From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from bifrost.lang.hm (mail.lang.hm [64.81.33.126]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by huchra.bufferbloat.net (Postfix) with ESMTPS id A7769200373 for ; Thu, 8 Dec 2011 04:18:15 -0800 (PST) Received: from asgard.lang.hm (asgard.lang.hm [10.0.0.100]) by bifrost.lang.hm (8.13.4/8.13.4/Debian-3) with ESMTP id pB8CIDwH021326; Thu, 8 Dec 2011 04:18:13 -0800 Date: Thu, 8 Dec 2011 04:18:13 -0800 (PST) From: david@lang.hm X-X-Sender: dlang@asgard.lang.hm To: Dave Taht In-Reply-To: Message-ID: References: User-Agent: Alpine 2.02 (DEB 1266 2009-07-14) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Cc: cerowrt-devel@lists.bufferbloat.net Subject: Re: [Cerowrt-devel] Dave needs to get better at pushing out patches X-BeenThere: cerowrt-devel@lists.bufferbloat.net X-Mailman-Version: 2.1.13 Precedence: list List-Id: Development issues regarding the cerowrt test router project List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Dec 2011 12:18:15 -0000 On Thu, 8 Dec 2011, Dave Taht wrote: >> as a holdout pine user I understand your frustration :-) >> >> have you considered doing something like setting up openvpn to connect to >> the bufferbloat.net server and then configuring the mail server to trust >> mail arriving form the VPN clients? >> >> I know this is horrible overkill for such a trivial job, but it avoids all >> the problems of doing authentication for the SMTP connection (and the fact >> that many locations block outbound connections from dhcp addresses to port >> 25) > > Both 25 and VPNs are blocked at lincs. 567 works. Neither certs nor > sasl from postfix worked. So far I've figured out openvpn works over any port you want. now, as a security person I am going to point out that you should not break the security of a company network by establishing a VPN that bypasses the security controls. but if it's just a careless network config (they allow anyone to connect to it, but then block specific ports outbound), I feel no guilt over establishing connections over oddball ports :-) I just took an openvpn class, and one of the upcoming features is the ability for openvpn to work over ping, so I'll bet that you can make it work (odds are really good that it will work over port 443 from just about anywhere, and anyone who has security setup well enough that you can't do it over 443 is probably a place where youreally shouldn't be doing it anywhay :-) > That the last 'update' from ubuntu wiped out my certs on my main > email box. > > That dovecot sieve sucks compared to procmail > > that they've created a new abstraction for mail handling > for doing sasl that doesn't want to work > > and I forget what else. > > I mean, mail used to 'just work'. Even with bang > paths it would mostly just work. Nowadays you have > to be a rocket scientist to run your own server, > and damn it, I LIKE running my own mail server. > > Or at least, I used to. It's not quite that bad, but yes, the spammers have required significant changes. If the problem is doing this from one particular network (and one that you trust to be sane, like your office), why not just configure the mail server to allow unauthenticated mail from that IP (or IP range)? David Lang