest 3.9 with mariadb 10.8, but when I running I get > the error: > > fatal: load_library_symbols: dlopen failure loading > /usr/lib64/postfix/postfix-mysql.so: > /usr/lib64/postfix/postfix-mysql.so: undefined symbol: >

[pfx] Re: Redirecting mail with an mx record containing *.protection.outlook.com or *.prod.outlook.com to a different transport

2023-11-08 Thread Wietse Venema via Postfix-users
Norbert Schmidt via Postfix-users: > Am 07.11.2023 um 17:26 schrieb Wietse Venema via Postfix-users: > > Viktor Dukhovni via Postfix-users: > >> On Tue, Nov 07, 2023 at 08:14:04AM -0500, Wietse Venema via Postfix-users > >> wrote: > >> > >>> Anoth

[pfx] Re: Redirecting mail with an mx record containing *.protection.outlook.com or *.prod.outlook.com to a different transport

2023-11-07 Thread Wietse Venema via Postfix-users
Viktor Dukhovni via Postfix-users: > On Tue, Nov 07, 2023 at 08:14:04AM -0500, Wietse Venema via Postfix-users > wrote: > > > Another option would be to use the DNS resolver (Bind, unbound, etc) > > support to manipulate zone lookups. > > But the OP wants a dedicated

[pfx] Re: Redirecting mail with an mx record containing *.protection.outlook.com or *.prod.outlook.com to a different transport

2023-11-07 Thread Wietse Venema via Postfix-users
Norbert Schmidt via Postfix-users: > Hello, > > as many people we do have problems delivering mail through the Microsoft > MX'es which are used by a lot of company domains. All these domains use MX > records with *.protection.outlook.com or *.prod.outlook.com. > > I am looking for a way to

[pfx] Re: local domain email collection

2023-11-06 Thread Wietse Venema via Postfix-users
lejeczek via Postfix-users: > Hi guys. > > How do you do your local domain local root mail collection? > Having a numer of boxes, say: > r...@box1.my.private > r...@box2.my.private > etc.. Have you considerd using local aliases to forward mail for 'root' to a different address? $ man 5 aliases

[pfx] Re: Recommendation for dkim signing

2023-11-06 Thread Wietse Venema via Postfix-users
Patrick Ben Koetter via Postfix-users: > Noel, > > * Noel Butler via Postfix-users : > > > sys4.de are not removing original DKIM sigs just adding postfix.org's, > > > which also fails for some reason, but ohh looky that - SPF passes :D > > > > Decided to have a look ater lunch, that looks like

[pfx] Re: Multiple cascaded lookup tables for check_recipient_access possible?

2023-11-05 Thread Wietse Venema via Postfix-users
r.barclay--- via Postfix-users: > Hello, > > Does Postfix support specifying multiple lookup tables for > check_recipient_access? > (If there's no match in the first table, look up in the next one.) > > smtpd_recipient_restrictions = > reject_unauth_pipelining, >

[pfx] Re: resolv.conf in chroot

2023-11-05 Thread Wietse Venema via Postfix-users
Jesper Dybdal via Postfix-users: > To avoid using a public name server for DNSBL lookups, I would like the > DNSBL checks to be done using only the name server running on localhost. > But I would like the rest of the system to have for instance Google as a > secondary name server. > > I do not

[pfx] Re: When using LDAP over socket, „smtpd_sender_login_maps“ requires an LDAP socket relative to chroot in contrast to other map configurations (potential bug?)

2023-11-05 Thread Wietse Venema via Postfix-users
As Viktor mentions, best practice is to: - Share the LDAP socket handle among the three tables that connect to the same LDAP endpoint (i.e. delay the bind with bind=no in the three *cf files). - Open LDAP tables from outside the chroot, by configuring LDAP tables as proxy:ldap:/path/to/file, and

[pfx] Re: When using LDAP over socket, „smtpd_sender_login_maps“ requires an LDAP socket relative to chroot in contrast to other map configurations (potential bug?)

2023-11-04 Thread Wietse Venema via Postfix-users
Viktor Dukhovni via Postfix-users: > On Sat, Nov 04, 2023 at 09:48:32AM -0400, Wietse Venema via Postfix-users > wrote: > > > To be precise: Postfix opens your LDAP configuration file and asks > > the LDAP library to create an LDAP client instance, before entering > >

[pfx] Re: When using LDAP over socket, „smtpd_sender_login_maps“ requires an LDAP socket relative to chroot in contrast to other map configurations (potential bug?)

2023-11-04 Thread Wietse Venema via Postfix-users
Matthias Nagel via Postfix-users: > Hello all, > > I am using Postfix 3.8.1 on Ubuntu 23.10. Per distribution default, > Postfix runs chrooted. I have setup LDAP lookups for most maps. > OpenLDAP is only listening via UNIX socket on > ldapi:///var/run/slapd/ldapi. > > For all but one LDAP lookup

[pfx] Re: Connect Postfix to Dovecot SASL with TLS?

2023-11-03 Thread Wietse Venema via Postfix-users
Nick Lockheart via Postfix-users: > > If I have Postfix configured to use Dovecot SASL via TCP, and Dovecot > is running on a remote server, can I set up Postfix to use TLS for its > connection to Dovecot SASL? > > Postfix main.cf: > > smtpd_sasl_path = inet:dovecot.example.com:12345 >

[pfx] Re: [pfx-dev] Re: Bug in Dovecot SASL driver: authentication failure reason is wrong

2023-11-02 Thread Wietse Venema via Postfix-users
Stephan Bosch via Postfix-devel: > > Op 2-11-2023 om 15:22 schreef Wietse Venema: > > Stephan Bosch via Postfix-devel: > >> Looks like Postfix [...] somehow uses the data from the previous CONT auth > >> service > >> response as the reason. > > Does

[pfx] Re: DEF_DB_TYPE change?

2023-11-02 Thread Wietse Venema via Postfix-users
Eray Aslan via Postfix-users: > On Wed, Nov 01, 2023 at 09:41:07AM -0400, Wietse Venema via Postfix-users > wrote: > > Eray Aslan via Postfix-users: > > > Having said that, Berkeley DB is mature software and it works and is > > > widely available in various *nix

[pfx] Postfix stable release 3.8.3, and legacy releases 3.7.8, 3.6.12, 3.5.22

2023-11-01 Thread Wietse Venema via Postfix-users
[An on-line version of this announcement will be available at https://www.postfix.org/announcements/postfix-3.8.3.html] Fixed with Postfix 3.8.3, 3.7.8, 3.6.12, 3.5.22: * Bugfix (defect introduced Postfix 2.5, date 20080104): the Postfix SMTP server was waiting for a client command instead

[pfx] Re: DEF_DB_TYPE change?

2023-11-01 Thread Wietse Venema via Postfix-users
Eray Aslan via Postfix-users: > About 10 years ago, Oracle switched the licencing for Berkeley DB to > AGPL. As a result, most distributions decided to stick to the versions > prior to the licence change and there were (and are) some initiatives > throughout the years to stop shipping Berkeley DB

[pfx] Re: forward IP source from a postfix relay to a postfix server

2023-10-31 Thread Wietse Venema via Postfix-users
testeur via Postfix-users: > Hi, > > Thx wietse for your help. > > I can understand now more precisely where to act. > > In the External_Postfix_relay, i use too amavis, spamassassin, > policy-spf. Then i ve to indicate the "smtp_send_xforward_command=yes" > option in the master.cf . But i

[pfx] Re: read postscreen database?

2023-10-31 Thread Wietse Venema via Postfix-users
Viktor Dukhovni via Postfix-users: > On Tue, Oct 31, 2023 at 01:38:13PM -0400, Michael W. Lucas via Postfix-users > wrote: > > > That's what I would have thought. I can run postmap -s and postmap -q > > on the usual db files in /etc/postfix just fine, but when I try it on > >

[pfx] Re: read postscreen database?

2023-10-31 Thread Wietse Venema via Postfix-users
Michael W. Lucas via Postfix-users: > Hi, > > Is there a way to dump the postscreen database, showing which > addresses are cached and why? > > Running postfix 3.8 on FreeBSD. postmap -s The database contains tuples with (client IP address, list of timestamps). Each timestamp indicates when

[pfx] Re: Postfix 3.8.2 compile problem in Solaris 11.4

2023-10-31 Thread Wietse Venema via Postfix-users
Viktor Dukhovni via Postfix-users: > My advice by the way is to use dynamic not static linking. The latter > is not recommended, especially on Solaris. Dynamic linking is much > more adept at avoiding symbol conflics, and is better "supported" on > Solaris. > > make -f Makefile.init

[pfx] Re: Postfix 3.8.2 compile problem in Solaris 11.4

2023-10-31 Thread Wietse Venema via Postfix-users
Jaco Lesch via Postfix-users: > Hello > > Has anyone been able to compile Postfix 3.8 on Solaris 11.4 using GCC, > current "gcc version 12.2.0 (GCC)", with TLS support? > > Attempting to compile with the follow settings, with OpenSSL 3.0.8 > (Library: OpenSSL 3.0.8 7 Feb 2023): > make

[pfx] Re: FW: Wrong email in DMARC dns

2023-10-30 Thread Wietse Venema via Postfix-users
Szymon Malinowski via Postfix-users: > You see the point? We got stuck in a loop of sending DMARC reports which are > beeing bounced because of unknown user. > > Is there any way to prevent such situations? Many decennia ago, in RFC 821, and perhaps earlier, the solution to avoid email error

[pfx] Re: Recommended APP to build approved transport recipients from Exhange / AD / LDAP

2023-10-26 Thread Wietse Venema via Postfix-users
Joey J via Postfix-users: > Hello All, > > I'm trying to see if someone has a good app to connect to an exchange or > O365 server either via LDAP or AD to grab all of the legitimate email > accounts, forwarding accounts and Groups in order to build a > transport_recipients file this way reject

[pfx] PATCH: forward_path setting not being processed correctly after upgrade

2023-10-26 Thread Wietse Venema via Postfix-users
sandmant--- via Postfix-users: > I am updating a system from postfix-2.10.1 to postfix-3.5.9 (and > RHEL7->RHEL9), and it seems my forward_path is no longer getting processed > correctly. > > postconf shows the correct forward_path: > > root@rt2:/etc/postfix-auth> postconf -c

[pfx] Re: logging username in a failed smtp attemps

2023-10-24 Thread Wietse Venema via Postfix-users
Viktor Dukhovni via Postfix-users: > On Tue, Oct 24, 2023 at 12:52:37PM +0200, Paul Menzel via Postfix-users wrote: > > > Jozsef Kadlecsik submitted a patch, and it was accepted and is going to be > > available in the 3.9 release [1]. > > > > > 20231006 > > > > > > Cleanup: attempt to log the

[pfx] Re: Wildcard sender_transport

2023-10-24 Thread Wietse Venema via Postfix-users
Mark Constable via Postfix-users: > Hi folks, I have googled for this but not found a definitive answer. > > I have two IPs for my postfix server and want to send out most emails > from one IP but a few via the alternate IP. I'm using this in main.cf... > >

[pfx] Re: [CERT-Bund#2023092728001552] Vulnerability report regarding postfix and postfix-mta-sts-resolver

2023-10-24 Thread Wietse Venema via Postfix-users
I am the main Postfix author. At this time, there is no MTA-STS support in the software that is distributed by the Postfix project. The postfix-mta-sts-resolver software is a third-party extension that is developed and maintained separately from Postfix. I suggest that you contact their authors

[pfx] Re: postfix milter connection information missing

2023-10-22 Thread Wietse Venema via Postfix-users
mailmary--- via Postfix-users: > > we must be looking at different manuals/specifications because I > don't see how a SMFIC_ABORT is implied here. Your SMFIC_ABORT implementation of this spec: Quote from milter-protol.txt: 'A' SMFIC_ABORT Abort current filter checks

[pfx] Re: postfix milter connection information missing

2023-10-21 Thread Wietse Venema via Postfix-users
Wietse Venema: > - After the remote SMTP client connects to Postfix, The Postfix > SMTP daemon sends 'CONNECT' macros (j, _, {daemon_name}) and > SMFIC_CONNECT. > > - After the remote SMTP client sends STARTTLS, the Postfix SMTP > daemon sends SMFIC_ABORT to reset Milter

[pfx] Re: postfix milter connection information missing

2023-10-21 Thread Wietse Venema via Postfix-users
mailmary--- via Postfix-users: > > (resending because the previous email failed to submit due to its size) > > I'm sorry I did not provide enough information. > > With "the next email" I mean the next SMTP SESSION, a different sender. > > I should also mention that I'm using AlmaLinux

[pfx] Re: postfix milter connection information missing

2023-10-21 Thread Wietse Venema via Postfix-users
mailmary--- via Postfix-users: > > Hello everyone, > > While running my milter, I noticed an inconsistency filtering incoming mail > by their connection information and by inconsistency I mean complete lack of > data. Of course it could be a bug in my milter, but in case it is not, here > is

[pfx] Re: SMTP Require TLS Option?

2023-10-18 Thread Wietse Venema via Postfix-users
Joachim Lindenberg via Postfix-users: > Thanks Wietse, > > I agree that end-to-end use cases are difficult. I have nothing to add here. Wietse ___ Postfix-users mailing list -- postfix-users@postfix.org To unsubscribe send an email to

[pfx] Re: can't read SMFIC_OPTNEG

2023-10-17 Thread Wietse Venema via Postfix-users
natan via Postfix-users: > Hi > I have a some problem with setup > opendkim+opendmarc+amavisd-milter > > > main.cf--- > smtpd_milters = > inet:localhost:10028,inet:localhost:10027,inet:localhost:10029 > > > When I try local telnet 25 i get many many logs like: > .. > Oct 17

[pfx] Re: milter SMFIC_ABORT instead of SMFIC_QUIT

2023-10-17 Thread Wietse Venema via Postfix-users
mailmary--- via Postfix-users: > > Hello everyone, > > I'm coding a milter and I noticed an issue with postfix. Once postfix is done > communicating with the milters, instead of sending a SMFIC_QUIT, it sends > SMFIC_ABORT. > > abort all milters > milter8_abort: abort milter

[pfx] Re: Postscreen dnsbl logs

2023-10-16 Thread Wietse Venema via Postfix-users
Matus UHLAR - fantomas via Postfix-users: > I see this was changed in 20120222 > Cleanup: when multiple DNSBLs block an SMTP client, the > postscreen "reject" message now gives credit to the DNSBL > with the largest weight, instead of the DNSBL that replies >

[pfx] Re: Postscreen dnsbl logs

2023-10-16 Thread Wietse Venema via Postfix-users
UHLAR - fantomas via Postfix-users: > >> Note that this can even result into logging DNSWL as reason for blocking, > >> if > >> e.g. IP hits one DNSWL but multiple DNSBLs. You can use > >> postscreen_dnsbl_reply_map to map the list into other strings, e.g.

[pfx] Re: Postscreen dnsbl logs

2023-10-16 Thread Wietse Venema via Postfix-users
Matus UHLAR - fantomas via Postfix-users: > On 16.10.23 10:33, Ivan Ionut via Postfix-users wrote: > >postscreen_blacklist_action = drop > >postscreen_dnsbl_threshold = 4 > >postscreen_dnsbl_action = enforce > >postscreen_dnsbl_sites = > >zen.spamhaus.org > >b.barracudacentral.org > >

[pfx] Re: Postscreen dnsbl logs

2023-10-16 Thread Wietse Venema via Postfix-users
Viktor Dukhovni via Postfix-users: > On Mon, Oct 16, 2023 at 10:33:34AM +0300, Ivan Ionut via Postfix-users wrote: > > > Hi, I'm using postscreen dnsbl configuration to block some spam: > > > > postscreen_blacklist_action = drop > > postscreen_dnsbl_threshold = 4 > > postscreen_dnsbl_action =

[pfx] Re: SMTP Require TLS Option?

2023-10-13 Thread Wietse Venema via Postfix-users
Joachim Lindenberg via Postfix-users: > Hello, > > are there any ideas or plans to implement SMTP Require TLS Option (RFC 8689) > in postfix? It is not on the calendar. Below is a preliminary analysis of the implementation effort. Rumor has it that there was a preliminary implementation for

[pfx] Re: Chaining XFORWARD

2023-10-12 Thread Wietse Venema via Postfix-users
Wietse: > Postfix does not XFORWARD the information that it has received > with XFORWARD. It XFORWARDs the information that it has used for > its own smtpd_mumble_restrictions. Pedro David Marco: > Thanks Wietse, sometimes we want to stretch Postifx like gum beyond limits... > Thanks again, Mr!

[pfx] Re: No Permissions To TLS Certificates

2023-10-12 Thread Wietse Venema via Postfix-users
Matthew J Black via Postfix-users: > On 12/10/2023 23:19, Wietse Venema via Postfix-users wrote: > > If the 'find' command cannot enumerate mode 755 directories, then > > this is no longer a problem that receives Postfix support. > > > > Turning off SeLinux is easy. &

[pfx] Re: Chaining XFORWARD

2023-10-12 Thread Wietse Venema via Postfix-users
Pedro David Marco via Postfix-users: > Hi, > Postfix documentation states clearly that XFORDWARD is intended for scenarios > like this: > Client -> MTA1-> Content_filter -> MTA2 > And then Content_filter is able to get the IP of Client. Works great! Only if the filter understands XFORWARD

[pfx] Re: No Permissions To TLS Certificates

2023-10-12 Thread Wietse Venema via Postfix-users
duluxoz via Postfix-users: > (Sorry, can't remember if I should be top-posting or bottom-posting :-)? ) > > The answer for both queries: > > * The root folder is 555 root:root > * All other folders are 755 root:root > * The certs themselves are 600 root:root (I think I mentioned this one >

[pfx] Re: forward IP source from a postfix relay to a postfix server

2023-10-11 Thread Wietse Venema via Postfix-users
uthorized_xforward_hosts Wietse > Regards, > > PG > > On 11/10/2023 00:20, Wietse Venema via Postfix-users wrote: > > testeur via Postfix-users: > >> Hi, > >> > >> I don't understand how the External_Postfix_relay server could send &g

[pfx] Re: Question about postscreen_dnsbl_sites

2023-10-11 Thread Wietse Venema via Postfix-users
Ivan Ionut: > Thx, but I noticed that there is only for cidr...and i want for > hosts/domains too. If you want client name/domain based policies, don't use postscreen, use smtpd_mumble_restrictions instead. An smtpd process can do complex things such as verifying fully-confirmed

[pfx] Re: No Permissions To TLS Certificates

2023-10-11 Thread Wietse Venema via Postfix-users
duluxoz via Postfix-users: > Oct 11 17:33:05 mail.me.local email_postfix[2038]: find: > '/etc/postfix/./certs/me.local.pem': Permission denied > Oct 11 17:33:05 mail.me.local email_postfix[2039]: postfix/postlog: > warning: not owned by root: /etc/postfix/./certs/me.local.pem What is the output

[pfx] Re: Question about postscreen_dnsbl_sites

2023-10-11 Thread Wietse Venema via Postfix-users
Ivan Ionut via Postfix-users: > > Hi, I'm using postscreen_dnsbl_sites to block some spam and I want some > domain/hosts/ip to bypass this option, like an whitelist. > > Does postscreen/postfix has this option? > Yes. Near the top of https://www.postfix.org/POSTSCREEN_README.html#quick Quick

[pfx] Re: forward IP source from a postfix relay to a postfix server

2023-10-10 Thread Wietse Venema via Postfix-users
ed it. Postfix does support sending XFORWARD commands with remote SMTP client information for the purpose of logging, not impersonantion. It is typically used with SMTP-based content filters. Wietse > Regards, > > On 08/10/2023 22:19, Wietse Venema via Postfix-users wrote: >

[pfx] Re: forward IP source from a postfix relay to a postfix server

2023-10-08 Thread Wietse Venema via Postfix-users
testeur via Postfix-users: > Hi, > > I try to find a solution to forward the IP source from the postfix relay > to the final postfix server (internal). > > Mail_Message sent to -> External_Postfix_relay (ip source from client > ok) -> Internal_Postfix_server (ip source from external postfix

[pfx] Re: SASL username logging for failed authentications

2023-10-08 Thread Wietse Venema via Postfix-users
Wietse Venema via Postfix-users: > Viktor Dukhovni via Postfix-users: > > On Fri, Oct 06, 2023 at 06:50:38PM -0400, Wietse Venema via Postfix-users > > wrote: > > > > > +} else { > > > + server->username = mystrdup(serverout); > > > + prin

[pfx] Re: Problem setting up postfix on arch linux to forward mail to my gmail account

2023-10-08 Thread Wietse Venema via Postfix-users
Wietse Venema via Postfix-users: > mwoodpatrick--- via Postfix-users: > > Removing the config directory, uninstalling and reinstalling now provides a > > clean start of postfix: > > > > sudo postfix start > > postfix/postfix-script: starting the Postfix ma

[pfx] Re: Problem setting up postfix on arch linux to forward mail to my gmail account

2023-10-08 Thread Wietse Venema via Postfix-users
mwoodpatrick--- via Postfix-users: > Removing the config directory, uninstalling and reinstalling now provides a > clean start of postfix: > > sudo postfix start > postfix/postfix-script: starting the Postfix mail system Will it also start with systemd commands? Probably, but that requires

[pfx] Re: Problem setting up postfix on arch linux to forward mail to my gmail account

2023-10-08 Thread Wietse Venema via Postfix-users
Wietse Venema via Postfix-users: > mwoodpatr...@gmail.com: > > Many thanks for the response, much appreciated. > > > > Doing that I see: > > > > sudo postfix start > > postfix: Postfix is using backwards-compatible default settings

[pfx] Re: Problem setting up postfix on arch linux to forward mail to my gmail account

2023-10-08 Thread Wietse Venema via Postfix-users
mwoodpatr...@gmail.com: > Many thanks for the response, much appreciated. > > Doing that I see: > > sudo postfix start > postfix: Postfix is using backwards-compatible default settings > postfix: See http://www.postfix.org/COMPATIBILITY_README.html for details > postfix: To disable backwards

[pfx] Re: Problem setting up postfix on arch linux to forward mail to my gmail account

2023-10-08 Thread Wietse Venema via Postfix-users
Mark Wood-Patrick via Postfix-users: > I'm trying to setup postfix on arch linux (running on WSL-2) to > forward mail to my gmail account but while I followed and verified > the instructions on: > > How to configure postfix as smtp relay for Gmail on Archlinux | >

[pfx] Re: SASL username logging for failed authentications

2023-10-07 Thread Wietse Venema via Postfix-users
Viktor Dukhovni via Postfix-users: > On Fri, Oct 06, 2023 at 06:50:38PM -0400, Wietse Venema via Postfix-users > wrote: > > > +} else { > > + server->username = mystrdup(serverout); > > + printable(server->username, '?'); > > I might note that wh

[pfx] Re: SASL username logging for failed authentications

2023-10-06 Thread Wietse Venema via Postfix-users
Wietse Venema via Postfix-users: > I think I can take it from here. Wietse 20231006 Clenaup: attempt to log the SASL username after authentication failure. This appends ", sasl_username=xxx" to SASL authentication failure logging. Based on c

[pfx] Re: SASL username logging for failed authentications

2023-10-06 Thread Wietse Venema via Postfix-users
Jozsef Kadlecsik via Postfix-users: > +sasl_username = xsasl_server_get_username(state->sasl_server); > +if (sasl_username != 0) { > + state->sasl_username = mystrdup(sasl_username); > + printable(state->sasl_username, '?'); 1) There is no corresponding myfree() call. 2) There

[pfx] Re: SASL username logging for failed authentications

2023-10-06 Thread Wietse Venema via Postfix-users
Jozsef Kadlecsik: > If I increase the log_level to 4 in the sasl config for smtpd and add -v > to smtpd in master.cf, then the username is reported in the log: Of course the login name is sent via the AUTH command, and it will show up in the raw protocol logging. Your example is for the LOGIN

[pfx] Re: SASL username logging for failed authentications

2023-10-06 Thread Wietse Venema via Postfix-users
Jozsef Kadlecsik via Postfix-users: > Hi, > > Is there a way to get the SASL username logged for the failed > authentications together with the client IP data? Postfix can log half of > the information the connecting client IP address, while Cyrus saslauthd > the second one the username.

[pfx] Re: smtpd rate limiting

2023-10-04 Thread Wietse Venema via Postfix-users
Wietse Venema via Postfix-users: > Viktor Dukhovni via Postfix-users: > > On Tue, Oct 03, 2023 at 06:29:08PM -0400, Wietse Venema via Postfix-users > > wrote: > > > > > > My first wild guess is setting in_flow_delay to a higher value might > >

[pfx] Re: smtpd rate limiting

2023-10-04 Thread Wietse Venema via Postfix-users
Viktor Dukhovni via Postfix-users: > On Tue, Oct 03, 2023 at 06:29:08PM -0400, Wietse Venema via Postfix-users > wrote: > > > > My first wild guess is setting in_flow_delay to a higher value might > > > help. Note this may be completely inappropriate for your

[pfx] Re: smtpd rate limiting

2023-10-03 Thread Wietse Venema via Postfix-users
Noel Jones via Postfix-users: > My first wild guess is setting in_flow_delay to a higher value might > help. Note this may be completely inappropriate for your specific > application. > http://www.postfix.org/postconf.5.html#in_flow_delay That, and reducinig the number of smtpd processes if

[pfx] Re: behavior of postscreen_dnsbl_min_ttl

2023-10-02 Thread Wietse Venema via Postfix-users
patpro--- via Postfix-users: > hello, > > September 29, 2023 4:30 PM, "Wietse Venema via Postfix-users" > wrote: > > > postscreen does not duplicate DNS caching. DNS lookup results are > > already cached in a non-Postfix DNS resolver (see /etc/reso

[pfx] Re: Possible (indirect) libspf2 security issues

2023-09-30 Thread Wietse Venema via Postfix-users
Mike via Postfix-users: > > Quoting Viktor Dukhovni via Postfix-users : > > > On Sun, Oct 01, 2023 at 12:00:25AM +0300, mailmary--- via > > Postfix-users wrote: > > > >> In my case, libspf2 is a dependent package of OpenDMARC > > > > Not surprising, since DMARC takes both DKIM and SPF into

[pfx] Re: smtpd rate limiting

2023-09-29 Thread Wietse Venema via Postfix-users
Matthew McGehrin via Postfix-users: > Hi Kevin. > > If the delays are being caused by bounce message processing, you could Then you should configre Postfix to block undeliverable mail. - Don't accept mail for non-existent recipients. - Don't forward SPAM to other systems. Wietse

[pfx] Re: Postfix smtpd process life time

2023-09-29 Thread Wietse Venema via Postfix-users
Jacek Grabowski via Postfix-users: > Is there any option to set up how long the smtpd process will exist ? > I noticed that after the connection ends, the smtpd process still exists > for several dozen seconds. Can this time be shortened to a few seconds? > Thank you. Wietse: > That would bad for

[pfx] Re: Postfix smtpd process life time

2023-09-29 Thread Wietse Venema via Postfix-users
Jacek Grabowski via Postfix-users: > Hello > > Is there any option to set up how long the smtpd process will exist ? > I noticed that after the connection ends, the smtpd process still exists > for several dozen seconds. Can this time be shortened to a few seconds? > Thank you. That would bad

[pfx] Re: smtpd rate limiting

2023-09-29 Thread Wietse Venema via Postfix-users
Wietse Venema via Postfix-users: > Kevin Cousin via Postfix-users: > > Greetings List, > > > > We recently had an issue and the active queue was full and slowed > > down all new mail delivery. Is it possible to rate limit the mail > > flow to protec

[pfx] Re: behavior of postscreen_dnsbl_min_ttl

2023-09-29 Thread Wietse Venema via Postfix-users
patpro--- via Postfix-users: > Hello, > > I'm surprised to see that dnsblog can issue up to 40 absolutely > identical DNS requests per seconds, for postscreen, when my setup > reads: postscreen does not duplicate DNS caching. DNS lookup results are already cached in a non-Postfix DNS resolver

[pfx] Re: smtpd rate limiting

2023-09-29 Thread Wietse Venema via Postfix-users
Kevin Cousin via Postfix-users: > Greetings List, > > We recently had an issue and the active queue was full and slowed > down all new mail delivery. Is it possible to rate limit the mail > flow to protect smtpd from a massive mail input ? By default, the Postfix SMTP server enforces

[pfx] Re: pipelining issue

2023-09-27 Thread Wietse Venema via Postfix-users
Wietse Venema via Postfix-users: > Joey J via Postfix-users: > > In: DATA > > Out: 354 End data with . > > Out: 451 4.3.0 Error: queue file write error > > This SMTP transcript was sent to you by a Postfix smtpd process. > The file write error may ha

[pfx] Re: pipelining issue

2023-09-27 Thread Wietse Venema via Postfix-users
Joey J via Postfix-users: > In: DATA > Out: 354 End data with . > Out: 451 4.3.0 Error: queue file write error This SMTP transcript was sent to you by a Postfix smtpd process. The file write error may have been logged by that process, or by a Postfix cleanup process. You should be able to

[pfx] Re: IP protocol inconsistency

2023-09-26 Thread Wietse Venema via Postfix-users
raf via Postfix-users: > On Tue, Sep 26, 2023 at 02:01:24PM -0400, Wietse Venema via Postfix-users > wrote: > > > Wietse Venema via Postfix-users: > > > Wietse Venema via Postfix-users: > > > > It's a rather long explanation for "why not do X". l

[pfx] Re: IP protocol inconsistency

2023-09-26 Thread Wietse Venema via Postfix-users
Wietse Venema via Postfix-users: > Wietse Venema via Postfix-users: > > It's a rather long explanation for "why not do X". like several > > times longer than the text that explains what protocol preferences > > do. And this is the only place where adding that

[pfx] Re: IP protocol inconsistency

2023-09-26 Thread Wietse Venema via Postfix-users
> Sadly, I need smtp_address_preference = ipv4 because some > reputation systems (spamhaus, I think) don't realise > that an entity might only have a single ipv6 address. Then you should disable IPv6, in the PostfiX SMTP client (master.cf: smtp -o inet_protocols=ipv4) or globally

[pfx] Re: Exporting environment to specific pipe service

2023-09-26 Thread Wietse Venema via Postfix-users
Matt Saladna via Postfix-users: > I'd like to export a single var to a set of pipe processes without > wrapping with env or setting export_environment in main.cf. > > This works in main.cf, > > export_environment=TZ MAIL_CONFIG LANG X=Y > > On the other hand, adding -o export_environment="TZ

[pfx] Re: Value of client certificates, was: Re: Re: [ext] list.sys4.de fails with starttls

2023-09-25 Thread Wietse Venema via Postfix-users
A. Schulze via Postfix-users: > Am 25.09.23 um 22:11 schrieb Viktor Dukhovni via Postfix-users: > > ... > > So, unfortunate as it may seem, they just increase > > opportunities for failure, without adding anything by way of security. > > ... > > Client certificates serve no purpose unless the

[pfx] Re: [ext] list.sys4.de fails with starttls

2023-09-25 Thread Wietse Venema via Postfix-users
Viktor Dukhovni via Postfix-users: > > > The best solution is [to] configure client certs *sparingly*, only > > > for transports dedicated to destinations that definitely need the > > > client certs, and not otherwise. > > > > Why? I feel a little like I was feeling in the early 2000s when we had

[pfx] Re: IP protocol inconsistency

2023-09-25 Thread Wietse Venema via Postfix-users
Polarian via Postfix-users: Checking application/pgp-signature: FAILURE -- Start of PGP signed section. > Hello, > > This seems to clarify it a lot, I hope that it is added to the current > manpages. It's already on-line. PS it never hurts to choose an accurate subject line. Wietse

[pfx] Re: IP protocol inconsistency

2023-09-24 Thread Wietse Venema via Postfix-users
Wietse Venema via Postfix-users: > It's a rather long explanation for "why not do X". like several > times longer than the text that explains what protocol preferences > do. And this is the only place where adding that text would help. I updated the text a little: Notes for ma

[pfx] Re: IP protocol inconsistency

2023-09-24 Thread Wietse Venema via Postfix-users
Polarian via Postfix-users: Checking application/pgp-signature: FAILURE -- Start of PGP signed section. > Hello, > > I understood RFC 5321 before hand, apologies for you having to type > this all out, I feel bad now. > > But my point was, the documentation states that setting a preference is >

[pfx] Re: IP protocol inconsistency

2023-09-24 Thread Wietse Venema via Postfix-users
Polarian via Postfix-users: > Hello, > > Firstly thank you for the response. > > > RFC 5321 requires that the Postfix SMTP CLIENT connects to hosts > > with primary MX preference, before connecting to hosts with a > > secondary MX preference. > > > > For example, given the following DNS

[pfx] Re: Example config aliases from mysqldb and /etc/aliases

2023-09-24 Thread Wietse Venema via Postfix-users
Noah via Postfix-users: > Hi there, > > I am provisioning an postfix installation. Is there an example > configuration for finding aliases from a mysqldb and also checking the > /etc/aliases file please? alias_maps = hash:/etc/aliases proxy:mysql:/path/to/file This will search the MySQL

[pfx] Re: IP protocol inconsistency

2023-09-24 Thread Wietse Venema via Postfix-users
Polarian via Postfix-users: > What technology do you use to pick between the protocols? As documented at the link you mentioned, the Postfix SMTP CLIENT can sort IP addresses, with the same MX preference, by their protocol. RFC 5321 requires that the Postfix SMTP CLIENT connects to hosts with

[pfx] Re: milter outgoing not working

2023-09-24 Thread Wietse Venema via Postfix-users
Stanislav via Postfix-users: > Greetings, > > After upgrading from postfix 3.7.3 to postfix 3.8.2, I've noticed my > email is not signed with DKIM anymore. After further investigation, I've > found that Postfix ignores milter on outgoing emails (incoming goes > through milter ok). This has

[pfx] Re: pipelining issue

2023-09-20 Thread Wietse Venema via Postfix-users
Joey J via Postfix-users: > In: DATA > Out: 354 End data with . > Out: 451 4.3.0 Error: queue file write error Look in Postfix logs. https://www.postfix.org/DEBUG_README.html#logging Look for obvious signs of trouble Postfix logs all failed and successful deliveries to a logfile. When

[pfx] Re: Address family for hostname not supported?

2023-09-18 Thread Wietse Venema via Postfix-users
Viktor Dukhovni via Postfix-users: > On Mon, Sep 18, 2023 at 10:31:59AM +1000, Phil Biggs via Postfix-users wrote: > > > >From what I could understand, it seems the recommendation was to return > > >the > > same value as Linux. Is that something postfix would need to take into > > account?

[pfx] Re: [ext] list.sys4.de fails with starttls

2023-09-17 Thread Wietse Venema via Postfix-users
In my case, all STARTTLS commands fail. Delivery succeeds after re-connecting with plaintext. Apparently, not all connections are retried in plaintext. To work around one could say: smtpd_discard_ehlo_keyword_address_maps = cidr:{ {188.68.34.52 starttls}

[pfx] Re: [PATCH 3.9-20230912] postconf(5)'s inet_protocols says "see 'postconf -d output'"

2023-09-16 Thread Wietse Venema via Postfix-users
??? via Postfix-users: Checking application/pgp-signature: FAILURE -- Start of PGP signed section. > $ man 5 postconf | grep ^inet_protocols > inet_protocols (default: see 'postconf -d output') > $ man 5 postconf | grep -F "see 'postconf" > inet_protocols (default: see 'postconf -d output') >

[pfx] Re: how to log forwarded email subject

2023-09-14 Thread Wietse Venema via Postfix-users
Eero Volotinen via Postfix-users: > Hi list, > > I need to log all subjects that are forwarded via my mailproxy. how to do > this? > > looks like this is not working for me? > > https://www.linuxtechi.com/log-email-subject-maillog/ Then you made a mistake. Try "tail -f" instead of "tailf".

[pfx] Re: mask "mail from: " for Microsoft

2023-09-14 Thread Wietse Venema via Postfix-users
Marc Lucke via Postfix-users: > On 15/09/2023 12:08 am, Wietse Venema via Postfix-users wrote: > > > Marc Lucke via Postfix-users: > >> re: > >> https://techcommunity.microsoft.com/t5/exchange-team-blog/updated-requirements-for-smtp-relay-through-exchange-onl

[pfx] Re: mask "mail from: " for Microsoft

2023-09-14 Thread Wietse Venema via Postfix-users
Marc Lucke via Postfix-users: > re: > https://techcommunity.microsoft.com/t5/exchange-team-blog/updated-requirements-for-smtp-relay-through-exchange-online/ba-p/3851357 > That text is about relaying email: you originate a message, and use Postfix to ask a Microsoft email service to deliver

[pfx] Re: Number of active amavis processes

2023-09-13 Thread Wietse Venema via Postfix-users
Jesper Dybdal via Postfix-users: > On 2023-09-13 09:00, Matus UHLAR - fantomas via Postfix-users wrote (in > another thread): > > > you may need to limit number of concurrent amavis instances if you > > don't have enough of CPU or RAM, e.g. in main.cf: > > > >

<    1   2   3   4   5   6   7   8   9   10   >