gmane.mail.postfix.policyd-weight

Re: still problems with: while reading input attribute name

Andre Hübner — 2008-10-22T13:44:00

Hallo, yes, master is alive. i see healthy processes and also logs from policyd-weight around errormessage i did, but messages do appear again quickly i did set $TRY_BALANCE back to 0 $MAX_PROC = 100; $MIN_PROC = 10; and it seems that now it is ok, messages did not appear for some time... hmm, i did set $TRY_BALANCE to 1 because formerly i had this "Server Configuration problem" messages. i thought $TRY_BALANCE = 1 and often reloading of postfixs caused this error on rcpostfix reload also daemons under master are shortly restartet. my idea was that this negativly affected the childs of policyd-weight Thanks, Andre p.s. postfwd is packaged and running on testmachine. try to find a good configuration... ____________________________________________________________ Policyd-weight Mailinglist - http://www.policyd-weight.org/

Re: still problems with: while reading input attribute name

Robert Felber — 2008-10-21T12:21:01

Is the master alive? Please show the output of ps axo pid,ppid,command | grep policyd It appears that the childs have trouble to talk to a connection oriented socket (probably the master). Please increase to >= 1024 One is in the scope of the kernel - the system. The other is in the scope of the program's socket. Both should be equal.

Re: still problems with: while reading input attribute name

Andre Hübner — 2008-10-21T11:54:43

Hallo, here an example from one affected machine, but seems to be the same on other servers. Oct 21 10:57:00 servername postfix/policyd-weight[30304]: warning: child: err: Died at /usr/lib/postfix/policyd-weight line 1322. Oct 21 10:57:00 servername postfix/policyd-weight[7581]: warning: child: err: Died at /usr/lib/postfix/policyd-weight line 1322. Oct 21 10:57:00 servername postfix/policyd-weight[7015]: warning: child: err: Died at /usr/lib/postfix/policyd-weight line 1322. Oct 21 11:55:53 servername postfix/policyd-weight[29656]: warning: child: err: Died at /usr/lib/postfix/policyd-weight line 1322. Oct 21 11:55:53 servername postfix/policyd-weight[29309]: warning: child: err: Died at /usr/lib/postfix/policyd-weight line 1322. Oct 21 12:00:57 servername postfix/policyd-weight[9438]: warning: child: err: Died at /usr/lib/postfix/policyd-weight line 1322. Oct 21 12:56:54 servername postfix/policyd-weight[587]: warning: child: err: Died at /usr/lib/postfix/policyd-weight line 1322. Oct 21 12:56:54

Re: still problems with: while reading input attribute name

Robert Felber — 2008-10-21T11:23:20

provide some debug-logs, eg: egrep -i '(warn|err|fatal|panic):' /some/log/file what is your OS' somax-value (sysctl -a | grep somax) No, it requires a complete rewrite from scratch. I always run the latest devel on a company-server, I haven't experienced scalability or stability problems. It should be "safe enough". postfwd (www.postfwd.org looks flexible and promising).

Re: still problems with: while reading input attribute name

Henrik K — 2008-10-21T11:19:40

Have a look at postfwd.org ____________________________________________________________ Policyd-weight Mailinglist - http://www.policyd-weight.org/

still problems with: while reading input attribute name

Andre Hübner — 2008-10-21T10:30:05

policyd-weight 0.1.14 beta-17 Hi List, i have read this: http://www.mail-archive.com/policyd-weight-list-MtC3HXRotUOzQB+pC5nmwQ< at >public.gmane.org/msg00623.html but still have problems with message: "while reading input attribute name". i reduced maxproc for smtpd in postfix-master.cf and increased some values in /etc/policyd-weight.conf This values i changed at this time: $IPC_TIMEOUT auf 4 $TRY_BALANCE auf 1 $MAX_PROC auf 50 $MIN_PROC auf 10 $SOMAXCONN auf 2048 max-proc of postfix is ~30 Is there still something to do for me? This should be the problem: is this solved in 0.1.14 beta-17 or later in 0.1.15 devel-1 Is 0.1.15 devel-1 safe enough to work in production-environment. i also read that this daemon is no longer maintained, thats a pitty. is there some other policyd-weight recommendable policyd-weight? I have seen some, but most of them are oversized for my intensions. Thanks, Andre ____________________________________________________________ Policyd-weight Mailinglist - http://w

Re: version update: version 0.1.15 devel-1

Jonas Genannt — 2008-09-24T10:50:06

Hello Robert, thanks for including my patch to your upstream release. I have noticed that I have send you an unclean patch. Please have a look at the new patch against 0.1.15 devel-1, this patch remove the lines "no Ipv6 support yet". Greets, Jonas

version update: version 0.1.15 devel-1

Robert Felber — 2008-09-24T09:42:18

Hello, even though I officially don't maintain polw, I want to thank Jonas Genannt for his work to start on IPv6 support. 0.1.15 devel-x should be dedicated to stabilize/test IPv6. ############################ Other priorities would be: - evaluating of RBL A records, 127.0.0.1, 127.0.0.2, and so on The result of _one_ RBl with many records should be not much higher than the record with the highest value. Simple addition/multiplying/averaging leads to false results. Eg: 127.1 = 3.4 127.2 = 1.5 127.3 = 1.5 127.4 = 2.3 ~~~~~~~~~~~ ~4.2 127.1 = 3.4 127.2 = 2.3 ----------- ~4.1 - configurable dynamic/static-host heuristic via regexp-array defaulting to the current set

IPv6 patch against policyd-weight

Jonas Genannt — 2008-09-22T19:04:50

Hi All, I have created an patch against the current policyd-weight version(0.1.14 beta-17). This patch adds support for IPv6 Helo and RBL checks. This code is not very nice, but it seems to work :) I have modified the default configuration to query the IPv6 Beta RBL at http://ipv6rbl.ipv6-world.net/. Greets, Jonas

Updated RPM - SUSE and Redhat

Morgan Weetman — 2008-06-03T06:53:26

Hi all, I've updated the rpm on SourceForge, the init script now works on SuSE and Redhat so the release id has changed. Tested on openSUSE 10.3 and RHEL4, pls let me know if you find any issues, thnx ____________________________________________________________ Policyd-weight Mailinglist - http://www.policyd-weight.org/

Re: missing subfolders in /tmp/.policyd-weight

Andre Hübner — 2008-04-01T14:20:07

oh, alles klar. Ich dachte nur weil der autor auf der homepage schreibt das hier nicht viel los wäre. ok, ich ändere nun mein setup ein bisschen ab, ist wohl das beste. ich entferne den kram aus der master und starte den policyd-weight als separaten daemon. in der main.cf notiere ich dann check_policy_service inet:127.0.0.1:12525 so wie vorgesehen. nur beim stop -> start hab ich die erfahrung gemacht das er da ab und zu hängt. dies kann ich aber umgehen wenn ich /tmp/.policyd-weight entferne nach dem stop. ich baus mal so in das postfix startscript ein, wird das beste sein. mal sehen vielen dank andre ----- Original Message ----- From: "Daniel Hackenberg" public.gmane.org> To: "Andre Hübner" public.gmane.org> Sent: Tuesday, April 01, 2008 2:02 PM Subject: Re: missing subfolders in /tmp/.policyd-weight So inaktiv ist die Liste gar nicht. Das siehst du, wenn du mal in das Listen-Archiv unter http://news.gmane.org/gmane.mail.postfix.policyd%2dweight

Re: missing subfolders in /tmp/.policyd-weight

Whit Blauvelt — 2008-04-01T13:22:55

monit is good for that too. - Whit On Tue, Apr 01, 2008 at 03:02:26PM +0200, Robert Felber wrote: ____________________________________________________________ Policyd-weight Mailinglist - http://www.policyd-weight.org/

Re: missing subfolders in /tmp/.policyd-weight

Robert Felber — 2008-04-01T13:02:26

Yes one someone needs to fix policyd-weight which creates this directories also in non-damon mode. Policyd-weight itself doesn't have a nice routine for easily creating directory X with correct perms, owners and symlink checks. I would say 'policyd-weight start' is better. Probably that it promises some failover-redundancy because postfix would start the program for each smtpd session. If policyd-weight crashes, it would be re-called the next time a smtpd session is made. However, if you fear that policyd-weight (or any other daemon for that matter) crashes and want to restart it automatically you may want to have a look at runit [1] or daemontools [2]. Personally I use none of those as I rather have crashed services than undiscovered problems. 1: http://smarden.org/runit/ 2: http://cr.yp.to/daemontools.html

missing subfolders in /tmp/.policyd-weight

Andre Hübner — 2008-04-01T11:27:30

Hi List, i hope there is enough traffic here to get answers. ;) Im updateing my postfix-configuration to the new policyd-weight Version: 0.1.14 beta-17 Only difference to ./policyd-weight defaults is: $GROUP = "nogroup"; policyd-weight.conf is in /etc/ I do not start policyd-weight by ./policyd-weight start, i have this in my master.cf: policy-pdw unix - n n - - spawn user=polw argv=/usr/lib/postfix/policyd-weight i cannot say the reason why this is made that way, this was made by other people policyd-weight is running and gives a correct checkresult, but between the checks are also warnings in the log. Apr 1 12:41:46 servername postfix/policyd-weight[8958]: warning: cache_query: $csock couln't be created: connect: No such file or directory, calling spawn_cache () Apr 1 12:41:46 servername postfix/policyd-weight[8981]: warning: cache: err: cache: chdir /tmp/.policyd-weight/: No such file or directory at /usr/lib/postfix/p olicyd-weight lin

Re: security: version update: version 0.1.14 beta-17

Robert Felber — 2008-03-29T20:18:26

A misguiding log-message. Following patch makes it not more clear, but more correct. --- old/policyd-weight Fri Mar 28 15:55:22 2008 +++ new/policyd-weight Sat Mar 29 20:50:44 2008 < at >< at > -2945,7 +2945,8 < at >< at > # change directory to $LOCKPATH in order to get some # coredumps just in case. - chdir "$LOCKPATH/cores/cache" or die "cache: chdir $LOCKPATH: $!"; + chdir "$LOCKPATH/cores/cache" or die + "cache: chdir $LOCKPATH/cores/cache: $!"; mylog(info=>'cache spawned'); Manually killing policyd-weight implies to kill the cache instance. The way to completely shut down policyd-weight is policyd-weight -k stop This doesn't work anymore if the directory has been deleted, in such cases you need to do a ps xauww | grep policyd-weight and kill the pids by verifying that it is a policyd-weight process. Policyd-weight needs completely to be shut down _before_ you change the $LOCKPATH config parameter.

Re: security: version update: version 0.1.14 beta-17

Whit Blauvelt — 2008-03-29T18:12:43

Hi Robert, What's this: postfix/policyd-weight[18125]: warning: cache: err: cache: chdir /tmp/.policyd-weight/: No such file or directory at /usr/sbin/policyd-weight line 2948, line 100 That's with beta-17, yet # ls -ld /tmp/.policyd-weight/ drwx------ 2 polw polw 4096 2008-03-29 14:09 /tmp/.policyd-weight/ So "No such" message yet such a directory? That directory in this case has been recreated by policyd-weight - I misread your "workaround" suggestion as instructions to go ahead and delete it. Maybe if I hadn't it wouldn't be broken? Thanks, Whit On Fri, Mar 28, 2008 at 04:16:29PM +0100, Robert Felber wrote: ____________________________________________________________ Policyd-weight Mailinglist - http://www.policyd-weight.org/

Re: security: version update: version 0.1.14 beta-17

Robert Felber — 2008-03-29T08:50:48

Which? I'll use /var/run in some of the next releases.

Re: security: version update: version 0.1.14 beta-17

Paul B. Henson — 2008-03-28T23:30:28

If you have a trailing slash, Linux follows the symbolic link and runs lstat on what the link points to, not the link itself. You can demonstrate the same behavior with ls: henson< at >gentoo ~/tmp $ mkdir foo henson< at >gentoo ~/tmp $ ln -s foo bar henson< at >gentoo ~/tmp $ touch foo/baz henson< at >gentoo ~/tmp $ ls -l bar lrwxrwxrwx 1 henson henson 3 Mar 28 16:21 bar -> foo henson< at >gentoo ~/tmp $ ls -l bar/ total 0-rw-r--r-- 1 henson henson 0 Mar 28 16:21 baz Interestingly, other operating systems display different behavior. For example, under Solaris 8: $ ls -l bar/ lrwxrwxrwx 1 henson csupomona 3 Mar 28 15:20 bar/ -> foo I'm not sure which is the more correct behavior... Also, the S_IFDIR output from strace isn't an argument to lstat, it's the return value of the lstat call. There are still race conditions present in the code. It is rather difficult to securely create files/directories in a world writable directory. If you are running on a multiuser system, it's probably best to have the lock direc

Re: Thanks for fix, Website slightly confused

Henrik K — 2008-03-28T17:08:15

I keep a somewhat updated reference of everything at: http://hege.li/howto/spam/etc/ Maybe you can get some ideas from the postfix setup too. ____________________________________________________________ Policyd-weight Mailinglist - http://www.policyd-weight.org/

Re: Thanks for fix, Website slightly confused

Steve — 2008-03-28T17:01:56

-------- Original-Nachricht -------- Care to share your rules for postfwd?

Re: Thanks for fix, Website slightly confused

Henrik K — 2008-03-28T16:49:12

I've been running postfwd for several weeks on production already and it's developing forward very quickly. You can do pretty much everything that policyd-weight does and some better (like async DNS). It's missing some checks like MX relations etc, but I don't know if thats really even needed. The developer is very active and knowable, so I think we are in good shape there. ____________________________________________________________ Policyd-weight Mailinglist - http://www.policyd-weight.org/