Hot answers tagged

41

It's not actually a problem, just a warning that can seem alarming to new users. A NIS (Network Information System) allows "a group of machines within an NIS domain to share a common set of configuration files." Basically, if you're running email servers on more than one box, you can share config files between them. In this case, since you are just running ...


18

That error message is appearing because the mail client is sending only a bare hostname ("PLLAMNAZIFE") rather than a fully-qualified hostname (e.g. "PLLAMNAZIFE.example.com") in the HELO/EHLO part of the SMTP transaction, and your Postfix server is configured to reject such mail. Many mail client programs do not send correctly formatted, fully-qualified, ...


17

When you delete mail.log file, rsyslog (on ubuntu) loose handle to file. To get it working back on Ubuntu, please give: sudo service rsyslog restart This will not only create new file but also start to write logs.


16

Quick summary that helped me to fix this warning on Ubuntu 16.04 LTS: Postfix version 3.1.0-3ubuntu0.2 Opendkim version 2.10.3-3build1 (I assume that Postfix and Opendkim are already installed, integrated with each other and the only warning you are getting is 'connect to Milter service local:/var/spool/postfix/opendkim/opendkim.sock: No such file or ...


15

WARNING: The request does not follow best security practice because you disable TLS (encryption) on your main mail relay port, exposing data sent through that port to third-party listeners and/or in-flight modification. The answer below satisfies the request, but best practice requires STARTTLS for the port 25 connection as well. The master.cf file (usually ...


14

Debian or Ubuntu sudo service postfix status


13

Cristian's comment is correct: you need a trailing slash to make Postfix store incoming mail in Maildir format: home_mailbox = Maildir/ If you leave it off, it stores the mail in an mbox-style file of the same name. That is to say, this is not a setting where you are providing the name of a type of storage, you are providing the name of a file or ...


13

Have a look at the smtpd_sender_restrictions and smtpd_sender_login_maps settings. The former can prevent malformed from addresses, while the latter can force the sender address to match the login name. # Prevent malformed senders smtpd_sender_restrictions = reject_non_fqdn_sender # Ensure correct mail addresses reject_unknown_sender_domain # ...


12

Pravin offers some good general points, but doesn't really elaborate on any of them and doesn't address your likely actual problems. First, you need to find out how postfix is receiving those messages and why it's choosing to relay them (the two questions are very likely related). The best way to do it is by looking at the message ID of any one of the ...


12

I had similar problems with Thunderbird on Mac OSX and a new StartSSL cert. Thunderbird uses OCSP to validate the certificates and fails silently in this special case. Additionally the StartSSL OCSP server need some time to update the catalogue of known certificates (compare with https://forum.startcom.org/viewtopic.php?t=2654). To check if OCSP is the ...


11

You can bypass HELO restrictions for authenticated users by inserting permit_sasl_authenticated before rejecting rules in the smtpd_helo_restrictions list: smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, permit


10

Best bet is to use a service like uptime robot. Free tier will cover less than 50 sites, pro plan is quite cheap. It'll do a simple ping check or even HTTP status code check The upshot of this is that you're not adding an additional point of failure (that you can control). You've no longer got to maintain and update a monitoring service


10

The formail tool from procmail (available in any distribution, it's a classic) is designed precisely for this purpose. Basic usage: formail -s myprogram --option runs myprogram --option on each mail in turn. The program receives each mail on its standard input.


9

Postfix itself does not "set" the from address for an mail (as long has you haven't really tweaked the postfix configuration). The from address header of an e-mail is set by the mail client which is asking postfix to deliver the mail (Postfix is a MTA). Hence you are looking at the wrong place - as far as I understand your question. You mentioned that you ...


8

The first thing to do in case of SMTP problems where the configuration seems to be OK is that you can actually reach the SMTP server. Use: telnet gmail-smtp-in.l.google.com 25 you should see: Trying 173.194.69.27... Connected to gmail-smtp-in.l.google.com. Escape character is '^]'. 220 mx.google.com ESMTP lv5si9142984bkb.114 - gsmtp (after that type ...


8

The correct procedure to execute a script (I use a shell script) upon receipt of a mail message is the following. It involves modifying postfix's configuration file, master.cf (which, in my Debian, is located in /etc/postfix) by adding the following line: my_shell_script unix - n n - - pipe flags=F user=MY_USERNAME argv=/path/to/my/shell/script ${sender} ${...


8

This was my final solution after research and help from @tarleb My mail delivery was happening over sendmail program, which was adding some additional headers to my email. I could use a mitter (mail filter) to filter incoming email and drop the sendmail usage, however I decided to change to Dovecot LDA for the delivery. My original filter was, at the ...


7

postfix uses procmail, to deliver email, and as postfix invokes procmail running as nobody for security reasons, emails sent to root will end up being sent to the nobody user. Debian mailing lists explain it better than me, and suggest a work around: postfix's own delivery agent can deliver to root's mailbox, but postfix will NEVER fork an external ...


7

The $1$ at the beginning of the password field hints it is a MD5 hash. To encrypt a password in a MD5 hash, you can use the openssl passwd command. From man openssl: passwd Generation of hashed passwords. and from openssl passwd --help: -1 MD5-based password algorithm -stdin read passwords from stdin So to generate ...


7

Postfix has not been hacked. The vulnerability is in the isyfoyvr.php script, which has allowed a code injection. The injected code is sending emails, and since Postfix sees the emails sourced from localhost it accepts them as legitimate. Probable quick fix Remove the isyfoyvr.php script, or set its permissions so that the web server cannot execute it. ...


6

I was facing the same issue on Debian stretch, which turned out to be caused by a broken systemd service file for opendkim. See this answer for a solution: https://serverfault.com/a/847442/84962 This fix boils down to: /lib/opendkim/opendkim.service.generate systemctl daemon-reload service opendkim restart


6

There are several ways to do this Using SSMTP: You can find a detailed article here. (Please consider Zulakis' comment below regarding security: I let ssmtp solution here for your knowledge, but prefer postfix solution) Install ssmtp sudo aptitude install ssmtp Edit the configuration file: sudo vim /etc/ssmtp/ssmtp.conf And configure it with your ...


6

The message "... is not yet authorized to deliver mail from ..." is similar to a greylist implementation described in Adding Greylisting Support. If the destination server implement similar script, you can send your mail by flushing your queue to retry sending soon. $ postqueue -f The greylist implementation works as follows; If a mail come from an ...


6

Even after creating an empty file touch /var/log/mail you have to restart the syslog service syslog restart and then it's logging gain :)


6

The way to go here is to first tell Postfix to add the TLS connection status into the Received header. In /etc/postfix/main.cf add smtpd_tls_received_header = yes This will add something like (using TLSv1.2 with cipher … (256/256bits)) to the postfix generated received header. This information can then be used to add a custom headers. E.g. one could add ...


6

procmail is considered problematical by Philip Guenther (and is quite possibly useless in this case, as .forward files or equivalent can send the mails directly to your program, skipping the thus needless complexity of procmail). Executive summary: delete the procmail port; the code is not safe and should not be used as a basis for any further work. ...


5

You have two options: You can setup your Internet DNS Server with BIND OR You can Specify, your IP with hostname in /etc/hosts file Example: I'm assuming that you have hosted laptop1.local, laptop2.local as virtual domain: 192.168.174.128 laptop1.local 192.168.200.128 laptop2.local One more thing, whenever you are sending mail just watch the mail log ...


5

The correct order for combining multiple PEM files is: the correct PEM order is as follows: -----BEGIN RSA PRIVATE KEY----- (Your Private Key: your_domain_name.key) -----END RSA PRIVATE KEY----- -----BEGIN CERTIFICATE----- (Your Primary SSL certificate: your_domain_name.crt) -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- (Your Intermediate ...


5

This looks to be a permissions problem with this directory: /var/spool/amavisd/tmp/ Based on the log messages it looks like the user amavis does not have access to this directory.


5

No, Postfix has no way to configure this. As @HBruijn said, the Maildir format is a specification and it would be quite an effort to make the LDA and the MUA both agree on a different format. That said, if you don't like the filenames in your maildir, you could beautify them a bit when you look them up: $ ls | head -1 1325471944.27745_1.beta,S=10662:2,S $ ...


Only top voted, non community-wiki answers of a minimum length are eligible