# Формат почтового ящика, возможен вариант Mailbox
home_mailbox = mbox
# Каталоги для хранения почты и очереди Postfix

mail_spool_directory = /var/mail

queue_directory = /var/spool/postfix

 
mail_location =  mbox:/var/mail

debiantest:~# telnet 192.168.3.25 25 
Trying 192.168.3.25...
Connected to 192.168.3.25.
Escape character is '^]'.
Connection closed by foreign host.
debiantest:~# 

# See /usr/share/postfix/main.cf.dist for a commented, more complete version


# Debian specific:  Specifying a file name will cause the first
# line of that file to be used as the name.  The Debian default
# is /etc/mailname.
#myorigin = /etc/mailname

smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

readme_directory = no

# TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.

myhostname = virdebian.kagaz.local
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = $myhostname
mydestination = virdebian.local, localhost.kagaz.local, , localhost
relayhost = 
mynetworks = 192.168.3.0/24,127.0.0.0/8
mailbox_command = procmail -a "$EXTENSION"
#mailbox_size_limit = 
recipient_delimiter = +
inet_interfaces = all
inet_protocols = ipv4

# Настройки SASL
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
smtpd_sasl_local_domain = $myhostname


# Файл-сокет для обмена информацией с Dovecot;
# путь указывается относительно queue_directory

smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous


# Используем тип dovecot
smtpd_sasl_type = dovecot

mail.err
Nov  3 12:06:49 virdebian postfix/smtpd[2744]: fatal: no SASL authentication mechanisms
mail.info
ov  3 12:06:49 virdebian postfix/smtpd[2744]: warning: SASL: Connect to private/auth failed: No such file or directory
Nov  3 12:06:49 virdebian postfix/smtpd[2744]: fatal: no SASL authentication mechanisms
Nov  3 12:06:50 virdebian postfix/master[2703]: warning: process /usr/lib/postfix/smtpd pid 2744 exit status 1
Nov  3 12:06:50 virdebian postfix/master[2703]: warning: /usr/lib/postfix/smtpd: bad command startup -- throttling
mail.log
Nov  3 12:04:47 virdebian postfix/master[2703]: daemon started -- version 2.7.1, configuration /etc/postfix
Nov  3 12:06:49 virdebian postfix/smtpd[2744]: warning: database /etc/aliases.db is older than source file /etc/aliases
Nov  3 12:06:49 virdebian postfix/smtpd[2744]: connect from virdebian.kagaz.local[192.168.3.25]
Nov  3 12:06:49 virdebian postfix/smtpd[2744]: warning: SASL: Connect to private/auth failed: No such file or directory
Nov  3 12:06:49 virdebian postfix/smtpd[2744]: fatal: no SASL authentication mechanisms
Nov  3 12:06:50 virdebian postfix/master[2703]: warning: process /usr/lib/postfix/smtpd pid 2744 exit status 1
Nov  3 12:06:50 virdebian postfix/master[2703]: warning: /usr/lib/postfix/smtpd: bad command startup -- throttling
mail.warn
Nov  3 12:06:49 virdebian postfix/smtpd[2744]: warning: database /etc/aliases.db is older than source file /etc/aliases
Nov  3 12:06:49 virdebian postfix/smtpd[2744]: warning: SASL: Connect to private/auth failed: No such file or directory
Nov  3 12:06:49 virdebian postfix/smtpd[2744]: fatal: no SASL authentication mechanisms
Nov  3 12:06:50 virdebian postfix/master[2703]: warning: process /usr/lib/postfix/smtpd pid 2744 exit status 1
Nov  3 12:06:50 virdebian postfix/master[2703]: warning: /usr/lib/postfix/smtpd: bad command startup -- throttling

From root@virdebian.local  Thu Oct 28 14:09:01 2010
Return-Path: <root@virdebian.local>
X-Original-To: root
Delivered-To: root@virdebian.local
Received: by virdebian.kagaz.local (Postfix, from userid 0)
        id B4FC85CD1C; Thu, 28 Oct 2010 14:09:01 +0400 (MSD)
From: root@virdebian.local (Cron Daemon)
To: root@virdebian.local
Subject: Cron <root@virdebian>   [ -x /usr/lib/php5/maxlifetime ] && [ -d /var/lib/php5 ] && find /var/lib/php5/ -type f -cmin +$(/usr/lib/php5/maxlifetime) -print0 | xargs -n 200 -r -0 rm
Content-Type: text/plain; charset=UTF-8
X-Cron-Env: <SHELL=/bin/sh>
X-Cron-Env: <HOME=/root>
X-Cron-Env: <PATH=/usr/bin:/bin>
X-Cron-Env: <LOGNAME=root>
Message-Id: <20101028100901.B4FC85CD1C@virdebian.kagaz.local>
Date: Thu, 28 Oct 2010 14:09:01 +0400 (MSD)

PHP Warning:  Directive 'safe_mode' is deprecated in PHP 5.3 and greater in Unknown on line 0

фрагмент моего php.ini 
###################################
; Safe Mode
; http://php.net/safe-mode
safe_mode = on
###################################
; By default, Safe Mode does a UID compare check when
; opening files. If you want to relax this to a GID compare,
; then turn on safe_mode_gid.
; http://php.net/safe-mode-gid
safe_mode_gid = Off

; When safe_mode is on, UID/GID checks are bypassed when
; including files from this directory and its subdirectories.
; (directory must also be in include_path or full path must
; be used when including)
; http://php.net/safe-mode-include-dir
safe_mode_include_dir =

; When safe_mode is on, only executables located in the safe_mode_exec_dir
; will be allowed to be executed via the exec family of functions.
; http://php.net/safe-mode-exec-dir
safe_mode_exec_dir = "/usr/share/sams/bin"

; Setting certain environment variables may be a potential security breach.
; This directive contains a comma-delimited list of prefixes.  In Safe Mode,
; the user may only alter environment variables whose names begin with the
; prefixes supplied here.  By default, users will only be able to set
; environment variables that begin with PHP_ (e.g. PHP_FOO=BAR).
; Note:  If this directive is empty, PHP will let the user modify ANY
;   environment variable!
; http://php.net/safe-mode-allowed-env-vars
safe_mode_allowed_env_vars = PHP_

; This directive contains a comma-delimited list of environment variables that
; the end user won't be able to change using putenv().  These variables will be
; protected even if safe_mode_allowed_env_vars is set to allow to change them.
; http://php.net/safe-mode-protected-env-vars
safe_mode_protected_env_vars = LD_LIBRARY_PATH

virdebian:/var/log/havp# service havp start
Mounting /var/lib/havp/havp.loop under /var/spool/havp ...mount: according to mtab /var/lib/havp/havp.loop is already mounted on /var/spool/havp as loop
virdebian:/var/log/havp# ps -A|grep havp 
virdebian:/var/log/havp# service havp restart
Restarting havp: Starting HAVP Version: 0.91
LibClamAV Warning: **************************************************
LibClamAV Warning: ***  The virus database is older than 7 days!  ***
LibClamAV Warning: ***   Please update it as soon as possible.    ***
LibClamAV Warning: **************************************************
havp.
virdebian:/var/log/havp# service havp status
virdebian:/var/log/havp# 

мой havp.conf
USER havp
GROUP havp
DAEMON true
PIDFILE /var/run/havp/havp.pid
SERVERNUMBER 8
MAXSERVERS 100
ACCESSLOG /var/log/havp/access.log
ERRORLOG /var/log/havp/havp.log
USESYSLOG false
LOG_OKS false
LOGLEVEL 0
SCANTEMPFILE /var/spool/havp/havp-XXXXXX
TEMPDIR /var/tmp
DBRELOAD 60 
FORWARDED_IP true
PORT 8080
BIND_ADDRESS 127.0.0.1
TEMPLATEPATH /etc/havp/templates/ru
FAILSCANERROR false
SCANNERTIMEOUT 10
RANGE tue
SCANIMAGES true
MAXSCANSIZE 5000000
STREAMUSERAGENT Player Winamp iTunes QuickTime Audio RMA/ MAD/ Foobar2000 XMMS
ENABLECLAMLIB true
CLAMDBDIR /var/lib/clamav
ENABLEFPROT false
ENABLEAVG false
ENABLEAVESERVER false
ENABLESOPHIE false
ENABLETROPHIE false
ENABLENOD32 false
ENABLEAVAST false
ENABLEARCAVIR false
ENABLEDRWEB false

прошу оценить мою конфигурацию iptables для щлюза (squiid+sams)
ppp0-подключение к нету с динамическим ip
eth0-интерфейс подключённый к локалке (192ю168.3.)

#!/bin/bash
#этот модуль позволяет работать с ftp в пассивном режиме
#modprobe nf_conntrack_ftp
#очистка цепочек
iptables -F INPUT
iptables -F FORWARD
iptables -F OUTPUT
iptables -t nat -F PREROUTING
iptables -t nat -F POSTROUTING
iptables -t mangle -F

#Запрет всего
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

#включение логов iptables
#префиксы сообщений iptables 
#iptables -A INPUT -p tcp  -j LOG --log-prefix "input tcp"
#iptables -A INPUT -p icmp -j LOG --log-prefix "input icmp"
#логи входящих tcp udp icmp
#iptables -A INPUT -j LOG --log-level 4


#разрешаем все входящие пакеты на интрефейс замыкания на себя иначе ничего не работает 
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT 
#РАЗРЕШЕНЫ ТОЛЬКО ВХОДЯЩИЕ СОЗДАННЫЕ НАШИМИ ИСХОДЯЩИМИ
iptables -A INPUT -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT 
iptables -A INPUT -p UDP -m state --state ESTABLISHED,RELATED -j ACCEPT
#разрешаем любые входящие и исходящие по icmp
iptables -A INPUT -p icmp -j ACCEPT

iptables -A OUTPUT -p icmp -j ACCEPT
#разрешаем подключение по  ssh INPUT разрешаем для того чтобы было можно конектится с любой #тачки посети  
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT
#разрешаем ntpdate-синхронизация времени
iptables -A OUTPUT -p udp --dport 123 -j ACCEPT
#разрешаем ftp без пассивного режима
iptables -A OUTPUT -p tcp --dport 21 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 20 -j ACCEPT
#разрешаем входящие и исходящие на на порт 80 инет и 53 - dns 
iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
#разрешаем исходящий на локальное зеркало

sysctl net.ipv4.ip_forward = 1 # Разрешаем шлюзу передавать транзитный трафик

iptables -A FORWARD -m conntrack --ctstate NEW -i eth0 -s 192.168.3.0/24 -j ACCEPT # Разрешаем исходящие соединения из локальной сети к интернет-хостам

iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE # Маскарадим весь трафик, идущий через eth0

virdebian:/usr/share/sams/mysql# mysql -u root -p
Enter password: 
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 113
Server version: 5.1.49-1 (Debian)

Copyright (c) 2000, 2010, Oracle and/or its affiliates. All rights reserved.
This software comes with ABSOLUTELY NO WARRANTY. This is free software,
and you are welcome to modify and redistribute it under the GPL v2 license

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> GRANT ALL ON squidctrl.* TO sams@localhost IDENTIFIED BY "123"
    -> 
    -> GRANT ALL ON squidlog.* TO sams@localhost IDENTIFIED BY "123"
    -> exit
    -> 
    -> quit
    -> quit
    -> select * from user
    -> ^CCtrl-C -- exit!

debian squeeze
установил  настроил фирменая утилита стартует при подключении модема, подключается к нету 
пытаюсь зайти в нет с любого браузера - болты 

в resolv.conf
#появляются после подключения
nameserver 83.149.24.244
nameserver 83.149.24.243
#старые настройки
search kagaz.local
nameserver 192.168.3.249

после подключения с помощью фирм утилиты 

ifconfig 

virdebian:/etc/network# ifconfig
eth0      Link encap:Ethernet  HWaddr 08:00:27:0e:2d:8b  
          inet addr:192.168.3.25  Bcast:192.168.3.255  Mask:255.255.255.0
          inet6 addr: fe80::a00:27ff:fe0e:2d8b/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:94943 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2950 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:10342936 (9.8 MiB)  TX bytes:354525 (346.2 KiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:938 errors:0 dropped:0 overruns:0 frame:0
          TX packets:938 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:68290 (66.6 KiB)  TX bytes:68290 (66.6 KiB)

ppp0      Link encap:Point-to-Point Protocol  
          inet addr:10.242.21.235  P-t-P:10.64.64.64  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:8 errors:0 dropped:0 overruns:0 frame:0
          TX packets:14 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:3 
          RX bytes:146 (146.0 B)  TX bytes:781 (781.0 B)

мои настройки сети 

interface

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
allow-hotplug eth0
iface eth0 inet static
    address 192.168.3.25
    netmask 255.255.255.0
    network 192.168.3.0
    broadcast 192.168.3.255
    gateway 192.168.3.1
    # dns-* options are implemented by the resolvconf package, if installed
    dns-nameservers 192.168.3.249
    dns-search kagaz.local

Но если я отрубаю eth0
/sbin/ifdown eth0 

 нет появляется , подскажите где касяк?

#!/bin/bash
#этот модуль позволяет работать с ftp в пассивном режиме
modprobe nf_conntrack_ftp
#очистка цепочек
iptables -F INPUT 
iptables -F OUTPUT
iptables -A FORWARD

#Запрет всего
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

#включение логов iptables
#префиксы сообщений iptables 
#iptables -A INPUT -p tcp  -j LOG --log-prefix "input tcp"
#iptables -A INPUT -p icmp -j LOG --log-prefix "input icmp"
#логи входящих tcp udp icmp
#iptables -A INPUT -j LOG --log-level 4
#цепочка input разрешаем пакеты с сотоянием RELATED,ESTABLISHED
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
#разрешаем все входящие пакеты на интрефейс замыкания на себя
iptables -A INPUT -i lo -j ACCEPT
#разрешаем входящие по icmp
iptables -A INPUT -p icmp -j ACCEPT
#разрешаем подключение по  ssh
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
#разрешаем ntpdate-синхронизация времени
iptables -A INPUT -p udp --dport 123 -j ACCEPT
iptables -A OUTPUT -p udp --dport 123 -j ACCEPT

#разрешаем ftp без пассивного режима
iptables -A INPUT -p tcp --dport 21 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 21 -j ACCEPT
iptables -A INPUT -p tcp --dport 20 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 20 -j ACCEPT


#цепочка output разрешаем пакеты с сотоянием RELATED,ESTABLISHED
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
#разрешаем все исходящие пакеты с  интрефейса замыкания на себя
iptables -A OUTPUT -o lo -j ACCEPT 
#разрешаем входящие на на порт 8080
iptables -A OUTPUT -p tcp --dport 8080 -j ACCEPT