Alexander's questions

From the python-libmilter I am trying to run the test milter.

The milter is listening (I can connect via telnet to localhost 5000)

I enabled the milter in the postfix config:

milter_protocol = 6
milter_default_action = accept
smtpd_milters = tcp:127.0.0.1:5000 unix:/var/run/opendkim/opendkim.sock
non_smtpd_milters = tcp:127.0.0.1:5000 unix:/var/run/opendkim/opendkim.sock

Thus, the testmilter should be called before the opendkim milter.
(postfix was of course restarted)

However, I don't get any log from the testmilter when I send an email.
Why is that?

When should I use defer and when reject?

In my case there is postfix running. The parameter smtpd_relay_restrictions defaults to defer_unauth_destination, while the Access Readme suggests reject_unauth_destination.

I recently switched from sendmail to postfix.
My /etc/aliases says:

[...]
postmaster: /var/spool/mail/postmaster
[...]

The permissions are:

-rw-rw---- 1 postfix mail 4.9M Aug  9 13:54 /var/spool/mail/postmaster

before it was g=r, I changed it to g=rw for testing.

The error I get is:

[...] postfix/local[4554]: 2D4EF8C1626: to=<postmaster@DOMAIN>, [...] status=bounced (cannot append message to file /var/spool/mail/postmaster: cannot open file: Permission denied)

I don't have a unix user postmaster, if that's relevant.

How can I fix this?

When I have two servers available, what are the pros and cons for

1. one main mail-server + a backup-MX that only queues mail if main is down

2. two 'dedicated' (possibly identically configured) mail-servers that work as end-points for all domains

A sketch of my current configuration see below.

I can't figure out which rule is missing to make this happen...

# iptables -Z ; curl -v -k --connect-timeout 2 http://www.myhost.com/ ; iptables -L -v
* Hostname was NOT found in DNS cache
*   Trying <correct IP>...
* Connection timed out after 2001 milliseconds
* Closing connection 0
curl: (28) Connection timed out after 2001 milliseconds
Chain INPUT (policy DROP 2 packets, 120 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  lo     any     ip6-localhost        anywhere            
    0     0 DROP       all  -f  any    any     anywhere             anywhere            
    0     0 DROP       tcp  --  any    any     anywhere             anywhere             tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,ACK
    0     0 DROP       tcp  --  any    any     anywhere             anywhere             tcp flags:FIN,SYN/FIN,SYN
    0     0 DROP       tcp  --  any    any     anywhere             anywhere             tcp flags:SYN,RST/SYN,RST
    0     0 DROP       all  --  any    any     200.200.200.200      anywhere            
    0     0 DROP       all  --  any    any     192.168.0.0/24       anywhere            
    0     0 DROP       all  --  eth+   any     127.0.0.0/8          anywhere            
    0     0 DROP       tcp  --  any    any     anywhere             anywhere             tcp flags:!FIN,SYN,RST,ACK/SYN state NEW
    9   468 ACCEPT     all  --  any    any     anywhere             anywhere             state RELATED,ESTABLISHED
    0     0 LOG        tcp  --  any    any     anywhere             anywhere             tcp dpt:ssh recent: UPDATE seconds: 20 hit_count: 20 TTL-Match name: SSH side: source mask: 255.255.255.255 LOG level warning prefix "SSH brute force "
    0     0 DROP       tcp  --  any    any     anywhere             anywhere             tcp dpt:ssh recent: CHECK seconds: 20 hit_count: 20 TTL-Match name: SSH side: source mask: 255.255.255.255
    0     0 icmp-chain  icmp --  any    any     anywhere             anywhere            
    0     0 services   all  --  eth0+  any     anywhere             anywhere             state NEW

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere             state RELATED,ESTABLISHED

Chain OUTPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  any    lo      anywhere             ip6-localhost       
   10  1072 ACCEPT     all  --  any    any     anywhere             anywhere             state RELATED,ESTABLISHED
    2   120 ACCEPT     all  --  any    any     anywhere             anywhere             state NEW,ESTABLISHED

Chain icmp-chain (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp echo-reply state RELATED,ESTABLISHED
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp echo-request limit: avg 5/sec burst 5 state NEW
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp destination-unreachable state NEW
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp time-exceeded state NEW
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp timestamp-request state NEW
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp timestamp-reply state RELATED,ESTABLISHED
    0     0 DROP       all  --  any    any     anywhere             anywhere            

Chain services (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     tcp  --  eth0   any     anywhere             anywhere             tcp dpt:ssh state NEW recent: SET name: SSH side: source mask: 255.255.255.255
    0     0 ACCEPT     tcp  --  eth0+  any     anywhere             anywhere             tcp spts:1024:65535 dpt:http state NEW
    0     0 ACCEPT     tcp  --  eth0+  any     anywhere             anywhere             tcp spts:1024:65535 dpt:https state NEW
    0     0 ACCEPT     tcp  --  eth0+  any     anywhere             anywhere             tcp spts:1024:65535 dpt:smtp state NEW
    0     0 ACCEPT     tcp  --  eth0+  any     anywhere             anywhere             tcp spts:1024:65535 dpt:submission state NEW
    0     0 ACCEPT     tcp  --  eth0+  any     anywhere             anywhere             tcp spts:1024:65535 dpt:imaps state NEW
    0     0 ACCEPT     tcp  --  eth0+  any     anywhere             anywhere             tcp spts:1024:65535 dpt:pop3s state NEW
    0     0 ACCEPT     tcp  --  eth0+  any     anywhere             anywhere             tcp spts:1024:65535 dpt:imap2 state NEW
    0     0 ACCEPT     tcp  --  eth0+  any     anywhere             anywhere             tcp spts:1024:65535 dpt:pop3 state NEW
    0     0 ACCEPT     tcp  --  eth0+  any     anywhere             anywhere             tcp spts:1024:65535 dpt:ftp state NEW
    0     0 ACCEPT     tcp  --  eth0+  any     anywhere             anywhere             tcp spts:1024:65535 dpt:sieve state NEW
    0     0 DROP       all  --  any    any     anywhere             anywhere            

It works with iptables -P INPUT ACCEPT

When running jobs with --mem or --mem-per-cpu the AllocMem stays 0 when the job is running.

# scontrol -V
slurm 2.6.5
# sbatch --mem=2500 tmp.sh 
Submitted batch job 25
# squeue 
             JOBID PARTITION     NAME     USER ST       TIME  NODES NODELIST(REASON)
                25      main   tmp.sh     root  R       0:05      1 w1
# scontrol -o show node w1 | awk '{ print $1, $13, $14}'
NodeName=w1 RealMemory=3764 AllocMem=0

Why is that the case?

I would expect there to be a number corresponding to my mem requirement.

I have a server with dedicated IP address A and a server with dynamic IP address B (routing via no-ip.org). A uploads a backup to B via sshpass:

export SSHPASS=***
sshpass -e sftp **@** << !
    [..]
    put [..]
    bye
!

Every time now on (A) following happens:

Warning: Permanently added the ECDSA host key for IP address '[...]' to the list of known hosts.

I have some feeling that this might be not a safe method to transfer the backup data (tar file). Is it possible for someone to intercept the backup?

Also, shouldn’t I remove the IP from the list of known hosts again afterwards? The backup is run every day. Sounds like a long list of known hosts that are just dynamic!