OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: Signing outgoing mailman mail with DKIM

From: Noel Jones (njonesmegan.vbhcs.org)
Date: Mon Jun 15 2009 - 13:14:48 CDT


Zbigniew Szalbot wrote:
> Hello,
>
> I used to have a working setup where all outgoing mail, including
> mailman, was being signed. However, I decided to stop using maia for
> content scanning (most of my mail is variuos subscriptions sent to
> outside users) and just sign the outgoing mail with DKIM.
>
> So I changed the entry in main.cf to say this:
> smtpd_milters = inet:127.0.0.1:4445
> non_smtpd_milters = inet:127.0.0.1:4445
>
> This does what I want as DKIM-filter is listening on port 4445 and is
> indeed singing outgoing mail. However, I am not sure why, mailman lists
> emails are no longer being signed.
>
> Here is the entry in mailman that I have been using all the time.
>
> mailman unix - n n - - pipe
> flags=FR user=mailman:mailman
> argv=/usr/local/mailman/postfix-to-mailman.py
> ${nexthop} ${user}
> -o milter_macro_daemon_name=ORIGINATING
> -o smtpd_milters=inet:127.0.0.1:4445
>
> And it has always worked well but not anymore. I mean the outgoing mail
> is not being signed. Is there any apparent flaw in my setup? I guess
> there is but I would appreciate if you could give me some pointers.
>
> I am using postfix-2.5.6,1 on a FreeBSD 7.2 system.
>
> Thank you very much in advance!
>
> Zbigniew Szalbot

The "-o smtpd_milters..." and "-o milter..." in your entry
above is not used; those options are a property of smtpd, not
pipe.

As a consequence, dkim-milter never processes your mailman
mail, so they aren't signed.

To fix this, you can run an smtpd listener on another port
including the milter options, and configure your mailman to
submit to that port.

   -- Noel Jones