SMTP AUTH allows any sender via SSL, but only correct auth via non-SSL

Re: weird issue with email to <at> jud.ca.gov

On 23/04/13 12:31, John Levine wrote:
> The ANY query works around a BIND bug that was fixed 15 years ago
> (really, in about 1998) so I encourage everyone to use this patch to
> change it to the CNAME query it should have been making all along:
> http://www.memoryhole.net/qmail/any-to-cname.patch R's, John 

[cross-posted from djbdns list]

Not to contradict DJB, but it does look like all the ANY query does it
try to see if there is a CNAME for the canonicalized host. So doing an
actual CNAME does sound more appropriate. Am I missing anything?

--

-- 
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +1 408 481 8171
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

server migration

qmail-authentication 0.8

Hi everybody out there,

within my current qmail-authentication patch (0.8) I realized a feature for qmail-remote  which was
required by some users:

qmail-remote allows now two distinct mechanisms to enable authentication:

* Sender-based authentication: This is triggered by the 'Mail From:' address and can be customized by control/authsenders.
* Target-based authentication: As an extension for control/smtproutes now for a specific route the
authentication information can be optionally added.

The last feature is often called a 'smart relay' or 'smart host'. Of course the 'Submisson' is always possible!

Sender-based authentication has precedence over 'relay-based' authentication.

The current version + docs are available on my web site 

   http://www.fehcom.de/qmail/smtpauth.html

Note: For qmail-smtpd I use now an extensible scheme for the environment variable SMTPAUTH.

These features have been included into my SPAMCONTROL patch (2.7). Users of this patch are encouraged to
update ! All new features are now in place and working. 

regards.
--eh. 

--

-- 
Dr. Erwin Hoffmann | FEHCom | http://www.fehcom.de | PGP Key-Id: 7E4034BE

Compiling ezmlm on Solaris 10 - HeLp

Greeting failed, but delivery success

Smarthost (outgoing mail through Remote SMTP Server)

RE: Compiling DaemonTools on Solaris 10

Hi Andy,

Thanks a lot for the reply... I will look more into tomorrow morn but I think you are on the right track here
because I saw the test.sv hanging out in the process list.  In fact, I tried a few different goes of getting it
to compile so there were three of these in the process list- one from each attempted compile of daemontools.

I went ahead and installed daemontools via OpenCSW and it worked sweet.  I will think about whether or not I
want to run with the package from OpenCSW or go for another compile.

Have a good one,
jg

-----Original Message-----
From: Andy Bradford [mailto:amb-sendok-1366330883.cbcjedhdeganpoonfbhp <at> bradfords.org] 
Sent: Tuesday, March 19, 2013 5:21 PM
Cc: John Giordano; 'qmail <at> list.cr.yp.to'
Subject: Re: Compiling DaemonTools on Solaris 10

Thus said "Andy Bradford" on 19 Mar 2013 18:07:01 -0600:

> root <at> solaris11.1:/package/admin/daemontools-0.76# ./command/svc -dx compile/r
ts-tmp/test.sv

I think this was wrong, I meant:

root <at> solaris11.1:/package/admin/daemontools-0.76# ./command/svc -u compile/rts-tmp/test.sv

This is where it hangs:

--- svc -ox works
hi
--- svstat works for up services
.: up (pid x) x seconds, normally down
--- svc -u works
svc: warning: unable to control test.sv: supervise not running

So it should be trying to bring up the service (not sure why it didn't).

Andy

Compiling DaemonTools on Solaris 10

Questions about bounce messages and qmail-queue

Are bounce messages inserted into the queue via qmail-queue, or are they added some other way? If
qmail-queue is used, and the QMAILQUEUE patch is installed, does the bounce process use the qmail-queue
program specified by QMAILQUEUE, or is it hardcoded to use qmail-queue?

My reason for asking:

I am using a qmail-queue replacement to sign outbound messages with DKIM.  Most of the outbound mail from my
server is either from ezmlm, or from mail clients submitting through SMTP.  I am successfully signing
those messages by using QMAILQUEUE  in the ezmlm .qmail files and the smptd script.   But bounce messages are
not being signed, and I would like to sign them.  (Actually, I would prefer not to send bounce messages at
all, but the ezmlm architecture uses bounces to send error messages).

I have tried setting the QMAILQUEUE environment variable in the qmail/rc script that starts qmail, but
apparently either that is not getting passed to whatever process generates bounces, or it is being
ignored.   If possible, I would like bounces to be processed through a replacement program that signs them
and passes them to the "real" qmail-queue, just like all other outbound messages.

I know I have a couple of other alternatives if I can't make this work.  One alternative would be to sign the
messages in a qmail-remote wrapper instead of qmail-queue.  But since I've gotten the qmail-queue
signing process working, I'm reluctant to re-engineer the process.    Another possibility would be to
rename qmail-queue to something else,  and replace qmail-queue with the signing program which would then
call the actual qmail-queue via its new name.  But that will only work if the bounce messages are being sent
through qmail-queue with the program name hard-coded.

--

-- 
Matt Simpson
Tatertown, KY

Relay issue