OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: How to make sure sender's mail gets through [VASCL:A125EFB4960]

From: Sandy Drobic (postfix-usersjapantest.homelinux.com)
Date: Tue May 02 2006 - 10:44:34 CDT


Robert Felber wrote:
> On Tue, May 02, 2006 at 05:11:16PM +0200, Sandy Drobic wrote:
>>> smtpd_recipient_restrictions =
>>> reject_non_fqdn_recipient
>>> reject_non_fqdn_sender
>>> permit_mynetworks
>>> reject_unauth_destination
>>> reject_unauth_pipelining
>>> reject_invalid_hostname
>>> check_helo_access regexp:/etc/postfix/helo_checks
>>> permit
>> reject_unauth_pipelining is only useful in smtpd_data_restrictions.
>> Also, reject_unauth_pipelining is not useful in helo restrictions.
>
> Why should reject_unauth_pipelining in smtpd_recipient_restrictions be
> harmfull?
>
> Why does it make more sense in the data restriction?
>
> For now I currently see no sense in having it in data, but rather earlier.
>
Quote from http://www.postfix.org/postconf.5.html#reject_unauth_pipelining:

Note: reject_unauth_pipelining is not useful outside
smtpd_data_restrictions when 1) the client uses ESMTP (EHLO instead of
HELO) and 2) with "smtpd_delay_reject = yes" (the default). The use of
reject_unauth_pipelining in the other restriction contexts is therefore
not recommended.

This is probably the case most of the time.

Though I also remember a thread where some people asked how often this
restriction is triggered at all. I think Cami had a few messages trigger
this restriction every day, not really worth mentioning, so it's probably
not much more than the storm in the waterglass. (^-^)

What is your experience with that restriction?

Sandy