Joachim Breitner's questions

I am running a personal mail server using exim that only forwards mails (and also runs a few mailman mailing lists).

Unfortunately, my server’s spam protection is worse than that of the mail provider I forward most mails to (mailbox.org). So my server might accept an email, try to send it to mailbox.org’s MX, that will reject it, and now my server might generate a bounce message. Which then often can’t be delivered and would then be frozen.

Can I configure exim to try to forward the mail before finally accepting it, and if the downstream server does not like it, simply reject it as well, so that my server never creates bounce messages in that situation?

I’m trying to pull a certain routing stunt where I want my Linux server to respond to arp requests for 10.0.0.1 on eth0, although

• 10.0.0.1 is not the configured IP for eth0 (in which case the kernel would do this nevertheless) and
• 10.0.0.1 is not routed to some other interface of this server (in which case arp proxying would help).

The effect should be that other devices on eth0 would route packages to 10.0.0.1 to my server, where I can then handle them in PREROUTING and other tables.

Can I do that, preferably without an additional daemon?

As requested, here is my motivation (but note that this question is not about suggestions how to achieve this by different means – I really am interested in knowing if above is possibly, not whether it is sensible :-)).

Assume 10.0.0.1 to be a public IP address, and the only one routed to the machine in question. The system (host) contains a virtual machine (guest). I want guest to believe 10.0.0.1 is his, so giving it a different IP and doing nat is not what I want to do. Instead, I host to

• have another ip address (192.168.0.1), not publicly routed,
• act towards eth0 as if it had 10.0.0.1,
• redirect any access to 10.0.0.1:2222 to 192.168.0.1, i.e. handle it locally,
• route any other traffic to 10.0.0.1 towards the virtual interface that guest is attached to.

This explains the two constraints in the question: The guest machine may not always be up, so the mentioned route will not always be there – this is what rules out Proxy ARP. Also, I cannot assing 10.0.0.1 to eth0, as it is really difficult to make Linux route a package away that is destined to an address that the kernel thinks is local. The local routing table has priority 0 according to ip rule, for instance.

I have a global entry

Alias /.well-known/acme-challenge /var/www/letsencrypt/.well-known/acme-challenge/

in my apache configuration, outside any virtual host. This way, the above Alias is effective for all virtual hosts. Unfortunately, there are still virtual hosts where this does not work as intended, e.g. due to redirects, authetication requirements etc.

Is there a way to tell apache to consider this alias before even reading the configuration of the particular virtual host?

I just upgraded dovecot from 2.1.7 to 2.2.13, and my previously working configuration broke.

I have one user with an empty prefix in his default namespace:

Error: XXXX: Initialization failed: namespace configuration error: list=yes requires prefix=yes to end with separator
Error: Invalid user settings. Refer to server log for more information.

The prefix is set to empty via the userdb:

XXXX:YYYY::::::userdb_namespace/inbox/prefix=

Unfortunately, I could not find any other configuration. With

XXXX:YYYY::::::userdb_namespace/inbox/prefix=.

I get

namespace configuration error: list=yes requires prefix=. not to start with separator

What is the correct way to get the old behaviour with 2.2.13?

Currently, I have exim set up to mark spam mail, and reject spam mail with high scores, using these ACL instructions in the acl_smtp_data ACL:

  warn  condition = ${if <{$message_size}{500000}{1}{0}}
        spam = nobody
        add_header = X-Spam-Status: Yes
  deny  condition = ${if <{$message_size}{500000}{1}{0}}
        condition = ${if >{$spam_score_int}{80}{1}{0}}
        spam = nobody:true
        message = This message scored $spam_score spam points.

I’d like to be more aggressive for mails that are destined to certain addresses, e.g. all to @lists.example.com, and deny all spam mails to such addresses. Unfortunately, the domain acl condition is not available in acl_smtp_data. What is the suggested work-around for this?

(I would not mind imposing the more strict behaviour also on messages with multiple recipients, where at least one of them is a lists address.)

When my mail setup detects that a mail is spam, it puts *SPAM* in the subject. Now I want to improve my bayes filter by training it on my corpus of spam.

If I feed these thousands of mails to sa-learn, will that work even if they still have the *SPAM* in the subject? Or will it have the effect of telling the filter “something is only spam if it has *SPAM* in the header”, which would be counter-productive?

There are many different places where systemd unit files may be placed. Is there a quick and easy way to ask systemd where it read a service’s declaration from, given just the service name?

On my server, I implement redirects using this router

virtual_aliases:
  driver = redirect
  allow_defer
  allow_fail
  data = ${lookup{$local_part@$domain}wildlsearch*@{/etc/vhosts/forwards}}
  domains = /etc/vhosts/maildomains
  qualify_preserve_domain
  retry_use_local_part

and entries in /etc/vhosts/forwards like

[email protected]: [email protected]
^.*@example2.com: [email protected]

This works fine and as intended. Now my customer asks me to change the second line to “forward all, with the exception of [email protected] and [email protected]”, as these attract too much spam.

Is there a nice way to implement this logic inside the /etc/vhosts/forwards, or would I have to add another blacklisting router?

I run a small mail server with all the usual functionality: Sending of local mail, receiving mail for local folders, redirecting mail according to alias and a mailing lists.

The redirections go to addresses at other domains, including Google, so all spam going to one of these redirected addresses harm my server’s reputation with Google, causing even my locally generate mails to be rate-limited.

I could imagine that one way to reduce the problem is to never store mails that is bound to be redirected. This way, if Google rejects some message as spam, so do I. And instead of my server retrying its delivery, the original server has to which, being a spam sending server, hopefully doesn’t try again.

So the question is: Can I somewhere in the ACLs tell exim to

• figure out if the mail is going to be delivered using a redirection to a remote location,
• attempt this right away,
• and accept the mail only if the relay was successful?

Thanks!

I run an authoritative name server (BIND), and I have a few dozens domain with identical zone files, i.e. they all use /etc/bind/db.default3.

I’m considering deploying DNSSEC on my server, but so far all documentation I found on it would require me to do many manual steps per zone (such as generating KSK and ZSK). BIND 9.9’s inline-signing makes some of it easier, but not everything.

So, can I make BIND, in inline-signing mode, use the same KSK for multiple domains? If so, will I be able to put the same value in the DS record for these domains? And why do I have to manage the ZSK – shouldn’t BIND, given a KSK, be able to take care of that for me?

I have a running simpleid installation, and I use my own homepage as the identifier. Now I want to add a user to simpleid who does not have a homepage or similar.

Does simpleid provide an identifier for its users automatically somehow?

E.g. after configuring /var/lib/simpleid/foo.identity I’d like to be able to use http://example.com/simpleid/foo (or similar) as the identity for the user.

I recently acquired a nice 7×11 LED display, and I want (among other stuff) display my nagios status on it. For that I need to query the status of my Nagios installation.

What is the appropriate way to get a status summary (e.g. number of non-OK services) from a remote Nagios server from, say, a perl script?

I have a dovecot IMAP server (version 2.1.7) with Maildirs and a virtual user setup (e.g. all accounts are mapped to the same system user). I’d like to create a public namespace shared between users A and B, but not any other user.

I tried to set up the namespace as follows:

namespace {
  type = public
  separator = .
  prefix = INBOX.XFeeds.
  location = maildir:/var/vhosts/feeds:INDEX=~/Maildir/feeds/
  subscriptions = no
}

together with a acl-file:

/var/vhosts/feeds $ cat dovecot-acl
user=A lrwstipekxa
user=B lrwipk

Now user C cannot access the contents of the XFeeds mailbox, but it still hows up in its IMAP client. How can I make sure that other users cannot observe that this namespace exists?

Currently, my apache configuration includes one SSL certificate (with all domains listed as Alternative Subject Names). I furthermore have one virtual host configuration per domain that serves both SSL and non-SSL requests. All this happens on one public IP.

I’d like to switch to multiple SSL certificates, one per domain, using Subject Name Indication. I know it is possible if I duplicate all vhost configuration entries, once for port 80 and once for port 443 with SSL (as already discussed on SF).

But I would rather have something that resembles my current setup, with these features:

• All SSL related configuration in one place. In the best case a statement telling apache „Use all SSL certificates in this directory, and for each HTTP request, pick the right one based on the SNI information“
• Virtual host configuration non-duplicated and with no special mention of SSL at all.
• Possibility to server many domain names with one virtual host configuration, while still having separate certificates for each.

Is that possible?

When exactly does ISC dhcpd forget a lease that is not explicitly freed by the client?

Context: I am running an installation with many small pools (3 address) and it does not seem to cope well when all three leases are taken. Nevertheless I see entries in dhcpd.leases-file whose end date has passed. Also, these entries are counted towards the number of used leases for the adaptive lease time feature. Shouldn’t these be considered unused?

I run a slave name server of a domain that I do not have full control over (i.e. changing the SOA is not possibly). The SOA specifies an expiry time of one week. For various reasons, I’d like to override that value on my specific slave server to something larger. Is there a way to do that?

N.B: I know that for the refresh and retry fields, bind9 provides the options min-refresh-time, max-refresh-time, min-retry-time and max-retry-time to overrule the SOA, as mentioned in the documentation. For some reason this just does not include expiry.

I have rented a dedicated server, running Debian stable. Is the startup output that you would see on the screen (if you had one) stored anywhere? If not, is there a non-intrusive way to make that data available after the next reboot? Or how else do you make sure that the system boots up cleanly?