May 19, 2011 
< | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | >
May 19, 2011 [00:02:09] *** Timzzzz is now known as Timmooo[00:07:00] *** Section1 has quit IRC[00:12:36] *** loddafnir1 has quit IRC[00:13:05] *** sphenxes02 has quit IRC[00:18:01] *** brancaleone has quit IRC[00:34:42] *** basho__ has quit IRC[00:34:42] *** geek_cl has joined #postfix[00:35:01] *** Gatto has quit IRC[00:36:13] *** Lenhix has quit IRC[00:44:17] *** krzee has quit IRC[01:02:30] *** BuenGenio has joined #postfix[01:07:31] *** pj has quit IRC[01:08:28] *** geek_cl has quit IRC[01:10:21] *** Kingrat has quit IRC[01:16:58] *** Timmooo is now known as Timzzzz[01:20:12] *** Southron has joined #postfix[01:23:40] *** geek_cl has joined #postfix[01:27:24] *** wdp has quit IRC[01:28:13] *** wdp_ has quit IRC[01:53:41] *** BuenGenio has quit IRC[01:54:09] *** Motoko has quit IRC[02:09:44] *** ScorpiusLetalis has quit IRC[02:27:32] *** n0sq has quit IRC[02:28:55] *** n0sq has joined #postfix[02:34:46] *** p3rror has joined #postfix[02:37:11] *** p3rror has quit IRC[02:37:23] *** p3rror has joined #postfix[02:53:58] *** lusted_gay has quit IRC[03:02:35] *** kuhkatz has quit IRC[03:08:24] *** master_of_master has quit IRC[03:08:29] *** asb has quit IRC[03:08:49] *** Zblakany has quit IRC[03:09:38] *** asb has joined #postfix[03:10:23] *** master_of_master has joined #postfix[03:12:10] *** Hyperi has left #postfix[03:18:53] *** Kingrat has joined #postfix[03:56:07] *** mu574n9 has quit IRC[03:58:04] *** mu574n9 has joined #postfix[04:10:53] *** ScorpiusLetalis has joined #postfix[04:12:46] *** eckirchn has joined #postfix[04:14:30] *** p3rror has quit IRC[04:21:19] *** mu574n9 has quit IRC[04:26:10] *** geek_cl has quit IRC[04:36:04] *** eckirchn has quit IRC[04:47:23] *** eckirchn has joined #postfix[04:47:39] *** eckirchn has quit IRC[04:47:43] *** eckirchn_ has joined #postfix[05:14:55] *** beginer has joined #postfix[05:19:19] *** eckirchn_ has quit IRC[05:20:21] *** Belial_ has quit IRC[05:26:15] *** dragonheart has joined #postfix[05:39:25] *** Kingrat has quit IRC[05:42:10] *** eckirchn has joined #postfix[05:48:38] *** Linex has joined #postfix[05:50:36] *** hparker has quit IRC[05:53:45] *** MAAAAAD has joined #postfix[05:55:45] *** eckirchn has quit IRC[05:57:46] *** MAAAAD has quit IRC[06:04:13] *** Rado has quit IRC[06:14:07] *** Kingrat has joined #postfix[06:22:41] *** krzie has quit IRC[06:24:24] *** JoeCoder has joined #postfix[06:25:06] <JoeCoder> trying to setup an account with thunderbird/imap fails. In my mail.log, I get the error, "imapd: authentication error: Input/output error"[06:25:41] <JoeCoder> I am using mysql to store users. I have a table where I insert rows like this:[06:25:42] <JoeCoder> INSERT INTO `users` (`email`, `password`) VALUES ('paul at democloudserver dot com', ENCRYPT('secretpassword'));[06:25:58] <JoeCoder> but maybe ENCRYPT is not hashing the password the sam way?[06:28:19] *** Dessa has quit IRC[06:32:47] *** krzee has joined #postfix[06:32:47] *** krzee has joined #postfix[06:33:01] *** Dessa has joined #postfix[06:52:15] <JoeCoder> I enabled debugging in authdaemonrc and now I found the problem. it has an issue with my sql syntax[06:53:51] <dragonheart> !imap[06:53:51] <knoba> dragonheart: "imap" : IMAP is an application layer Internet protocol that allows a client (MUA) to access mailboxes on a remote server (see: http://en.wikipedia.org/wiki/IMAP). Postfix does not provide IMAP (or POP3) service; see !courier or !dovecot for common IMAP/POP3 choices.[06:54:36] <JoeCoder> #courier was almost empty. I knew several projects were involved but didn't know the heirarchy[07:04:04] *** JoeCoder has left #postfix[07:07:27] *** p3rror has joined #postfix[07:22:37] *** hever has joined #postfix[07:33:27] *** ThePing has joined #postfix[07:33:27] *** ThePing has left #postfix[07:40:25] *** lusted_gay has joined #postfix[07:48:36] *** e-anima has joined #postfix[07:58:54] *** ScorpiusLetalis has quit IRC[08:00:22] *** ScorpiusLetalis has joined #postfix[08:05:49] *** weedar has joined #postfix[08:21:53] *** weta has quit IRC[08:25:59] *** Southron has quit IRC[08:29:44] *** Zeit|awy has joined #postfix[08:44:49] *** e-jones has joined #postfix[08:49:54] *** weta has joined #postfix[08:54:27] *** Gatto has joined #postfix[08:59:29] *** Dessa has quit IRC[08:59:29] *** Dessa has joined #postfix[08:59:42] *** Kingrat has quit IRC[09:01:45] *** Kingrat has joined #postfix[09:02:57] *** brancaleone has joined #postfix[09:07:38] *** Guip`aw is now known as Guip[09:12:07] *** weta has quit IRC[09:22:51] *** fOrsberg is now known as forsberg[09:24:03] *** Rado has joined #postfix[09:26:00] *** gerhard7 has joined #postfix[09:27:10] *** sphenxes has joined #postfix[09:34:57] *** sphenxes has quit IRC[09:36:41] *** sphenxes has joined #postfix[09:38:23] *** breaker313 has joined #postfix[09:48:12] *** RecQuery has quit IRC[09:48:57] *** empity has joined #postfix[09:50:53] *** Lujeni has joined #postfix[09:51:23] *** RecQuery has joined #postfix[09:51:23] *** RecQuery has joined #postfix[09:58:46] *** JoKoT3 has joined #postfix[10:01:09] *** loddafnir1 has joined #postfix[10:01:47] *** dragonheart has quit IRC[10:04:47] *** DanGer has joined #postfix[10:04:52] <DanGer> hello guys, having thins one[10:04:55] <DanGer> May 19 10:05:32 services postfix/smtpd[70219]: NOQUEUE: reject: RCPT from mail.jinx.sk[188.40.140.124]: 450 4.1.7 <root at jinx dot sk>: Sender address rejected: unverified address: host mail.jinx.sk[188.40.140.124] said: 554 5.7.1 <root at jinx dot sk>: Relay access denied (in reply to RCPT TO command); from=<root at jinx dot sk> to=<danger at rulez dot sk> proto=ESMTP helo=<mail.jinx.sk>[10:05:17] <DanGer> does it indicate that mail.jinx.sk doesn't accept mails for root at jinx dot sk ?[10:06:51] *** eckirchn has joined #postfix[10:07:12] <adaptr> no[10:07:52] <DanGer> adaptr: so what is the problem?[10:08:08] *** sep has quit IRC[10:08:19] <adaptr> the sender address is rejected[10:08:25] <adaptr> it says so[10:08:35] <DanGer> adaptr: sender is root at jinx dot sk right?[10:08:52] <adaptr> yes[10:09:07] <DanGer> ok, and why is it rejected?[10:09:15] <adaptr> because it doesn't exist[10:09:35] <DanGer> it does. when I actually telnet to mail.jinx.sk and try to send to root at jinx dot sk it gets delivered[10:09:52] <adaptr> you're confusing two unrelated phenomena[10:10:30] <DanGer> adaptr: can you be more specific please?[10:10:55] <adaptr> this error states that mail.jink.sk returned the address probe with a relay denied error. that means this postfix cannot deliver to root at jink dot sk.[10:11:18] <adaptr> it is entirely possible that you did not really want to use reject_unverified_sender[10:12:56] *** sep has joined #postfix[10:13:10] *** beginer has quit IRC[10:14:34] *** beginer has joined #postfix[10:14:43] <DanGer> adaptr: I still don't understand. why would mail.jinx.sk return with relay access denied when my mailserver is trying an existing address (root at jinx dot sk) ?[10:15:32] *** beginer has quit IRC[10:16:08] <DanGer> so, which end point is misconfigured?[10:18:19] <adaptr> possibly both[10:18:37] <adaptr> pastebin postconf -n from both systems, and more relevant logs[10:18:54] *** shal3r has quit IRC[10:19:24] *** cilly has joined #postfix[10:20:57] <DanGer> adaptr: http://danger.rulez.sk/postconf.txt is the recieving side[10:21:10] <DanGer> adaptr: I don't have the postconf from the other side[10:21:13] <DanGer> (sender)[10:24:10] <adaptr> do you know what all of those settings mean ?[10:24:46] <DanGer> well it's been some time since I set it up :-)[10:25:00] <adaptr> that is a no, then.[10:25:17] <adaptr> it's a mess[10:26:06] <DanGer> what exactly? :)[10:26:10] <adaptr> all of it[10:26:13] <adaptr> it's a mess[10:26:27] <Aprogas> The fact that it barely fits on my 24" 1920x1200 screen.[10:26:44] <adaptr> there's dozens of default values in that config, and dozens more of duplicated stuff you don't even understand[10:27:02] <Aprogas> !duplicates[10:27:02] <knoba> Aprogas: "duplicates" : the following can be used to list redundant settings defined in main.cf: (postconf -d; postconf -n) | sort | uniq -d[10:27:42] <adaptr> there's a prettier one: (postconf -d; postconf -d; postconf -n) | sort | uniq -u[10:27:48] <adaptr> that yields you rminimum main.cf[10:29:13] <adaptr> be careful since custom dfeinitions are not shown by postconf[10:29:21] <adaptr> (that goes for both versions)[10:29:53] <Aprogas> And continued logical lines are merged with lots of whitespace.[10:30:45] <DanGer> ok I guess having the default values defined in main.cf is not the problem[10:30:46] <adaptr> ...no, postconf does not output multiline settings[10:30:52] <adaptr> DanGer: yes it is.[10:31:39] <adaptr> not as much as the plethora of advanced settings you have, of course[10:31:59] <DanGer> what exactly is so advanced on my config?[10:32:28] <DanGer> it's just a bunch of antispam proticetions[10:34:08] <DanGer> I will be happy to clean it up if you tell me what you dislike about my config[10:37:32] <Aprogas> Defining settings that are already default clutters the config.[10:38:09] <Aprogas> Also Postfix offers many settings that you can set, but usually wouldn't, and are only there for very specific situations.[10:38:53] *** dragonheart has joined #postfix[10:39:03] <Aprogas> e.g. smtpd_hard_error_limit will probably be fine at its default setting too[10:39:48] *** cilly has quit IRC[10:40:30] <DanGer> ok, I have removed the redundancies (besides host config which I want to have under control in the config file) - http://danger.rulez.sk/postconf.txt[10:44:06] <Aprogas> This looks much better.[10:44:35] <Aprogas> What is in your verify map?[10:45:26] <Aprogas> By the way, personally I prefer putting all my pre-DATA restrictions under recipient_restrictions and ignoring client/helo/sender[10:47:31] *** Killsudo has joined #postfix[10:47:39] <Killsudo> ayone around?[10:47:42] *** dragonheart has quit IRC[10:48:04] <Aprogas> !tell Killsudo ask[10:48:04] <knoba> Killsudo: "ask" : Please regard http://workaround.org/getting-help-on-irc and don't ask to ask, just ask. (after you've read 'getting help')[10:48:34] <DanGer> Aprogas: the file is binary, how do I dump it?[10:48:39] <Killsudo> tryng to find someone that can fill me in on an option for PostfixAdmin(chan is dead)[10:49:00] <Killsudo> Im tryijng to deteremine if the following '' is correct or a typo[10:49:01] <Killsudo> // Specify '' for Dovecot and 'INBOX.' for Courier.[10:49:03] <Killsudo> $CONF['create_mailbox_subdirs_prefix']='INBOX.';[10:49:11] <Aprogas> DanGer: You are probably looking at the btree, rather than the source-file of the btree[10:49:24] <DanGer> Killsudo: so which one are you using, dovecot or courier?[10:49:25] <adaptr> Killsudo: ask in #postfixadmin or TIAS[10:49:33] <Killsudo> dovecot[10:49:40] <Aprogas> !postfixadmin[10:49:40] <knoba> Aprogas: "postfixadmin" : used for managing email accounts through a web interface (http://high5.net/postfixadmin/). Further, this channel is for issues regarding postfix. For postfixadmin support, please try the postfixadmin mailing list or the postfixadmin channel.[10:49:41] <Killsudo> adaptr: already did and googled[10:49:43] <DanGer> Killsudo: then do what the coment sais[10:49:45] <DanGer> says[10:50:08] <Killsudo> just seems odd to leave it blank[10:51:10] <DanGer> Aprogas: I guess there should be /var/db/postfix/verify, which I don't have although there's verify.db[10:51:39] <Aprogas> I never used btree's, but I think their mostly just a sorted hash and still have a plaintext input.[10:51:59] <Aprogas> You can probably make postmap dump the output of the file though.[10:52:18] <Aprogas> !postmaps[10:52:18] <knoba> Aprogas: Error: "postmaps" is not a valid command.[10:52:20] <Aprogas> !postmap-s[10:52:20] <knoba> Aprogas: Error: "postmap-s" is not a valid command.[10:53:37] <Aprogas> Never mind what I'm saying, I was confused.[10:53:41] *** basho__ has joined #postfix[10:53:47] <Aprogas> verify map is written by verify(8)[10:54:32] <DanGer> Aprogas: the only verify configuration is in my main.cf which doesn't really say much about that and master.cf which has a standard line[10:54:53] <Aprogas> You have a few reject_unverified restrictions.[10:55:15] <Aprogas> I think you should clean and merge all your pre-DATA restrictions into recipient_restrictions; they will be processed in order.[10:55:25] <Aprogas> This will give more oversight for you and make it easier to understand what happens.[10:55:53] <Aprogas> There's no point in doing identical check_recipient_access in both recipient and sender restrictions.[10:57:10] <DanGer> Aprogas: that's true. and what about others?[10:58:13] <Aprogas> I recommend you first clean them up and order them logically; it is hard for me to parse them in their current form, I'm not used to them being split up like that.[11:01:57] <Aprogas> Also I think Postfix only picks up comments that start at the beginning of the line. Your mynetworks has a "comment" but I don't think it's being parsed as such.[11:14:07] *** Kingrat has quit IRC[11:16:49] *** beginer has joined #postfix[11:24:10] <DanGer> Aprogas: so what would be a logical order? :)[11:25:01] <Aprogas> Cheap checks before expensive checks, and keep reject_unauth_destination and various permits in the right place.[11:35:12] *** TomHome has joined #postfix[11:38:14] *** n0sq has quit IRC[11:41:24] *** Killsudo has quit IRC[11:44:19] <adaptr> end-of-line comments are not supported anywhere in postfix[11:46:27] <jelly> sad parser is sad[11:51:26] *** n0sq has joined #postfix[11:52:10] <DanGer> adaptr: ok, I fixed that too, thanks[11:53:15] *** jwing has quit IRC[11:53:41] *** jwing has joined #postfix[12:11:46] <DanGer> Aprogas: so I have this now: http://danger.rulez.sk/postconf.txt[12:13:24] <Aprogas> I think you misunderstood what I meant by merging client, helo, sender and recipient restrictions into recipient restrictions.[12:16:49] <Aprogas> You are still doing a lot of redundant checking.[12:17:05] <adaptr> but is he doing it CYCLICALLY[12:17:40] <Aprogas> adaptr: I don't follow.[12:18:07] <adaptr> postconf -e cyclic_redundancy_check = are_you_anidiot[12:18:42] *** cilly has joined #postfix[12:20:28] <DanGer> Aprogas: so do you mean something like that I should move all checks that are the same for client, helo, sender and recipient into recipient only?[12:21:04] <adaptr> DanGer: as documented, unless you know what you are doing and why, use smtpd_recipient_restrictions[12:21:11] <Aprogas> I am saying that smtpd_(client|helo|sender)_restrictions shouldn't exist.[12:21:12] <adaptr> !tell DanGer access[12:21:13] <knoba> DanGer: "access" : http://www.postfix.org/SMTPD_ACCESS_README.html : An overview of access(5) controls in the Postfix smtpd(8) SMTP server.[12:21:25] <adaptr> it's long. read it ALL.[12:24:37] <Aprogas> You should really be familiar with how Postfix restrictions work, since that is where your error is coming from.[12:25:19] <adaptr> we tiold him hours ago what the exact problem was. didn't help, of course[12:26:26] *** cpm has joined #postfix[12:27:18] <DanGer> adaptr: well you only told me that it's a mess but not why. now I'm starting to understand...[12:27:22] * DanGer going to clean it up[12:28:23] <Aprogas> Apart from permit_mynetworks and reject_unauth_destination, if you don't understand or know what a restriction does, you can probably do without it.[12:29:09] <adaptr> 10:13:21 adaptr | it is entirely possible that you did not really want to use reject_unverified_sender[12:29:20] <adaptr> 2 hours and 18 minutes ago[12:29:31] <Aprogas> horiversary[12:31:37] <Aprogas> I actually prefer DanGer's approach: wanting to thoroughly clean the config, rather than just hearing your fix, removing just that, and leaving with an ugly config[12:31:48] <Aprogas> So we should all be glad.[12:32:27] *** thunderstrike has joined #postfix[12:34:52] <adaptr> he actively protested against that part, so I don't really care.[12:36:30] *** davlefou has joined #postfix[12:40:33] *** slune has joined #postfix[12:41:33] *** n0sq has quit IRC[12:42:17] *** leprechau has quit IRC[12:44:09] *** davlefou has quit IRC[12:44:26] *** cilly has quit IRC[12:46:00] *** davlefou has joined #postfix[12:48:12] *** n0sq has joined #postfix[12:48:57] <DanGer> Aprogas, adaptr better? http://danger.rulez.sk/postconf.txt[12:50:32] <Aprogas> Your IPv6 connectivity is slow or down.[12:51:06] <DanGer> Aprogas: it's probably down, sorry[12:51:07] <cpm> anyone have doughnuts?[12:51:39] <Aprogas> DanGer: Another step closer, but still not quite there.[12:51:59] <Aprogas> DanGer: You can put stuff like check_client_access under smtpd_recipient_restrictions too.[12:52:10] <Aprogas> Restrictions aren't evaluated until after RCPT anyway.[12:52:43] <Aprogas> Hence why many prefer to just put all pre-DATA restrictions under recipient_restrictions, even if they apply to helo, sender, etc.[12:53:21] <cpm> after you go buy #postfix doughnuts[12:54:59] <DanGer> Aprogas: actually I was reading http://www.postfix.org/SMTPD_ACCESS_README.html[12:55:10] <DanGer> Aprogas: which says: "In order to avoid surprises like these with smtpd_recipient_restrictions, you should place non-recipient restrictions AFTER the reject_unauth_destination restriction, not before. In the above example, the HELO based restrictions should be placed AFTER reject_unauth_destination, or better, the HELO based restrictions should be placed under smtpd_helo_restrictions where they can do no harm."[12:55:40] <Aprogas> If you do it right, you can put all under recipient.[12:55:48] <Aprogas> By the way, I don't recommend your unverified_recipient_reject_code = 550[12:56:04] <Aprogas> Default reject code is a temporary error, so remote MTAs will retry.[12:56:21] *** forsberg is now known as fOrsberg[12:56:22] <Aprogas> verify(8) might fail to verify because of a temporary error[12:56:33] <DanGer> oki[12:57:07] <Aprogas> One should indeed be extra careful about access(5)-tables used above reject_unauth_destination[12:57:54] <Aprogas> You should of course verify the contents of the access tables you use as well, especially if you move them directly under recipient_restrictions.[12:58:00] <Aprogas> DUNNO is a much safer alternative to OK[12:58:13] <Aprogas> DUNNO just "passes" that restriction but keeps processing the rest[12:58:26] <DanGer> Aprogas: indeed, that's why I kept it separated where it says it makes no harm at all[12:58:59] *** wdp has joined #postfix[12:58:59] *** wdp has joined #postfix[12:59:15] <Aprogas> Well, alright.[12:59:42] <DanGer> Aprogas: my access lists use OK currently[12:59:48] <Aprogas> Do any of your access(5) tables contain lines that say OK/PERMIT ?[12:59:54] <DanGer> yep[12:59:58] <Aprogas> Why? Most of the things access(5) tables check against are easily forged.[13:00:10] <Aprogas> You might move your recipient_access down somewhat then.[13:01:44] *** torvald_ has quit IRC[13:02:15] <DanGer> Aprogas: like where for example? :)[13:02:28] <DanGer> Aprogas: before first reject_ ?[13:02:33] <Aprogas> Does your recipient_access contain any ok/permit lines?[13:02:48] <DanGer> Aprogas: yes[13:02:49] *** weta has joined #postfix[13:03:03] <Aprogas> Below reject_unauth_destination then.[13:03:33] *** torvald_ has joined #postfix[13:03:44] <Aprogas> You can also use another restriction as result in an access(5)-table, for example to whitelist mail to abuse at example dot net I have an access(5)-table stating: abuse at example dot net permit_auth_destination[13:03:54] *** eckirchn has quit IRC[13:04:22] *** danlii has quit IRC[13:04:43] <DanGer> Aprogas: ok, got it[13:04:47] <Aprogas> If you accidently have anything in your recipient_access table that is not a domain you serve, you might become an open relay to that domain, if you give it a ok/permit[13:05:22] <Aprogas> I have to leave now.[13:05:40] <DanGer> Aprogas: I have only 2 entries under domains that is mine, so that's fine then :)[13:12:44] *** loddafnir1 has quit IRC[13:15:41] *** david_ has joined #postfix[13:19:36] *** davlefou has quit IRC[13:23:05] <DanGer> Aprogas: thanks for help so far, when you got the time again, just ping me[13:23:27] *** mitchlovin has quit IRC[13:24:16] *** mitchlovin has joined #postfix[13:25:31] *** bubu has joined #postfix[13:32:20] *** mythicalbox has joined #postfix[13:34:47] *** kuhkatz has joined #postfix[13:35:36] *** breaker313 has quit IRC[13:35:57] *** mitchlovin has quit IRC[13:35:58] *** mythicalbox is now known as mitchlovin[13:50:44] *** david_ has quit IRC[13:51:12] *** david_ has joined #postfix[13:59:10] *** Cain` has joined #postfix[14:00:41] *** Cain has quit IRC[14:00:47] *** Cain` is now known as Cain[14:02:51] *** hparker has joined #postfix[14:21:24] *** david_ has quit IRC[14:21:54] *** david_ has joined #postfix[14:22:33] <adaptr> a recipient access table[14:22:39] <adaptr> meh[14:23:12] *** dizorder has joined #postfix[14:23:49] <cpm> a rob0_access_table, even less meh[14:24:18] <adaptr> the rob0_access_table is a myth[14:24:51] *** fOrsberg is now known as forsberg[14:24:52] <cpm> some would say rob0 is a myth, but we all know better, for we have beheld[14:25:10] <adaptr> well, be-read. and in some unfortunate cases, befelt[14:27:01] *** dragonheart has joined #postfix[14:27:44] <dizorder> Question: when I want to use Postfix solely for sending notification e-mails and alerts for monitoring services through smtp.gmail.com, do I have to add a domain?[14:27:48] *** beginer has quit IRC[14:28:13] <adaptr> !tell dizorder nullclient[14:28:13] <knoba> dizorder: "nullclient" : a null client is a computer that can only send mail. it receives no mail from the network, and it does not deliver any mail locally. while postfix can be configured to fill this role, it is often unnecessary overkill, and a much simpler software package is more appropriate. see !nullclient_software for more details.[14:28:52] <dizorder> !nullclient_software[14:28:52] <knoba> dizorder: "nullclient_software" : a program that serves as a drop in replacement for /usr/sbin/sendmail and provides a simple means to submit messages to an existing msa without the need to install and maintain a full-blown mta/msa. examples include msmtp, esmtp, ssmtp and nullmailer. also see !msa[14:29:03] *** e-anima is now known as romulaner[14:29:11] *** romulaner is now known as e-anima[14:29:18] <dizorder> !msa[14:29:18] <knoba> dizorder: "msa" : Message Submission Agent : a process which accepts message submissions from MUAs on port 587 known as 'message submission service' using the 'message submission protocol' defined by rfc4409. To enable message submission service in postfix uncomment the relevant lines in master.cf. also see !submission.[14:30:30] <dizorder> Thanks, adaptr[14:30:34] *** milligan has quit IRC[14:31:27] <adaptr> np[14:38:13] <_NiC> When I have in my smtpd_recipient_restrictions section, postgrey listed with check_policy_service inet:127.0.0.1:10023, followed by some reject_rbl_client-lines, and an incoming email is greylisted, it seems that it continues to check against the RBL, why is that?[14:38:19] *** milligan has joined #postfix[14:41:00] *** david_ has quit IRC[14:41:02] <adaptr> because greylisting rejects mail[14:41:30] <adaptr> all it does when it passes mail is DUNNO.[14:41:38] <adaptr> !policy[14:41:38] <knoba> adaptr: "policy" : Postfix smtpd(8) policy protocol, http://www.postfix.org/SMTPD_POLICY_README.html , for complex and intelligent restrictions[14:43:07] *** jujugre has joined #postfix[14:43:23] *** david_ has joined #postfix[14:43:48] <_NiC> so it has no effect?[14:44:43] <lunaphyte_> you should not be greylisting until after mail has passed rbl checks.[14:45:28] <_NiC> I figured I'd be nice and save some traffic against the RBL and greylist first.. bad idea?[14:45:57] <Dominian> greylisting is overrated anyway[14:46:19] <_NiC> Yes, I've heard people say that[14:46:28] <Dominian> I haven't greylisted in years[14:46:40] <Dominian> and now with the builtin postscreen in postfix.. greylisting is useless imho[14:48:06] <wdp> _NiC, i did the same and had the same thought: greylisting first, followed by rbl's to not make a lot of traffic to rbl's. However. That leads to a massive amount of used resources in greylisting, which depending on your greylisting daemon leads to a lot of problems. So i guess you want to make sure, you feed as less mails to greylisting, as possible. I guess the correct way would be: pre-filtering (rbl's, simple checks, etc), greylisting, resource-eati[14:48:06] <wdp> ng-techniques (amavisd, spamassassin, whatever)[14:49:21] <wdp> _NiC, however, i disabled greylisting for a lot of my domains because it leads to other trouble with several providers. for example t-online in germany. In some forum entry an employer of them wrote that greylisting is not rfc-conform and thus they don't care about mail trouble if greylisting is enabled. greylisting enabled means you reciever their mails up to two weeks too late.[14:49:59] <wdp> s/reciever/recieve[14:50:29] <lunaphyte_> yes, doing greylisting before checking rbls is a bad idea.[14:50:37] <_NiC> hmyes. I just remember when I first put it in, I had such a drastic reduction in the amount of spam, I have a hard time letting it go I think[14:52:54] <lunaphyte_> you'd be a fool to stop doing something on your mail server because someone else's mail server did not benefit from doing it.[14:52:57] *** geek_cl has joined #postfix[14:53:07] <lunaphyte_> greylisting is not overrated.[14:53:20] <lunaphyte_> it does what it does, and it either works for you or it doesn't.[14:53:39] *** zorg1 has joined #postfix[14:53:53] <lunaphyte_> because it isn't beneficial for some people does not mean it's overrated, and does not mean you should stop using it.[14:54:01] <lunaphyte_> if it's effective for you, then use it.[14:54:41] <_NiC> It is, so I will.[14:54:50] <_NiC> Moved it below RBL now though.[14:54:54] <wdp> lunaphyte, thats not the point, if i may argue with you. the point is, some providers are handling that bad, and if emails are important for you, greylisting might make such important mails come to you too late.[14:55:09] <lunaphyte_> no, that is the point.[14:55:23] <wdp> lunaphyte, so its not about "is it effective" it's about "can you life with the negative aspects of it"[14:55:32] <wdp> because then, you might lose money.[14:55:33] *** Belial_ has joined #postfix[14:55:34] <lunaphyte_> as with anything, greylisting has a set of considerations that accompany it.[14:55:55] <_NiC> I'm aware of the downsides of greylisting, and we've had customers on the phone a few times about it[14:56:12] <wdp> of course, you could create a whitelist for greylisting. But i came to the conclusion, whitelisting is way too much work :)[14:56:19] <lunaphyte_> this is irrelevant. a competent mail admin manages whatever needs to be managed and is aware of what is happening.[14:56:36] <_NiC> We've offered to whitelist their domain, but when I told them how it works and why we've chosen to have it, they mostly think it's a good idea.[14:56:39] <lunaphyte_> we don't debate the merits of stuff here based on how it would affect an idiot who has no clue of what they're doing.[14:57:07] <lunaphyte_> that lowest common denominator garbage has no place here, or in linux in general.[14:57:50] <wdp> lunaphyte, so who's the idiot, the company with millions of mail addresses configuring their mailservers in a way that mails which got temporarily rejected will be resend two weeks later (and not, as greylisting assums 15-30-60minutes later) or the mail admin on the other side who didn't know about this and so didnt whitelisted that company?[15:02:32] *** david_ has quit IRC[15:03:08] <lunaphyte_> oh, in that case, both.[15:03:49] <wdp> heh :)[15:03:54] *** david_ has joined #postfix[15:05:31] <_NiC> :)[15:06:13] *** TomHome has quit IRC[15:16:01] *** sbeam has joined #postfix[15:24:27] *** david__ has joined #postfix[15:28:06] *** david_ has quit IRC[15:33:29] *** asb has quit IRC[15:33:45] <e\ectro_> is there anyway I can manipulate from sender address using sender_canonical where I can rewrite the sender? I can do it if email is sent directly to the postfix server, but not if its relayed from an internal smarthost[15:34:18] <e\ectro_> i need my permimeter SMTP host to modify the from address so one of our clients doesnt spam themselves[15:35:14] *** kuhkatz has quit IRC[15:36:58] *** StupidMop has joined #postfix[15:37:55] *** StupidMop has quit IRC[15:38:52] *** asb has joined #postfix[15:39:06] *** kuhkatz has joined #postfix[15:39:07] *** kuhkatz has joined #postfix[15:39:08] <Aprogas> DanGer: I have returned.[15:39:24] *** ampletime has joined #postfix[15:39:32] <ampletime> hello[15:40:01] <e\ectro_> ello govna[15:41:16] <ampletime> another day.. i just can't get used to mornings[15:45:23] *** dizorder has quit IRC[15:46:47] *** bubu has quit IRC[15:47:31] <DanGer> Aprogas: okay[15:47:57] <DanGer> Aprogas: so do you see some further problems with myu config?[15:48:21] <digitolx> I'm scripting a cronjob and I'd like to from to be the server name,, but right now it says from root... what setting should I be looking for[15:48:47] *** asb has quit IRC[15:51:05] *** asb has joined #postfix[15:52:03] <lunaphyte_> digitolx: why are you asking for help with cron here? this is #postfix .[15:52:20] <digitolx> I'm using postfix to send the mail[15:52:26] <lunaphyte_> so?[15:52:27] <Dominian> its not postfix's fault[15:52:45] <Aprogas> DanGer: Do you understand what all restrictions do, and are you sure you want to use them?[15:52:48] <Dominian> Sounds like.. zomg.. can it be.. that the cronjob is being run as... root?[15:53:19] <lunaphyte_> mail servers don't set stuff for mail generated by other programs.[15:54:22] <DanGer> Aprogas: well I guess I understand most of them. as I said, it's quite a few years since I set it up[15:54:30] *** david__ has quit IRC[15:54:31] <DanGer> Aprogas: but I was using these restrictions for a long time[15:54:56] *** david__ has joined #postfix[15:55:26] <Aprogas> reject_unverified_sender and reject_unverified_recipient will reject mails to or from addresses that cannot be verified.[15:55:58] <digitolx> lunaphyte_: ok understood, I wasn't sure if I could force all mail from postfix to go out as a specific user.. and I guess you can't[15:56:01] *** weedar has quit IRC[15:56:19] <digitolx> or all mail sent through postfix[15:56:23] <lunaphyte_> it's not about whether or not you can or can't.[15:56:25] <Aprogas> digitolx: You can do rewriting, but the first place to change addresses is in the MUA or other program that generates the mail.[15:56:27] *** xro has joined #postfix[15:56:53] <lunaphyte_> of course you can. postfix is about as flexible as it gets - so naturally, you can do a ton of brain dead stuff with it.[15:56:54] <DanGer> Aprogas: yep, I do not want to receive mails from non-existing senders[15:57:10] <lunaphyte_> the point is that it's not the right way to solve the problem.[15:58:06] <DanGer> Aprogas: do I understand that option well?[15:58:12] <DanGer> *correctly?[15:58:23] *** forsberg is now known as fOrsberg[15:58:24] <lunaphyte_> you wouldn't improperly address postal mail, send it off to your post office, and then try to convince the post office to correct it.[15:59:31] *** UQlev has joined #postfix[15:59:58] <Aprogas> DanGer: Probes are not always entirely correct; and bothering other mailservers with probes is not always appreciated.[16:00:41] <lunaphyte_> address verification is rude, and inconsiderate. don't do it.[16:01:12] <digitolx> I understand that, and see the implications, I just wasn't sure if it was something as simple as an alias .. my apologies I think I've upset you lol[16:01:32] <lunaphyte_> why do you think you've upset us?[16:01:44] <DanGer> lunaphyte_: why rude, incosiderate?[16:02:04] <thumbs> umm?[16:02:19] <lunaphyte_> uh...[16:02:53] <lunaphyte_> all i have to do to get you to harass some poor schmuck's innocent mail server is send you messages using him as the sender...?[16:03:09] <lunaphyte_> ah - add irresponsible in there too.[16:03:54] <digitolx> I didn't really think I upset you but thanks for the clarification[16:04:09] <lunaphyte_> oh, ok, good. no problem[16:04:09] <DanGer> digitolx: these messages are for me :)[16:04:16] <Aprogas> I think address verification is meant for between servers you control or have explicitly agreed to it; e.g. if you relay mail to the backend mailserver of a client and you probe the backend.[16:04:45] <lunaphyte_> yes, and even then, it's the wrong solution to the problem.[16:04:50] <DanGer> ok I can disable it, but i've been using it for a long time (in years :))[16:05:11] <Aprogas> lunaphyte_: Are you saying that obtaining a periodic fresh copy of the list of valid addresses on the backend mailserver is more efficient?[16:05:24] <lunaphyte_> heavens no.[16:05:32] <lunaphyte_> that would be brain dead as well.[16:05:38] <_NiC> lunaphyte_, why is it the wrong solution to probe your own backend servers?[16:05:44] <Aprogas> What is the right solution then?[16:06:05] * DanGer disabled address verification[16:06:16] <lunaphyte_> funny though, how many of the commercial "anti-spam" appliances do that very thing, and seem to think it's perfectly sane.[16:06:34] <DanGer> so, anything else? ;)[16:06:42] <lunaphyte_> the right solution is real-time, out of band, recipient validation.[16:07:31] <lunaphyte_> [with, perhaps, some tolerable degree of caching, if necessary, to keep a balance between performance and accuracy - although that is rarely necessary with a well configured system][16:09:39] <_NiC> I do probe my backend servers for valid recipient addresses[16:09:55] <_NiC> with reject_unverified_recipient[16:10:28] <lunaphyte_> only inferior products and software would require that sort of workaround.[16:10:29] <rob0> It's not wrong, it's just less than ideal. It's far better than backscattering.[16:11:03] <_NiC> lunaphyte_, I fail to see how that's any different than what you just said the right solution is?[16:11:14] <Aprogas> I think what lunaphyte is saying, is that an SMTP message is a rather inefficient way to ask "does this exist yes/no", and that directly asking their backend database is more efficient.[16:11:16] <lunaphyte_> oh, of course. i'm not suggesting that deficient methodologies be abandoned in favor of backscattering.[16:12:06] * _NiC looks up "out of band"[16:12:07] <lunaphyte_> backscattering is not acceptable, empirically - so that doesn't even enter into the equation.[16:12:19] <rob0> It's a kludge. Quite necessary for those who cling to inferior products and software, but that doesn't make it ideal or pretty.[16:12:25] <Aprogas> I have to rewrite my virtual alias SQL table to prevent future backscattering.[16:12:29] <lunaphyte_> _NiC: think of it this way - how does your backend system know if a recipient is valid or not?[16:13:20] <_NiC> lunaphyte_, exim (which happens to be on my backend servers) check various things.[16:13:22] <Aprogas> I need the local-parts that exist under example.net to also exist under example.org, but @example.org @example.net is a backscatter catch-all.[16:13:35] <lunaphyte_> _NiC: check *what* various things?[16:14:15] <_NiC> lunaphyte_, files I suppose, that contain email accounts. I see where you're going.[16:14:16] <rob0> "out of band" are plain language. In context here it means "not using SMTP".[16:14:41] <lunaphyte_> _NiC: cool, good deal.[16:14:42] <Aprogas> I'm pretty bad at SQL; any clues on how I set this up? I came as far as realising that I need to split email-addresses into their localpart and domainpart (trivial) and to not literally store the domainpart, but link the localpart to the id(s) of one or more domains from another table.[16:14:59] <_NiC> I looked into other ways of getting a yes/no answer to wether or not an address existing, but I ended up with asking exim. It was the easiest way to implement it.[16:15:59] <lunaphyte_> easiest...[16:16:04] <_NiC> My backend servers are DirectAdmin servers, so I'm not exactly sure how exim deals with various forwards, accounts, lists, extensions..[16:16:30] <_NiC> My alternative would to find some other way of querying all these files and settings[16:16:49] *** ssureshot has joined #postfix[16:17:52] <_NiC> It may be a bad option, but so far it's the best one I've found at least.[16:18:26] *** davlefou has joined #postfix[16:19:50] *** digitolx has quit IRC[16:22:54] *** david__ has quit IRC[16:23:31] *** geek_cl has quit IRC[16:23:49] *** krzee has quit IRC[16:24:27] *** krzee has joined #postfix[16:24:27] *** krzee has joined #postfix[16:24:48] *** asb has quit IRC[16:25:42] *** asb has joined #postfix[16:30:53] *** Lenhix has joined #postfix[16:31:19] *** ScorpiusLetalis has quit IRC[16:32:10] *** ScorpiusLetalis has joined #postfix[16:34:07] *** secretary_linux has joined #postfix[16:34:24] <secretary_linux> can anyone tell me if the centos package for postfix just does not include a manpage for mailq?[16:35:07] *** xro has left #postfix[16:39:05] *** weta has quit IRC[16:41:48] <lunaphyte_> so far, no one from the centos community has expressed any interest in providing support here for the abandoned versions of postfix they ship, so you'll need to ask #centos .[16:42:14] <secretary_linux> heh, go figure.[16:42:36] <lunaphyte_> yup.[16:42:51] <lunaphyte_> crappy os with a gimmick, crappy support. no surprise.[16:42:52] <secretary_linux> well, is the syntax close enough from postfix mailq to sendmail mailq that the manpage would be roughly equivalent?[16:43:19] <lunaphyte_> i'm not sure what you're getting at.[16:43:29] <secretary_linux> maybe they just don't ship a separate manpage for mailq since it's there mostly for sendmail compatibility?[16:43:37] <lunaphyte_> !goal[16:43:37] <knoba> lunaphyte_: "goal" : describe your goal, not what you think the solution is[16:44:41] <secretary_linux> goal: no real goal other than reading the manpage for mailq :) and figuring out why zcat /usr/share/man/man1/mailq.postfix.1.gz returns ".so man1/sendmail.1"[16:45:44] *** sandwiches has quit IRC[16:46:06] <DanGer> Aprogas: well, thank you so far for the help[16:46:48] <Aprogas> secretary_linux: All Postfix man-pages are available online.[16:47:10] *** davlefou has quit IRC[16:47:13] *** loddafnir has joined #postfix[16:47:29] <Aprogas> !docs[16:47:30] <knoba> Aprogas: "docs" : Postfix documentation http://www.postfix.org/documentation.html[16:47:32] <lunaphyte_> [or, included for free with the product, which can be downloaded for free][16:47:53] <jumperboy> secretary_linux: try: ls -alh `which mailq`[16:48:03] <jumperboy> secretary_linux: if it's a symlink, look up that manpage[16:48:26] <_NiC> What's best practice for things like this? postfix/smtpd[13789]: warning: 124.123.115.60: hostname ras.beamtele.net verification failed: No address associated with hostname[16:48:38] <secretary_linux> thanks all. it's not so much I even need that manpage I'd just ideally not like to see broken manpages sitting around but it may just be a centos packaging flaw[16:49:02] *** davlefou has joined #postfix[16:49:25] *** amir has quit IRC[16:49:52] <jumperboy> secretary_linux: on slackware, man mailq brings up the sendmail man page. see how they package it, maybe...[16:49:57] *** amir has joined #postfix[16:50:22] <jumperboy> secretary_linux: duh, sorry, that's my own install from source[16:50:27] <secretary_linux> :)[16:50:52] <jumperboy> secretary_linux: ugh, actually, that[16:50:57] <secretary_linux> well the symlinks are all good, it's just that literally the text of the mailq.postfix manpage is ".so man1/sendmail.1"[16:50:57] <jumperboy> 's from linux mint[16:51:36] * jumperboy is running on empty, need more coffee[16:51:46] <lunaphyte_> blech[16:51:51] <lunaphyte_> coffee is foul[16:52:14] <secretary_linux> I'm with both of you on that.[16:52:19] <Aprogas> _NiC: I'd use missing rDNS or failing FCRDNS in a scoring system.[16:52:22] <secretary_linux> it is foul, and damn, I need more.[16:52:28] *** weedar has joined #postfix[16:52:39] <_NiC> I've had these coffee periods in my life a few times.. and I have to admit, I feel better after being off it for a while than while I was on it. :)[16:52:59] <secretary_linux> yeah, yeah. I know that's true. I'm just too cynical about life without coffee to listen.[16:53:10] <jumperboy> i've found that the cream and sugar is the bad part, black coffee isn't that bad[16:53:39] *** ScorpiusLetalis has quit IRC[16:53:48] <lunaphyte_> coffee is a crutch.[16:53:55] <_NiC> Aprogas, so too strict to just reject things like that immediately?[16:54:18] <Aprogas> _NiC: It depends on what kind of mailserver you a running and who would normally mail you.[16:54:31] *** ScorpiusLetalis has joined #postfix[16:54:32] <Aprogas> For a personal mailserver where only yourself are affected by false positives, you could be more strict.[16:55:05] <_NiC> don't think I can afford to be strict with it.. :)[16:55:54] <_NiC> humm. I seem to be getting mail to an address I forgot I had.[16:55:59] <lunaphyte_> use it as another metric in your content filter scoring mechanism.[16:56:15] *** ketema has left #postfix[16:56:33] * adaptr scores a metric lunaton[16:57:06] <lunaphyte_> careful with that. it gets denser when the tide comes in.[16:58:14] *** weedar has quit IRC[16:59:49] <jumperboy> secretary_linux: .so man1/sendmail.1 is a man directive to show that page instead, that's default for postfix when compiling from source[17:00:19] <secretary_linux> ah so postfix doesn't have its own mailq manpage, it depends on sendmail?[17:00:23] <jumperboy> secretary_linux: so you might have another problem involving the man system itself[17:00:26] <lunaphyte_> no[17:00:36] <lunaphyte_> sendmail.1 is a postfix man page.[17:00:41] <jumperboy> secretary_linux: no that's postfix's sendmail compatible interface[17:00:51] <jumperboy> secretary_linux: all systems need a sendmail command[17:01:06] <secretary_linux> yes of course[17:01:18] <jumperboy> postfix provides one. that's why it's tricky to have 2 MTAs installed on a machine[17:01:29] *** wdp has quit IRC[17:01:35] <jumperboy> they overlap a little and may overwrite some files[17:01:57] <secretary_linux> postfix uses man1/sendmail.1 for help on the commands that overlap with sendmail?[17:02:28] <jumperboy> its sendmail binary is also its mailq command[17:02:43] <secretary_linux> makes sense[17:02:47] <jumperboy> it puts all this info in one manpage[17:03:02] <secretary_linux> I wonder if centos just didn't package this manpage because they thought like I just did that it was part of sendmail and not postfix[17:03:31] <secretary_linux> or if removing sendmail removes that file[17:03:50] <secretary_linux> I never did like RPM.[17:04:09] <jumperboy> are you sure they didn't? is there a sendmail(1) manpage?[17:04:23] <secretary_linux> hm yes there is[17:04:29] <secretary_linux> for postfix[17:04:35] <jumperboy> ok, that's good[17:04:40] *** DanGer has left #postfix[17:04:55] <jumperboy> so you need to figure out why man isn't obeying the .so link feature[17:04:56] <_NiC> Hm, sometimes it's hard to follow the log to see the path and destiny of an email going through the system.. is there any tools that can show me all entries for an email at a time?[17:06:03] <adaptr> unfortunately, no[17:06:16] <lunaphyte_> just your brain.[17:06:18] <adaptr> your best bet is tracing a specific queue-id[17:06:27] <adaptr> lunaphyte_: now you KNOW that is an impossible requirement on IRC[17:06:31] <lunaphyte_> adaptr's a tool, but he can't help.[17:06:37] <lunaphyte_> :p[17:06:40] <_NiC> hehe[17:06:45] <adaptr> I don't fit anybody's hand[17:06:52] <adaptr> you need two[17:07:07] <jumperboy> _NiC: some tools like logwatch can present the information in a different way that may be helpful[17:07:07] <_NiC> hm, that's odd.. AV-scan-1 takes up 59% of my content filtering time[17:07:27] <adaptr> why is that odd ?[17:07:30] <adaptr> AV is slowwww[17:08:12] <jumperboy> _NiC: actually, postfix-logwatch can even run standalone[17:09:20] *** UQlev has quit IRC[17:10:12] <_NiC> I don't understand why it was scanned in the first place..[17:15:22] *** else- has quit IRC[17:15:56] *** else- has joined #postfix[17:21:02] *** weedar has joined #postfix[17:21:57] *** dwery has joined #postfix[17:22:36] *** david_ has joined #postfix[17:22:56] <dwery> hi. I'm experiencing a delay on incoming connections to postfix. When I telnet on the smtp port it takes postfix 15/20 secs to emit it's first message. What could I check? The site is not particularly busy[17:23:23] <lunaphyte_> !tell dwery welcome[17:23:23] <knoba> dwery: "welcome" : welcome to #postfix! if you're joining for the first time, or are new to irc, the first thing you'll want to do is read the channel topic (/topic). it includes crucial instructions on how to effectively ask for help here, and what data you should include with your questions. the degree of success you'll have is directly related to how effectively you're able to follow those guidelines.[17:24:00] <f3ew> !logs[17:24:01] <knoba> f3ew: "logs" : postfix logs to the mail facility of syslog. Something like grep -i `postconf -h syslog_facility` /etc/syslog.conf should tell you where logs are going. also see !no_logs and !have2mung[17:24:30] *** slune has quit IRC[17:26:29] *** davlefou has quit IRC[17:33:15] *** Dessa has quit IRC[17:33:41] *** mutante has joined #postfix[17:34:05] <mutante> "fatal: file /etc/postfix/main.cf: parameter myhostname: bad parameter value: ." Wasnt i supposed to use an FQDN name? so it's including "."[17:34:48] <mutante> even the example is host.domain.tld ...sigh[17:35:16] <lunaphyte_> !tell mutante welcome[17:35:16] <knoba> mutante: "welcome" : welcome to #postfix! if you're joining for the first time, or are new to irc, the first thing you'll want to do is read the channel topic (/topic). it includes crucial instructions on how to effectively ask for help here, and what data you should include with your questions. the degree of success you'll have is directly related to how effectively you're able to follow those guidelines.[17:35:30] *** daguz has joined #postfix[17:35:56] *** daguz has left #postfix[17:37:12] *** Dessa has joined #postfix[17:37:47] *** ampletime has quit IRC[17:43:19] *** cilly has joined #postfix[17:44:09] *** david__ has joined #postfix[17:44:28] *** ced117 has joined #postfix[17:44:28] *** ced117 has joined #postfix[17:44:39] *** dwery has left #postfix[17:48:04] *** david_ has quit IRC[18:01:38] <_NiC> Will postfix use system-installed CA-certificates to validate remote certificates even if I don't point smtp_tls_CApath to them?[18:01:47] <_NiC> (I'm guessing not)[18:02:02] <Aprogas> !postconf-d[18:02:02] <knoba> Aprogas: Error: "postconf-d" is not a valid command.[18:02:53] <Aprogas> I think the default is empty, but some packages may have been compiled with a different default.[18:04:26] <_NiC> default is empty yes[18:04:45] <rob0> It will if you or your distributor pointed Postfix toward those certs.[18:05:09] <_NiC> it's an ubuntu package[18:08:50] *** cilly has quit IRC[18:09:12] <thumbs> ubuntu likes to ship empty config files, yes.[18:12:04] *** nardev has joined #postfix[18:12:33] *** jujugre has quit IRC[18:14:11] *** cilly has joined #postfix[18:14:33] *** war9407 has quit IRC[18:14:45] *** davlefou has joined #postfix[18:17:00] *** Captain has quit IRC[18:18:33] *** nardev has quit IRC[18:18:49] *** david__ has quit IRC[18:19:07] *** krzie has joined #postfix[18:20:42] *** war9407 has joined #postfix[18:24:14] *** hever has quit IRC[18:29:08] *** hever has joined #postfix[18:33:45] *** Serotonergic has joined #postfix[18:35:18] *** david_ has joined #postfix[18:38:05] *** cilly has quit IRC[18:39:04] *** davlefou has quit IRC[18:45:36] *** war9407 has quit IRC[18:45:57] *** war9407 has joined #postfix[18:46:08] *** sbeam has quit IRC[18:46:09] *** e-jones has quit IRC[18:47:52] *** seekwill has joined #postfix[18:50:29] *** mcp has quit IRC[18:52:22] *** david_ has quit IRC[18:54:50] *** david_ has joined #postfix[18:57:31] *** locohost has joined #postfix[18:58:16] <locohost> what would be the recommended way to queue mail up (tell my inbound postfix server to not bother trying to deliver messages for 10 hours or so) durring maintenance[18:58:53] <locohost> i can think of a bunch of ways that should work, not sure which would be best[18:59:09] <adaptr> !defer_transport[18:59:09] <knoba> adaptr: Error: "defer_transport" is not a valid command.[18:59:11] <adaptr> bah[18:59:40] <adaptr> !defer_transports[18:59:40] <knoba> adaptr: "defer_transports" : a configuration parameter in the main.cf: The names of message delivery transports that should not be delivered to unless someone issues "sendmail -q" or equivalent. Specify zero or more names of mail delivery transports names that appear in the first field of master.cf).[18:59:58] <adaptr> or match it with an access(5) map and issue a HOLD[19:00:13] <adaptr> those are the two options[19:00:20] *** Lujeni has quit IRC[19:00:40] *** Lujeni has joined #postfix[19:00:44] <adaptr> oh, you're talking about locally delivering INBOUND mail ?[19:00:49] *** mu574n9 has joined #postfix[19:01:10] <adaptr> locohost: wake up![19:01:18] <locohost> im talking about taking down my internal mail servers for several hours, possibly 2 days and holding everything at the paramater over the weekend[19:01:36] <adaptr> ITYM "perimeter"[19:01:50] <adaptr> so you have an inbound edge gateway that distributes mail to internal servers ?[19:01:57] <locohost> exaclty[19:02:03] <adaptr> nothing gets delivered ON this edge gateway ?[19:02:42] <locohost> no, it sends everything for about 10 different domains in /etc/postfix/transports to an internal server that gives it to mailbox servers[19:02:50] <locohost> i was thinking of just stopping amavis...[19:03:01] <adaptr> that's stupid, since amavis has no SMTP capability[19:03:13] <adaptr> I already gave you a simple solution[19:03:27] <adaptr> postconf -e defer_transports = smtp && postfix reload[19:04:19] <locohost> alright, thanks, let me see if i can test that[19:05:19] <adaptr> obviously, you can[19:07:32] <adaptr> it works fine, mailq lists them as (deferred transport)[19:10:38] *** weta has joined #postfix[19:13:56] *** david__ has joined #postfix[19:15:01] *** ScorpiusLetalis has quit IRC[19:15:52] *** ScorpiusLetalis has joined #postfix[19:18:33] *** david_ has quit IRC[19:18:36] *** weedar has quit IRC[19:23:37] *** nitrox has joined #postfix[19:23:53] *** empity has quit IRC[19:24:16] <nitrox> hi someone into DKIM and willing to explore an implementation problem (probably - no false claims here :)?[19:25:17] *** cpm has quit IRC[19:26:08] <nitrox> concerning the problem with DKIM we tried to summarize it here: http://stbuehler.de/blog/article/2011/05/19/dkim_fails_at_content-transfer-encoding.html - i forced my exim to accept 8bitmime in order to solve verification problems, sending side was postfix tho[19:26:38] *** sbeam has joined #postfix[19:27:28] <nitrox> people at #dkim on efnet "admitted" rfc's aren't that good, a SHOULD must have been a MUST[19:27:57] <patdk-wk> heh?[19:28:05] <patdk-wk> dkim fails if ANYTHING that was signed, changes[19:28:08] *** cpm has joined #postfix[19:28:09] *** cpm has joined #postfix[19:28:15] <patdk-wk> if you convert the email from 8bit to 7bit, that is a change[19:29:10] * patdk-wk also wonders how you save bandwidth using 8bits when sending attachments, aren't attachments send using base64 :)[19:30:07] *** Lenhix has quit IRC[19:30:08] <nitrox> wtf! isn't there any chan in which you aren't idling around? :)[19:30:18] <nitrox> hi btw. :)[19:30:25] <patdk-wk> nitrox, many :)[19:30:40] * nitrox picks a random one...[19:30:50] <nitrox> indeed! :)[19:31:10] <patdk-wk> how did you sign the email?[19:31:11] *** Lujeni has quit IRC[19:31:20] <patdk-wk> that is completely missing :)[19:31:41] *** e-anima has quit IRC[19:31:58] <nitrox> patdk-wk: it's pretty irrelevant, as i'm not in control of every sending side :)[19:31:59] <patdk-wk> I use relaxed/simple[19:32:11] <nitrox> that doesn't matter[19:32:34] <patdk-wk> so your attempting to fix it on the receiving side?[19:32:52] <patdk-wk> not much you can do at all[19:33:24] <nitrox> i can accept 8bit and verification succeeds, i'm more or less forced to be not rfc compliant[19:33:28] *** davlefou has joined #postfix[19:33:29] <patdk-wk> all dkim params are what you sign, and how you sign it, all sender adjustable only[19:34:06] <nitrox> right, so postfix's dkim filter should take care[19:34:37] *** david__ has quit IRC[19:34:40] <patdk-wk> didnt know postfix had a dkim filter[19:34:48] *** hever has quit IRC[19:34:54] <nitrox> dkim's rfc will be revised soon and they're thinking about to be more clear about it[19:35:01] *** ced117 has quit IRC[19:35:27] <nitrox> i'm not familiar with pf, is it 3rd party or sth. build-in?[19:35:44] * lunaphyte_ wonders when nitrox will be sharing postfix's dkim filter with the software's author.[19:35:48] <patdk-wk> ya, domainkeys and dkim have always been a, get it working, then attempt to make it as compatable as you can without breaking it[19:36:30] <patdk-wk> postfix only does email nothing else[19:36:39] <lunaphyte_> pf is the bsd packet filter[19:36:44] <lunaphyte_> nothing to do with dkim[19:36:46] <seekwill> http://stbuehler.de/blog/article/2011/05/19/dkim_fails_at_content-transfer-encoding.html --> "you announce with DNS records that you sign all your mails with a RSA key" <-- how do you do that?[19:37:24] <patdk-wk> seekwill, you need help, as usual[19:37:31] <lunaphyte_> yeah, that's yet another poorly worded blag posting.[19:38:06] <seekwill> The blog posting seems to have a lot of wrong assumptions[19:38:30] <nitrox> as long as you get the point it's ok[19:38:46] <nitrox> not everyone is a master on each of those topics[19:38:49] <lunaphyte_> the author might have a clue in terms of 7/8bit discrepancies [which is nothing new and really has little to do with dkim], but clearly does not have a grasp of the fundamentals and theory of what dkim does, and how it works.[19:38:59] <lunaphyte_> no, it's not ok.[19:39:20] *** Serotonergic has quit IRC[19:39:22] <nitrox> well, people at #dkim got it[19:39:46] <seekwill> No one in #dkim :([19:39:55] <nitrox> efnet[19:40:11] <lunaphyte_> now we're missing the point about the point. it's a meta-misunderstanding.[19:40:14] *** mcp has joined #postfix[19:40:15] <adaptr> nobody important on efnet[19:40:33] <seekwill> omg!!! meta misunderstanding![19:40:36] <adaptr> metafailboatfail[19:41:00] <nitrox> is this how you want to handle it?[19:41:09] <lunaphyte_> sorry?[19:41:12] <seekwill> Yes![19:41:25] <seekwill> But I am of very little significance[19:41:29] * lunaphyte_ wonders what nitrox is getting at.[19:41:30] <nitrox> you've moved around the topic[19:41:42] <adaptr> the topic is at the top of your screen.[19:41:53] <adaptr> oddly enough, it doesn't include dkim[19:42:40] <adaptr> nitrox: you seem to want people to agree with you on something. they don't. move on.[19:43:34] <seekwill> I want people to agree with me too![19:43:42] <nitrox> adaptr: i'd like to talk about dkim, not bad assumptions or alike on the blog posting[19:43:46] <thumbs> seekwill: I disagree[19:43:53] <adaptr> nitrox: this is not the place[19:44:00] <seekwill> thumbs: :( did you get your ram upgrade yet?[19:44:19] <thumbs> seekwill: ordered. The boss is paying for it, too.[19:44:25] <seekwill> woohoo[19:44:32] <thumbs> seekwill: I suspect I'll get it Tuesday.[19:44:37] <seekwill> Why so long?[19:44:43] <adaptr> ooh I may get 16GB tomorrow[19:44:44] * seekwill only has 4GB[19:44:48] <seekwill> adaptr: IN YOUR LAPTOP?[19:44:50] <thumbs> seekwill: it's coming from the USA.[19:45:04] <thumbs> adaptr: upgrading the XPS from 2GB to 8GB[19:45:04] <seekwill> thumbs: oh[19:45:05] <adaptr> seekwill: no, in two cluster nodes[19:45:16] <seekwill> oh[19:45:25] <adaptr> you have to lead up to those things gradually, with innocent-seemig orders[19:45:30] <adaptr> the laptop is next[19:45:37] <seekwill> thumbs already got a new laptop[19:45:52] <thumbs> adaptr: can your laptop support 8GB?[19:46:03] <adaptr> no idea[19:46:09] <adaptr> I got one last week[19:46:13] <seekwill> What did you get?[19:46:20] <adaptr> latitude something[19:46:56] <seekwill> oh[19:47:19] <thumbs> I got the ultrathin 13" model.[19:47:25] <seekwill> Not the red one[19:47:41] <thumbs> silver.[19:47:59] <seekwill> yeah[19:48:00] <seekwill> Not the red one[19:48:15] <thumbs> seekwill: I'll get the pink one next, just for you.[19:48:22] <seekwill> :)[19:48:35] *** nitrox has left #postfix[19:48:46] <seekwill> So yeah, about this DKIM thing...[19:50:09] *** secretary_linux has left #postfix[19:50:21] <adaptr> I think it's an e6400[19:51:07] <seekwill> Does it run Win7?[19:51:56] <thumbs> vostro v130 here.[19:52:13] <thumbs> seekwill: it runs slackware64 just fine.[19:52:23] <seekwill> oh. good to hear, i think[19:53:01] <adaptr> seekwill: I think it has win7 on it now[19:53:29] <seekwill> The kids here are installing Win7 on their MBPs :([19:53:30] *** davlefou has quit IRC[19:53:33] <thumbs> adaptr: yeah - keep the win7 partition, but shrink it.[19:53:44] <thumbs> it might be useful one day[19:53:55] *** davlefou has joined #postfix[19:53:58] <adaptr> it's a work laptop, so probably not[19:54:52] <thumbs> adaptr: so you're not allowed to play with it?[19:56:17] *** weedar has joined #postfix[20:00:43] <l1nuxman> I can't get my smtp server running postfix and dovecot to show login banner and prompt to login when I connect to my server on port 587. It says it connects, but then closes connection soon[20:02:08] *** weedar has quit IRC[20:13:41] *** david_ has joined #postfix[20:15:50] <seekwill> Neither services prompt for login info[20:16:16] <seekwill> Dovecot doesn't listen on 587 either[20:17:23] *** davlefou has quit IRC[20:24:44] *** krzee has quit IRC[20:31:59] *** Ryushin has joined #postfix[20:32:43] *** david_ has quit IRC[20:33:10] *** david_ has joined #postfix[20:35:48] *** Ryushin has quit IRC[20:35:57] *** e-jones has joined #postfix[20:40:16] *** p3rror has quit IRC[20:53:13] *** delphinen has joined #postfix[20:53:19] <delphinen> hi guys[20:53:44] *** david__ has joined #postfix[20:53:54] <delphinen> we are a web hosting company, and are being massively spammed[20:54:08] <delphinen> I never see something like this in 6 years[20:54:26] <seekwill> heh[20:54:34] <delphinen> could someone help me?[20:55:06] <seekwill> First question is, what changed recently[20:55:32] <seekwill> My other wild ass guess, is your antispam solution expired or something[20:55:50] <delphinen> all our customers are receiving the same spam, even us[20:56:27] <seekwill> Coming from a specific IP?[20:56:27] <delphinen> and we have like, heck I dont know 500.000 users[20:56:35] <tuxick> so it's just one particular spam getting through?[20:56:50] <delphinen> no[20:56:50] <Aprogas> Check the topic for instructions. We need to see some logs and configs.[20:56:57] <delphinen> yes yes I know[20:56:57] *** p3rror has joined #postfix[20:57:05] <seekwill> If it's really all of your clients, I would guess it's an inside job[20:57:07] <delphinen> its coming from everywhere[20:57:52] <tuxick> well of course it is[20:58:00] <tuxick> millions of compromised windows systems out there[20:58:05] *** david_ has quit IRC[20:58:27] <delphinen> no.. let me paste bin[20:59:34] <tuxick> getting mismatches as well? i frequently see spammers trying random addresses on a domain[20:59:36] <delphinen> here is a minimal paste from the maillog tail http://pastebin.com/WHwCscfk[21:00:17] <delphinen> justargentina.org is the "host" that are "spamming" us[21:00:40] <Aprogas> Did you set up that discard just now?[21:00:43] <seekwill> Are you using RBLs?[21:01:07] <delphinen> yes Aprogas, an hour ago[21:01:13] <delphinen> yes seekwill[21:01:26] <Aprogas> That shows only cleanup output; pick one of the queue-IDs shown and pastebin the logs pertaining to that queue-ID.[21:01:29] *** war9407 has quit IRC[21:01:59] <delphinen> the IP of justargentina.org points to some guy listed as top ten spammers in spamhaus[21:02:04] <delphinen> !?[21:02:04] <knoba> delphinen: Error: "?" is not a valid command.[21:02:11] <delphinen> (!?)[21:03:32] <Aprogas> delphinen: Try to resolve 2.0.0.127.zen.spamhaus.org[21:04:27] *** cpm has quit IRC[21:04:30] <delphinen> # host 2.0.0.127.zen.spamhaus.org[21:04:31] <delphinen> 2.0.0.127.zen.spamhaus.org has address 127.0.0.2... and two lines more[21:04:48] <Aprogas> At least you're not blocked from using Zen.[21:05:09] <Aprogas> So pastebin the logs of one of the queue-ids of the spam, so we can see that mail in its process.[21:05:29] <delphinen> the spam contain the word world-jobuniuon.com[21:05:35] <seekwill> delphinen: Did you run the 'dig' on the mailserver?[21:06:25] <delphinen> yes, our resolves are working ok[21:06:47] <delphinen> and we are discarding the mails based on the body of the spam[21:07:19] <Aprogas> Is the spam being sent to existing addresses?[21:07:23] <tuxick> if it's in same country you could try police ;p[21:07:26] <delphinen> but it keeps coming, since yesterday, from, like I said, different hosts around the world[21:07:46] <delphinen> yes Aprogas[21:07:56] <Aprogas> header and body checks are rather intensive, you may wish to reject on a pre-DATA criterium instead.[21:08:48] <delphinen> true, but how is possible this?[21:09:15] <delphinen> I want to deny the host/IP in our ASA[21:09:46] *** _Tassadar has quit IRC[21:09:48] <delphinen> also, cannot see anything with netstat -na, show conn, etc etc[21:10:44] *** _Tassadar has joined #postfix[21:12:17] *** davlefou has joined #postfix[21:13:55] <adaptr> delphinen: content checks are expensive. do you use all inexpensive checks at your disposal BEFORE doing content checks ?[21:14:41] <delphinen> I suppose...[21:14:44] *** david__ has quit IRC[21:15:05] <Aprogas> You could set up some access(5) table or such that throws a temporary error for hosts failing FCRDNS, or having hostnames/helos with words like dhcp and dynamic and ip-1-2-3-4[21:15:13] <delphinen> did somebody read the pastebin?[21:15:16] <Aprogas> At least for now.[21:15:35] <Aprogas> delphinen: Yes, and I asked for a pastebin showing the logs of one of those queue-IDs for more context[21:15:49] <Aprogas> The pastebin has only lines from cleanup[21:16:00] <delphinen> well, ok[21:16:10] <adaptr> delphinen: that's an incredibly useless response. you should know exactly what your config does[21:18:49] <delphinen> adaptr: I am no expert and I am doing the best I can[21:18:53] <Aprogas> delphinen: That output might be useful too, but what I really asked for was a grep DF4902D551F mail.log[21:20:16] <delphinen> err... DF490... to use with postcat?[21:20:26] <Aprogas> No, with grep, on your mail.log[21:20:36] <delphinen> ok..[21:20:53] <Aprogas> The log that you pastebinned contained only lines from cleanup on many different messages. I'd like to see the output of other Postfix processes of one of those messages.[21:22:22] *** Belial_ has quit IRC[21:23:10] <adaptr> !tell delphinen debug[21:23:10] <knoba> delphinen: "debug" : http://www.postfix.org/DEBUG_README.html : a good starting point for how to deal with problems and to report information to those who might help. Post your information in a pastebin such as http://pastebin.ca/ or http://dpaste.com/[21:23:44] <Aprogas> delphinen: I prefer we keep all this on the channel, not query.[21:24:22] <Aprogas> At least it's coming in through postfix/smtpd from a remote host, and not postfix/pickup or something.[21:24:47] <Aprogas> delphinen: Is the raw mail you pastebinned me in query, an example of one of the spams?[21:25:14] <delphinen> all the mails contains that[21:25:49] <Aprogas> Do you use Mailman?[21:27:27] <delphinen> yes[21:27:40] <Aprogas> I am tryin to determine whether your own Mailman is aiding in the spamming.[21:28:59] <Aprogas> Can you run "id 110" on your mailserver and tell the result?[21:31:09] *** davlefou has quit IRC[21:32:07] <delphinen> yes[21:32:27] <delphinen> no such user?[21:32:49] *** davlefou has joined #postfix[21:33:13] <Aprogas> The Received headers of what you showed contain a userid 110 line.[21:33:30] <Aprogas> Can I reveal the hostname/domain in that pastebin?[21:33:58] <Aprogas> (You are already being targetted by a spambotnet, IMO no opinion in hiding the domain from #postfix channel)[21:34:18] <Aprogas> Hmm.. the language centre of my brain is running sub-optimal.[21:34:23] <seekwill> delphinen: I'd suggest using a commercial antispam filter for your 500k users[21:34:36] <Aprogas> He's still using SA 3.2.5 so ...[21:35:01] <Aprogas> delphinen: If SA 3.2.5 is any indication, your anti-spam solution is outdated.[21:35:14] <delphinen> yes Aprogas[21:35:17] <Aprogas> Also make very sure your own Mailman is not adding to the problem; i.e. check that all lists are secure.[21:35:39] <Aprogas> I'm having some trouble determining from the logs whether mailman is also duplicating the spams to the listed members.[21:36:03] <delphinen> the spamming is propagating through our intranet to other server with cPanel[21:37:07] <Aprogas> delphinen: The raw message you pastebinned me looks to me like Mailman redelivered that message.[21:37:11] *** Lenhix has joined #postfix[21:37:18] <Aprogas> Perhaps share that pastebin with all of #Postfix so other eyes can judge that as well.[21:37:50] <delphinen> ok we are being spammed BADLY anyway[21:38:03] <delphinen> http://pastebin.com/hjpMChEk[21:38:11] <Aprogas> Yes, but if your own Mailman lists are multiplying that spam, it will be even worse.[21:38:20] <jimpop> delphinen: you work for debian?[21:38:25] <jimpop> :-)[21:38:35] <Aprogas> Is mailfacil.com one of your domains?[21:39:03] *** _Tassadar has quit IRC[21:40:58] <jimpop> delphinen: your spammassassin is out of date, and additionally it is not scoring very well[21:41:03] <jimpop> X-Spam-Status: No, score=-0.1 required=3.4 tests=BAYES_00,HTML_MESSAGE, MIME_HTML_ONLY,RCVD_IN_PBL,RDNS_NONE,UNPARSEABLE_RELAY autolearn=no[21:41:26] <jimpop> delphinen: there is no way in hell that ^^ should be a -0.1 score[21:42:09] <jimpop> delphinen: try checking out #spamassassin for advice on setting up and maintaining spamassassin[21:43:10] <delphinen> yes Aprogas[21:43:31] <delphinen> will do later jimpop really busy now[21:46:24] *** hparker has quit IRC[21:48:34] *** wdp has joined #postfix[21:50:01] *** p3rror has quit IRC[21:50:08] *** ScorpiusLetalis has quit IRC[21:50:59] *** ScorpiusLetalis has joined #postfix[21:52:22] *** david_ has joined #postfix[21:53:17] *** Timzzzz is now known as Timmooo[21:56:01] *** war9407 has joined #postfix[21:56:21] *** davlefou has quit IRC[21:56:29] *** mu574n9 has quit IRC[21:58:02] *** mu574n9 has joined #postfix[22:07:33] *** p3rror has joined #postfix[22:11:52] *** brancaleone has quit IRC[22:13:51] *** brancaleone has joined #postfix[22:14:19] *** thunderstrike has left #postfix[22:14:45] *** david_ has quit IRC[22:17:06] *** Matic`Makovec has joined #postfix[22:17:08] *** McBoingbo has quit IRC[22:24:44] *** ScorpiusLetalis has quit IRC[22:25:38] *** ScorpiusLetalis has joined #postfix[22:28:16] *** e\ectro_ has quit IRC[22:29:53] *** cilly has joined #postfix[22:30:01] *** cilly has quit IRC[22:30:23] *** sbeam has quit IRC[22:30:52] *** hparker has joined #postfix[22:30:53] *** hparker has joined #postfix[22:34:40] *** amir has quit IRC[22:39:29] *** delphinen has quit IRC[22:39:30] *** amir has joined #postfix[22:40:20] *** amir has joined #postfix[22:42:01] *** _Tassadar has joined #postfix[22:44:49] *** amir has quit IRC[22:45:23] *** amir has joined #postfix[22:46:24] *** Timmooo is now known as Timzzzz[22:55:04] *** gerhard7 has quit IRC[23:09:12] *** Matic`Makovec has quit IRC[23:11:06] *** krzee has joined #postfix[23:11:07] *** krzee has joined #postfix[23:16:36] *** hever has joined #postfix[23:17:39] *** busta has joined #postfix[23:18:24] *** marchelly has quit IRC[23:18:53] *** Timzzzz is now known as Timmooo[23:24:38] *** mu574n9 has quit IRC[23:25:47] *** sphenxes has quit IRC[23:26:02] *** busta has quit IRC[23:26:06] *** hparker has quit IRC[23:26:15] *** geek_cl has joined #postfix[23:26:38] *** marchelly has joined #postfix[23:40:58] <seekwill> So what was the result of that guy getting spammed?[23:42:14] <Aprogas> Not sure.[23:44:45] *** hparker has joined #postfix[23:44:45] *** hparker has joined #postfix[23:45:17] *** Timmooo is now known as Timzzzz[23:45:18] <jimpop> he got too busy to deal with it[23:45:38] * jimpop wishes Tim* would get some damn coffee[23:45:45] <Aprogas> When has dealing with something ever truely helped someone?[23:46:24] <jimpop> that depends on the person ;-)[23:46:57] <seekwill> Like me[23:47:41] <jimpop> still not sure that you're human....[23:48:50] <seekwill> I am God like yes...[23:49:23] <seekwill> Well, at least thumbs thinks so[23:49:39] * thumbs is not sure he should agree here[23:49:59] <seekwill> That's not what you said last night[23:50:18] <jimpop> oh god.....[23:50:27] <seekwill> That's exactly his words![23:52:53] *** e-jones has quit IRC[23:54:09] *** Ryushin has joined #postfix