http://permalink.gmane.org/gmane.mail.imap.courier.general hourly 1 1901-01-01T00:00+00:00 http://gmane.org/img/gmane-25t.png http://gmane.org http://permalink.gmane.org/gmane.mail.imap.courier.general/34939 <pre> Most receiving servers perform forward and reverse DNS lookup on the peer's IP address. This is even more popular than ident lookups. It's not uncommon for DNS lookups to stall for various reasons. When testing connections to remote servers, I find quite often that remote servers take a fairly long time to issue their greeting, even if the connection goes thru promptly, while they struggle with their own DNS servers. Senders which are so impatient are going to be fairly broken in many other ways, too. ------------------------------------------------------------------------------ Try New Relic Now &amp; We'll Send You this Cool Shirt New Relic is the only SaaS-based application performance monitoring service that delivers powerful full stack analytics. Optimize and monitor your browser, app, &amp; servers with just a few lines of code. Try New Relic and get this awesome Nerd Life shirt! http://p.sf.net/sfu/newrelic_d2d_may_______________________________________________ courier-users mailing list cou</pre> Sam Varshavchik 2013-05-24T10:56:15 http://permalink.gmane.org/gmane.mail.imap.courier.general/34938 <pre>I think your take on this is closer to my own sentiments - using ident lookups as an accepted greylisting technique and I think this is what Matus is also doing. As for whether or not to provide valid ident lookups my take is that all you really need is to reject the connection. Courier will then accept the reject and continue immediately as far as I understand/have tested. I totally agree with Sam's and Jan's comment that ident lookups as a verifying technique probably is a thing of the past. As for Jan's comment on dropping instead of rejecting - I think the idea behind dropping used to work. But for servers connected directly to the internet I don't think it makes much sense any more as it's relatively easy to identify all the open ports anyway. So to sum it up - I think I'll leave my server the way it is and try to politely tell the admin of the server that even though the specification says SHOULD be 300 seconds it's probably a good idea not to lower it, even if it makes your queues empty faster. Re</pre> Kristian Duus Østergaard 2013-05-24T05:41:09 http://permalink.gmane.org/gmane.mail.imap.courier.general/34937 <pre> Consider it an effective orthogonal version of greylisting (which often causes other greater problems unfortunately)? Enabled, it typically tends to hold the inbound smtp connection open ~30 seconds before a "HELO" smtp conversation is allowed to begin. Turns out numerous virus/malware bots drop their tcp connection right at the 30 second mark. (yet another reason also why port 587 is a better choice for local relaying end user clients/senders such they do not experience the hold time, entirely a different issue though and not helpful to your experience) It's very effective in reducing spam in my system, testing with either setting a couple years ago the effective cut rate of 2/3 or more. In combo with good RBL selection, I see 90% of connection attempts dropped/rejected/etc, and still my users receive their good mail. My users complained more when it was disabled, and many have been shielded for so long against spam they don't understand why users of other systems complain about spam:-) It may be possi</pre> Andrew Burnette 2013-05-24T03:57:18 http://permalink.gmane.org/gmane.mail.imap.courier.general/34936 <pre> On 2013-05-24 02:07, Sam Varshavchik wrote: reason that very short them. This question and mail from the sender is accepted, or not. Has no impact, whatsoever. in mail headers. and smaller. identd is only to be found on multiuser servers, which haven't been exactly popular, in a long, long time. 30 seconds. Legitimate mail servers will wait several minutes before timing out. timeout after 30 seconds. server issues its own ident query, Courier will wait 5 minutes for the remote server's initial response, and that is configurable wth the esmtptimeouthelo config setting. No but in my case the problem comes from the combination that the sending server has a timeout of less than 30 seconds AND drops the ident packages making courier use the full timeout of 30 seconds. </pre> Kristian Duus Østergaard 2013-05-24T04:17:53 http://permalink.gmane.org/gmane.mail.imap.courier.general/34935 <pre> Make that "…passing year…". Serves me right for trying to reply to my email, while watching Youtube at the same time… ------------------------------------------------------------------------------ Try New Relic Now &amp; We'll Send You this Cool Shirt New Relic is the only SaaS-based application performance monitoring service that delivers powerful full stack analytics. Optimize and monitor your browser, app, &amp; servers with just a few lines of code. Try New Relic and get this awesome Nerd Life shirt! http://p.sf.net/sfu/newrelic_d2d_may_______________________________________________ courier-users mailing list courier-users&lt; at &gt;lists.sourceforge.net Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users </pre> Sam Varshavchik 2013-05-24T00:15:56 http://permalink.gmane.org/gmane.mail.imap.courier.general/34934 <pre> The success or failure of ident lookup has no effect on whether the mail from the sender is accepted, or not. Has no impact, whatsoever. The only thing that ident lookup does is record some additional data in mail headers. And, with each passing here, the value of ident lookups gets smaller, and smaller. identd is only to be found on multiuser servers, which haven't been exactly popular, in a long, long time. As others have stated, Courier will timeout on its ident query after 30 seconds. Legitimate mail servers will wait several minutes before timing out. There's also some confusion here regarding when ident lookup matters. Courier makes an ident query when receiving mail. And Courier will timeout after 30 seconds. When sending mail, Courier has no control over whether the remote mail server issues its own ident query, Courier will wait 5 minutes for the remote server's initial response, and that is configurable wth the esmtptimeouthelo config setting. ---------------------------</pre> Sam Varshavchik 2013-05-24T00:07:20 http://permalink.gmane.org/gmane.mail.imap.courier.general/34933 <pre>On Thu, May 23, 2013 at 9:47 PM, Matus UHLAR - fantomas &lt;uhlar&lt; at &gt;fantomas.sk&gt;wrote: I'm sorry for interpreting you in the way that you yourself let your own servers behave in the way that you expect from others. Then we heartily disagree. It is common for non-provided services to be firewalled off with DROP rules rather than DENY or even ACCEPT. This comes from hard-learned lessons about permitting services on a whitelisting basis rather than blacklisting basis; this reduces risk of damage or loss of service from several types of attacks. It is good network maintenance practice. You in fact say there's no need to turn ident lookups off. No, I don't. The SMTP client I'm afraid you're misremembering the standard. RFC 2821 and 5321 specify that timeouts MUST be supported, but only SHOULD be at least 5 minutes for the initial 220 message. https://tools.ietf.org/html/rfc2821#page-56 https://tools.ietf.org/html/rfc5321#page-65 A SHOULD requirement weighs very heavily, of course, but it means tha</pre> Jan Ingvoldstad 2013-05-23T20:10:38 http://permalink.gmane.org/gmane.mail.imap.courier.general/34932 <pre> This is not what I was saying. I have said that if someone provides IDENT lookups, the response will be used and the client is rewarded with avoiding the timeout when waiting to timeout. Of course, using SMTP delay of e.g. 30 seconds may help you even if ident is working, so I encourage you to implement this anti-spam measure (and drop all clients who send any content before your server displays the greeting). I think courier has no such measure currently. I don't think anyone sane would "block" IDENT lookups. You may simply not provide it. Note that IDENT response is for your (sender's, smtp client's) use, not for the recipient (SMTP server) admin's - the server will just log it and in case of spamming the header will be passed to you, who can in addition see the IDENT response, if you have decided to provide it. You in fact say there's no need to turn ident lookups off. The SMTP client MUST wait at least 300 seconds, because delays may happen because of other reasons, while timeout for TCP connect </pre> Matus UHLAR - fantomas 2013-05-23T19:47:25 http://permalink.gmane.org/gmane.mail.imap.courier.general/34931 <pre>On Thu, May 23, 2013 at 6:24 PM, Kristian Duus Østergaard &lt;kristian&lt; at &gt;duus.com Hi there! I'll just start with noting that I come from a different school of MTA administration than Matus Uhlar, so I've learned things differently. Ident lookups have historically been associated with spamming, as a more or less efficient way of identifying which addresses are valid and therefore okay to send spam to. It has also been associated with targeted attacks against specific accounts across protocols, e.g. for FTP, SSH etc. Relying on ident lookups therefore is to rely on that most MTA admins open up for ident lookups, such as Matus Uhlar obviously is doing. In my experience, this is futile. Many legitimate email providers block ident lookups. Those are two questions. In my opinion, you should stop using it. This is not likely to be the last time you experience problems with legitimate email related to blocked/blackholed ident lookups. But only you can really answer which balance of spam blocked vs. legitimate</pre> Jan Ingvoldstad 2013-05-23T18:07:23 http://permalink.gmane.org/gmane.mail.imap.courier.general/34930 <pre> I have configured the same on my former employer's SMTP servers because of the same reason. I found it useful - if the machine provides ident, SMTP transaction starts imediately and if client is firewalled, it has to wait, which helps against spambots. Clients have to use different ports (and different SMTP server) even... Such SMTP client violates the SMTP protocol, which requires waiting at least 300 seconds for SMTP welcome greeting. Inform the clients (and remote postmaster) that remote SMTP server is misconfigured and violates the standard which results in problems. Commented above. I recommend using ident on SMTP server to avoid much of spam. no automation no filtering, but for special cases you can drop SMTP connections when outgoing, which will result in immediate dropped ident connection, instead of waiting to time out. </pre> Matus UHLAR - fantomas 2013-05-23T17:49:51 http://permalink.gmane.org/gmane.mail.imap.courier.general/34929 <pre>Hi, My smtp server is currently using identlookup and I think it is one reason that I don't receive a ton of Spam. Unfortunately some of my users receive mails from a domain that has a very short timeout and drops identlookups at the firewall, instead of rejecting them. This results in no mails coming through to my users from the domain in question and me getting asked how many other domains does this happen from. My own approximate count indicates that only 1.6% of the failing connections are from legit servers. So my questions are really : What is your experience with identlookups ? Should I stop using it on my server and risk more Spam ? When you discover a problem with a server what do you do ? Do any of you have automated scripts to inform the postmaster in the other end that you do have a server and it actually can respond ? Does courier have any filtering function for this very special scenario ? Sorry for the long rant.. Regards Kristian Duus Østergaard ----------------</pre> Kristian Duus Østergaard 2013-05-23T16:24:49 http://permalink.gmane.org/gmane.mail.imap.courier.general/34928 <pre>Welcome! You will increase the likelihood of useful answers if you specify your setup more exactly; e.g. "courier-mta" is the Debian package for the SMTP part of Courier, not pop3 or imap -&gt; I'm confused. ESR has written a great introduction on How To Ask Questions The Smart Way: http://www.catb.org/esr/faqs/smart-questions.html If you are talking about the client software: As far as I understand, it might be possible (though not very reliable) for SMTP, by logging the "User-Agent: " header (and maybe some others to detect bad software like MS Outlook). For the IMAP-side, you are out of luck; I don't know of any way that IMAP-clients would specify the user-agent when connecting to an IMAP-server. (but I might be wrong :) cheers, </pre> Martin Schuster (IFKL IT OS DC CD 2013-05-15T05:50:50 http://permalink.gmane.org/gmane.mail.imap.courier.general/34927 <pre> I think it logs by default, apparently to syslog. can you check for /var/log/mail ? </pre> Matus UHLAR - fantomas 2013-05-14T19:54:26 http://permalink.gmane.org/gmane.mail.imap.courier.general/34926 <pre>Hi all! This is my first post :-) On debian I installed courier-mta (pop3 and imap). Is there a way to logging the email client used to connect to my server? thanks! ------------------------------------------------------------------------------ AlienVault Unified Security Management (USM) platform delivers complete security visibility with the essential security capabilities. Easily and efficiently configure, manage, and operate all of your security controls from a single console and one unified framework. Download a free trial. http://p.sf.net/sfu/alienvault_d2d _______________________________________________ courier-users mailing list courier-users&lt; at &gt;lists.sourceforge.net Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users </pre> Pol Hallen 2013-05-14T19:02:01 http://permalink.gmane.org/gmane.mail.imap.courier.general/34925 <pre> This needs to be debugged further than the point I was able to, just by reading the logs. This does appear to be the same issue from that thread. I don't recall any follow-up to that. You should be able to confirm this by looking at config.log. ------------------------------------------------------------------------------ Get 100% visibility into Java/.NET code with AppDynamics Lite It's a free troubleshooting tool designed for production Get down to code-level detail for bottlenecks, with &lt;2% overhead. Download for free and get started troubleshooting in minutes. http://p.sf.net/sfu/appdyn_d2d_ap2_______________________________________________ courier-users mailing list courier-users&lt; at &gt;lists.sourceforge.net Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users </pre> Sam Varshavchik 2013-05-05T13:59:00 http://permalink.gmane.org/gmane.mail.imap.courier.general/34924 <pre>After the release of Debian Squeeze, I'm going to produce new Debian packages for Courier Authlib and Courier. The build of Courier Authlib fails as shown below. I found this thread, http://courier-mail-server.10983.n7.nabble.com/Rebuilding-courier-authlib-with-libmysqld-dev-and-libmysqlcppcon-dev-Now-Results-in-an-Error-td20387.html, but there was no solution to the problem. Any advice? Regards Racke --snip-- racke&lt; at &gt;argus:~/debian/courier$ debaux-build courier-authlib dpkg-buildpackage: source package courier-authlib dpkg-buildpackage: source version 0.65.0-1 dpkg-buildpackage: source changed by Stefan Hornburg (Racke) &lt;racke&lt; at &gt;linuxia.de&gt; dpkg-source --before-build courier-authlib-0.65.0 dpkg-buildpackage: host architecture amd64 fakeroot debian/rules clean dh_testdir chmod +x debian/courier_perms dh_testroot rm -f stamp-build stamp-install [ ! -f Makefile ] || /usr/bin/make distclean dh_clean dpkg-source -b courier-authlib-0.65.0 dpkg-source: warning: no source format specified in debian/sou</pre> Stefan Hornburg (Racke 2013-05-05T10:04:48 http://permalink.gmane.org/gmane.mail.imap.courier.general/34922 <pre> It is strongly advised that you use sssd, not nss-pam-ldapd. ------------------------------------------------------------------------------ Try New Relic Now &amp; We'll Send You this Cool Shirt New Relic is the only SaaS-based application performance monitoring service that delivers powerful full stack analytics. Optimize and monitor your browser, app, &amp; servers with just a few lines of code. Try New Relic and get this awesome Nerd Life shirt! http://p.sf.net/sfu/newrelic_d2d_apr _______________________________________________ courier-users mailing list courier-users&lt; at &gt;lists.sourceforge.net Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users </pre> Gordon Messmer 2013-04-26T22:49:33 http://permalink.gmane.org/gmane.mail.imap.courier.general/34921 <pre>Hi, is it possible to use domain alias and mailbox alias at the same time? E.g. I have domain with alias in hosteddomains (and esmtpacceptmailfor) mydomain.com&lt;tab&gt;my-domain.com and at the same time there are aliases in aliases/my-domain.com like user&lt; at &gt;my-domain.com: personal&lt; at &gt;email.com So I would like to first rewrite domain alias and then apply mailbox alias and deliver. user&lt; at &gt;mydomain.com --&gt; user&lt; at &gt;my-domain.com --&gt; personal&lt; at &gt;email.com Currently it succesfully rewrites domain, but then I get 500 user unknown. (Sadly I did not forget to run makealiases). Marek ------------------------------------------------------------------------------ Try New Relic Now &amp; We'll Send You this Cool Shirt New Relic is the only SaaS-based application performance monitoring service that delivers powerful full stack analytics. Optimize and monitor your browser, app, &amp; servers with just a few lines of code. Try New Relic and get this awesome Nerd Life shirt! http://p.sf.net/sfu/newrelic_d2d_apr ___________________</pre> Marek Blažek 2013-04-26T11:51:57 http://permalink.gmane.org/gmane.mail.imap.courier.general/34920 <pre>I found the problem. The /var/run/courier was not created with correct owner by the init.d script (Gentoo). /run and /var/run are on tmpfs since a while back in Gentoo so it has to be created with correct permission and user/group by the init.d scripts. On 2013-04-26 09:18, Anders wrote: ------------------------------------------------------------------------------ Try New Relic Now &amp; We'll Send You this Cool Shirt New Relic is the only SaaS-based application performance monitoring service that delivers powerful full stack analytics. Optimize and monitor your browser, app, &amp; servers with just a few lines of code. Try New Relic and get this awesome Nerd Life shirt! http://p.sf.net/sfu/newrelic_d2d_apr _______________________________________________ courier-users mailing list courier-users&lt; at &gt;lists.sourceforge.net Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users </pre> Anders 2013-04-26T08:57:02 http://permalink.gmane.org/gmane.mail.imap.courier.general/34919 <pre>Hi, Since I upgraded, pythonfilter-1,8 has stopped functioning. Is there a known compatibility issue? I do not see anything in the logs that the filter is even being considered/used. Regards, Anders On 2013-03-06 03:15, Sam Varshavchik wrote: ------------------------------------------------------------------------------ Try New Relic Now &amp; We'll Send You this Cool Shirt New Relic is the only SaaS-based application performance monitoring service that delivers powerful full stack analytics. Optimize and monitor your browser, app, &amp; servers with just a few lines of code. Try New Relic and get this awesome Nerd Life shirt! http://p.sf.net/sfu/newrelic_d2d_apr _______________________________________________ courier-users mailing list courier-users&lt; at &gt;lists.sourceforge.net Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users </pre> Anders 2013-04-26T07:18:52 http://permalink.gmane.org/gmane.mail.imap.courier.general/34918 <pre> On 04/24/2013 01:00 PM, Sam Varshavchik wrote: Yes, sort of. The first imapd process is started as root by /etc/rc.d/init.d/imapd and then it spawns children for every user with an UID other than 0. It does, but placing all users under the same UID can only be done on a pure vmail system with no other access for the users. Then again, on such a system userdb would be a fully sufficient solution and LDAP &amp; cousins would be rather an overkill. On more complex systems where users have access to more services than just mail, LDAP &amp; Co make sense but a single UID for all users does not. That's where I typically run into the gamin problem and the frustration sets in of users reporting error messages and logs filling up. Speaking about which, there is a short but very important notice on the gamin homepage: "By default gamin revert to using polling for all paths matching /mnt/* or /media/* on Linux". Redhat systems do not provide an /etc/gamin/gaminrc file by default and vmail directories are seldom placed </pre> Zenon Panoussis 2013-04-24T22:09:45 Search the mailing list at Gmane query http://search.gmane.org/?group=$group=gmane.mail.imap.courier.general