I've set up mod_sftp with ProFTPD, and for some reason it still prompts me for a password when I connect.
This is my conf.d/myserver file:
SFTPEngine on
SFTPLog /var/log/sftp.log
Port 7770
SFTPHostKey /etc/ssh/ssh_host_rsa_key
SFTPHostKey /etc/ssh/ssh_host_dsa_key
SFTPAuthorizedUserKeys file:/etc/proftpd/authorized_keys/%u
SFTPCompression delayed
MaxLoginAttempts 6
DefaultRoot ~
Umask 002
CreateHome on 770 dirmode 770
And the public key for the user is in /etc/proftpd/authorized_keys.
For some reason, when I ftp in using ProFTP, files I create are owned by www-data:www-data. I'd like them to be owned by myusername:www-data. The strange thing is, there's nothing in the files in /etc/proftpd that mentions www-data.
User's info:
$ id user1
uid=1002(user1) gid=33(www-data) groups=33(www-data)
$ grep 1002 /etc/passwd
user1:x:1002:33:User,,,:/home/user1:/bin/bash
I'm running on a server that has Apache on port 80. I also have nginx installed, and just one conf file in /etc/nginx/sites-enabled which has listen 8888; specified. This works perfectly fine.
Now, I added a second conf file for a different vhost within /etc/nginx/sites-enabled, listening on port 7979. When I run sudo service nginx restart, I get:
Restarting nginx: nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Address already in use)
nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Address already in use)
nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Address already in use)
nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Address already in use)
nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Address already in use)
nginx: [emerg] still could not bind()
nginx.
Nowhere in any file within /etc/nginx is port 80 mentioned! And the only reason I used a different port (7979) is because if both vhosts had port 8888, one would simply redirect to the other, even though they have different server_name values.
What's going on here?
I desperately need help in figuring out how to troubleshoot this problem I'm having. I run a fairly mission critical web server (Debian 7.5, 512MB RAM, 512MB swap, Apache, MySQL). It runs a couple WordPress sites on it. Today I found the websites responding quite slowly, and ssh'd in to find the load average was just above 10.0, and RAM use was at 100% and swap was close to the 512MB limit.
I have no idea how to figure out what's going on. Is Apache or MySQL not tuned properly? Maybe someone is attacking the server with repeated hits (how would I know?). I installed htop but even if I saw that Apache or MySQL was eating up a ton of resources, how would I figure out why?
Any points in the right direction would be massively appreciated. I'm at a loss here and I have to keep this server stable.
Side note: The server was up for 30 days, so maybe this was some sort of slow leak. Now that I've rebooted, load average is at 0.45 1.10 0.88, RAM is 165/512MB and swap is 68/512MB.
UPDATE: Still having issues. I captured a screenshot of htop below.
I'm going through all the amavisd-new config files, and I can't find anything that tells amavis to talk to spamassassin/spamd to get a spam score. The reason I ask is because I'd like to swap out spamassassin for dspam, and am wondering how amavis is wired up.
I'm looking at having a way for my mail users to completely manage their own spam training. Before I get into it, my mail server details:
Debian 7.5, postfix 2.9.6, dovecot 2.1.7, amavisd-new 2.7.1, spamassassin 3.3.2
So, each of my users in each domain has a Junk folder (/var/vmail/domain/user/.Junk) where they can put spam that doesn't get flagged as such. Then I have this script in place:
#!/bin/sh
find /var/vmail -name .Junk -exec echo Examining {}... \; -exec sa-learn --dbpath=/var/lib/amavis/.spamassassin --spam {}/cur \;
I also have a folder that each user has called False Positives where they can drag messages into that are erroneously marked as spam, and I have a daily script for that too, which learns it as ham and moves it back to their inbox.
#!/bin/sh
doveadm search -A mailbox 'False Positives' 2>/dev/null | while read user guid uid; do
doveadm fetch -u $user text mailbox-guid $guid uid $uid > /tmp/$guid-$uid.eml
doveadm move -u $user INBOX mailbox-guid $guid uid $uid
done
sa-learn --dbpath=/var/lib/amavis/.spamassassin --ham /tmp/*-*.eml
if ls /tmp/*-*.eml >/dev/null 2>&1; then
rm /tmp/*-*.eml
fi
My question is, am I doing this correctly? Is there a better way? Does sa-learn work properly with amavis? I figure as long as I'm using the --dbpath=/var/lib/amavis/.spamassassin option, it should work fine.
I'd like a way to test a spam message to see its spam scores that SpamAssassin gives it. The SA db files (bayes_toks, etc) reside in /var/lib/amavis/.spamassassin. I've been testing emails by doing this:
sudo su amavis -c 'spamassassin -t msgfile'
Though this yields some strange results, such as:
Content analysis details: (3.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
3.5 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
-0.0 NO_RELAYS Informational: message was not relayed via SMTP
0.0 LONG_TERM_PRICE BODY: LONG_TERM_PRICE
0.2 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
-0.0 NO_RECEIVED Informational: message has no Received headers
0.2 is an awfully low scores for BAYES_999! But this is the first time I've used amavis, previously I've always just used spamassassin directly as a content filter in postfix, but apparently running amavis/spamassassin is more efficient.
So, with amavis in the picture, how can I run a test on a message to see its spam score breakdown?
Another email I ran a test on got this result:
2.0 BAYES_80 BODY: Bayes spam probability is 80 to 95%
[score: 0.8487]
Doesn't make sense, that BAYES_80 can yield a higher score than BAYES_999. Help!
I've set up my first mail server that uses amavis. First off, I don't really see the point in amavis if I don't care about viruses. I don't use clamav as it's a huge RAM hog. SpamAssassin has worked just fine before on its own without amavis.
Just this morning I caught some emails stuck in something called a quarantine (amavis feature). I don't know how to disable the quarantine feature entirely. I'm wondering how to get back the default SpamAssassin behavior where it does nothing more than add ***** SPAM <score> ***** to the subject line, and drops it into my inbox.
Server details: Debian 7.5, postfix 2.9.6, amavisd-new 2.7.1, spamassassin 3.3.2.
I noticed a spammer got through postgrey AND SpamAssassin, which was very strange. I examined /var/log/mail.log and saw some suspect lines:
Log below, or on Pastebin: http://pastebin.com/k7sKnvGE
Jul 19 07:59:06 mail postfix/smtpd[15492]: connect from unknown[37.215.63.185]
Jul 19 07:59:07 mail postfix/smtpd[15492]: NOQUEUE: reject_warning: RCPT from unknown[37.215.63.185]: 504 5.5.2 <37.215.63.185>: Helo command rejected: need fully-qualified hostname; from=<> to=<[email protected]> proto=SMTP helo=<37.215.63.185>
Jul 19 07:59:07 mail postgrey[13086]: action=pass, reason=triplet found, delay=316, client_name=unknown, client_address=37.215.63.185, [email protected]
Jul 19 07:59:07 mail postfix/smtpd[15492]: B8D5D20BDD: client=unknown[37.215.63.185]
Jul 19 07:59:09 mail postfix/cleanup[15500]: B8D5D20BDD: message-id=<>
Jul 19 07:59:09 mail postfix/qmgr[3224]: B8D5D20BDD: from=<>, size=493, nrcpt=1 (queue active)
Jul 19 07:59:09 mail amavis[11960]: (11960-14) NOTICE: reconnecting in response to: err=2006, HY000, DBD::mysql::st execute failed: MySQL server has gone away at (eval 111) line 170, <GEN39> line 9463.
Jul 19 07:59:10 mail postfix/smtpd[15492]: disconnect from unknown[37.215.63.185]
Jul 19 07:59:11 mail postfix/smtpd[15505]: connect from localhost[127.0.0.1]
Jul 19 07:59:11 mail postfix/smtpd[15505]: 96E1820C16: client=localhost[127.0.0.1]
Jul 19 07:59:11 mail postfix/cleanup[15500]: 96E1820C16: message-id=<[email protected]>
Jul 19 07:59:11 mail postfix/qmgr[3224]: 96E1820C16: from=<>, size=1166, nrcpt=1 (queue active)
Jul 19 07:59:11 mail postfix/smtpd[15505]: disconnect from localhost[127.0.0.1]
Jul 19 07:59:11 mail amavis[11960]: (11960-14) Passed CLEAN {RelayedInbound}, [37.215.63.185]:55743 <> -> <[email protected]>, Queue-ID: B8D5D20BDD, mail_id: d6hKjzEiMtex, Hits: 1.296, size: 493, queued_as: 96E1820C16, 2128 ms
Jul 19 07:59:11 mail postfix/smtp[15502]: B8D5D20BDD: to=<[email protected]>, relay=127.0.0.1[127.0.0.1]:10024, delay=4.2, delays=2.1/0.01/0.01/2.1, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as 96E1820C16)
Jul 19 07:59:11 mail postfix/qmgr[3224]: B8D5D20BDD: removed
Jul 19 07:59:11 mail dovecot: auth-worker(15508): mysql(localhost): Connected to database vimbadmin
Jul 19 07:59:11 mail dovecot: lda([email protected]): sieve: msgid=<[email protected]>: stored mail into mailbox 'INBOX'
Jul 19 07:59:11 mail postfix/pipe[15506]: 96E1820C16: to=<[email protected]>, relay=dovecot, delay=0.05, delays=0/0/0/0.04, dsn=2.0.0, status=sent (delivered via dovecot service)
Jul 19 07:59:11 mail postfix/qmgr[3224]: 96E1820C16: removed
I can't tell if someone exploited the server to spoof localhost, or if Amavis or MySQL failed on my end and then allowed the email to come through. Any insight into this would be greatly appreciated!
# See /usr/share/postfix/main.cf.dist for a commented, more complete version
# The first text sent to a connecting process.
smtpd_banner = $myhostname ESMTP $mail_name
biff = no
# appending .domain is the MUA's job.
append_dot_mydomain = no
readme_directory = no
# SASL parameters
# ---------------------------------
# Use Dovecot to authenticate.
smtpd_sasl_type = dovecot
# Referring to /var/spool/postfix/private/auth
smtpd_sasl_path = private/auth
smtpd_sasl_auth_enable = yes
broken_sasl_auth_clients = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain =
smtpd_sasl_authenticated_header = yes
# TLS parameters
# ---------------------------------
# The default snakeoil certificate. Comment if using a purchased
# SSL certificate.
#smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
#smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
# Uncomment if using a purchased SSL certificate.
smtpd_tls_cert_file=/etc/ssl/mail.myhost.com/crt
smtpd_tls_key_file=/etc/ssl/mail.myhost.com/key
# The snakeoil self-signed certificate has no need for a CA file. But
# if you are using your own SSL certificate, then you probably have
# a CA certificate bundle from your provider. The path to that goes
# here.
smtpd_tls_CAfile=/etc/ssl/mail.myhost.com/ca-bundle
smtp_tls_note_starttls_offer = yes
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom
#smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
#smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
# Note that forcing use of TLS is going to cause breakage - most mail servers
# don't offer it and so delivery will fail, both incoming and outgoing. This is
# unfortunate given what various governmental agencies are up to these days.
#
# Enable (but don't force) all incoming smtp connections to use TLS.
smtpd_tls_security_level = may
# Enable (but don't force) all outgoing smtp connections to use TLS.
smtp_tls_security_level = may
# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.
# SMTPD parameters
# ---------------------------------
# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h
# will it be a permanent error or temporary
unknown_local_recipient_reject_code = 450
# how long to keep message on queue before return as failed.
# some have 3 days, I have 16 days as I am backup server for some people
# whom go on holiday with their server switched off.
maximal_queue_lifetime = 7d
# max and min time in seconds between retries if connection failed
minimal_backoff_time = 1000s
maximal_backoff_time = 8000s
# how long to wait when servers connect before receiving rest of data
smtp_helo_timeout = 60s
# how many address can be used in one message.
# effective stopper to mass spammers, accidental copy in whole address list
# but may restrict intentional mail shots.
smtpd_recipient_limit = 16
# how many error before back off.
smtpd_soft_error_limit = 3
# how many max errors before blocking it.
smtpd_hard_error_limit = 12
# This next set are important for determining who can send mail and relay mail
# to other servers. It is very important to get this right - accidentally producing
# an open relay that allows unauthenticated sending of mail is a Very Bad Thing.
#
# You are encouraged to read up on what exactly each of these options accomplish.
# Requirements for the HELO statement
smtpd_helo_restrictions = permit_mynetworks, warn_if_reject reject_non_fqdn_hostname, reject_invalid_hostname, permit
# Requirements for the sender details
smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks, warn_if_reject reject_non_fqdn_sender, reject_unknown_sender_domain, reject_unauth_pipelining, permit
# Requirements for the connecting server
smtpd_client_restrictions =
# Requirement for the recipient address. Note that the entry for
# "check_policy_service inet:127.0.0.1:10023" enables Postgrey.
smtpd_recipient_restrictions = reject_unauth_pipelining, permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_recipient, reject_unknown_recipient_domain, reject_unauth_destination, check_policy_service inet:127.0.0.1:10023, permit
smtpd_data_restrictions = reject_unauth_pipelining
# This is a new option as of Postfix 2.10, and is required in addition to
# smtpd_recipient_restrictions for things to work properly in this setup.
#smtpd_relay_restrictions = reject_unauth_pipelining, permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_recipient, reject_unknown_recipient_domain, reject_unauth_destination, check_policy_service inet:127.0.0.1:10023, permit
# require proper helo at connections
smtpd_helo_required = yes
# waste spammers time before rejecting them
smtpd_delay_reject = yes
disable_vrfy_command = yes
# General host and delivery info
# ----------------------------------
myhostname = mail.myhost.com
#myorigin = /etc/hostname
# Some people see issues when setting mydestination explicitly to the server
# subdomain, while leaving it empty generally doesn't hurt. So it is left empty here.
# mydestination = mail.example.com, localhost
mydestination = mail.myhost.com, localhost.localdomain, localhost
# If you have a separate web server that sends outgoing mail through this
# mailserver, you may want to add its IP address to the space-delimited list in
# mynetworks, e.g. as 10.10.10.10/32.
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
mynetworks_style = host
# This specifies where the virtual mailbox folders will be located.
virtual_mailbox_base = /var/vmail
# This is for the mailbox location for each user. The domainaliases
# map allows us to make use of Postfix Admin's domain alias feature.
#virtual_mailbox_maps = mysql:/etc/postfix/mysql_virtual_mailbox_maps.cf, mysql:/etc/postfix/mysql_virtual_mailbox_domainaliases_maps.cf
virtual_mailbox_maps = mysql:/etc/postfix/vimb/virtual_mailbox_maps.cf
# and their user id
virtual_uid_maps = static:150
# and group id
virtual_gid_maps = static:8
# This is for aliases. The domainaliases map allows us to make
# use of Postfix Admin's domain alias feature.
#virtual_alias_maps = mysql:/etc/postfix/mysql_virtual_alias_maps.cf, mysql:/etc/postfix/mysql_virtual_alias_domainaliases_maps.cf
virtual_alias_maps = mysql:/etc/postfix/vimb/virtual_alias_maps.cf
# This is for domain lookups.
#virtual_mailbox_domains = mysql:/etc/postfix/mysql_virtual_domains_maps.cf
virtual_mailbox_domains = mysql:/etc/postfix/vimb/virtual_domains_maps.cf
alias_maps=hash:/etc/aliases
# Integration with other packages
# ---------------------------------------
# Tell postfix to hand off mail to the definition for dovecot in master.cf
virtual_transport = dovecot
#dovecot_destination_recipient_limit = 1
# Use amavis for virus and spam scanning
content_filter = amavis:[127.0.0.1]:10024
# Header manipulation
# --------------------------------------
# Getting rid of unwanted headers. See: https://posluns.com/guides/header-removal/
header_checks = regexp:/etc/postfix/header_checks
# getting rid of x-original-to
enable_original_recipient = no
#
# Postfix master process configuration file. For details on the format
# of the file, see the master(5) manual page (command: "man 5 master").
#
# Do not forget to execute "postfix reload" after editing this file.
#
# ==========================================================================
# service type private unpriv chroot wakeup maxproc command + args
# (yes) (yes) (yes) (never) (100)
# ==========================================================================
smtp inet n - - - - smtpd
#smtp inet n - - - 1 postscreen
#smtpd pass - - - - - smtpd
#dnsblog unix - - - - 0 dnsblog
#tlsproxy unix - - - - 0 tlsproxy
#submission inet n - - - - smtpd
# -o syslog_name=postfix/submission
# -o smtpd_tls_security_level=encrypt
# -o smtpd_sasl_auth_enable=yes
# -o smtpd_client_restrictions=permit_sasl_authenticated,reject
# -o milter_macro_daemon_name=ORIGINATING
#smtps inet n - - - - smtpd
# -o syslog_name=postfix/smtps
# -o smtpd_tls_wrappermode=yes
# -o smtpd_sasl_auth_enable=yes
# -o smtpd_client_restrictions=permit_sasl_authenticated,reject
# -o milter_macro_daemon_name=ORIGINATING
#628 inet n - - - - qmqpd
pickup fifo n - - 60 1 pickup
-o content_filter=
-o receive_override_options=no_header_body_checks
cleanup unix n - - - 0 cleanup
qmgr fifo n - n 300 1 qmgr
#qmgr fifo n - n 300 1 oqmgr
tlsmgr unix - - - 1000? 1 tlsmgr
rewrite unix - - - - - trivial-rewrite
bounce unix - - - - 0 bounce
defer unix - - - - 0 bounce
trace unix - - - - 0 bounce
verify unix - - - - 1 verify
flush unix n - - 1000? 0 flush
proxymap unix - - n - - proxymap
proxywrite unix - - n - 1 proxymap
smtp unix - - - - - smtp
relay unix - - - - - smtp
# -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
showq unix n - - - - showq
error unix - - - - - error
retry unix - - - - - error
discard unix - - - - - discard
local unix - n n - - local
virtual unix - n n - - virtual
lmtp unix - - - - - lmtp
anvil unix - - - - 1 anvil
scache unix - - - - 1 scache
#
# ====================================================================
# Interfaces to non-Postfix software. Be sure to examine the manual
# pages of the non-Postfix software to find out what options it wants.
#
# Many of the following services use the Postfix pipe(8) delivery
# agent. See the pipe(8) man page for information about ${recipient}
# and other message envelope options.
# ====================================================================
#
# maildrop. See the Postfix MAILDROP_README file for details.
# Also specify in main.cf: maildrop_destination_recipient_limit=1
#
maildrop unix - n n - - pipe
flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
#
# ====================================================================
#
# Recent Cyrus versions can use the existing "lmtp" master.cf entry.
#
# Specify in cyrus.conf:
# lmtp cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
#
# Specify in main.cf one or more of the following:
# mailbox_transport = lmtp:inet:localhost
# virtual_transport = lmtp:inet:localhost
#
# ====================================================================
#
# Cyrus 2.1.5 (Amos Gouaux)
# Also specify in main.cf: cyrus_destination_recipient_limit=1
#
#cyrus unix - n n - - pipe
# user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
#
# ====================================================================
# Old example of delivery via Cyrus.
#
#old-cyrus unix - n n - - pipe
# flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
#
# ====================================================================
#
# See the Postfix UUCP_README file for configuration details.
#
uucp unix - n n - - pipe
flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
#
# Other external delivery methods.
#
ifmail unix - n n - - pipe
flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp unix - n n - - pipe
flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
scalemail-backend unix - n n - 2 pipe
flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
mailman unix - n n - - pipe
flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
${nexthop} ${user}
# The next two entries integrate with Amavis for anti-virus/spam checks.
amavis unix - - - - 2 smtp
-o smtp_data_done_timeout=1200
-o smtp_send_xforward_command=yes
-o disable_dns_lookups=yes
-o max_use=20
127.0.0.1:10025 inet n - - - - smtpd
-o content_filter=
-o local_recipient_maps=
-o relay_recipient_maps=
-o smtpd_restriction_classes=
-o smtpd_delay_reject=no
-o smtpd_client_restrictions=permit_mynetworks,reject
-o smtpd_helo_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,reject
-o smtpd_data_restrictions=reject_unauth_pipelining
-o smtpd_end_of_data_restrictions=
-o mynetworks=127.0.0.0/8
-o smtpd_error_sleep_time=0
-o smtpd_soft_error_limit=1001
-o smtpd_hard_error_limit=1000
-o smtpd_client_connection_count_limit=0
-o smtpd_client_connection_rate_limit=0
-o receive_override_options=no_header_body_checks,no_unknown_recipient_checks
# Integration with Dovecot - hand mail over to it for local delivery, and
# run the process under the vmail user and mail group.
dovecot unix - n n - - pipe
flags=DRhu user=vmail:mail argv=/usr/lib/dovecot/dovecot-lda -d $(recipient)
Let's say I receive emails from the following clients:
mail2.dx300.mail.net mail4.dx121.mail.net mail5.dx121.mail.net
Even though these are all from the same service (e.g. LinkedIn or MailChimp), postgrey sees them as entirely different clients. How can I configure postgrey to just look at the domain (mail.net), not the FQDN?
When I run tests (spamassassin -t) on obvious spam, I get results like this:
Content analysis details: (2.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 NO_RELAYS Informational: message was not relayed via SMTP
0.0 T_TVD_MIME_NO_HEADERS BODY: T_TVD_MIME_NO_HEADERS
0.0 HTML_MESSAGE BODY: HTML included in message
2.0 PYZOR_CHECK Listed in Pyzor (http://pyzor.sf.net/)
-0.0 NO_RECEIVED Informational: message has no Received headers
0.0 T_REMOTE_IMAGE Message contains an external image
It's clearly finding things wrong with it, but everything scores at 0 points for some reason (except Pyzor). Have I configured something wrong?
If I edit the .htaccess file for a site, say oldsite.com, and put this:
Redirect permanent / http://newsite.com/page
It works fine if I surf to oldsite.com. But if I surf to oldsite.com/about, it goes to http://newsite.com/pageabout
How do I just take any hit to the old site and put it to an absolute URL without carrying over the rest of the path?
I've got a domain on dns.he.net that only has an SOA record, NS records, and one MX (pointing to a totally different host). Does my domain need an A record? Currently nslookup fails since there is no IP associated with it. But mail seems to get to the MX host just fine.
Let's say I have several domains. bossguy.com is the domain that hosts my mail (IMAP server) and where I ssh in to manage other domains, for example:
It makes sense to set up MX records for domain1/2/3.com to point to bossguy.com, so if someone emails me at [email protected], it gets routed to bossguy.com for storage. But does bossguy.com need its own MX record (for emails sent to [email protected])? Currently I have it set up like this:
bossguy.com. 86400 IN MX 10 mail.bossguy.com.
bossguy.com 86400 IN A 23.xx.xx.xx
mail.bossguy.me. 86400 IN A 23.xx.xx.xx
Is the MX record needed in this case?
Also, assume all these domains share the same IP address. Then really, they could all just have MX records that equal the domain/host (domain1.com's MX being domain1.com), and it doesn't really matter since they all share the same IP. Correct?
There's a command in the rules file called stop, which stops processing. I'm not sure why this is needed though. If it's the last command in a list of directives within a rule, then isn't the rule already done processing? Or does it mean don't skip to the next rule in the list? In other words, let's say my sieve file has a list of rules:
Rule A
Rule B
Rule C
Rule D
If Rule B has a stop command at the end, will rules C and D be skipped? And I'm assuming rules are executed in the order they appear in the sieve file?
I run a VPS, and I have to say that by far, getting SpamAssassin working right has been the most frustrating thing of all. It keeps missing spam mails and I see autolearn=ham in the header, yet when I find the message in /var/vmail on the server and run spamassassin -t to test it, it yields a score of above 100 (because the sender is on my blacklist). Doesn't make any sense.
This is the X-Spam-Status in the email's header:
X-Spam-Status: No, score=-0.5 required=3.4 tests=BAYES_05,HTML_MESSAGE,
NO_RECEIVED,NO_RELAYS autolearn=ham version=3.3.2
Why would the score here by -0.5 and why is it being autolearned as ham?? Yet running spamassassin -t on this message yields:
Content analysis details: (103.0 points, 3.4 required)
pts rule name description
---- ---------------------- --------------------------------------------------
100 USER_IN_BLACKLIST From: address is in the user's black-list
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(advertise.bz222hwpxo[at]gmail.com)
-0.0 NO_RELAYS Informational: message was not relayed via SMTP
3.0 BAYES_95 BODY: Bayes spam probability is 95 to 99%
[score: 0.9502]
0.0 T_OBFU_HTML_ATTACH BODY: HTML attachment with non-text MIME type
0.0 T_HTML_ATTACH HTML attachment to bypass scanning?
-0.0 NO_RECEIVED Informational: message has no Received headers
I'm thoroughly confused. Any help would be greatly appreciated!
/etc/postfix/master.cf
#
# Postfix master process configuration file. For details on the format
# of the file, see the master(5) manual page (command: "man 5 master").
#
# Do not forget to execute "postfix reload" after editing this file.
#
# ==========================================================================
# service type private unpriv chroot wakeup maxproc command + args
# (yes) (yes) (yes) (never) (100)
# ==========================================================================
smtp inet n - - - - smtpd
-o content_filter=spamassassin
#smtp inet n - - - 1 postscreen
#smtpd pass - - - - - smtpd
#dnsblog unix - - - - 0 dnsblog
#tlsproxy unix - - - - 0 tlsproxy
submission inet n - - - - smtpd
-o content_filter=spamassassin
# -o syslog_name=postfix/submission
# -o smtpd_tls_security_level=encrypt
# -o smtpd_sasl_auth_enable=yes
# -o smtpd_client_restrictions=permit_sasl_authenticated,reject
# -o milter_macro_daemon_name=ORIGINATING
smtps inet n - - - - smtpd
-o syslog_name=postfix/smtps
-o smtpd_tls_wrappermode=yes
-o smtpd_sasl_auth_enable=yes
-o smtpd_tls_auth_only=yes
-o smtpd_client_restrictions=permit_sasl_authenticated,reject_unauth_destination,reject
-o smtpd_sasl_security_options=noanonymous,noplaintext
-o smtpd_sasl_tls_security_options=noanonymous
# -o milter_macro_daemon_name=ORIGINATING
#628 inet n - - - - qmqpd
pickup fifo n - - 60 1 pickup
cleanup unix n - - - 0 cleanup
qmgr fifo n - n 300 1 qmgr
#qmgr fifo n - n 300 1 oqmgr
tlsmgr unix - - - 1000? 1 tlsmgr
rewrite unix - - - - - trivial-rewrite
bounce unix - - - - 0 bounce
defer unix - - - - 0 bounce
trace unix - - - - 0 bounce
verify unix - - - - 1 verify
flush unix n - - 1000? 0 flush
proxymap unix - - n - - proxymap
proxywrite unix - - n - 1 proxymap
smtp unix - - - - - smtp
relay unix - - - - - smtp
# -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
showq unix n - - - - showq
error unix - - - - - error
retry unix - - - - - error
discard unix - - - - - discard
local unix - n n - - local
virtual unix - n n - - virtual
lmtp unix - - - - - lmtp
anvil unix - - - - 1 anvil
scache unix - - - - 1 scache
#
# ====================================================================
# Interfaces to non-Postfix software. Be sure to examine the manual
# pages of the non-Postfix software to find out what options it wants.
#
# Many of the following services use the Postfix pipe(8) delivery
# agent. See the pipe(8) man page for information about ${recipient}
# and other message envelope options.
# ====================================================================
#
# maildrop. See the Postfix MAILDROP_README file for details.
# Also specify in main.cf: maildrop_destination_recipient_limit=1
#
maildrop unix - n n - - pipe
flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
#
# ====================================================================
#
# Recent Cyrus versions can use the existing "lmtp" master.cf entry.
#
# Specify in cyrus.conf:
# lmtp cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
#
# Specify in main.cf one or more of the following:
# mailbox_transport = lmtp:inet:localhost
# virtual_transport = lmtp:inet:localhost
#
# ====================================================================
#
# Cyrus 2.1.5 (Amos Gouaux)
# Also specify in main.cf: cyrus_destination_recipient_limit=1
#
#cyrus unix - n n - - pipe
# user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
#
# ====================================================================
# Old example of delivery via Cyrus.
#
#old-cyrus unix - n n - - pipe
# flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
#
# ====================================================================
#
# See the Postfix UUCP_README file for configuration details.
#
uucp unix - n n - - pipe
flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
#
# Other external delivery methods.
#
ifmail unix - n n - - pipe
flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp unix - n n - - pipe
flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
scalemail-backend unix - n n - 2 pipe
flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
mailman unix - n n - - pipe
flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
${nexthop} ${user}
dovecot unix - n n - - pipe
flags=DRhu user=vmail:mail argv=/usr/lib/dovecot/dovecot-lda -d $(recipient)
spamassassin unix - n n - - pipe
user=spamd argv=/usr/bin/spamc -f -e
/usr/sbin/sendmail -oi -f ${sender} ${recipient}
#sp-order unix - n n - - pipe
# user=sara argv=/home/sara/order-notify -f ${sender} -- ${recipient}
/etc/spamassassin/local.cf
# This is the right place to customize your installation of SpamAssassin.
#
# See 'perldoc Mail::SpamAssassin::Conf' for details of what can be
# tweaked.
#
# Only a small subset of options are listed below
#
###########################################################################
bayes_path /var/lib/spamassassin/.spamassassin/bayes
# Add *****SPAM***** to the Subject header of spam e-mails
#
rewrite_header Subject [***** SPAM _SCORE_ *****]
# Save spam messages as a message/rfc822 MIME attachment instead of
# modifying the original message (0: off, 2: use text/plain instead)
#
report_safe 0
# Set which networks or hosts are considered 'trusted' by your mail
# server (i.e. not spammers)
#
# trusted_networks 212.17.35.
# Set file-locking method (flock is not safe over NFS, but is faster)
#
# lock_method flock
# Network checks
skip_rbl_checks 0
use_razor2 0
#use_dcc 0
use_pyzor 0
# Set the threshold at which a message is considered spam (default: 5.0)
#
required_score 3.4
# Use Bayesian classifier (default: 1)
#
use_bayes 1
use_bayes_rules 1
# Bayesian classifier auto-learning (default: 1)
#
bayes_auto_learn 1
# Set headers which may provide inappropriate cues to the Bayesian
# classifier
#
# bayes_ignore_header X-Bogosity
# bayes_ignore_header X-Spam-Flag
# bayes_ignore_header X-Spam-Status
# Some shortcircuiting, if the plugin is enabled
#
ifplugin Mail::SpamAssassin::Plugin::Shortcircuit
#
# default: strongly-whitelisted mails are *really* whitelisted now, if the
# shortcircuiting plugin is active, causing early exit to save CPU load.
# Uncomment to turn this on
#
# shortcircuit USER_IN_WHITELIST on
# shortcircuit USER_IN_DEF_WHITELIST on
# shortcircuit USER_IN_ALL_SPAM_TO on
# shortcircuit SUBJECT_IN_WHITELIST on
# the opposite; blacklisted mails can also save CPU
#
# shortcircuit USER_IN_BLACKLIST on
# shortcircuit USER_IN_BLACKLIST_TO on
# shortcircuit SUBJECT_IN_BLACKLIST on
# if you have taken the time to correctly specify your "trusted_networks",
# this is another good way to save CPU
#
# shortcircuit ALL_TRUSTED on
# and a well-trained bayes DB can save running rules, too
#
# shortcircuit BAYES_99 spam
# shortcircuit BAYES_00 ham
endif # Mail::SpamAssassin::Plugin::Shortcircuit
blacklist_from [email protected]
blacklist_from advertise*@gmail.com
When web apps on my VPS use the PHP built-in mail function, some domains (like att.net) bounce emails back. /var/log/mail.log reveals:
550 [PERMFAIL] att.net requires valid sender domain (in reply to RCPT TO command)
Basically the MAIL FROM line is something like <user@myhost> when it should be <[email protected]>, so AT&T's mail server doesn't like it.
I'm not entirely sure if my /etc/hostname file needs to be myhost or myhost.com. Any time I try to change it to myhost.com, upon reboot it reverts back to myhost.
I'm at a loss here.
EDIT:
Apparently /etc/hostname (according to Google searches) should be just the hostname, not the FQDN. If I type hostname --fqdn, then I get the FQDN.
As a test, I started a TorBrowser, got its IP, and banned it via this command on my VPS:
sudo iptables -A INPUT -s <IP address> -j DROP
I'm still able to surf pages hosted by my server from the TorBrowser. I've even double checked the HTTP access.log to make sure the IP is what I banned, and it is. What am I missing?
My iptables file that gets read in upon boot (via iptables-restore)
# Allow all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.0/8 -j REJECT
# IP bans
-A INPUT -s 42.121.24.80 -j DROP
-A INPUT -s 121.196.43.157 -j DROP
-A INPUT -s 192.30.85.135 -j DROP
-A INPUT -s 94.102.53.175 -j DROP
# Accept all established inbound connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allow all outbound traffic - you can modify this to only allow certain traffic
-A OUTPUT -j ACCEPT
# Allow HTTP and HTTPS connections from anywhere (the normal ports for websites and SSL).
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT
-A INPUT -p tcp --dport 8080 -j ACCEPT
# Mail
-A INPUT -p tcp --dport 993 -j ACCEPT
-A INPUT -p tcp --dport 465 -j ACCEPT
-A INPUT -p tcp --dport 587 -j ACCEPT
-A INPUT -p tcp --dport 25 -j ACCEPT
# Minecraft
-A INPUT -p tcp --dport 25565 -j ACCEPT
# Allow SSH connections
#
# The -dport number should be the same port number you set in sshd_config
#
-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT
# Allow ping
-A INPUT -p icmp -j ACCEPT
# Log iptables denied calls
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
# Drop all other inbound - default deny unless explicitly allowed policy
-A INPUT -j DROP
-A FORWARD -j DROP
COMMIT
And iptables -L output:
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
REJECT all -- anywhere 127.0.0.0/8 reject-with icmp-port-unreachable
DROP all -- out524-80.mail.aliyun.com anywhere
DROP all -- ip196.hichina.com anywhere
DROP all -- 192.30.85.135-IP-Static-VISPERAD.COM anywhere
DROP all -- tor-exit-nl1.privacyfoundation.dk anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp dpt:http
ACCEPT tcp -- anywhere anywhere tcp dpt:https
ACCEPT tcp -- anywhere anywhere tcp dpt:http-alt
ACCEPT tcp -- anywhere anywhere tcp dpt:imaps
ACCEPT tcp -- anywhere anywhere tcp dpt:ssmtp
ACCEPT tcp -- anywhere anywhere tcp dpt:submission
ACCEPT tcp -- anywhere anywhere tcp dpt:smtp
ACCEPT tcp -- anywhere anywhere tcp dpt:25565
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh
ACCEPT icmp -- anywhere anywhere
LOG all -- anywhere anywhere limit: avg 5/min burst 5 LOG level debug prefix "iptables denied: "
DROP all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
DROP all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
What I'd like to do is set up an address like [email protected] which will take whatever email it gets and run the full message as STDIN into a shell script. I can't seem to get this working though. Tried a couple solutions, including this one:
How can I route some emails to a script in Postfix?
But my setup is a bit different. I've got the Postfix/Dovecot/MySQL setup, so all email is handled by Dovecot, and Postfix reads its maps from MySQL. Whatever I add to master.cf doesn't seem to work. SpamAssassin has a line in there and that's working fine. I'm stuck!
EDIT: I really wish people would read carefully before downvoting my question. I am using MySQL for my alias maps, so /etc/aliases does not work, I already tried that of course.
I'm running postfix + dovecot, and all IMAP messages are in /var/vmail/DOMAIN/USER. I'd like to make a cron script that will look for messages for all users in a folder called 'False Positives,' sa-learn them as ham, and then move them into the inbox.
The question here is, is it safe to just mv one of these message files around? Or must it be done through some "official" means so the IMAP server is aware of the move?