gmane.mail.postfix.policyd-weight

still problems with: while reading input attribute name

Andre Hübner — 2008-10-21T10:30:05

policyd-weight 0.1.14 beta-17 Hi List, i have read this: http://www.mail-archive.com/policyd-weight-list-MtC3HXRotUOzQB+pC5nmwQ< at >public.gmane.org/msg00623.html but still have problems with message: "while reading input attribute name". i reduced maxproc for smtpd in postfix-master.cf and increased some values in /etc/policyd-weight.conf This values i changed at this time: $IPC_TIMEOUT auf 4 $TRY_BALANCE auf 1 $MAX_PROC auf 50 $MIN_PROC auf 10 $SOMAXCONN auf 2048 max-proc of postfix is ~30 Is there still something to do for me? This should be the problem: is this solved in 0.1.14 beta-17 or later in 0.1.15 devel-1 Is 0.1.15 devel-1 safe enough to work in production-environment. i also read that this daemon is no longer maintained, thats a pitty. is there some other policyd-weight recommendable policyd-weight? I have seen some, but most of them are oversized for my intensions. Thanks, Andre ____________________________________________________________ Policyd-weight Mailinglist - http://www.policyd-weight.org/

version update: version 0.1.15 devel-1

Robert Felber — 2008-09-24T09:42:18

Hello, even though I officially don't maintain polw, I want to thank Jonas Genannt for his work to start on IPv6 support. 0.1.15 devel-x should be dedicated to stabilize/test IPv6. ############################ Other priorities would be: - evaluating of RBL A records, 127.0.0.1, 127.0.0.2, and so on The result of _one_ RBl with many records should be not much higher than the record with the highest value. Simple addition/multiplying/averaging leads to false results. Eg: 127.1 = 3.4 127.2 = 1.5 127.3 = 1.5 127.4 = 2.3 ~~~~~~~~~~~ ~4.2 127.1 = 3.4 127.2 = 2.3 ----------- ~4.1 - configurable dynamic/static-host heuristic via regexp-array defaulting to the current set

IPv6 patch against policyd-weight

Jonas Genannt — 2008-09-22T19:04:50

Hi All, I have created an patch against the current policyd-weight version(0.1.14 beta-17). This patch adds support for IPv6 Helo and RBL checks. This code is not very nice, but it seems to work :) I have modified the default configuration to query the IPv6 Beta RBL at http://ipv6rbl.ipv6-world.net/. Greets, Jonas

Updated RPM - SUSE and Redhat

Morgan Weetman — 2008-06-03T06:53:26

Hi all, I've updated the rpm on SourceForge, the init script now works on SuSE and Redhat so the release id has changed. Tested on openSUSE 10.3 and RHEL4, pls let me know if you find any issues, thnx ____________________________________________________________ Policyd-weight Mailinglist - http://www.policyd-weight.org/

missing subfolders in /tmp/.policyd-weight

Andre Hübner — 2008-04-01T11:27:30

Hi List, i hope there is enough traffic here to get answers. ;) Im updateing my postfix-configuration to the new policyd-weight Version: 0.1.14 beta-17 Only difference to ./policyd-weight defaults is: $GROUP = "nogroup"; policyd-weight.conf is in /etc/ I do not start policyd-weight by ./policyd-weight start, i have this in my master.cf: policy-pdw unix - n n - - spawn user=polw argv=/usr/lib/postfix/policyd-weight i cannot say the reason why this is made that way, this was made by other people policyd-weight is running and gives a correct checkresult, but between the checks are also warnings in the log. Apr 1 12:41:46 servername postfix/policyd-weight[8958]: warning: cache_query: $csock couln't be created: connect: No such file or directory, calling spawn_cache () Apr 1 12:41:46 servername postfix/policyd-weight[8981]: warning: cache: err: cache: chdir /tmp/.policyd-weight/: No such file or directory at /usr/lib/postfix/p olicyd-weight line 2948, line 120. I dont know what to do. /tmp/.policyd-weight is existing. It is recursivly chowned to polw.nogroup and its chmod is 700 What could be wrong? If i start policyd-weight with ./policyd-weight start and stopping it again after incoming mails no warnings are visible and /tmp/.policyd-weight has cores/master cores/cache Is there a way to create this folders in correct way without starting it directly. I could do this in my postfix rpm or in postfix startscript, but i would prefer solution within the script itself. Or is it better to start it like author is recommend? What could be the reason to do start the policyd-weight from master.cf? Thank you Andre ____________________________________________________________ Policyd-weight Mailinglist - http://www.policyd-weight.org/

security: version update: version 0.1.14 beta-17

Robert Felber — 2008-03-28T15:16:29

Hello, policyd-weight still did not check the working directory correctly. 1st: I assumed [ -L /foo/bar ] is the same as [ -L /foo/bar/ ] because the -L tells the file test what to look for. But in the latter form it is checked with S_IFDIR. We normalize the path with File::Spec->canonpath as s,/+$,, is not sufficient. 2nd: policyd-weight didn't check the ownership of real directories which might have been resulted in a race attack. Policyd-weight once gets the stat/lstat and reuses that information in order to provide some sort of atomicity of the check_symlnk() sub-routine. MD5 (policyd-weight) = 68373b7cfeda52b78df6229ed658771e SHA256 (policyd-weight) = 4245495685e516e00a363a97aaa17456f48c51fcbdb4458989a9d68db64083bc MD5 (policyd-weight-0.1.14.17.tar.gz) = c90128d2442ba343e8127dc0dbdcfd9a SHA256 (policyd-weight-0.1.14.17.tar.gz) = c13bac397cbd8c018b41686da4e4ce9450fb045752d7f0ab518d9836b39dbf36

pw rpm for RHEL / Fedora uploaded to sourceforge

Morgan Weetman — 2008-03-27T03:05:21

Hi all, I have uploaded policyd-weight-0.1.14b15-1rh.noarch.rpm to the sourceforge page - please note this is a Redhat based release. I performed some basic testing on RHEL4, RHEL5 and Fedora 8 but please let me know if you find any problems. The init script in this package is not compatible with SuSE but I hope to release a SuSE-specific rpm shortly depending on work commitments, cheers, Morgan ____________________________________________________________ Policyd-weight Mailinglist - http://www.policyd-weight.org/

errors regarding cache

Martin Monshausen — 2008-03-25T07:52:22

Hello, we've reinstalled our server recently and since then we've got the following error: (in mail.log) postfix/policyd-weight[22860]: warning: cache: err: cache: chdir /tmp/.policyd-weight/: No such file or directory at /usr/local/bin/policyd-weight line 2938, line 24. postfix/policyd-weight[22859]: warning: cache_query: $csock couln't be created: connect: No such file or directory, calling spawn_cache() Can someone please give some advice how to resolve the problem? I've checked the directory /tmp/.policyd-weight/: it's existing, but it's empty. We first used the debian package and then updated it with the actual 0.1.14 beta-15 one. All locations are like in Setup HOWTO... Thank's alot!!! Yours, Martin ____________________________________________________________ Policyd-weight Mailinglist - http://www.policyd-weight.org/

Announce: I stop development of policyd-weight

Robert Felber — 2008-02-09T12:55:44

Hello, to put it short: I don't develop policyd-weight any further, nor do I do any patching. I don't have the time and resources anymore. Real- and Work-Life keeps me way to busy (When I started policyd-weight in 2005 I was able to program up to 48 hours. Today, with family and so on, I only have 1 to 2 hours with interrupts - while I need up to 1 or 2 hours to become familiar with the code again). I do this step also because I realized I cannot provide, due to the time-constraints, the constant reliability required for such a project anymore. I think, it is my responsibility to stop, when the quality/reliability of development gets lower. Probably I should even have done this step earlier. Another reason is, if I receive patches, they often contain module dependencies. I don't like to reject such patches or to stress users to not use modules. You will know what I mean if you received the Nth patch containing yet another simple module and if you look one day at the memory footprint or if you find yourself debugging N foreign modules. If someone wants to continue with policyd-weight then it would also be nice, if he takes over the policyd-weight.org domain. I also appreciate maintainers-only. Those seeking an alternative to policyd-weight might want to have a look at postfwd - which makes the step to stop on policyd-weight easier. I will keep the ML running until a new maintainer has set up a new ML.

policyd-weight init.d/script needs 1 fix

Justin Piszcz — 2008-01-16T18:39:51

Package: policyd-weight Version: 0.1.14.5-1 Distribution: Debian Testing (Lenny) If you do not kill the cache instance, when you (in Debian) /etc/init.d/policyd-weight stop, it only stops the master/child (but not the cache) process. echo -n "Stopping $DESC: " + # kill cache instance first. + $DAEMON -k $DAEMON $DAEMON_OPTS stop echo "$NAME." ;; ____________________________________________________________ Policyd-weight Mailinglist - http://www.policyd-weight.org/

version update: version 0.1.14 beta-14

Robert Felber — 2008-01-15T17:48:21

Changes: - (change) rbls.org link changed to robtext.com - (change) results with 'rc:' as action are not cached - (fix) regexp check for dynamic helo/client did hit also some clients with "static" - (fix) helo numeric check was too fuzzy. - (fix) master didn't read config after policyd-weight reload - (fix) HELO_SEEMS_DIALUP may have scored even if the IP is listed for the sender domain. - (fix) An interrupt of policyd-weight -s may cause a SIGPIPE which killed the cache - (change) Implemented $NS list. Useful for users with split horizon DNS - (fix) don't cache rejections which were deferred (4xx and friends) - (fix) helo_numeric_score didn't catch [n.n.n.n] helos - (fix) Header was not included if $dnsbl_checks_only = 1; and $ADD_X_HEADER = 1; - Thanks to J. Genannt - (fix) Corrected handling of [n.n.n.n] HELOs and address-literals as sender (long standing issue) - (change) Introduced < at >dnsbl_checks_only_regexps in order to skip DNS checks for certain client hostnames - (change) Added -D (Don't detach) switch for daemon-tools/runit users - (change) Added signals handlers for most of signals so that they are at least logged, also, provide a perl backtrace. - (change) prerequisite steps for providing coredumps (build coredump directories, chdir) - coredumps are non-trivial: we start as root, change uid. At this moment coredumps are denied by kernel in order to protect root-data. The only workaround would be, to start cache and master via system() after changing uid - (change) In daemon mode wrongly crafted policy requests don't lead to a child-exit anymore, only the connection is closed - (change) log-facilities other than 'info' are now mentioned in log-lines - (change) SMTP information such as client, helo, sender and to are now logged in each log-message. If $DEBUG is set this also logs the instance variable. - (fix) rbl_lookup used sometimes 65536 as packet id which appeared to cause problems - (fix) Check for syslog absence. If syslog is not available then log temporarily to $LOCKPATH/polw-emergency.log - (tmpfix) Introduced $TRY_BALANCE which closes connections to smtpds after they got their response in order to avoid too many established smtpd->policyd-weight (child) connections. MD5 (policyd-weight-0.1.14.14.tar.gz) = ec8f36dd68edb2c0bcad8899a9e51668 MD5 (policyd-weight) = 1e58aef75f90c2052cb28a5392ce1a5d NOTE: there are some more changes in the queue, this is just a release to make distributions happy.

RBL-based greylisting using Policyd-weight and Postgrey

Fili — 2008-01-10T15:52:15

Hello Policyd List, I'm trying to set up RBL-based greylisting using Policyd-weight and Postgrey on Debian Etch. After some intensive Google-ing I came to the conclusion that it should be possible. However, I couldn't find any concrete configuration examples. Would the following configuration work? --postfix: main.cf-- smtpd_restriction_classes = greylist greylist = check_policy_service inet:127.0.0.1:60000 smtpd_recipient_restrictions = permit_mynetworks, reject_unauth_destination, check_policy_service inet:127.0.0.1:12525 --policyd-weight.conf-- $REJECTLEVEL = 4.25; $dnsbl_checks_only = 1; $MAXDNSBLHITS = 4; $MAXDNSBLMSG = 'rc:greylist'; $BIND_ADDRESS = 'all'; It is unclear to me if the 'rc:greylist' is supported on the Debian packaged version: 0.1.14-beta-6. Has anyone done this with Policyd-weight/Postgrey on Debian Etch? Thanks in advance for your reply, Fili ____________________________________________________________ Policyd-weight Mailinglist - http://www.policyd-weight.org/

too many local DNS-errors in HELO MX lookups

Thomas Richter — 2008-01-06T18:07:36

Hi there, with version 0.1.14 beta-12 i'm getting the folling log entries: Jan 6 18:42:24 ns2 postfix/policyd-weight[6936]: decided action=PREPEND X-policyd-weight: passed - too many local DNS-errors in HELO MX lookups for rev.gaoland.net;

public.gmane.org> public.gmane.org>; delay: 12s Jan 6 18:42:37 ns2 postfix/policyd-weight[6936]: decided action=PREPEND X-policyd-weight: passed - too many local DNS-errors in HELO MX lookups for as9105.com;

public.gmane.org> public.gmane.org>; delay: 0s Jan 6 18:43:13 ns2 postfix/policyd-weight[6936]: decided action=PREPEND X-policyd-weight: passed - too many local DNS-errors in HELO MX lookups for as9105.com;

public.gmane.org> public.gmane.org>; delay: 1s Seems that there is still something wrong with helo string processing so that a wrong/nonexistant hostname is processed. so long tho ____________________________________________________________ Policyd-weight Mailinglist - http://www.policyd-weight.org/

policyd-weight feature request

Justin Piszcz — 2007-12-23T11:23:34

Hi, Was wondering if support for whitelists would be made available in policyd-weight? For example, see: http://www.dnswl.org/ I add it in here: 'list.dnswl.org', 0.00, -5.0, 'DNSWL', But it still counts as a 'bad' RBL, is there any chance of making a whitelist section where if X number of whitelist RBLs include a certain IP -or- the value is less than X it is allowed? This then leads to a second question, perhaps one wants to place emphasis or weight upon the trust level: Per: http://www.dnswl.org/tech Trustworthiness / Score (127.0.x.Y): * 0 = none - only avoid outright blocking (eg Hotmail, Yahoo mailservers, -0.1) * 1 = low - reduce chance of false positives (-1.0) * 2 = medium - make sure to avoid false positives but allow override for clear cases (-10.0) * 3 = high - avoid override (-100.0). So it would need to be something like: list.dnswl.org ret=127.0.0.0 -5.0 list.dnswl.org ret=127.0.0.1 -3.0 Just an idea.. But the main request is a < at >whitelist for RBL's to help reduce false positives. Justin. ____________________________________________________________ Policyd-weight Mailinglist - http://www.policyd-weight.org/

Problem with false positives

Til Obes — 2007-11-28T14:26:34

Hello, after months of successfull use of the daemon, we are having more and more problems :( For example mails from yahoo or strato are getting rejected. Do i have to use always the latest devel version? It also seems, that sometimes pw is giving up with to many dns lookup errors. Any suggestions? Regards Til ____________________________________________________________ Policyd-weight Mailinglist - http://www.policyd-weight.org/

HELO_NUMERIC

Riaan Kok — 2007-11-07T16:16:00

(another one of these!) the test around line 2340 or so looks at whether there's any number or closing square bracket at the end of a helo and then fires HELO_NUMERIC? Say a server incorrectly identifies itself as "EHLO server3", it already gets penalised in the right places, and it might not be the intention to fire off HELO_NUMERIC as well then? I stumbled onto a decent perl-regexp for identifying IP addresses on some PHP site a while ago, if you think it useful here instead of the current test: /^\[(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])(\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])){3}\]$/ (square brackets added to fit this case) regards, Riaan

Removing test for FROM/MX_MATCHES_NOT_HELO(DOMAIN)

Sahil Tandon — 2007-11-07T02:29:49

This score penalizes legitimate email from people who send "From:" personal domain names using their ISP's SMTP server (which, generally, is not the authorized MX for some-domain-name.org). In order to disable this test, based on http://www.mail-archive.com/policyd-weight-list-MtC3HXRotUOzQB+pC5nmwQ< at >public.gmane.org/msg00525.html , I added < at >from_match_regex_verified_helo = (0, -2 ); into policyd-weight.conf. /var/log/maillog confirms that the new conf is loaded. Nevertheless, new email is still being tagged with a FROM/MX_MATCHES_NOT_HELO(DOMAIN)=1. What am I doing wrong? Sahil ____________________________________________________________ Policyd-weight Mailinglist - http://www.policyd-weight.org/

FROM_MULTIPARTED?

Riaan Kok — 2007-11-01T13:45:55

Hi Robert and list, It seems that this test looks whether there is two or more full stops in the domain of a sender.. Am I correct? Shouldn't it be three or more? Otherwise you'd penalise blah.org.fr (for example).. and raise the false alarm rate for many normal international sender addresses. thanks, Riaan

Configuration question

Til Obes — 2007-10-18T10:16:38

Hello, we use polw now for some time and are happy with the results. But rejecting mails is not always wanted, so we have to change it. What i want to have is, that if polw would reject the mail, postfix should add a header entry on which sa would always say "It's spam". Has anyone done that yet? Is that possible? Regards Til ____________________________________________________________ Policyd-weight Mailinglist - http://www.policyd-weight.org/

Policyd-weight questions

Andreas Fuchs — 2007-10-16T06:36:34

Hi Since a couple of days we are using policyd-weight and are really happy. It saves us from buying more powerfull hardware as the load on the server dropped from 90% to 10% (spamassassin has nothing todo anymore). So far i have two questions: 1. how can we support the policyd-weight project, as we saved money for new hardware we would like to contribute something to the project. 2. in the log i have quite often the following entry Oct 16 08:30:53 schilt postfix/policyd[20148]: decided action=DUNNO NULL (<>) Sender; delay: 0s Oct 16 08:30:55 schilt postfix/policyd[20148]: decided action=DUNNO NULL (<>) Sender; delay: 0s Oct 16 08:30:59 schilt postfix/policyd[29859]: decided action=DUNNO NULL (<>) Sender; delay: 0s Oct 16 08:31:00 schilt postfix/policyd[18480]: decided action=DUNNO NULL (<>) Sender; delay: 0s Oct 16 08:31:01 schilt postfix/policyd[17144]: decided action=DUNNO NULL (<>) Sender; delay: 0s Oct 16 08:31:02 schilt postfix/policyd[17144]: decided action=DUNNO NULL (<>) Sender; delay: 0s Oct 16 08:31:02 schilt postfix/policyd[32604]: decided action=DUNNO NULL (<>) Sender; delay: 0s Oct 16 08:31:04 schilt postfix/policyd[18480]: decided action=DUNNO NULL (<>) Sender; delay: 0s Oct 16 08:31:04 schilt postfix/policyd[13837]: decided action=DUNNO NULL (<>) Sender; delay: 0s Oct 16 08:31:05 schilt postfix/policyd[20148]: decided action=DUNNO NULL (<>) Sender; delay: 0s I don't know exactly how to debug them, the process number is repeating quite often, any ideas? thanks Andreas

from testing from SA

Giles Westwood i — 2007-09-25T13:05:31

Hi List, Chat on the list got me thinking of another customization I could make. Pulling out all the of the from: checks from SA http://spamassassin.apache.org/tests_3_2_x.html And adding them as weightings in polw. SA itself will only parse a full message so I can't just plug it in. I'm having a look at the source now but don't know where to look. g. ____________________________________________________________ Policyd-weight Mailinglist - http://www.policyd-weight.org/