OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: Programmatic access to the showq daemon/data

From: Victor Duchovni (Victor.DuchovniMorganStanley.com)
Date: Tue Oct 02 2007 - 10:18:38 CDT

On Tue, Oct 02, 2007 at 09:40:16AM +0100, Ward, Martin wrote:

> > > I ask because I have a number of mail servers that regularly have
> mail
> > > queues 300,000 emails and a lot of these queues are bounces and
> > > double-bounces. Right now I have a simple script that someone wrote
> > > (possibly it even came with the Postfix installation since I didn't
> > > perform the installation) which runs the "postqueue -p" command,
> > > grep/awks out the message ID of the unwanted emails and runs
> > > "postsuper -d" for each ID.
> >
> > EEEEKS!
> >
> > Don't accept mail for bogus senders, so that you don't have
> > to send bounces later!
> >
> > Talk about fixing the wrong problem at the wrong end!
> >
>
> Unfortunately I didn't design or implement this system and I have
> to work with what I have been given, a complete rewrite of the
> System is not going to happen! As for bogus senders, this is
> something that will be looked at but how can I verify them?

Not bogus senders, incoming mail to bogus recipients, which you accept,
but then cannot deliver and thus bounce, generating gobs of backscatter
at joe-job victims and DoSing your own queue.

> How else can I use Postfix to verify the sender address?

The *recipient* address for downstream relay mail via:

        reject_unverified_recipient

and suitable negative/positive cache lifetimes.

    http://www.postfix.org/ADDRESS_VERIFICATION_README.html#recipient

--
        Viktor.

Disclaimer: off-list followups get on-list replies or get ignored.
Please do not ignore the "Reply-To" header.

To unsubscribe from the postfix-users list, visit
http://www.postfix.org/lists.html or click the link below:
<mailto:majordomopostfix.org?body=unsubscribe%20postfix-users>

If my response solves your problem, the best way to thank me is to not
send an "it worked, thanks" follow-up. If you must respond, please put
"It worked, thanks" in the "Subject" so I can delete these quickly.