Re: postfix clustering

How can I get original subject in bounce template

Can I configure the bounce template to include the original subject
inside the subject of the NDR. 
The bounce man page does not mention original subject anywhere. 

Thanks
Ram

Re: Posfix: deliver to spam folder analog of reject_rbl_client

For now almost a week without sorbs and wothout spam.

Remebered that the metter I was installed sorbs list was many forged
freemail spams. That time I've done client/hello/sender match check for
a list of free mail services (discussed on this list). And I was also
advised to add sorbs, b/c all cases with forged freemails were listed
there.

So, now sorbs removed, client/hello/sender match check is working, and
no spam.

В Чтв, 28/10/2010 в 22:07 -0500, Stan Hoeppner пишет:
> Покотиленко Костик put forth on 10/28/2010 5:31 AM:
> 
> > a. mail was send directly from company's public ip which is DSL (shouldn't send direct)
> > b. advertising company's mail server doesn't have revers DNS
> > c. doesn't send proper hello
> > d. advertising company's ip black listed by sorbs
> 
> Ahh, I see.  You live in one of "those" internet neighborhoods.
> 
> > Whitelists are growing fast in my experience, so I'm looking for solutions which work
> > well and doesn't need much attention from my side. Most should work automatic, rest is
> > left to user's attention. I should only support this ballance.
> 
> And whitelists that never stop growing are often the most popular
> solution, as you've done.  Have you tried a content filter such as
> SpamAssassin, turning off the client dnsbl function and relying on Bayes
> and rhsbl checks of header/body domains?  SA's built in tagging function
> would allow you to easily filter to user spam folder with sieve,
> procmail, or maildrop.  This setup might help you eliminate the FPs or
> drop them into the spam folder instead of rejecting them.
> 
> > This worth experementing. In my experience sorbs blocks much more spam (not
> > blocked by the rest) than producing FP. That's why I'm looking for solution
> > to make those FPs easy recoverable.
> 
> Until hearing from you, I'd never heard an OP state that SORBS was so
> effective at catching spam the other dnsbls did not that they were
> willing to accept and deal with the FP rate of SORBS.  Maybe this is due
> to your location in eastern Europe?
> 
> > Several months statistic on my own mailbox shows that without sorbs I was
> > getting 3-10 spams a day. With sorbs I recover 1-5 messages a week for
> > entire ~200 users. Well, this is not counting 41 blocked messages from
> > this list this week.
> 
> This is good example of why SORBS sucks and why the FPs are not
> acceptable.  They list the postfix-users outbound list server IP
> (probably shared with other lists) due to a trap hit(s), even though the
> ham ratio is 100% on most days.  I'm sure there was no "spam run" but
> merely a couple of hits.  Again, bad policy, and why I haven't used
> SORBS for years.
> 
> Usually when I sign up for a mailing list I manually add a whitelist
> entry, or I just let my auto whitelisting script take care of it.
> 
> > This worth trying, thanks.
> 
> I'm not saying BRBL is a great dnsbl, but from what I hear from other
> OPs it's pretty decent and as good or better than SORBS without the high
> FPs.  I tried it out for a while but it wasn't catching much so I dumped
> it.  Most dnsbls don't catch much spam here because my other A/S
> countermeasures kill most of it first.  dnsbls get crumbs here, same
> with postgrey.
> 
> >>>>> So the question is: how it is possible to direct SPAM mail to a user's
> >>>>> imap spam folder?
> >>
> >> The answer is don't do this.  Reject the spam during the SMTP connection.
> > 
> > This is costy in management.
> 
> If you have filters with higher accuracy that don't cause FPs it's not
> costly in management.
> 
> >> Try this out for a week or two:
> >>
> >> 1.  Comment out your SORBS entries in main.cf
> >> 2.  Implement reject_rbl_client b.barracudacentral.org
> >>     See http://www.barracudacentral.org/rbl as sign up is required
> >> 3.  Implement this dynamic/generic (residential/zombie) blocking PCRE
> >>     check_client_access pcre:/etc/postfix/fqrdns.pcre
> >>     http://www.hardwarefreak.com/fqrdns.pcre
> > 
> > Who's supporting this file?
> 
> There is no support, and none needed.  It's a home grown regular
> expression table that matches fully qualified reverse or forward DNS
> names of connecting clients.  It targets dynamic IPs and generic static
> IPs of broadband providers around the world, mostly in the US and
> Europe, but includes some others around the world.  I.e. it blocks
> direct senders who shouldn't be sending direct.  It's much like the
> Spamhaus PBL regarding results, but blocks many client IPs that the PBL,
> SORBS DUL, and other "dynamic" dnsbls don't.
> 
> If you don't trust it because no big vendor name is behind it, use sed
> and replace REJECT with "WARN fqrdns".  Monitor its effectiveness by
> greping your log for "fqrdns".
> 
> Put it above your RBL checks in main.cf so it gets first crack at the
> connections.  You will likely be pleasantly surprised by the results.
> 
--

-- 
Покотиленко Костик <casper <at> meteor.dp.ua>

Postfix as an SMTP proxy?

Hello,

I am in a case, where I need to configure a postfix daemon for acting as an SMTP server, where some
spam-filtering and some anti-virus would run in parallel in the box. This would be a help, for a local ISP,
to control spam relayed outside from his own network and thus avoiding IPs to get blacklisted, etc. Now my
problem. The users can use the SMTP server directly, thus if they select mysmtp.mynetwork.com
everything is okay.

Now, we do suppose that a few users do have a valid subscription for an SMTP server, outside our network, say
theirsmtp.theirnetwork.com. That foreign server uses SMTP auth as well. Obviously, redirecting that
traffic first to our proxy, results in complete e-mail delivery failure.

Is any way to handle this? Preferable methods.
a) Our SMTP proxy, talks with the foreign SMTP and sends the e-mail accordingly.
b) Our SMTP proxy, just forwards the commands, without checking the e-mail for spam/virus (not vey wise,
but if there's no other solution, is part of the foreign server's responsibility to do these checks)
c) Our SMTP proxy, just sends the e-mail directly to the recipient after checking it, without ever talking
to the foreign SMTP server (it can cause problems with DKIM and SPF domains, but in any case, it may be helpful).

What I need, is some configuration instructions about how to achive such a functionality.

Best Regards
N. Sideris

Re: How can I get original subject in bounce template

Ramprasad:
> Can I configure the bounce template to include the original subject
> inside the subject of the NDR. 
> The bounce man page does not mention original subject anywhere. 

If it is not in the documentation, then it is not supported.
As you correctly observed, the subject and more is in the returned
email message that sits at the bottom of the bounce message.

	Wietse

Re: Postfix as an SMTP proxy?

Le 01/11/2010 10:36, Nicholas Sideris a écrit :
> Hello,
>
> I am in a case, where I need to configure a postfix daemon for acting as an SMTP server, where some
spam-filtering and some anti-virus would run in parallel in the box. This would be a help, for a local ISP,
to control spam relayed outside from his own network and thus avoiding IPs to get blacklisted, etc. Now my
problem. The users can use the SMTP server directly, thus if they select mysmtp.mynetwork.com
everything is okay.
>
> Now, we do suppose that a few users do have a valid subscription for an SMTP server, outside our network, say
theirsmtp.theirnetwork.com. That foreign server uses SMTP auth as well. Obviously, redirecting that
traffic first to our proxy, results in complete e-mail delivery failure.
>
> Is any way to handle this? Preferable methods.
> a) Our SMTP proxy, talks with the foreign SMTP and sends the e-mail accordingly.
> b) Our SMTP proxy, just forwards the commands, without checking the e-mail for spam/virus (not vey wise,
but if there's no other solution, is part of the foreign server's responsibility to do these checks)
> c) Our SMTP proxy, just sends the e-mail directly to the recipient after checking it, without ever talking
to the foreign SMTP server (it can cause problems with DKIM and SPF domains, but in any case, it may be helpful).

In general, you should not redirect traffic "transparently"...

The "common" approach is to block port 25:
- TCP traffic from one of your IPs to a foreign IP on port 25
- TCP traffic from a foreign IP with source port 25 to one of your IPs
then your customers can use port 587.

you can allow few customers to send directly (by whitelisiting their IP 
from the block-25 rule).

This way, you don't need an smtp proxy.

> [snip]
>

default_destination_recipient_limit not working after changing the mailbox_transport to local_transport

Hello everyone. Im using postfix 2.5.5 and im trying to use the
singleinstancestore of cyrus to hardlink mails instead of having one copy
of every recipient.

To make this work, I had to change the:

mailbox_transport = lmtp:unix:/var/spool/postfix/public/lmtp
local_transport =

to

mailbox_transport =
local_transport = lmtp:unix:/var/spool/postfix/public/lmtp

When I made this change, now it seems that the:

default_destination_recipient_limit = 60

isn't working...

Now I can add 600 recipients in one mail, with no problem. Before the
change, the 60 limit was working.

Why? Any ideas how to fix this?

Tnxs in advance.

Re: default_destination_recipient_limit not working after changing the mailbox_transport to local_transport

guido <at> lorenzutti.com.ar:
> local_transport = lmtp:unix:/var/spool/postfix/public/lmtp
> default_destination_recipient_limit = 60
> 
> isn't working...

As documented, the local_destination_recipient_limit setting has
precedence over the default_destination_recipient_limit setting.

	Wietse

Re: Postfix as an SMTP proxy?

On Mon, Nov 01, 2010 at 11:36:00AM +0200, Nicholas Sideris wrote:

> Hello,
> 
> I am in a case, where I need to configure a postfix daemon for acting
> as an SMTP server, where some spam-filtering and some anti-virus would
> run in parallel in the box. This would be a help, for a local ISP, to
> control spam relayed outside from his own network and thus avoiding IPs
> to get blacklisted, etc. Now my problem. The users can use the SMTP server
> directly, thus if they select mysmtp.mynetwork.com everything is okay.

Don't silently redirect users' SMTP traffic.

Your options:

    - Join the SpamHaus PBL as an ISP, and add your IPs to the PBL. Allow
      users to request being exempted from the PBL.

    - Block port 25 outbound, and allow users to request having the 
      filter removed. Operate a reliable relay that users may elect
      to use. Don't block port 587.

    - Deploy something similar to the Symantec 8600 (aka Turntide)
      SMTP traffic shaping appliance, that can rate limit outgoing
      spam without rerouting the SMTP connection (limitation:
      it can't see through STARTTLS).

--

-- 
	Viktor.

Re: default_destination_recipient_limit not working after changing the mailbox_transport to local_transport

On Mon, Nov 1, 2010 at 2:13 PM, <guido <at> lorenzutti.com.ar> wrote:
>
> Hello everyone. Im using postfix 2.5.5 and im trying to use the
> singleinstancestore of cyrus to hardlink mails instead of having one copy
> of every recipient.
>
> To make this work, I had to change the:
>
> mailbox_transport = lmtp:unix:/var/spool/postfix/public/lmtp
> local_transport =
>
> to
>
> mailbox_transport =
> local_transport = lmtp:unix:/var/spool/postfix/public/lmtp
>
> When I made this change, now it seems that the:
>
> default_destination_recipient_limit = 60
>
> isn't working...

What the problem? Do you want enforce 60? Do you want a regular file
foreach 60 recipients? why?

>
> Now I can add 600 recipients in one mail, with no problem. Before the
> change, the 60 limit was working.
>
> Why? Any ideas how to fix this?
>

What the local_destination_concurrency_limit and
local_destination_recipient_limit values?

With local_destination_concurrency_limit > 1, you can't enforce one
regular file. Cyrus will be create 1 regular file peer message, if you
have concurrency connections, the recipients will be splited in some
messages.

--
Reinaldo de Carvalho
http://korreio.sf.net
http://python-cyrus.sf.net

"While not fully understand a software, don't try to adapt this
software to the way you work, but rather yourself to the way the
software works" (myself)