Subject: smap/smapd/postfix: malformed sender addesses

From: "Overdijk, Harrie" <[email-masked]>
Date: Wed, 07 Jun 2000 14:35:16 +0200

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Dear FWTK-guru's

The time has come to get rid of ouw good old mail-gateway
and replace it by a system running the smap/smapd combo from
fwtk 2.1 with the Joseph Yao Antirelay/AntiSPAM patches. As
a replacement for sendmail I have chosen for postfix in send
only mode and configured it for use on a firewall. I have
tested it local from several systems using telnet to simulate
a SMTP session and all looks well.

So the time has come to let our Microsoft Exchange server
version 5.5 send the messages via the described system to
the outside world. I was very scared when I saw the
following type of messages in the log:

 -----8<-----
Jun  7 13:26:10 ecnwall postfix/sendmail[2427]: warning: -f option specified
malformed sender: <[email-masked]> SIZE=1639
 -----8<-----

That does not look good... especially not when I saw:

 -----8<-----
Jun  7 13:26:11 ecnwall postfix/pickup[2149]: 0B0DD2F: uid=5
from=<SIZE=1639>
Jun  7 13:26:11 ecnwall postfix/cleanup[2425]: 0B0DD2F:
message-id=<[email-masked]>
Jun  7 13:26:11 ecnwall postfix/qmgr[1738]: 0B0DD2F:
from=<SIZE=[email-masked]>, size=1979 (queue active)
 -----8<-----

The 'sender' address has become <SIZE=1639@blabla> instead of
<[email-masked]>. Most messages were accepted by the remote
system, but I don't feel good about it. I think there are
remote systems that will not accept these types of sender
addresses... So... I switched back to the old mailgateway
and wait for a response on my following question:

Has anyone seen this before? And (even better) has anyone a
patch to fight this type of Gatesware functionallity?

Thanks in advance for your help!

Harrie.

Harrie Overdijk, ECN, Postbox 1, 1755 ZG  Petten (NH), The Netherlands.
Internet: [email-masked]              Noisenet: +31 224 56 4597
Fidonet : 2:500/43.1902  (At home!)    FAXnet  : +31 224 56 1864
ICP/Postmaster/UseNet-News-manager/WWW-manager/Security-manager of ECN.

---

From: "Overdijk, Harrie" <[email-masked]>
Date: Thu, 8 Jun 2000 13:17:15 +0200

Dear Rick and Jim,

Rick wrote me the following:

> -----Original Message-----
> From:	Rick Murphy [SMTP:[email-masked]]
> Sent:	Thursday, June 08, 2000 12:51 PM
> To:	[email-masked]; [email-masked]
> Cc:	[email-masked]
> Subject:	Re: smap/smapd/postfix: malformed sender addesses
> 
> At 10:04 AM 6/7/00 -0400, James Seymour wrote:
> >Kind of a "carrying coals to Newcastle" approach, IMO.
> 
> I've got to agree with Jim. If you're going to go through the effort to 
> configure postfix, get rid of smap and smapd. Combining the two won't do 
> much to tighten up the postfix installation and it only serves to 
> complicate the setup. (More complicated means more likely to be set up 
> wrong IMHO.)
> 
	[Harrie]  OK, you both have convinced me now... I haven't
	[Harrie]  studied postfix that much, but after reading
	[Harrie]  the available doc's and testing by using smtpd
	[Harrie]  of postfix I have a good feeling about it.
	[Harrie]  Jim Seymour mentioned Wietse Venema as the writer
	[Harrie]  of postfix. Indeed Jim, I know Wietse and met him
	[Harrie]  during a security meeting in The Netherlands.
	[Harrie]  Thank you both for convincing me!

	Greetings,
	          Harrie