headers
Jeremy Harris | 1 Feb 2012 22:30

[Bug 1201] forwarding to a content-scanning site is a bounce-generator

------- You are receiving this mail because: -------
You are on the CC list for the bug.

http://bugs.exim.org/show_bug.cgi?id=1201

Jeremy Harris <jgh146exb <at> wizmail.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
 Attachment #540 is|0                           |1
           obsolete|                            |

--- Comment #4 from Jeremy Harris <jgh146exb <at> wizmail.org>  2012-02-01 21:30:39 ---
Created an attachment (id=541)
 --> (http://bugs.exim.org/attachment.cgi?id=541)
TLS cutthrough delivery

--

-- 
Configure bugmail: http://bugs.exim.org/userprefs.cgi?tab=email
Permalink | Reply | 0 comments |
headers
Phil Pennock | 4 Feb 2012 08:39
Favicon
Gravatar

SASL changes: branch sasl_fixes

Folks,

In debugging why my GSSAPI authenticator (cyrus_sasl driver) had stopped
working, I made a number of fixes, which are on the sasl_fixes branch.
Does anyone fancy giving them a look over for sanity?

$tls_bits is a new variable; that's fed into
sasl_setprop(..,SASL_SSF_EXTERNAL, ...) for the Exim-as-server case.
Should probably be done for the client too.

In the end, my problems are caused by Heimdal; I've sent mail to
heimdal-discuss <at> :
  http://permalink.gmane.org/gmane.comp.encryption.kerberos.heimdal.general/6701

(I noticed this in Heimdal 1.4, not sure when the problem was
introduced).

In short: KRB5_KTNAME is no longer honoured for processes that have had
security boundary transitions, such as Exim.  So using a different
keytab is impossible at present, thus the client library falls back to
trying to get "host/$system_primary_hostname" credentials from the KDC.

Once I figure out, or am told, the API to use to override the keytab in
source, I'll add a HEIMDAL build-option to Exim and add the knobs to let
that be set.  This means bypassing the cyrus-sasl abstraction layer, but
we don't appear to have a choice.

If there's anyone using MIT's Kerberos implementation reading: is there
an API call needed to override the keytab there too?
--

--
(Continue reading)

Permalink | Reply | 0 comments |
headers
Phil Pennock | 14 Feb 2012 03:52
Favicon
Gravatar

GNU SASL gsasl integration into Exim

Folks,

A first cut at GNU SASL (gsasl) integration has been written for Exim.

At this time, it's server-only.  I'm not sure whether or not to
integrate this for release as part of the next Exim.  Feedback may make
the difference, but something more informative than "+1"/"me too"
please.

This authentication driver can be built into Exim at the same time as
Cyrus SASL.  It provides the mechanism work, but does not provide
authentication sources (an inherent difference between the two
libraries).  You'll need to use server_condition or server_password for
that, depending upon the mechanism used.

The code is on the gsasl branch of git:
  http://git.exim.org/exim.git/shortlog/refs/heads/gsasl
and includes full documentation.

I've built the PDF and made it available at:
  http://www.exim.org/~pdp/spec-gsasl-dev.pdf
Note that this claims to be for 4.77.  The major changes are to chapter
33 and the insertion of a new chapter 38.

There are a number of open issues:

 (1) Versioning of available features and library interfaces is not
     ideal.  I wrote and tested against gsasl 1.6.1.

 (2) Some aspects of the API do not let Exim generically support future
(Continue reading)

Permalink | Reply | 6 comments |
headers
Phil Pennock | 17 Feb 2012 14:38
Favicon
Gravatar

Testing needed: heimdal_gssapi authenticator

Adventurous folks already using Heimdal needed for testing git branch of
Exim.  Docs not yet updated.

Per my mail of 2012-02-04, """Heimdal 1.4 put in some restrictions on
honouring a value of $KRB5_KTNAME inherited from the environment, which
means that at present there's no way to make Exim work with a
non-default keytab file."""

I've added a "heimdal_gssapi" authenticator, server-only.  I've
developed and tested against Heimdal 1.4 on FreeBSD.

 (1) Pull Exim git.
 (2) Switch to heimdal branch (git checkout heimdal)
 (3) Note that for historical reasons, "src/" in releases corresponds to
     "src/src/" in git, so cd down one level into the first src.
 (4) Edit your usual Local/Makefile to include:
       AUTH_HEIMDAL_GSSAPI=yes
       AUTH_HEIMDAL_GSSAPI_PC=heimdal-gssapi
 (4a) If you don't have pkg-config installed, ignore that second _PC
      option and instead add the needed -I/include/paths to CFLAGS and
      the library specs to AUTH_LIBS, as per usual
 (4b) If you do have pkg-config but heimdal's package has a different
      name, change the value of the define
 (5) Install as usual
 (6) Use driver "heimdal_gssapi", set option "server_keytab"; if
     switching from "cyrus_sasl" driver, remember to drop the
     "server_mech" option.
 (7) Make sure keytab is readable by Exim runtime user
 (8) Let me know how you get on!
(Continue reading)

Permalink | Reply | 3 comments |
headers
Jan van den Berg | 17 Feb 2012 13:21
Picon

[Bug 1212] New: Individual recipients_max per sender host IPrecipients_max

------- You are receiving this mail because: -------
You are on the CC list for the bug.

http://bugs.exim.org/show_bug.cgi?id=1212
           Summary: Individual recipients_max per sender host
                    IPrecipients_max
           Product: Exim
           Version: N/A
          Platform: Other
        OS/Version: Linux
            Status: NEW
          Severity: wishlist
          Priority: medium
         Component: Delivery in general
        AssignedTo: nigel <at> exim.org
        ReportedBy: jan.vandenberg <at> isp.solcon.nl
                CC: exim-dev <at> exim.org

Hi,

atm recipients_max is a global exim setting for all users. I would like to be
able to differentiate.

We have some heavy users that use/need recipients_max to be high. However most
users don't use/need this. The problem with this is that we have set
recipients_max to a high number for those specific user. But when any other
users' mail account gets compromised by a spammer, they use this high number to
quickly send *a lot* of spam emails.
So that's why I'd like to be able to have global (low) recipients_max number
and a file with host IPs (that I trust) who can have: either a specific
(Continue reading)

Permalink | Reply | 9 comments |
headers
Jan van den Berg | 17 Feb 2012 13:33
Picon

[Bug 1212] Individual recipients_max per sender host IP

------- You are receiving this mail because: -------
You are on the CC list for the bug.

http://bugs.exim.org/show_bug.cgi?id=1212

Jan van den Berg <jan.vandenberg <at> isp.solcon.nl> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|Individual recipients_max   |Individual recipients_max
                   |per sender host             |per sender host IP
                   |IPrecipients_max            |

--

-- 
Configure bugmail: http://bugs.exim.org/userprefs.cgi?tab=email
Permalink | Reply | 0 comments |
headers
Phil Pennock | 18 Feb 2012 11:07
Favicon
Gravatar

Re: Testing needed: heimdal_gssapi authenticator

On 2012-02-17 at 08:38 -0500, Phil Pennock wrote:
> I have:
> 
> auth_gssapi:
>   driver        = heimdal_gssapi
>   public_name   = GSSAPI
>   server_hostname = smtp.spodhuis.org
>   server_realm  = SPODHUIS.ORG
>   server_keytab = /etc/kerberos/tabs/exim.keytab
>   server_set_id = $auth1

*cough*  "server_realm" is unused and there doesn't seem to be anything
sane to do with it in GSSAPI; the concept exists in Kerberos, but really
any tickets for the specified principal in the keytab will be used.

So I'm removing that option.

Oops.

(Bright side: I found this while documenting the driver, thus there will
 shortly exist documentation for this.)

-Phil
Permalink | Reply | 0 comments |
headers
Jeremy Harris | 19 Feb 2012 17:32

[Bug 1214] New: Log lines for rejections should include authentication info

------- You are receiving this mail because: -------
You are on the CC list for the bug.

http://bugs.exim.org/show_bug.cgi?id=1214
           Summary: Log lines for rejections should include authentication
                    info
           Product: Exim
           Version: 4.77
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: wishlist
          Priority: medium
         Component: Logging
        AssignedTo: nigel <at> exim.org
        ReportedBy: jgh146exb <at> wizmail.org
                CC: exim-dev <at> exim.org

Created an attachment (id=547)
 --> (http://bugs.exim.org/attachment.cgi?id=547)
patch for A= info in rejection lines in logs

Here's a patch which adds the "A=" clause to rejection lines in the logs.

--

-- 
Configure bugmail: http://bugs.exim.org/userprefs.cgi?tab=email
Permalink | Reply | 2 comments |
headers
Phil Pennock | 19 Feb 2012 23:47
Favicon
Gravatar

[Bug 1214] Log lines for rejections should include authentication info

------- You are receiving this mail because: -------
You are on the CC list for the bug.

http://bugs.exim.org/show_bug.cgi?id=1214

Phil Pennock <pdp <at> exim.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED

--- Comment #1 from Phil Pennock <pdp <at> exim.org>  2012-02-19 22:47:07 ---
Looks sane to me.  Applied, tested, works.  Sent upstream.

Commit: b98bb9ac90bfc9c812c4c660fe017284ee222686

--

-- 
Configure bugmail: http://bugs.exim.org/userprefs.cgi?tab=email
Permalink | Reply | 0 comments |
headers
Jan van den Berg | 22 Feb 2012 19:33
Picon

[Bug 1212] Individual recipients_max per sender host IP

------- You are receiving this mail because: -------
You are on the CC list for the bug.

http://bugs.exim.org/show_bug.cgi?id=1212

--- Comment #1 from Jan van den Berg <jan.vandenberg <at> isp.solcon.nl>  2012-02-22 18:33:07 ---
Created an attachment (id=548)
 --> (http://bugs.exim.org/attachment.cgi?id=548)
recipients_max_exception_hosts becomes available

--

-- 
Configure bugmail: http://bugs.exim.org/userprefs.cgi?tab=email
Permalink | Reply | 0 comments |

Gmane