Discussion:
Fake users
(too old to reply)
M. Tolga Özses
2006-12-08 08:10:12 UTC
Permalink
Hi,

Some fake user was sending me e-mail from my domain, so I did what Noel
Jones suggested a while ago, like below:

Something like:
# main.cf
remote_header_rewrite_domain = domain.invalid
smtpd_sender_restrictions =
reject_non_fqdn_sender,
reject_unlisted_sender
--
Noel Jones

How can I verify that this is working other than I don't get such mails
anymore?

Regards,
--
M. Tolga Özses
Bilgi Teknolojisi
Sabanci Üniversitesi
Orhanli 34956 Tuzla
Istanbul
Tel: (216) 483 91 98
Web: http://people.sabanciuniv.edu/mtozses
Noel Jones
2006-12-08 14:24:28 UTC
Permalink
Post by M. Tolga Özses
Hi,
Some fake user was sending me e-mail from my domain, so I did what
# main.cf
remote_header_rewrite_domain = domain.invalid
smtpd_sender_restrictions =
reject_non_fqdn_sender,
reject_unlisted_sender
--
Noel Jones
How can I verify that this is working other than I don't get such
mails anymore?
Regards,
Send yourself some mail with a faked sender address and watch the logs.
--
Noel Jones
M. Tolga Özses
2006-12-08 14:40:02 UTC
Permalink
Post by Noel Jones
Post by M. Tolga Özses
Hi,
Some fake user was sending me e-mail from my domain, so I did what
# main.cf
remote_header_rewrite_domain = domain.invalid
smtpd_sender_restrictions =
reject_non_fqdn_sender,
reject_unlisted_sender
--
Noel Jones
How can I verify that this is working other than I don't get such
mails anymore?
Regards,
Send yourself some mail with a faked sender address and watch the logs.
If what you mean by "faking sender address" is simply changing the
e-mail address field in my account options in Thunderbird, I just did
that and sent an e-mail to my address, but it arrived.
Noel Jones
2006-12-08 17:54:34 UTC
Permalink
Post by M. Tolga Özses
Post by Noel Jones
Post by M. Tolga Özses
How can I verify that this is working other than I don't get such
mails anymore?
Regards,
Send yourself some mail with a faked sender address and watch the logs.
If what you mean by "faking sender address" is simply changing the
e-mail address field in my account options in Thunderbird, I just
did that and sent an e-mail to my address, but it arrived.
Then either you configured it wrong or tested it wrong, or you have
wildcard (virtual_alias_maps, *canonical_maps) entries that are
breaking recipient validation. It's hard for me to tell which from here.

Show evidence including "postconf -n" output and logs showing unknown
recipients being rejected and the unknown sender accepted.
--
Noel Jones
M. Tolga Özses
2006-12-11 07:59:07 UTC
Permalink
Post by Noel Jones
Post by M. Tolga Özses
Post by Noel Jones
Post by M. Tolga Özses
How can I verify that this is working other than I don't get such
mails anymore?
Regards,
Send yourself some mail with a faked sender address and watch the logs.
If what you mean by "faking sender address" is simply changing the
e-mail address field in my account options in Thunderbird, I just did
that and sent an e-mail to my address, but it arrived.
Then either you configured it wrong or tested it wrong, or you have
wildcard (virtual_alias_maps, *canonical_maps) entries that are
breaking recipient validation. It's hard for me to tell which from here.
Show evidence including "postconf -n" output and logs showing unknown
recipients being rejected and the unknown sender accepted.
Hello,

I didn't receive such a mail so far. If I do, I'll ask for help again.

Regards,
--
M. Tolga Özses
Bilgi Teknolojisi
Sabanci Üniversitesi
Orhanli 34956 Tuzla
Istanbul
Tel: (216) 483 91 98
Web: http://people.sabanciuniv.edu/mtozses
M. Tolga Özses
2006-12-11 11:00:12 UTC
Permalink
Post by Noel Jones
Post by M. Tolga Özses
Post by Noel Jones
Post by M. Tolga Özses
How can I verify that this is working other than I don't get such
mails anymore?
Regards,
Send yourself some mail with a faked sender address and watch the logs.
If what you mean by "faking sender address" is simply changing the
e-mail address field in my account options in Thunderbird, I just did
that and sent an e-mail to my address, but it arrived.
Then either you configured it wrong or tested it wrong, or you have
wildcard (virtual_alias_maps, *canonical_maps) entries that are
breaking recipient validation. It's hard for me to tell which from here.
Show evidence including "postconf -n" output and logs showing unknown
recipients being rejected and the unknown sender accepted.
Hello again,

Just after I said "I didn't receive such mails after that day.", a
fake-user e-mail has arrived. Here is the relevant log from
/var/log/mail.log:

Dec 11 10:06:31 kunduz postfix/qmgr[30112]: 398592C7A4:
from=<***@kunduz.org>, size=749, nrcpt=1 (queue active)
Dec 11 10:06:47 kunduz postfix/pipe[28748]: 398592C7A4:
to=<***@kunduz.org>, relay=spamfilter, delay=39, delays=23/0.04/0/16,
dsn=2.0.0, status=sent (delivered via spamfilter service)
Dec 11 10:06:47 kunduz postfix/pickup[28215]: 8EE1D6D177: uid=1007
from=<***@kunduz.org>
Dec 11 10:06:47 kunduz postfix/qmgr[30112]: 8EE1D6D177:
from=<***@kunduz.org>, size=1072, nrcpt=1 (queue active)
Dec 11 10:06:47 kunduz postfix/local[28760]: 8EE1D6D177:
to=<***@kunduz.org>, orig_to=<***@kunduz.org>, relay=local,
delay=16, delays=16/0.02/0/0.03, dsn=2.0.0, status=sent (delivered to
mailbox)

The user "mail" doesn't exist on my system.

Here is my postconf -n output:

2bounce_notice_recipient = postmaster
access_map_reject_code = 554
address_verify_default_transport = $default_transport
address_verify_local_transport = $local_transport
address_verify_map =
address_verify_negative_cache = yes
address_verify_negative_expire_time = 3d
address_verify_negative_refresh_time = 3h
address_verify_poll_count = 3
address_verify_poll_delay = 3s
address_verify_positive_expire_time = 31d
address_verify_positive_refresh_time = 7d
address_verify_relay_transport = $relay_transport
address_verify_relayhost = $relayhost
address_verify_sender = postmaster
address_verify_sender_dependent_relayhost_maps = $sender_dependent_relayhost_maps
address_verify_service_name = verify
address_verify_transport_maps = $transport_maps
address_verify_virtual_transport = $virtual_transport
alias_database = hash:/etc/mail/aliases
alias_maps = hash:/etc/mail/aliases
allow_mail_to_commands = alias, forward
allow_mail_to_files = alias, forward
allow_min_user = no
allow_percent_hack = yes
allow_untrusted_routing = no
alternate_config_directories =
always_bcc =
anvil_rate_time_unit = 60s
anvil_status_update_time = 600s
append_at_myorigin = yes
append_dot_mydomain = yes
application_event_drain_time = 100s
authorized_flush_users = static:anyone
authorized_mailq_users = static:anyone
authorized_submit_users = static:anyone
backwards_bounce_logfile_compatibility = yes
berkeley_db_create_buffer_size = 16777216
berkeley_db_read_buffer_size = 131072
best_mx_transport =
biff = yes
body_checks =
body_checks_size_limit = 51200
bounce_notice_recipient = postmaster
bounce_queue_lifetime = 5d
bounce_service_name = bounce
bounce_size_limit = 50000
bounce_template_file =
broken_sasl_auth_clients = no
canonical_classes = envelope_sender, envelope_recipient, header_sender, header_recipient
canonical_maps =
cleanup_service_name = cleanup
command_directory = /usr/sbin
command_execution_directory =
command_expansion_filter = 1234567890!@%-_=+:,./abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
command_time_limit = 1000s
config_directory = /etc/postfix
connection_cache_protocol_timeout = 5s
connection_cache_service_name = scache
connection_cache_status_update_time = 600s
connection_cache_ttl_limit = 2s
content_filter =
daemon_directory = /usr/lib/postfix
daemon_timeout = 18000s
debug_peer_level = 2
debug_peer_list =
default_database_type = hash
default_delivery_slot_cost = 5
default_delivery_slot_discount = 50
default_delivery_slot_loan = 3
default_destination_concurrency_limit = 20
default_destination_recipient_limit = 50
default_extra_recipient_limit = 1000
default_minimum_delivery_slots = 3
default_privs = mailman
default_process_limit = 100
default_rbl_reply = $rbl_code Service unavailable; $rbl_class [$rbl_what] blocked using $rbl_domain${rbl_reason?; $rbl_reason}
default_recipient_limit = 10000
default_transport = smtp
default_verp_delimiters = +=
defer_code = 450
defer_service_name = defer
defer_transports =
delay_logging_resolution_limit = 2
delay_notice_recipient = postmaster
delay_warning_time = 0h
deliver_lock_attempts = 20
deliver_lock_delay = 1s
disable_dns_lookups = no
disable_mime_input_processing = no
disable_mime_output_conversion = no
disable_verp_bounces = no
disable_vrfy_command = no
dont_remove = 0
double_bounce_sender = double-bounce
duplicate_filter_limit = 1000
empty_address_recipient = MAILER-DAEMON
enable_original_recipient = yes
error_notice_recipient = postmaster
error_service_name = error
execution_directory_expansion_filter = 1234567890!@%-_=+:,./abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
expand_owner_alias = no
export_environment = TZ MAIL_CONFIG LANG
fallback_transport =
fallback_transport_maps =
fast_flush_domains = $relay_domains
fast_flush_purge_time = 7d
fast_flush_refresh_time = 12h
fault_injection_code = 0
flush_service_name = flush
fork_attempts = 5
fork_delay = 1s
forward_expansion_filter = 1234567890!@%-_=+:,./abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
forward_path = $home/.forward${recipient_delimiter}${extension}, $home/.forward
frozen_delivered_to = yes
hash_queue_depth = 1
hash_queue_names = deferred, defer
header_address_token_limit = 10240
header_checks =
header_size_limit = 102400
helpful_warnings = yes
home_mailbox =
hopcount_limit = 50
html_directory = /usr/share/doc/postfix-2.3.4/html
ignore_mx_lookup_error = no
import_environment = MAIL_CONFIG MAIL_DEBUG MAIL_LOGTAG TZ XAUTHORITY DISPLAY LANG=C
in_flow_delay = 1s
inet_interfaces = all
inet_protocols = ipv4
initial_destination_concurrency = 5
internal_mail_filter_classes =
invalid_hostname_reject_code = 501
ipc_idle = 100s
ipc_timeout = 3600s
ipc_ttl = 1000s
line_length_limit = 2048
lmtp_bind_address =
lmtp_bind_address6 =
lmtp_cname_overrides_servername = no
lmtp_connect_timeout = 0s
lmtp_connection_cache_destinations =
lmtp_connection_cache_on_demand = yes
lmtp_connection_cache_time_limit = 2s
lmtp_connection_reuse_time_limit = 300s
lmtp_data_done_timeout = 600s
lmtp_data_init_timeout = 120s
lmtp_data_xfer_timeout = 180s
lmtp_defer_if_no_mx_address_found = no
lmtp_destination_concurrency_limit = $default_destination_concurrency_limit
lmtp_destination_recipient_limit = $default_destination_recipient_limit
lmtp_discard_lhlo_keyword_address_maps =
lmtp_discard_lhlo_keywords =
lmtp_enforce_tls = no
lmtp_generic_maps =
lmtp_host_lookup = dns
lmtp_lhlo_name = $myhostname
lmtp_lhlo_timeout = 300s
lmtp_line_length_limit = 990
lmtp_mail_timeout = 300s
lmtp_mx_address_limit = 5
lmtp_mx_session_limit = 2
lmtp_pix_workaround_delay_time = 10s
lmtp_pix_workaround_threshold_time = 500s
lmtp_quit_timeout = 300s
lmtp_quote_rfc821_envelope = yes
lmtp_randomize_addresses = yes
lmtp_rcpt_timeout = 300s
lmtp_rset_timeout = 20s
lmtp_sasl_auth_enable = no
lmtp_sasl_mechanism_filter =
lmtp_sasl_password_maps =
lmtp_sasl_path =
lmtp_sasl_security_options = noplaintext, noanonymous
lmtp_sasl_tls_security_options = $lmtp_sasl_security_options
lmtp_sasl_tls_verified_security_options = $lmtp_sasl_tls_security_options
lmtp_sasl_type = cyrus
lmtp_send_xforward_command = no
lmtp_sender_dependent_authentication = no
lmtp_skip_5xx_greeting = yes
lmtp_starttls_timeout = 300s
lmtp_tcp_port = 24
lmtp_tls_CAfile =
lmtp_tls_CApath =
lmtp_tls_cert_file =
lmtp_tls_dcert_file =
lmtp_tls_dkey_file = $lmtp_tls_dcert_file
lmtp_tls_enforce_peername = yes
lmtp_tls_exclude_ciphers =
lmtp_tls_key_file = $lmtp_tls_cert_file
lmtp_tls_loglevel = 0
lmtp_tls_mandatory_ciphers = medium
lmtp_tls_mandatory_exclude_ciphers =
lmtp_tls_mandatory_protocols = SSLv3, TLSv1
lmtp_tls_note_starttls_offer = no
lmtp_tls_per_site =
lmtp_tls_policy_maps =
lmtp_tls_scert_verifydepth = 5
lmtp_tls_secure_cert_match = nexthop
lmtp_tls_security_level =
lmtp_tls_session_cache_database =
lmtp_tls_session_cache_timeout = 3600s
lmtp_tls_verify_cert_match = hostname
lmtp_use_tls = no
lmtp_xforward_timeout = 300s
local_command_shell =
local_destination_concurrency_limit = 2
local_destination_recipient_limit = 1
local_header_rewrite_clients = permit_inet_interfaces
local_recipient_maps = proxy:unix:passwd.byname $alias_maps
local_transport = local:$myhostname
luser_relay =
mail_name = Postfix
mail_owner = postfix
mail_release_date = 20061101
mail_spool_directory = /var/mail
mail_version = 2.3.4
mailbox_command =
mailbox_command_maps =
mailbox_delivery_lock = fcntl, dotlock
mailbox_size_limit = 102400000
mailbox_transport =
mailbox_transport_maps =
mailq_path = /usr/bin/mailq
manpage_directory = /usr/share/man
maps_rbl_domains =
maps_rbl_reject_code = 554
masquerade_classes = envelope_sender, header_sender, header_recipient
masquerade_domains =
masquerade_exceptions =
max_idle = 100s
max_use = 100
maximal_backoff_time = 4000s
maximal_queue_lifetime = 5d
message_reject_characters =
message_size_limit = 10240000
message_strip_characters =
milter_command_timeout = 30s
milter_connect_macros = j {daemon_name} v
milter_connect_timeout = 30s
milter_content_timeout = 300s
milter_data_macros = i
milter_default_action = tempfail
milter_end_of_data_macros = i
milter_helo_macros = {tls_version} {cipher} {cipher_bits} {cert_subject} {cert_issuer}
milter_macro_daemon_name = $myhostname
milter_macro_v = $mail_name $mail_version
milter_mail_macros = i {auth_type} {auth_authen} {auth_author} {mail_addr}
milter_protocol = 2
milter_rcpt_macros = i {rcpt_addr}
milter_unknown_command_macros =
mime_boundary_length_limit = 2048
mime_header_checks = $header_checks
mime_nesting_limit = 100
minimal_backoff_time = 1000s
multi_recipient_bounce_reject_code = 550
mydestination = $myhostname, localhost.$mydomain, localhost
mydomain = kunduz.org
myhostname = kunduz.org
mynetworks = 192.168.1.0/24 127.0.0.0/8 192.168.105.0/24 172.16.73.0/24
mynetworks_style = subnet
myorigin = $myhostname
nested_header_checks = $header_checks
newaliases_path = /usr/bin/newaliases
non_fqdn_reject_code = 504
non_smtpd_milters =
notify_classes = resource, software
owner_request_special = yes
parent_domain_matches_subdomains = debug_peer_list,fast_flush_domains,mynetworks,permit_mx_backup_networks,qmqpd_authorized_clients,relay_domains,smtpd_access_maps
permit_mx_backup_networks =
pickup_service_name = pickup
plaintext_reject_code = 450
prepend_delivered_header = command, file, forward
process_id_directory = pid
propagate_unmatched_extensions = canonical, virtual
proxy_interfaces =
proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks
qmgr_clog_warn_time = 300s
qmgr_fudge_factor = 100
qmgr_message_active_limit = 20000
qmgr_message_recipient_limit = 20000
qmgr_message_recipient_minimum = 10
qmqpd_authorized_clients =
qmqpd_error_delay = 1s
qmqpd_timeout = 300s
queue_directory = /var/spool/postfix
queue_file_attribute_count_limit = 100
queue_minfree = 0
queue_run_delay = 1000s
queue_service_name = qmgr
rbl_reply_maps =
readme_directory = /usr/share/doc/postfix-2.3.4/readme
receive_override_options =
recipient_bcc_maps =
recipient_canonical_classes = envelope_recipient, header_recipient
recipient_canonical_maps =
recipient_delimiter =
reject_code = 554
relay_clientcerts =
relay_destination_concurrency_limit = $default_destination_concurrency_limit
relay_destination_recipient_limit = $default_destination_recipient_limit
relay_domains = $mydestination
relay_domains_reject_code = 554
relay_recipient_maps =
relay_transport = relay
relayhost =
relocated_maps =
remote_header_rewrite_domain =
require_home_directory = no
resolve_dequoted_address = yes
resolve_null_domain = no
resolve_numeric_domain = no
rewrite_service_name = rewrite
sample_directory = /etc/postfix
sender_bcc_maps =
sender_canonical_classes = envelope_sender, header_sender
sender_canonical_maps =
sender_dependent_relayhost_maps =
sendmail_path = /usr/sbin/sendmail
service_throttle_time = 60s
setgid_group = postdrop
show_user_unknown_table_name = yes
showq_service_name = showq
smtp_always_send_ehlo = yes
smtp_bind_address =
smtp_bind_address6 =
smtp_cname_overrides_servername = no
smtp_connect_timeout = 30s
smtp_connection_cache_destinations =
smtp_connection_cache_on_demand = yes
smtp_connection_cache_time_limit = 2s
smtp_connection_reuse_time_limit = 300s
smtp_data_done_timeout = 600s
smtp_data_init_timeout = 120s
smtp_data_xfer_timeout = 180s
smtp_defer_if_no_mx_address_found = no
smtp_destination_concurrency_limit = $default_destination_concurrency_limit
smtp_destination_recipient_limit = $default_destination_recipient_limit
smtp_discard_ehlo_keyword_address_maps =
smtp_discard_ehlo_keywords =
smtp_enforce_tls = no
smtp_fallback_relay = $fallback_relay
smtp_generic_maps =
smtp_helo_name = $myhostname
smtp_helo_timeout = 300s
smtp_host_lookup = dns
smtp_line_length_limit = 990
smtp_mail_timeout = 300s
smtp_mx_address_limit = 5
smtp_mx_session_limit = 2
smtp_never_send_ehlo = no
smtp_pix_workaround_delay_time = 10s
smtp_pix_workaround_threshold_time = 500s
smtp_quit_timeout = 300s
smtp_quote_rfc821_envelope = yes
smtp_randomize_addresses = yes
smtp_rcpt_timeout = 300s
smtp_rset_timeout = 20s
smtp_sasl_auth_enable = no
smtp_sasl_mechanism_filter =
smtp_sasl_password_maps =
smtp_sasl_path =
smtp_sasl_security_options = noplaintext, noanonymous
smtp_sasl_tls_security_options = $smtp_sasl_security_options
smtp_sasl_tls_verified_security_options = $smtp_sasl_tls_security_options
smtp_sasl_type = cyrus
smtp_send_xforward_command = no
smtp_sender_dependent_authentication = no
smtp_skip_5xx_greeting = yes
smtp_skip_quit_response = yes
smtp_starttls_timeout = 300s
smtp_tls_CAfile =
smtp_tls_CApath =
smtp_tls_cert_file =
smtp_tls_dcert_file =
smtp_tls_dkey_file = $smtp_tls_dcert_file
smtp_tls_enforce_peername = yes
smtp_tls_exclude_ciphers =
smtp_tls_key_file = $smtp_tls_cert_file
smtp_tls_loglevel = 0
smtp_tls_mandatory_ciphers = medium
smtp_tls_mandatory_exclude_ciphers =
smtp_tls_mandatory_protocols = SSLv3, TLSv1
smtp_tls_note_starttls_offer = no
smtp_tls_per_site =
smtp_tls_policy_maps =
smtp_tls_scert_verifydepth = 5
smtp_tls_secure_cert_match = nexthop, dot-nexthop
smtp_tls_security_level =
smtp_tls_session_cache_database =
smtp_tls_session_cache_timeout = 3600s
smtp_tls_verify_cert_match = hostname
smtp_use_tls = no
smtp_xforward_timeout = 300s
smtpd_authorized_verp_clients = $authorized_verp_clients
smtpd_authorized_xclient_hosts =
smtpd_authorized_xforward_hosts =
smtpd_banner = $myhostname ESMTP $mail_name
smtpd_client_connection_count_limit = 50
smtpd_client_connection_rate_limit = 0
smtpd_client_event_limit_exceptions = ${smtpd_client_connection_limit_exceptions:$mynetworks}
smtpd_client_message_rate_limit = 0
smtpd_client_new_tls_session_rate_limit = 0
smtpd_client_recipient_rate_limit = 0
smtpd_client_restrictions =
smtpd_data_restrictions =
smtpd_delay_open_until_valid_rcpt = yes
smtpd_delay_reject = yes
smtpd_discard_ehlo_keyword_address_maps =
smtpd_discard_ehlo_keywords =
smtpd_end_of_data_restrictions =
smtpd_enforce_tls = no
smtpd_error_sleep_time = 1s
smtpd_etrn_restrictions =
smtpd_expansion_filter = \t\40!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~
smtpd_forbidden_commands = CONNECT GET POST
smtpd_hard_error_limit = 20
smtpd_helo_required = no
smtpd_helo_restrictions =
smtpd_history_flush_threshold = 100
smtpd_junk_command_limit = 100
smtpd_milters =
smtpd_noop_commands =
smtpd_null_access_lookup_key = <>
smtpd_peername_lookup = yes
smtpd_policy_service_max_idle = 300s
smtpd_policy_service_max_ttl = 1000s
smtpd_policy_service_timeout = 100s
smtpd_proxy_ehlo = $myhostname
smtpd_proxy_filter =
smtpd_proxy_timeout = 100s
smtpd_recipient_limit = 1000
smtpd_recipient_overshoot_limit = 1000
smtpd_recipient_restrictions = permit_mynetworks, reject_unauth_destination
smtpd_reject_unlisted_recipient = yes
smtpd_reject_unlisted_sender = no
smtpd_restriction_classes =
smtpd_sasl_auth_enable = no
smtpd_sasl_authenticated_header = no
smtpd_sasl_exceptions_networks =
smtpd_sasl_local_domain =
smtpd_sasl_path = smtpd
smtpd_sasl_security_options = noanonymous
smtpd_sasl_tls_security_options = $smtpd_sasl_security_options
smtpd_sasl_type = cyrus
smtpd_sender_login_maps =
smtpd_sender_restrictions = reject_non_fqdn_sender, reject_unlisted_sender
smtpd_soft_error_limit = 10
smtpd_starttls_timeout = 300s
smtpd_timeout = 300s
smtpd_tls_CAfile =
smtpd_tls_CApath =
smtpd_tls_always_issue_session_ids = yes
smtpd_tls_ask_ccert = no
smtpd_tls_auth_only = no
smtpd_tls_ccert_verifydepth = 5
smtpd_tls_cert_file =
smtpd_tls_dcert_file =
smtpd_tls_dh1024_param_file =
smtpd_tls_dh512_param_file =
smtpd_tls_dkey_file = $smtpd_tls_dcert_file
smtpd_tls_exclude_ciphers =
smtpd_tls_key_file = $smtpd_tls_cert_file
smtpd_tls_loglevel = 0
smtpd_tls_mandatory_ciphers = medium
smtpd_tls_mandatory_exclude_ciphers =
smtpd_tls_mandatory_protocols = SSLv3, TLSv1
smtpd_tls_received_header = no
smtpd_tls_req_ccert = no
smtpd_tls_security_level =
smtpd_tls_session_cache_database =
smtpd_tls_session_cache_timeout = 3600s
smtpd_tls_wrappermode = no
smtpd_use_tls = no
soft_bounce = no
stale_lock_time = 500s
strict_7bit_headers = no
strict_8bitmime = no
strict_8bitmime_body = no
strict_mime_encoding_domain = no
strict_rfc821_envelopes = no
sun_mailtool_compatibility = no
swap_bangpath = yes
syslog_facility = mail
syslog_name = postfix
tls_daemon_random_bytes = 32
tls_export_cipherlist = ALL:+RC4:@STRENGTH
tls_high_cipherlist = ALL:!EXPORT:!LOW:!MEDIUM:+RC4:@STRENGTH
tls_low_cipherlist = ALL:!EXPORT:+RC4:@STRENGTH
tls_medium_cipherlist = ALL:!EXPORT:!LOW:+RC4:@STRENGTH
tls_null_cipherlist = !aNULL:eNULL+kRSA
tls_random_bytes = 32
tls_random_exchange_name = ${config_directory}/prng_exch
tls_random_prng_update_period = 3600s
tls_random_reseed_period = 3600s
tls_random_source = dev:/dev/urandom
trace_service_name = trace
transport_maps =
transport_retry_time = 60s
trigger_timeout = 10s
undisclosed_recipients_header = To: undisclosed-recipients:;
unknown_address_reject_code = 450
unknown_client_reject_code = 450
unknown_hostname_reject_code = 450
unknown_local_recipient_reject_code = 550
unknown_relay_recipient_reject_code = 550
unknown_virtual_alias_reject_code = 550
unknown_virtual_mailbox_reject_code = 550
unverified_recipient_reject_code = 450
unverified_sender_reject_code = 450
verp_delimiter_filter = -=+
virtual_alias_domains = $virtual_alias_maps
virtual_alias_expansion_limit = 1000
virtual_alias_maps = $virtual_maps
virtual_alias_recursion_limit = 1000
virtual_destination_concurrency_limit = $default_destination_concurrency_limit
virtual_destination_recipient_limit = $default_destination_recipient_limit
virtual_gid_maps =
virtual_mailbox_base =
virtual_mailbox_domains = $virtual_mailbox_maps
virtual_mailbox_limit = 51200000
virtual_mailbox_lock = fcntl
virtual_mailbox_maps =
virtual_minimum_uid = 100
virtual_transport = virtual
virtual_uid_maps =

(This is postconf -n output, not postconf output)

Regards,
--
M. Tolga Özses
Bilgi Teknolojisi
Sabanci Üniversitesi
Orhanli 34956 Tuzla
Istanbul
Tel: (216) 483 91 98
Web: http://people.sabanciuniv.edu/mtozses
Vadim Pushkin
2006-12-19 21:20:45 UTC
Permalink
All;

I am running postfix on two servers. Both of these servers are
Solaris/Sparc 2.8 and mount /var/mail from a fileserver. At times, email
destined for users who use mbox type mail, destined for /var/mail/username,
fail with permission denied on one host, but not the other.

Is their anything special that I should do in order for postfix to allow
this? Or is there a lock file for the user mailbox?

Thank you,

.vp
Mehmet Tolga Avcioglu
2006-12-19 21:23:37 UTC
Permalink
mbox type accounts are not good for NFS. Won't work and will great a
number of problems. As far as I know Maildir is the best solution for
NFS mounted solutions.

--
Mehmet
Post by Vadim Pushkin
All;
I am running postfix on two servers. Both of these servers are
Solaris/Sparc 2.8 and mount /var/mail from a fileserver. At times,
email destined for users who use mbox type mail, destined for
/var/mail/username, fail with permission denied on one host, but not the
other.
Is their anything special that I should do in order for postfix to allow
this? Or is there a lock file for the user mailbox?
Thank you,
.vp
v***@hotmail.com
2006-12-19 23:28:57 UTC
Permalink
----- Original Message -----
From: "Mehmet Tolga Avcioglu" <***@activecom.net>
To: "Vadim Pushkin" <***@hotmail.com>
Cc: <postfix-***@postfix.org>
Sent: Tuesday, December 19, 2006 4:23 PM
Subject: Re: Shared FS Mounts for /var/mail
Post by Mehmet Tolga Avcioglu
mbox type accounts are not good for NFS. Won't work and will great a
number of problems. As far as I know Maildir is the best solution for
NFS mounted solutions.
--
Mehmet
Post by Vadim Pushkin
All;
I am running postfix on two servers. Both of these servers are
Solaris/Sparc 2.8 and mount /var/mail from a fileserver. At times,
email destined for users who use mbox type mail, destined for
/var/mail/username, fail with permission denied on one host, but not the
other.
Is their anything special that I should do in order for postfix to allow
this? Or is there a lock file for the user mailbox?
Thank you,
.vp
I'll second that...
If you nfs mount MBOX, you'll have all kinds of weird errors. And high load
average - every time user does anything with his MBOX, IMAP server has to
reread entire MBOX file from nfs. We had MBOX and nfs setup working somewhat
on single nfs client IMAP server and even with one nfs client it was bad.
Maildir is the only way to go, if you want to do nfs. But, even with Maildir
you need fast nfs filer (like netapp). If not a NetApp - you should be
careful about filesystem on NFS server (ext3, for example, is terrible with
many files per directory.

We have now Maildir+NetApp+posfix+CourierIMAP with multiple IMAP servers
accessing Maildir storage and it works like a charm.

Vadim
Jay Chandler
2006-12-20 23:29:51 UTC
Permalink
Post by Mehmet Tolga Avcioglu
mbox type accounts are not good for NFS. Won't work and will great a
number of problems. As far as I know Maildir is the best solution for
NFS mounted solutions.
--
Mehmet
Post by Vadim Pushkin
All;
I am running postfix on two servers. Both of these servers are
Solaris/Sparc 2.8 and mount /var/mail from a fileserver. At times,
email destined for users who use mbox type mail, destined for
/var/mail/username, fail with permission denied on one host, but not the
other.
Is their anything special that I should do in order for postfix to allow
this? Or is there a lock file for the user mailbox?
Thank you,
.vp
We've been running them here for ages now. As long as you specify the
proper type of file locking (flock, IIRC), it works fine. If you'd like
I can dig out our settings and post them.
--
Jay Chandler
Network Administrator, Chapman University
714.628.7249 / ***@chapman.edu
Today's Excuse: Feature not yet implemented
Vadim Pushkin
2006-12-20 23:48:17 UTC
Permalink
I have this in my main.cf, I assume this is wrong for this scenario?

mailbox_delivery_lock = fcntl, dotlock

Love to see what you have.

.vp
Post by Jay Chandler
Post by Mehmet Tolga Avcioglu
mbox type accounts are not good for NFS. Won't work and will great a
number of problems. As far as I know Maildir is the best solution for
NFS mounted solutions.
--
Mehmet
Post by Vadim Pushkin
All;
I am running postfix on two servers. Both of these servers are
Solaris/Sparc 2.8 and mount /var/mail from a fileserver. At times,
email destined for users who use mbox type mail, destined for
/var/mail/username, fail with permission denied on one host, but not the
other.
Is their anything special that I should do in order for postfix to allow
this? Or is there a lock file for the user mailbox?
Thank you,
.vp
We've been running them here for ages now. As long as you specify the
proper type of file locking (flock, IIRC), it works fine. If you'd like I
can dig out our settings and post them.
Wietse Venema
2006-12-21 00:15:05 UTC
Permalink
Post by Vadim Pushkin
I have this in my main.cf, I assume this is wrong for this scenario?
mailbox_delivery_lock = fcntl, dotlock
mailbox_delivery_lock is used by the local(8) delivery agent.

Perhaps you can funally pay attention to line 6 of the
mailing list welcome message.

Wietse

1 Welcome to the postfix-users mailing list.
2
3 This list is for questions and discussions concerning the installation,
4 configuration and operation of the Postfix mail system.
5
6 TO REPORT A PROBLEM see http://www.postfix.org/DEBUG_README.html#mail
7
8 TO (UN)SUBSCRIBE see http://www.postfix.org/lists.html
9
10 Thank you for using Postfix.

Wietse Venema
2006-12-19 21:41:46 UTC
Permalink
Post by Vadim Pushkin
All;
I am running postfix on two servers. Both of these servers are
Solaris/Sparc 2.8 and mount /var/mail from a fileserver. At times, email
destined for users who use mbox type mail, destined for /var/mail/username,
fail with permission denied on one host, but not the other.
Is their anything special that I should do in order for postfix to allow
this? Or is there a lock file for the user mailbox?
What operation fails? Create username.lock? Open mailbox file?
It would help if you can show the complete error message.

File create operations can produce bogus errors when NFS server
replies get lost, especially under high load.

Depending on the error I may be able to work around it.

Wietse
Vadim Pushkin
2006-12-20 23:12:35 UTC
Permalink
Hi Wietse;

Not much too see, sorry.

------------------------------------

If you do so, please include this problem report. You can delete your own
text from the attached returned message.

The Postfix program

<***@virtualdomain.com> (expanded from <***@MYDOMAIN.COM>):
cannot access mailbox
/var/mail/userxyz for user userxyz. cannot open file: Permission denied

The client machine that is sending this is able to send from the commandline
to the alias above using Mail.

???

.vp
Post by Vadim Pushkin
Post by Vadim Pushkin
I am running postfix on two servers. Both of these servers are
Solaris/Sparc 2.8 and mount /var/mail from a fileserver. At times,
email
Post by Vadim Pushkin
destined for users who use mbox type mail, destined for
/var/mail/username,
Post by Vadim Pushkin
fail with permission denied on one host, but not the other.
Is their anything special that I should do in order for postfix to allow
this? Or is there a lock file for the user mailbox?
What operation fails? Create username.lock? Open mailbox file?
It would help if you can show the complete error message.
File create operations can produce bogus errors when NFS server
replies get lost, especially under high load.
Depending on the error I may be able to work around it.
Wietse
mouss
2006-12-20 23:34:23 UTC
Permalink
Post by Vadim Pushkin
Hi Wietse;
Not much too see, sorry.
------------------------------------
If you do so, please include this problem report. You can delete your
own text from the attached returned message.
The Postfix program
cannot access mailbox
/var/mail/userxyz for user userxyz. cannot open file: Permission denied
The client machine that is sending this is able to send from the
commandline to the alias above using Mail.
???
you probably have already seen messages like "blah blah, please contact
the admin" and feel frustrated when you are the admin.

now, as an admin, you should look at postfix logs, not at bounces.

BTW. mbox on nfs is known to cause trouble. that's the reason why
maildir was invented.
Wietse Venema
2006-12-21 00:10:26 UTC
Permalink
Post by Vadim Pushkin
Hi Wietse;
Not much too see, sorry.
...
Post by Vadim Pushkin
cannot access mailbox
/var/mail/userxyz for user userxyz. cannot open file: Permission denied
The client machine that is sending this is able to send from the commandline
to the alias above using Mail.
I would like to see the logfile records for both.

I suspect that mail submission with Mail is not delivered
by the same program.

Wietse
Noel Jones
2006-12-11 16:10:15 UTC
Permalink
Post by M. Tolga Özses
Post by Noel Jones
Post by M. Tolga Özses
Post by Noel Jones
Post by M. Tolga Özses
How can I verify that this is working other than I don't get
such mails anymore?
Regards,
Send yourself some mail with a faked sender address and watch the logs.
If what you mean by "faking sender address" is simply changing the
e-mail address field in my account options in Thunderbird, I just
did that and sent an e-mail to my address, but it arrived.
Then either you configured it wrong or tested it wrong, or you have
wildcard (virtual_alias_maps, *canonical_maps) entries that are
breaking recipient validation. It's hard for me to tell which from here.
Show evidence including "postconf -n" output and logs showing
unknown recipients being rejected and the unknown sender accepted.
Hello again,
Just after I said "I didn't receive such mails after that day.", a
delays=23/0.04/0/16, dsn=2.0.0, status=sent (delivered via spamfilter service)
Dec 11 10:06:47 kunduz postfix/pickup[28215]: 8EE1D6D177: uid=1007
delay=16, delays=16/0.02/0/0.03, dsn=2.0.0, status=sent (delivered to mailbox)
The user "mail" doesn't exist on my system.
The recipe is for rejecting unknown local senders during SMPT. The
above mail was submitted via the sendmail(1) compatibility command
and is not expected to reject unlisted senders or recipients.
Your postconf -n output is ridiculously long. Remove default entries
from your main.cf if you want anyone to look at it.
Post by M. Tolga Özses
(This is postconf -n output, not postconf output)
--
Noel Jones
M. Tolga Özses
2006-12-12 08:34:40 UTC
Permalink
Post by Noel Jones
Post by M. Tolga Özses
Post by Noel Jones
Post by M. Tolga Özses
Post by Noel Jones
Post by M. Tolga Özses
How can I verify that this is working other than I don't get such
mails anymore?
Regards,
Send yourself some mail with a faked sender address and watch the logs.
If what you mean by "faking sender address" is simply changing the
e-mail address field in my account options in Thunderbird, I just
did that and sent an e-mail to my address, but it arrived.
Then either you configured it wrong or tested it wrong, or you have
wildcard (virtual_alias_maps, *canonical_maps) entries that are
breaking recipient validation. It's hard for me to tell which from here.
Show evidence including "postconf -n" output and logs showing
unknown recipients being rejected and the unknown sender accepted.
Hello again,
Just after I said "I didn't receive such mails after that day.", a
fake-user e-mail has arrived. Here is the relevant log from
delays=23/0.04/0/16, dsn=2.0.0, status=sent (delivered via spamfilter service)
Dec 11 10:06:47 kunduz postfix/pickup[28215]: 8EE1D6D177: uid=1007
delay=16, delays=16/0.02/0/0.03, dsn=2.0.0, status=sent (delivered to mailbox)
The user "mail" doesn't exist on my system.
The recipe is for rejecting unknown local senders during SMPT. The
above mail was submitted via the sendmail(1) compatibility command and
is not expected to reject unlisted senders or recipients.
Your postconf -n output is ridiculously long. Remove default entries
from your main.cf if you want anyone to look at it.
Is postconf -n supposed to show me the lines I modified? I'm just wondering.
Post by Noel Jones
Post by M. Tolga Özses
(This is postconf -n output, not postconf output)
--
M. Tolga Özses
Bilgi Teknolojisi
Sabanci Üniversitesi
Orhanli 34956 Tuzla
Istanbul
Tel: (216) 483 91 98
Web: http://people.sabanciuniv.edu/mtozses
Eray Aslan
2006-12-12 09:12:58 UTC
Permalink
Post by M. Tolga Özses
Is postconf -n supposed to show me the lines I modified? I'm just wondering.
Check the docs. man 1 postconf:

-n Print parameter settings that are not left at their built-in
default value, because they are explicitly specified in main.cf.
--
Eray
M. Tolga Özses
2006-12-12 09:23:39 UTC
Permalink
Post by Eray Aslan
Post by M. Tolga Özses
Is postconf -n supposed to show me the lines I modified? I'm just wondering.
-n Print parameter settings that are not left at their built-in
default value, because they are explicitly specified in main.cf.
So it's basically what I said. Here it is:

default_privs = mailman
smtpd_sender_restrictions = reject_non_fqdn_sender, reject_unlisted_sender
mailbox_size_limit = 102400000

I hope this is it.

Regards,
--
M. Tolga Özses
Bilgi Teknolojisi
Sabanci Üniversitesi
Orhanli 34956 Tuzla
Istanbul
Tel: (216) 483 91 98
Web: http://people.sabanciuniv.edu/mtozses
Noel Jones
2006-12-12 15:57:01 UTC
Permalink
Post by M. Tolga Özses
Post by Noel Jones
Your postconf -n output is ridiculously long. Remove default
entries from your main.cf if you want anyone to look at it.
Is postconf -n supposed to show me the lines I modified? I'm just wondering.
"postconf -n" will show all lines explicitly set in main.cf, wether
they are default values or not. "Best practice" is to only set
those few config options that need changing in main.cf, and not add
to the noise by setting default values - most of which few people
will ever need.

If your distribution arrived with all 500+ postfix parameters set in
main.cf, complain to your package maintainer. If you added these
default values to main.cf yourself, don't do that, it makes it far
harder to track down problems.
--
Noel Jones
Continue reading on narkive:
Loading...