#haraka

morning

would it be a mad idea to add some sort of jsonrpc to monitor haraka internals that way?

endre: what internals do you want to monitor?

We've been toying with the idea of adding a REPL on a separate port for this sort of thing for ages.

The problem is that getting this to work nicely under cluster is 'tricky'

_smf_: statistics, greylist management

in cluster environments i'd go with mqtt

I get all of that stuff via plugins already

Which is why I haven't bothered too much about adding a REPL

i see

The most useful thing for a REPL is outbound queue management and to be able to 'tweak' Haraka on-the-fly.

e.g. increase/decrease child processes, force outbound queue runs, divert outbound mail to a different host etc. etc.

If you want stats etc. then a plugin makes the most sense IMO

yeah probably

For greylist stuff, I think that gets more tricky depending on how the greylist implementation works.

Personally - I'm using redis-timeseries for stats here.

And ElasticSearch for logging and more in-depth stuff.

My greylist implementation uses Redis too, but in a different DB.

But I don't really have to do any management on it - it's 100% automatic.

:)

sounds fun

morning

morning

_smf_: is there any way to get haraka to allow mail from box behind natted firewall

i have tried using auth on port 587 but postfix seems not to communicate it

when using relayhost on port 25 from postfix box, haraka says 550 no mx for domain

Fix the domain name or make some sort of exclusion for it then?

Or debug why Postfix isn't working over port 587.

its says auth required

Yeah - we went through that already.

i have it setup for auth

no kidding

i cannot get it working

The auth isn't working for some reason; you've either not set it up properly or something else is happening.

i have searched all weekend for postfix docs and get the same answers and results

i would think postfix would say it in the maillog but it doesnt

Debug it on the Haraka end then.

echo LOGPROTOCOL > config/loglevel

and you'll see the entire SMTP conversation in the logs.

It should connect, send a STARTTLS to go secure, and then attempt to authenticate. If it doesn't, you've got the Postfix configuration wrong.

i do see: error: open database /etc/postfix/sasl_passwd.db: No such file or directory

however

There's your issue then.

Postfix needs to know what username/password combo to use with which host.

ls -l /etc/postfix/sasl_passwd.db

-rw-r--r-- 1 root root 12288 Mar 8 18:12 /etc/postfix/sasl_passwd.db

right

and the file is there

I'm no Postfix expert.

Ask on #postfix

My only advice would be to check that the file is in the correct database format.

tell me, is there a plugin/ini one can put in names of servers behind natted firewall

e.g. it shoudln't be a text file.

No - because there's nothing special about natted hosts.

hmm

Plus - you're using MT6, so that's a 'pre-configured' Haraka, so I've no idea whats included.

What you're basically wanting to say is - here's a host with a fucked-up configuration, it's internal and never sends external mail, so accept the mail - regardless of how fucked up it is.

The moral of the story is - don't use hostnames for servers that aren't valid out on the internet. e.g. .internal, .lan, .lab, .foobar are all a bad idea (thanks Microsoft).

What you want is to be able to ignore that stuff for internal hosts, so you'll have to ask ultimatt about how to do that based on the configuration and set-up he's made for MT6.

hook=unrecognized_command plugin=tls function=tls_unrecognized_command params="STARTTLS" retval=OK msg=""

just before that line...

[tls] secured: cipher=AES256-SHA version=TLSv1/SSLv3 verified=false error="Error: UNABLE_TO_GET_ISSUER_CERT"

That's fine

ok

so why doesn't it auth?

said: 550 Authentication required (in reply to MAIL FROM command))

Auth happens after that.

It's not sending it.

that was from log on local

ok, that is not haraka problem then

Correct

in looking at haraka -h relay

it appears one can add hosts/32 or hosts/24 allowed to relay

i tried that too

lnb: I suspect MT6 might use the access plug-in. You could try adding the hostname of the machine to the mail_from access file.

all i get is something like 'no mx for domain'

You'll have to read the docs for that access plugin as I don't use it here.

If that plugin is used by MT6, then you can use it to bypass the check that's being done on the MAIL FROM address

And therefore it will allow the mail to pass through.

there is a config/plugins #access

that should be uncommented?

Read the docs first

what doc?

haraka -h access

ok

Or look at them on the Haraka website.

if #access remains commented does that mean mail_from.access.whitelist is not read?

uncommented #access, added public ip of server to whitelist file, sent mail -> said: 550 No MX for

your FROM address (in reply to MAIL FROM command)

this is a freaking nightmare to just get server to be able to send or relay mail

and it should not be

lnb: correct - if it's commented; the plugin won't be used.

ok, i uncommented it, and put local public IP in the whitelist file

And you don't put the IP address of the server in the mail_from.access file; you put the hostname of the machine.....

no mx from your domain

e.g. the mail from that you want to whitelist...

ok

i will try that

_smf_: you are talking about the mail_from_access.whitelist?

i dont see just a plain mail_from_access

they all have .something

I don't really know - I don't use this plugin myself.

I guess it's called something like connect.mail_from.access.whitelist or something like that.

ok i put in: root@myomie.internal

No!

in the .whitelist

no?

myomie.internal

ok

Is what you put in there.

np

there is already an entry there from install

same thing :(

said: 550 No MX for

your FROM address (in reply to MAIL FROM command)

Did you restart Haraka

You could try root@myomie.internal then too

morning

added in regex: .*@myomie.internal

sender <root@myomie.internal>; code=DENY msg="No MX for your FROM address"

lnb: you can't use a regex unless you use the .regexp file IIRC

morning baudehlo

morning baudehlo

there is already an entry in that regex from the initial install

no idea then. Like I said - I don't use that plugin.

The docs say the file should be called connect.mail_from.access.whitelist

i added .*@myomie.internal to mail_from.access.whitelist_regex

ok one sec

Ok - lnb. Look in config/plugins and make sure that access is listed *above* mail_from.is_resolvable.

If it isn't, then move it so that it is. Restart Haraka

Then try all that stuff again.

in plugins, is connect.rdns_access.whitelist supposed to be listed or is it included with access ?

Included with access

there is no connect.mail_from.access.whitelist

It's one plugin and a bunch of different configuration files.

ok

but what about the file name

access.ini controls which checks are enabled.