Re: SSL3 alert write:fatal:decode error

2023-02-10 Thread Wietse Venema
Marko ANGELSKI: > Hi, all, > > > > I'm having trouble with one client (iot) not able to send emails via > postfix. This is the log: > > postfix/smtps/smtpd[4420]: initializing the server-side TLS engine You deleted the useful time information, and added the useless debug logging. Wi

Re: disable Undelivered

2023-02-09 Thread Wietse Venema
natan: > Hi > One of client have two serwervers > > 1)for outgoing - smtp.domain.ltd > 2)for incomming - mx.domain.ltd > > and hi send e-mail from n...@domain.ltd > > bounce -> smtp.domain.ltd send to mx.domain.ltd > > how disable bounce and non delivery and sender notify who was send to > smt

Re: Repetitive message in /var/log/maillog

2023-02-08 Thread Wietse Venema
Wolfgang Paul Rauchholz: > Feb 8 17:33:03 home dovecot[484616]: imap-login: Login: This is the Postfix mailing list. For questions about Dovecot, see their lists. Wietse

Re: Blocking TLDs

2023-02-08 Thread Wietse Venema
James Pifer: > The error was: > Feb? 8 07:38:11 mailserver postfix/smtpd[446839]: NOQUEUE: reject: RCPT > from mail-qt1-f179.google.com[209.85.160.179]: 451 4.3.5 Server > configuration error; from= > to= proto=ESMTP helo= The cause of the problem was logged IMMEDIATELY BEFORE THAT LINE.

Re: Blocking TLDs

2023-02-08 Thread Wietse Venema
mailm...@ionos.gr: > Here is how I do it: > > check_sender_access regexp:/etc/postfix/sender_domain_checks > > here are the (partial) contents of /etc/postfix/sender_domain_checks: > > /\.top$/ REJECT > /\.xyz$/ REJECT > /\.cam$/ REJECT > /\.fun$/ REJECT > /\.buzz$/ REJECT > /\.club$/ REJECT > /

Re: SSL_accept error from unknown[10.5.2.1]: lost connection

2023-02-07 Thread Wietse Venema
Wolfgang Paul Rauchholz: > Hello I run postfix (postfix-3.5.8-4.el8.x86_64) on my Rocky Linux 8.7 home > server > I setup postfix and dovecot as a firs step and it seems to be working; > meaning I can send and receive mails (I send/returned mail from a gmail > account). > But I find these error mes

Re: How do you inject/reprocess an email file into the postfix queue?

2023-02-03 Thread Wietse Venema
Bryan Arenal: > Hi there, > > I have ~1000 emails that were previously sent from a different > platform (but failed due to a system error) and I've been asked to see > if we can re-send them with our Postfix server. > > I've looked into postfix's 'sendmail' as well as dropping a test file > into

turning off Postfix bounce notices (was: unexpected protocol delivery_request_protocol)

2023-02-03 Thread Wietse Venema
> I am seeing the subjected error for a small percentage of messages, and > then those message stay in the deferred queue. > > from the log: > postfix/local[1124]: warning: unexpected protocol delivery_request_protocol > from private/bounce socket (expected: delivery_status_protocol) There is som

Re: smtpd_reject_unlisted_recipient and reject_unlisted_recipient behavior

2023-02-01 Thread Wietse Venema
post...@ptld.com: > >> Or does reject_unlisted_recipient get disabled completely > >> when smtpd_reject_unlisted_recipient=no? > > > > You can then use "reject_unlisted_recipient" explicitly at > > the appropriate stage in the recipient restrictions. > > > Okay, I understand why doing any of thi

Re: 'queue file write error' in only very specific instances

2023-02-01 Thread Wietse Venema
> On Wed, 1 Feb 2023, Wietse Venema wrote: > > > post...@fongaboo.com: > >> Jan 31 20:06:15 h6lix postfix/smtp[6552]: 7128C4089C: > >> to=, relay=50.75.172.140[50.75.172.140]:25, > >> delay=2.5, delays=0.64/0.01/1.6/0.23, dsn=4.3.0, status=deferred >

Re: 'queue file write error' in only very specific instances

2023-02-01 Thread Wietse Venema
post...@fongaboo.com: > Jan 31 20:06:15 h6lix postfix/smtp[6552]: 7128C4089C: > to=, relay=50.75.172.140[50.75.172.140]:25, > delay=2.5, delays=0.64/0.01/1.6/0.23, dsn=4.3.0, status=deferred > (host 50.75.172.140[50.75.172.140] said: 451 4.3.0 Error: queue > file write error (in reply to end of DAT

Re: Postfix stable release 3.7.4 and legacy releases 3.6.8, 3.5.18, 3.4.28

2023-01-30 Thread Wietse Venema
Viktor Dukhovni: > On Mon, Jan 30, 2023 at 10:50:16AM +1100, Phil Biggs wrote: > > > I understand that why something non-critical, like the patch below, > > wouldn't be > > listed in the announcement but would it have been incorporated into 3.7.4? > > The patch is included in the latest patche

Re: append_dot_mydomain, how to make it work

2023-01-29 Thread Wietse Venema
Viktor Dukhovni: > On Sun, Jan 29, 2023 at 09:32:47PM +, Sean Hennessey wrote: > > > What I'm looking for is the envelope recipient. I need a way to force > > an unqualified to address to a domain I can blackhole. I've got an > > application that feeds into these systems that will allow its us

Re: append_dot_mydomain, how to make it work

2023-01-29 Thread Wietse Venema
Sean Hennessey: > Viktor, > > What I'm looking for is the envelope recipient. I need a way to > force an unqualified to address to a domain I can blackhole. I've > got an application that feeds into these systems that will allow > its users to enter badly formed email addresses. What I want to > d

Re: append_dot_mydomain, how to make it work

2023-01-29 Thread Wietse Venema
> What I'm looking for is a way to force a rewrite of ADDRESSES THAT > DON'T HAVE AN @DOMAIN that are coming into this machine from other > computers. Use append_at_myorigin: append_at_myorigin (for addresses without *domain*), Not append_dot_mydomain: append_dot_mydomain (for addresses

Re: Health check of postfix without the logging noise

2023-01-28 Thread Wietse Venema
Gerben Wierda: > > A proper health check verifies that a service actually responds. > > True. > > > You can find more with "haproxy health check script". For example, > > Postfix should reply with a "220" status within 5 seconds. > > Thanks, I have been looking at how to set this up, but so far

Re: Health check of postfix without the logging noise

2023-01-28 Thread Wietse Venema
Gerben Wierda: > Currently, every time haproxy checks if postfix is still alive, > e.g. on port 587, I see this in my logging: > > Jan 28 13:13:20 albus submission/smtpd[97331]: warning: haproxy read: EOF > Jan 28 13:13:20 albus submission/smtpd[97331]: connect from unknown[unknown] > Jan 28 13:13

Re: Checking configuration files in advance

2023-01-27 Thread Wietse Venema
Wietse Venema: > Viktor Dukhovni: > > On Thu, Jan 26, 2023 at 07:36:06PM -0500, Wietse Venema wrote: > > > > > You can check parameter names and some parameter value syntax with: > > > > > > postconf -m -f path-to-directory > > > pos

Re: Checking configuration files in advance

2023-01-27 Thread Wietse Venema
Viktor Dukhovni: > On Thu, Jan 26, 2023 at 07:36:06PM -0500, Wietse Venema wrote: > > > You can check parameter names and some parameter value syntax with: > > > > postconf -m -f path-to-directory > > postconf -M -f path-to-directory > > Did you mea

Re: Checking configuration files in advance

2023-01-26 Thread Wietse Venema
Pedro David Marco: > Hi all, > Is there anyway to check for potential errors in Postifx confiuration > files before movig them to /etc/postfix You can check parameter names and some parameter value syntax with: postconf -m -f path-to-directory postconf -M -f path-to-directory with main.c

PATCH: build error with OpenSSL 1.0.2

2023-01-25 Thread Wietse Venema
This patch addresses a build error for Postfix-3.4.28 and Postfix-3.5.18 with OpenSSL 1.0.2. Undefined first referenced symbol in file EVP_MD_CTX_new ../../lib/libtls.a(tls_fprint.o) EVP_MD_CTX_free ../..

Re: Are non_smtpd_milters applied to mail delivered via smtpd?

2023-01-24 Thread Wietse Venema
Yannik Sembritzki: > Hi everyone, > > I'm currently investigating a situation that milters are called twice, > once by smtpd, and once by cleanup, when both smtpd_milters and > non_smtpd_milters are configured (to the same values). No. THy are called twice because you have a post-queue content

Re: backop-transport maps

2023-01-24 Thread Wietse Venema
natan: > W dniu 24.01.2023 o?12:05, Wietse Venema pisze: > > natan: > >> Hi > >> For test i runnig gallera claster + haproxy > >> > >> haproxy: > >> . > >> listen galera-test > >> bind 10.10.10.10:3307 > >>

Re: question about redirecting email for a domain to a different server than is specified for the MX

2023-01-24 Thread Wietse Venema
charlie derr: > Pretty sure this is a transport map invocation which is needed. > > Our situation is that we have a server a.example.com which is receiving > email for the entire example.com domain. What we wish to do is to have > any email that is directed to an example.com email address *not*

Re: backop-transport maps

2023-01-24 Thread Wietse Venema
natan: > Hi > For test i runnig gallera claster + haproxy > > haproxy: > . > listen galera-test > bind 10.10.10.10:3307 > balance leastconn > mode tcp > option tcplog > option tcpka > option httpchk > > server sql1 10.10.10.11:3306 check port 9200 inter 12000 rise 2 fall 2 > server sql2 10.10

Re: [EXTERNAL] Re: Mail queue took 3 hours to recover from a flood. Suggestions ?

2023-01-23 Thread Wietse Venema
White, Daniel E. (GSFC-770.0)[AEGIS]: > postfix/qmgr[PID]: warning: mail for [127.0.0.1]:10024 is using up NUMBER of > NUMBER active queue entries As Viktor noted, Amavis is unable to keep up with incoming mail. Find out why it is slow. This will require diving into details. Wietse

Re: Mail queue took 3 hours to recover from a flood. Suggestions ?

2023-01-23 Thread Wietse Venema
White, Daniel E. (GSFC-770.0)[AEGIS]: > Around 12000 messages. > The queue went from ~3000 to over 12000 in about 30 minutes and then took 3 > hours to grind through all of them. > > I am still trying to determine if this was an accident or not. > The source claims it was not intentionally malici

Postfix stable release 3.7.4 and legacy releases 3.6.8, 3.5.18, 3.4.28

2023-01-22 Thread Wietse Venema
[This this announcement will be available at https://www.postfix.org/announcements/postfix-3.7.4.html] Fixed in Postfix 3.7, 3.6, 3.5, 3.4: * Workaround: with OpenSSL 3 and later always turn on SSL_OP_IGNORE_UNEXPECTED_EOF, to avoid warning messages and missed opportunities for TLS sess

Re: Assist with a spam message, check_sender_access and check_client_access targets

2023-01-22 Thread Wietse Venema
Wietse Venema: > Viktor Dukhovni: > > On Sat, Jan 21, 2023 at 02:49:34PM -0500, Wietse Venema wrote: > > > > > Correction: the MTA<==>Milter protocol hides the Received: header > > > that is prepended by the MTA, but it exposes headers that are already &

Re: Assist with a spam message, check_sender_access and check_client_access targets

2023-01-22 Thread Wietse Venema
Viktor Dukhovni: > On Sat, Jan 21, 2023 at 02:49:34PM -0500, Wietse Venema wrote: > > > Correction: the MTA<==>Milter protocol hides the Received: header > > that is prepended by the MTA, but it exposes headers that are already > > present. That's what Sendma

Re: postconf manpage suggestion

2023-01-21 Thread Wietse Venema
Jim Garrison: > Under the `-n` option, the man page currently says > > To show settings that differ from built-in defaults only, > use the following bash syntax: > comm -23 <(postconf -n) <(postconf -d) > Replace "-23" with "-12" to show settings that duplicate built-in >

Re: Assist with a spam message, check_sender_access and check_client_access targets

2023-01-21 Thread Wietse Venema
Bill Cole: > What is likely happening here is that when a milter sees a message, it > does not have the current Received header, because it has yet to be > fully received. If you are extracting this message from that stage > rather than after final delivery, Postfix has not yet added the Receive

Re: backop-transport maps

2023-01-20 Thread Wietse Venema
natan: > W dniu 20.01.2023 o?15:04, Wietse Venema pisze: > > natan: > >> Hi > >> I try to run "backup" transport maps like: > >> > >> smtpd_sender_login_maps = > >> #first-main database > >> proxy:mysql:/etc/postfix/

Re: backop-transport maps

2023-01-20 Thread Wietse Venema
natan: > Hi > I try to run "backup" transport maps like: > > smtpd_sender_login_maps = > #first-main database > proxy:mysql:/etc/postfix/mysql_sender_login_maps.cf > #second-backup > proxy:mysql:/etc/postfix/mysql_sender_login_maps-backup.cf > > Both databases are the same because they ar

Re: Use relay host if direct delivery fails

2023-01-19 Thread Wietse Venema
sashk: > Hi, > > There are some destinations which refuse to talk to my server > directly. My idea is to attempt deliver directly, and if it fails, > attempt with fallback smtp server. > > Looking at documentation, it seems that smtp_fallback_relay might > be useful, but reading about it suggests

Re: smtp_header_checks INFO chops long subjects while logging

2023-01-19 Thread Wietse Venema
Dhammika Gunawardena: > Hi > I have setup smtp_header_checks to log subject lines in my mail log. > However the issue is messages are truncated to about 50 characters. > Is there any method to get the full Subject into log? I suspect that you would like to have no limit on the amount of header tex

Re: What is happening here? (TLS Library Problem)

2023-01-19 Thread Wietse Venema
r > considering my request. > > > On Tue, Jun 14, 2022 at 5:17 PM Demi Marie Obenour > wrote: > > > On 6/10/22 08:55, Gerben Wierda wrote: > > > > > >> On 10 Jun 2022, at 13:17, Wietse Venema wrote: > > >> > > >> Wietse Venema

Re: mail queued by transport

2023-01-18 Thread Wietse Venema
Sean Hennessey: > Is there a way to see the transport that queued mail is using? > > I just created a new transport and pointed a domain to it. The > server also had mail for that domain queued up under the old > transport. > > Is there any way I can find out what transport the mail is using? No

Re: Enabling both redirection and local (virtual) delivery for catch-all email addresses?

2023-01-18 Thread Wietse Venema
EML: > On 17/01/2023 23:13, raf wrote: > > On Tue, Jan 17, 2023 at 03:31:43PM +, sa212+post...@cyconix.com wrote: > > > > >> (2) Mail to unknown user 'unkn...@example.com': > >> > >> valias: "@example.com @example.com, f...@external.org" > >> vmailbox: "@example.com example.com/foo/" >

Re: Understanding concurrency limits

2023-01-18 Thread Wietse Venema
Viktor Dukhovni: > On Wed, Jan 18, 2023 at 12:45:02AM +, Sean Hennessey wrote: > > > Thanks,I did realize after I sent the email that what was probably > > happening was the delay was the overiding controller, and not working > > as in addition as I thought it would. > > Once you have multi-s

Re: Understanding concurrency limits

2023-01-17 Thread Wietse Venema
Sean Hennessey: > In master.cf > smtp-tar unix -- y - 1 smtp > -o syslog_name=postfix/$service_name > > In main.cf > smtp-tar_destination_rate_delay = 600s RTFM, this puts 600s delay between deliveries as in: deliver one meessage wait 600s deliver one mee

Re: postfix/pickup question

2023-01-16 Thread Wietse Venema
Scott Kitterman: > On January 16, 2023 2:13:42 PM UTC, Wietse Venema > wrote: > >Maurizio Caloro: > >> The option that was cause: > >> -failurereports > >> -failureReportssendby emailaddress > > > >DO NOT run milters as the 'postfi

Re: postfix/pickup question

2023-01-16 Thread Wietse Venema
Maurizio Caloro: > The option that was cause: > -failurereports > -failureReportssendby emailaddress DO NOT run milters as the 'postfix' user. Only Postfix programs should use that userid. Wietse

Re: block domain

2023-01-16 Thread Wietse Venema
natan: > Hi > Is there any chance to reject domain (incomming) via postscreen ? postscreen does not know the sender email addres when it allows or denies a client. It logs the sender address only after it has already decided to deny a client. > I get many e-mails from one domain (from diferent IP

Re: postfix/pickup question

2023-01-16 Thread Wietse Venema
Maurizio Caloro: > Am 16.01.2023 um 00:53 schrieb Wietse Venema: > > What is the name for uid 109? > > > > Wietse > > postfix:x:109:115::/var/spool/postfix:/bin/false > Debian-exim:x:104:109::/var/spool/exim4:/bin/false And what are you using to submit mail to

Re: postfix/pickup question

2023-01-15 Thread Wietse Venema
Maurizio Caloro: > Hello > > Please i need your attention, when i send any mail, i have new this: > ??? >Jan 16 00:20:02 nmail postfix/pickup[18919]: 39E574367B: uid=109 > from=<*postfix*> > > i dont found the issue, Can you lure me on the right track What is the name for uid 109? Wie

Re: postscreen_cache: unable to get exclusive lock

2023-01-15 Thread Wietse Venema
Benny Pedersen: > Wietse Venema skrev den 2023-01-15 22:09: > > Benny Pedersen: > >> >> Jan 15 19:18:30 mail postfix/postscreen[1057]: fatal: > >> >> btree:/opt/local/var/lib/postfix/postscreen_cache: unable to get > >> >> exclusive lock: Re

Re: postscreen_cache: unable to get exclusive lock

2023-01-15 Thread Wietse Venema
Benny Pedersen: > >> Jan 15 19:18:30 mail postfix/postscreen[1057]: fatal: > >> btree:/opt/local/var/lib/postfix/postscreen_cache: unable to get > >> exclusive lock: Resource temporarily unavailable > > > > You can't have two postscreen service instances share that cache. > > will change from b

Re: postscreen_cache: unable to get exclusive lock

2023-01-15 Thread Wietse Venema
Gerben Wierda: > For some reason, one of my postfix servers says this: > > Jan 15 19:18:30 mail postfix/postscreen[1057]: fatal: > btree:/opt/local/var/lib/postfix/postscreen_cache: unable to get exclusive > lock: Resource temporarily unavailable > Jan 15 19:18:31 mail postfix/master[658]: warni

Re: postscreen_upstream_proxy_protocol and smtpd_upstream_proxy_protocol

2023-01-15 Thread Wietse Venema
Gerben Wierda: > The only minor thing left is that postscreen keeps logging the > health check attempts as such: > > Jan 15 17:20:09 snape postfix/postscreen[277]: warning: haproxy read: EOF Postfix should not simply ignore such errors. How would Postfix distinguish this from haproxy crashing or

Re: postscreen_upstream_proxy_protocol and smtpd_upstream_proxy_protocol

2023-01-15 Thread Wietse Venema
Gerben Wierda: > > On 15 Jan 2023, at 15:47, Wietse Venema wrote: > > > > "The name of the proxy protocol used by a before-postscreen proxy agent." > > That still doesn't tell you what the effect is of entering a value > for that setting while the traf

Re: postscreen_upstream_proxy_protocol and smtpd_upstream_proxy_protocol

2023-01-15 Thread Wietse Venema
Gerben Wierda: > Unambiguous would be for instance: "The name of the proxy protocol. > This is required when you use a before-postscreen proxy agent " Existing text: "The name of the proxy protocol used by an optional before-postscreen proxy agent." In that context, the name is not optional. The

Re: server not accepting outgoing mail

2023-01-13 Thread Wietse Venema
Michael Schumacher: > Hi, > > our mail server is running nicely for years. There is one recipients server > that doesn't accept our mails with a "time out" response without sending a > more detailed error message. I have attached the -v log output, but only the > part that is produced by the sm

Re: make transport decisions based on headers not envelope

2023-01-13 Thread Wietse Venema
Sean Hennessey: > I was using the sender_dependent_default_transport_maps to pick > off what I thought was going to be the interesting from domain. > The good news is that this mail is coming from customer applications. > It's not coming from regular user mail clients. So I can guarantee > there is

Re: none SRS issues

2023-01-12 Thread Wietse Venema
Emmanuel Fust?: > Le jeu. 12 janv. 2023, 17:15, a ?crit : > > > > Since I am using SPF as a validation method, the non-srs messages from > > those big providers will have possibility to break SPF and be rejected by > > our systems. > > > > Do you reject based on solely the SPF result? It would be

Re: Simple forwarder, part two

2023-01-11 Thread Wietse Venema
DL Neil: > Having managed two destinations, how far can this reasonably go? Five, > six, ten addresses? > Is there a limit to the number of addresses? That depends on whether you used virtual_alias_maps or alias_maps. Also, there is a limit on the queue file size (with a name message_size_limit

Re: RFC 5233 "Subaddresses" and LDAP lookups

2023-01-11 Thread Wietse Venema
Wietse Venema: > Viktor Dukhovni: > > On Wed, Jan 11, 2023 at 03:57:28PM +0100, Patrick Ben Koetter wrote: > > > > > Today I ran into a lookup problem where a sender (!) was using the RFC > > > 5233 > > > subaddress schema so send a message e.g.

Re: RFC 5233 "Subaddresses" and LDAP lookups

2023-01-11 Thread Wietse Venema
Viktor Dukhovni: > On Wed, Jan 11, 2023 at 03:57:28PM +0100, Patrick Ben Koetter wrote: > > > Today I ran into a lookup problem where a sender (!) was using the RFC 5233 > > subaddress schema so send a message e.g. as localpart+subaddress@domainpart > > and lookups with smtpd_sender_login_maps fai

Re: Bypass REDIRECT rule in header_checks for specific sender ?

2023-01-10 Thread Wietse Venema
This requires a milter or other content filter. Wietse

Re: nmap says there's vulnerability with Diffie-Hellman settings

2023-01-08 Thread Wietse Venema
Viktor Dukhovni: > On Sun, Jan 08, 2023 at 09:23:52PM +0100, Benny Pedersen wrote: > > > > I want again to state that header which says "Received: by > > > (Postfix, from userid )" is perfectly normal and > > > expected Postfix behavior when mail is submitted locally. I have > > > seen it countle

Re: nmap says there's vulnerability with Diffie-Hellman settings

2023-01-07 Thread Wietse Venema
Wietse Venema: > Sam: > > Hello everyone > > > > when I run `nmap --script vuln example.com` against a server I manage, I > > get the following vulnerability on my server on both ports 465 and 587. > > The only solutions I found are for legacy systems. > >

Re: nmap says there's vulnerability with Diffie-Hellman settings

2023-01-07 Thread Wietse Venema
Sam: > Hello everyone > > when I run `nmap --script vuln example.com` against a server I manage, I > get the following vulnerability on my server on both ports 465 and 587. > The only solutions I found are for legacy systems. > > > 587/tcp open submission > | ssl-dh-params: > | VULNERABL

Re: Dumping effective postfix configuration

2023-01-06 Thread Wietse Venema
Viktor Dukhovni: > > The Postfix master creates as many sockets as needed for an inet > > service, and sets the socket option SO_REUSEADDR on each socket, > > and bind()s them to the desired addresses. > > > > With that, it may be possible for the Postfix master to create new > > sockets, set SO_R

Re: Dumping effective postfix configuration

2023-01-06 Thread Wietse Venema
Demi Marie Obenour: Checking application/pgp-signature: FAILURE -- Start of PGP signed section. > On 1/6/23 07:15, Wietse Venema wrote: > > Peter Wienemann: > >> Hi, > >> > >> is there a way to dump the effective postfix configuration rather than > >&g

Re: Dumping effective postfix configuration

2023-01-06 Thread Wietse Venema
Viktor Dukhovni: > On Fri, Jan 06, 2023 at 01:45:48PM -0500, Wietse Venema wrote: > > > > Most changes in main.cf require a reload to become effective but there > > > are some exceptions requiring a restart, e. g. a change of > > > inet_interfaces

Re: Dumping effective postfix configuration

2023-01-06 Thread Wietse Venema
Peter Wienemann: > Most changes in main.cf require a reload to become effective but there > are some exceptions requiring a restart, e. g. a change of > inet_interfaces. That is incorrect. If inet_interfaces is changed, then a "postfix reload" (not restart) is required because the master daemon

Re: Dumping effective postfix configuration

2023-01-06 Thread Wietse Venema
Peter Wienemann: > On 06.01.23 13:15, Wietse Venema wrote: > >> is there a way to dump the effective postfix configuration rather than > >> the one specified in main.cf/master.cf? It seems that changes to > >> main.cf/master.cf have an immediate impact on the output

Re: Dumping effective postfix configuration

2023-01-06 Thread Wietse Venema
Peter Wienemann: > Hi, > > is there a way to dump the effective postfix configuration rather than > the one specified in main.cf/master.cf? It seems that changes to > main.cf/master.cf have an immediate impact on the output of postconf > regardless of whether a reload/restart of the service was

Re: postfix connects to dovecot lmtp socket, but nothing is delivered

2023-01-05 Thread Wietse Venema
Gerben Wierda: > Jan 05 16:16:59 snape postfix/lmtp[126]: C71B3D1262: to=, > relay=snape.rna.nl[private/lmtp], delay=300, delays=0.02/0/300/0, dsn=4.4.2, > status=deferred (conversation with snape.rna.nl[private/lmtp] timed out while > receiving the initial server greeting) Postfix creates the

Re: Find out whether a sender is authenticated in a milter?

2023-01-05 Thread Wietse Venema
David B?rgin: > Previously in a milter I have used presence of sendmail macro > "{auth_authen}" to decide whether a sender is authenticated. > > Now, in another milter I am using presence of macro "{auth_type}" to > make that decision. > > What is the recommended way of telling whether a sender i

Re: Rate limiting local clients: configuration and logging

2023-01-04 Thread Wietse Venema
H?bergement Arbre Binaire: > >As far as I know, "msmtp" can be used >as a replacement for > >/usr/sbin/sendmail to submit mail via >SMTP instead of writing it directly > to > >the queue > > That was a suggestion of Viktor too, but I did not investigated further > after reading the outdated descrip

Re: Rate limiting local clients: configuration and logging

2023-01-03 Thread Wietse Venema
H?bergement Arbre Binaire: > I really appreciate your (very) thorough answer. I'll use it to search for > a solution or devise a homemade one. > > The problem I'm describing affects so many web hosts... I'm surprised that > this security problem has not been circumvented in any reliable way. I

Re: cleanup log

2023-01-02 Thread Wietse Venema
Phil Biggs: > Hello and happy new year to all, > > My friend is currently running FreeBSD 13.1-RELEASE-p2 GENERIC with the > postfix-sasl-3.7.2_1,1 pkg. > > Today I noticed this in his log: > > 2023-01-02T20:07:39.385545+11:00 postfix.[redacted] postfix/verify 23191 - - > cache ???

Re: parent_domain_matches_subdomains && smtpd_access_maps

2023-01-02 Thread Wietse Venema
Laurent Frigault: > Hi, > > Is there any way to have some smtpd_access_maps with > parent_domain_matches_subdomains and some other without it ? There currently is no syntax to force some lookups with and some without. However, parent_domain_matches_subdomains does not apply to pcre:, regexp:, tc

Re: [Devel] OpenSSL 3.0 + TLS 1.3 and FFDHE key exchange

2023-01-02 Thread Wietse Venema
Viktor Dukhovni: > [ The devel list majordomo is not doing too well just now, so please > pardon my use of postfix-users instead. ] > > In TLS 1.3 the key exchange parameters, whether elliptic curve (ECDHE or > ECX, where ECX is one of X25519 or X448) or finite-field (FFDHE), are always > from a

Re: warning: unexpected protocol delivery_request_protocol from private/bounce socket (expected: delivery_status_protocol)

2023-01-01 Thread Wietse Venema
trading fours: > I am seeing the subjected error for a small percentage of messages, and > then those message stay in the deferred queue. > > from the log: > postfix/local[1124]: warning: unexpected protocol delivery_request_protocol > from private/bounce socket (expected: delivery_status_protocol

Re: Controlling envelope sender of sendmail(1) submission

2023-01-01 Thread Wietse Venema
Viktor Dukhovni: > On Sun, Jan 01, 2023 at 05:03:27PM +0100, Jesper Dybdal wrote: > > > I use reject_authenticated_sender_login_mismatch to control which > > envelope sender addresses SASL clients can use.? That works just fine. > > > > Is there a similar way to control which envelope sender add

Re: "Best" way to stop postfix from sending any DSN

2022-12-31 Thread Wietse Venema
Peter: > On 31/12/22 17:29, Sean Hennessey wrote: > > I'm doing some testing and am trying to figure out a way to set up > > postfix so that it won't ever send a DSN. > > DSNs are an important part of email but if your server sends out too > many of them, or in two many scenarios it becomes a po

Re: run script on new connection?

2022-12-26 Thread Wietse Venema
mats: > First statement: I'm new to Postfix > Second statement: I'm old enough that a 30mb harddrive was big > then I started working with computers .. 512kB (floppy disk). > The Challenge I want to be able to run my own "idp" type script > when someone tries to connect to my mailserver. Basi

Re: Restrict access relay to single client

2022-12-23 Thread Wietse Venema
You should also include "postconf -P" for parameter settings in master.cf. Wietse

Re: Spammer succeeded in relaying through my server

2022-12-22 Thread Wietse Venema
Samer Afach: > Thank you very much, Raf. I really appreciate your empathy and all this > help. > > I'm reading more and more every day. I really appreciate your support. > The challenge is knowing what matters. > > And about your HELO definition, thanks for explaining it. What confuses > me is

Re: Spammer succeeded in relaying through my server

2022-12-22 Thread Wietse Venema
Samer Afach: > Actually I would appreciate advice on how to do this on an internal > environment. Is there a way to do this, like tools? The challenge is > that I need an external email client to check IP addresses through the > proxy, do the TLS communication, etc. My plan is to completely cut

Re: Spammer succeeded in relaying through my server

2022-12-22 Thread Wietse Venema
It's good that you're willing to learn, but perhaps you can do some experiments on a "internal" environment before exposing it to the full internet. Wietse

Re: "Delayed Mail" notification

2022-12-22 Thread Wietse Venema
Fourhundred Thecat: > Hello, > > when I receive "Delayed Mail" notification, the message only has the > header of the original email. > > Is it possible to have the full email body included in the notification > message, so that I can see which email has not been delivered? > > I am dealing with

Re: warning: disabling connection caching

2022-12-21 Thread Wietse Venema
Demi Marie Obenour: Checking application/pgp-signature: FAILURE -- Start of PGP signed section. > On 12/20/22 06:13, Wietse Venema wrote: > > Fourhundred Thecat: > >> Hello, > >> > >> I had this in my logs: > >> > >>postfix/master: warni

Re: Log Table Lookup Result

2022-12-20 Thread Wietse Venema
Mehmet Avcioglu: > On Tue, Dec 20, 2022 at 9:57 PM Wietse Venema wrote: > > > However, Postfix does make information from multiple layers available > > for policy decisions: > > Thank you. Yes I am using milter extensively, however I am trying to > influence a

Re: Log Table Lookup Result

2022-12-20 Thread Wietse Venema
Mehmet Avcioglu: > On Sun, Dec 11, 2022 at 3:27 PM Mehmet Avcioglu wrote: > > > Is it possible to log the result of a table lookup? Perhaps similar to the > > header_checks INFO option. > > I guess it is not. > > I can write a daemon that acts like a tcp map and log the results, but I > wouldn'

Re: warning: disabling connection caching

2022-12-20 Thread Wietse Venema
Fourhundred Thecat: > Hello, > > I had this in my logs: > >postfix/master: warning: process /usr/lib/postfix/sbin/scache pid > 1215 killed by signal 11 >postfix/master: warning: /usr/lib/postfix/sbin/scache: bad command > startup -- throttling >postfix/smtp: warning: problem ta

Re: Typo in http://www.postfix.com/postconf.5.html#lmtp_line_length_limit default value (?)

2022-12-18 Thread Wietse Venema
Michael Grimm: > Hi, > > I recently found some of the following messages in my logfiles, all triggered > by the very same sender: > > | Dec 16 22:05:13 mmw.lan postfix/lmtp[46725]: 4MdkqX6PKszHgv: > breaking line > 998 bytes with SPACE > > Ok, after some evaluations, I understood why. From m

Re: Interaction of milters with virtual_alias and postfix/bounce

2022-12-17 Thread Wietse Venema
Thanks for the detailed reply. I'm actually traveling so I can't do a deep analysis on the spot. Other people can chime in if they like. Wietste

Re: Interaction of milters with virtual_alias and postfix/bounce

2022-12-17 Thread Wietse Venema
EML: > I've written a milter to replace a hand-coded SMTP relay. This works, > but I'm having a problem handling bounces. > > The 'relay' actually handles private mailing lists which must be > anonymised (for minors). A user sends a mail to 'virtual' addresses, and > the relay does a database l

Re: emails with s9b1.psmtp.com

2022-12-15 Thread Wietse Venema
Richard Raether: > Dear users wiser than me (probably everyone), > > We have a legitimate domain, einsteintoolkit.org, but I'm getting mail > for einsteintoolkit.org.s9b1.psmtp.com, which postfix doesn't allow Where does that email come from? You may have to look in Postfix logs, typically file

Re: Disable browser based access to postfix

2022-12-15 Thread Wietse Venema
mailm...@ionos.gr: > > now that is funny, I didn't know postfix replied to HTTP requests hahaha! > > $ telnet mail.server 25 > Trying 192.168.1.184... > Connected to mail.server. > Escape character is '^]'. > 220-mail.server.erebor.lan ESMTP > > GET / HTTP/1.0 > > 521 5.7.0 Error: I can break r

Re: outbound oauth2 auth

2022-12-15 Thread Wietse Venema
Gino Ferguson: > > Hi All, > > > First thanks for the replies to my tls connection reuse question. It's > already set up in our QA and it's working fine. :) > > Today's question: we were asked if we can send emails using oauth2 instead of > basic auth. > > The best I could find is this git r

Re: tls connection reuse

2022-12-14 Thread Wietse Venema
Viktor Dukhovni: > On Wed, Dec 14, 2022 at 07:17:43PM -0500, Demi Marie Obenour wrote: > > > > None have come up sofar. So maybe it is safe to make it the default. > > > We know it works well for small messages. but I'd like so see > > > performance metrics for large email messages, because many c

Re: mynetworks_style -> subnet within containers

2022-12-14 Thread Wietse Venema
On 14/12/2022 3:18 PM, Wietse Venema wrote: > mynetworks_style applies to local interface addresses, not proxied > ones. Sam: > Thank you for the response. > > One of the reasons for me asking this question is that I'm not fully > sure about the consequences of that.

Re: milter library for PHP (libMilterPHP)

2022-12-14 Thread Wietse Venema
mailm...@ionos.gr: > > The milter-8.c file you mention has a lot of information that I was missing, > thank you for that! > > One important part is missing, milter response codes are categorised as: > - "modification" There are not "final". They add a header, recipient, change sender, etc. > -

Re: Is there an easy way to "warm up" a new sending IP w/ Postfix

2022-12-14 Thread Wietse Venema
Viktor Dukhovni: > On Wed, Dec 14, 2022 at 06:07:41AM +, Sean Hennessey wrote: > > Viktor and anyone else, > > > > I'd like your opinion on something I've come up with that seems to > > work in my test box. What I've done is set things up so that instead > > of % thresholds I'm using a count o

Re: Filter mail with dangerous attachments

2022-12-14 Thread Wietse Venema
Tan Mientras: > Hello > > Excuse my generic question, but I dont know where to start > *Is it possible to filter/detect/forbid mails containing invoice.exe as > attachment at postfix level?* An example from https://www.postfix.org/header_checks.5.html /etc/postfix/main.cf: head

Re: tls connection reuse

2022-12-14 Thread Wietse Venema
Gino Ferguson: > Hi List, > > > I'm reading the doc and wondering why 'smtp_tls_connection_reuse' > is not enabled by default? Because it was unknown if doing so would cause problems (in Postfix, or in other software). Only real-world deployment can tell such things. > Are there any possible dr

<    5   6   7   8   9   10   11   12   13   14   >