Mikeage's questions -server

Mikeage

Asked: 2020-11-12 23:43:35 +0800 CST

Forward messages to Gmail (postfix+SRS) has DMARC failure even though SPF and DKIM succeed

1

I run my own domain, but forward many email addresses to my gmail account. Recently, I started seeing a lot of messages marked by gmail as spam. I have SPF set for my outgoing email, and use SRS to rewrite the from address as my own. I also have DKIM set up, although from what I understand, this should not apply to forwarded email, only emails generated from my server (and indeed, I see that forwarded emails don't get DKIM added, but locally sent messages do). However, I see gmail reporting a DMARC failure, and I'm not sure what else I need to do (it happens primarily for two domains; emails coming from chase.com, and emails from gmail.com itself).

Here's a sample set of message headers:

Received-SPF: pass (google.com: domain of srs0=uwyv=es=groups.io=bounce+69030+554308+4680414+8404272@mikeage.net designates 34.224.146.155 as permitted sender) client-ip=34.224.146.155;
Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=66.175.222.108; helo=mail02.groups.io; [email protected]; receiver=<UNKNOWN>
MIME-Version: 1.0
From: Safta Chavi <[email protected]>
Date: Wed, 11 Nov 2020 18:50:36 +0200
Message-ID: <CAB5sq-wzZZ13bfOpxWo2n+AV_AQNBLim4x_9PNZfWz+n7Evi1g@mail.gmail.com>
Subject: [BS/RBS List] Oven recommendations? #question
To: undisclosed-recipients:;
Precedence: Bulk
Sender: [email protected]
Mailing-List: list [email protected]; contact [email protected]
Content-Type: multipart/alternative; boundary="000000000000de985705b3d798e3"

(to reduce spam, I replaced the address the email was sent to with MYADDRESSORIGINAL, the actual delivery address (my gmail) with MYADDRESS and the source with SENDER, but other than that, everything is unchanged)

gmail reports: SPF: PASS with IP 34.224.146.155 DKIM: 'PASS' with domain groups.io DMARC: 'FAIL' Learn more

What can I do to get DMARC to pass? I think I might need to use ARC somehow... but what exactly do I?

postfix config (same censoring):

$ postconf -n
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = no
body_checks = pcre:/etc/postfix/body_checks
broken_sasl_auth_clients = yes
header_checks = pcre:/etc/postfix/header_checks
inet_interfaces = all
inet_protocols = all
local_recipient_maps =
luser_relay = [email protected]
mailbox_size_limit = 0
milter_default_action = accept
milter_protocol = 6
mydestination = $myhostname, mikeage.net, localhost
myhostname = aws1.mikeage.net
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
myorigin = /etc/mailname
non_smtpd_milters = local:opendkim/opendkim.sock
policyd-spf_time_limit = 3600
readme_directory = no
recipient_canonical_classes = envelope_recipient,header_recipient
recipient_canonical_maps = tcp:localhost:10002
recipient_delimiter = +
relayhost =
sender_canonical_classes = envelope_sender
sender_canonical_maps = tcp:localhost:10001
smtp_tls_CApath = /etc/ssl/certs
smtp_tls_loglevel = 1
smtp_tls_security_level = may
smtp_tls_session_cache_database = btree:/var/lib/postfix/smtp_scache
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
smtpd_milters = local:opendkim/opendkim.sock
smtpd_recipient_restrictions = permit_sasl_authenticated reject_invalid_helo_hostname reject_unauth_destination reject_unknown_recipient_domain reject_unverified_recipient check_policy_service unix:private/policyd-spf
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_tls_CApath = /etc/ssl/certs
smtpd_tls_cert_file = /etc/letsencrypt/live/aws1.mikeage.net/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/aws1.mikeage.net/privkey.pem
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_use_tls = yes
tls_random_source = dev:/dev/urandom

(The maps on 10001 and 10002 are postsrsd)

Mikeage

Asked: 2011-10-04 20:59:47 +0800 CST

cloud hosted sync with free file system integration

2

I'm currently using wuala for remote storage / sync, and while I dislike their GUI greatly (and their poor support for headless systems), they have one amazing feature where a virtual disk (windows) or mountpoint (using CBFS on Linux) is created letting me keep my files stored remotely but access them as though they were available locally.

I haven't found any free way to do this with any of the other major providers (DropBox, SpiderOak, etc), but I'm wondering if anyone else has seen anything?

A raw S3 storage solution is available using S3FS (http://code.google.com/p/s3fs/), but it's missing two important features: automatic sync of local files (because sometimes I do want a local mirror) and more importantly, a windows version (I can't seem to get it to compile using Dokan).

Has anyone found any alternatives to Wuala for this purpose (using either FUSE, WebDAV or anything) which supports both Windows and Linux?

Mikeage

Asked: 2010-10-19 00:01:13 +0800 CST

Forcing all traffic through OpenVPN from the client on Windows XP

1

Is there any way that a client can decide, on it's own, whether to route all traffic through OpenVPN or not?

I know that I can add:

push "redirect-gateway def1"

to my server config, but sometimes I'd like to decide on the client whether or not to use this. I suppose I could create two profiles, but that seems like a lot of overhead.

I suppose this may be more of a Windows question than OpenVPN; how can I easily set up a default route?

[Obviously, my server is set up to handle IP forwarding; I have one client that always uses redirect-gateway def1. I'm asking specifically about the other clients]

Mikeage

Asked: 2010-10-15 00:32:59 +0800 CST

Debugging UPnP / DLNA via Wireshark

2

Is there any way to parse / interpret the XMLs sent as part of a DLNA / UPnP using Wireshark, or any other network sniffer?

I can get the raw packets, but it would be nice to see them parsed, to make debugging easier.

Mikeage

Asked: 2010-08-25 09:28:32 +0800 CST

Link Aggregation (Bonding) of OpenVPN TAP devices in Windows XP

0

Is there any way to bond two TAP devices in Windows XP into one network device?

My ISP is, in theory, providing me with a 5Mb/s connection. However, my OpenVPN tap device can only reach ~100KB/s. However, I've tried connecting two devices, and each one can sustain the same 100KB/s.

In Linux, I can bond them together and get, for all practical purposes, a 200KB/s connection. Is there any way to do this in Windows XP?

Mikeage

Asked: 2010-08-23 11:25:16 +0800 CST

Sharing an IP pool for two openvpn instances (one TCP and one UDP)

4

I'm currently running OpenVPN on my VPS, listening on port 1194 via TCP. I need to use TCP since I sometimes need to tunnel traffic over an HTTP proxy. However, I'd also like to be able to use UDP, which should be faster. However, I don't want to create two subnets, as I also have my machines connect to one another, and I'd like to have them all on one subnet.

Is there any way I have two instances share one IP pool?

Here's my server config, for reference:

dev tun
proto tcp
persist-key
persist-tun
log-append /var/log/openvpn
comp-lzo

port 1194
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
ifconfig-pool-persist ipp.txt
server 192.168.192.0 255.255.255.0
topology subnet
client-to-client
push "dhcp-option DNS 192.168.192.1"
push "dhcp-option DOMAIN my.example.com"

# Daemon settings
user nobody
group nogroup

Mikeage

Asked: 2010-03-21 23:35:22 +0800 CST

Resolving DNS queries for two disconnected, private, networks

2

I'm trying to setup two PCs (one Windows, one Linux, but my understanding is that this problem is more DNS and less OS) as follows:

Home network: 192.168.1.0/24
VPN (via OpenVPN server not within the home network): 192.168.2.0/24 .

I would like a PC on both networks to be able to access three different types of site:

Internet addresses
Addresses on the home network
Addresses on the vpn

However, I'm not sure how/which DNS servers to use. If I prioritize my home DNS server, I can resolve (1) and (2), but not (3). If I prioritize my VPN DNS server, I can't resolve addresses of type (2). Of course, looking up addresses via nslookup and explicitly setting the correct server works, so I know my local DNS servers are OK.

Is there any way I can set up my PCs to fallback on the second DNS server if there is no address found (NXDOMAIN)? Alternatively, is there any way I can tell different queries to go to different servers [maybe by setting up different subdomains; foo.local.something vs. bar.vpn.something]?

Thanks

Mikeage

Asked: 2010-02-03 20:31:29 +0800 CST

Tuning mysql's query cache

3

I'm looking into tuning the query cache on mysql on my VPS [a 360MB setup]. When I started, it was set at 32MB, and I was getting a non-trivial amount of qcache_lowmem_prunes. I added a cronjob to run FLUSH QUERY CACHE periodically, which helped, but not enough. I've been enlarging it gradually, but even at 80MB [I temporarily took some memory away from php-cgi], I still see lowmem prunes.

OTOH, I only have about a 50% hit ratio [i.e., Qcache_hits is about half of Qcache_hits+Com_select]. I strongly suspect that many of my queries are one time queries, and therefore should not be cached. I'd like to identify them, and mark them with SQL_NO_CACHE.

Any suggestions for an easy way to do this?

It's also possible that some of my queries are not cached since the tables have changed, although I don't think, based on a rough mental model, that this is the case. At least, the results should be consistant for most queries; I'm using InnoDB, so my understanding is that a random UPDATE does not necessarily invalidate all SELECTs. Is this correct?

Mikeage

Asked: 2009-11-07 07:41:24 +0800 CST

SRS / Sender Rewriting when forwarding mail through postfix

16

Is there any way to perform SRS, or something similar using Postfix?

When I get a mail from [email protected], I forward it (via a catchall) to [email protected], but GMail is checking SPF, and seeing that my server is not authorized to send mail on behalf of example.org. I'd like to rewrite the sender to something@myserver, while leaving the from as [email protected].

Mikeage

Asked: 2009-06-17 18:25:18 +0800 CST

update XML from the command line [windows]

5

I have a few applications which store their config files in XML format. For a regular application, using a text based config, I could update a value easily enough by using perl, or sed, or awk, or any one of a million tools. I'm looking for something similar for XML, which will allow me to easily and reliably perform operations like: update a value, add a node, or remove one.

Regular text parsing would seem to be too risky, as I have no real guarantees about the physical file format.

Mikeage

Asked: 2009-05-17 18:41:16 +0800 CST

OpenVPN + iptables / NAT routing

6

I'm trying to set up an OpenVPN VPN, which will carry some (but not all) traffic from the clients to the internet via the OpenVPN server.

My OpenVPN server has a public IP on eth0, and is using tap0 to create a local network, 192.168.2.x. I have a client which connects from local IP 192.168.1.101 and gets VPN IP 192.168.2.3.

On the server, I ran:

iptables -A INPUT -i tap+ -j ACCEPT
iptables -A FORWARD -i tap+ -j ACCEPT

iptables -t nat -A POSTROUTING -s 192.168.2.0/24 -o eth0 -j MASQUERADE

On the client, the default remains to route via 192.168.1.1. In order to point it to 192.168.2.1 for HTTP, I ran

ip rule add fwmark 0x50 table 200
ip route add table 200 default via 192.168.2.1
iptables -t mangle -A OUTPUT -j MARK -p tcp --dport 80 --set-mark 80

Now, if I try accessing a website on the client (say, wget google.com), it just hangs there. On the server, I can see

$ sudo tcpdump -n -i tap0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tap0, link-type EN10MB (Ethernet), capture size 96 bytes
05:39:07.928358 IP 192.168.1.101.34941 > 74.125.67.100.80: S 4254520618:4254520618(0) win 5840 <mss 1334,sackOK,timestamp 558838 0,nop,wscale 5>
05:39:10.751921 IP 192.168.1.101.34941 > 74.125.67.100.80: S 4254520618:4254520618(0) win 5840 <mss 1334,sackOK,timestamp 559588 0,nop,wscale 5>

Where 74.125.67.100 is the IP it gets for google.com .

Why isn't the MASQUERADE working? More precisely, I see that the source showing up as 192.168.1.101 -- shouldn't there be something to indicate that it came from the VPN?

Edit: Some routes [from the client]

$ ip route show table main
192.168.2.0/24 dev tap0  proto kernel  scope link  src 192.168.2.4
192.168.1.0/24 dev wlan0  proto kernel  scope link  src 192.168.1.101  metric 2
169.254.0.0/16 dev wlan0  scope link  metric 1000
default via 192.168.1.1 dev wlan0  proto static

$ ip route show table 200
default via 192.168.2.1 dev tap0

Mikeage

Asked: 2009-05-15 11:15:14 +0800 CST

Transparent Proxy with Squid / iptables

4

I'm trying to force one PC to use a remote transparent squid proxy by re-routing all outgoing packets headed for port 80 to the squid proxy, although I'm having some difficulty with the exact iptables command line.

The mini-HOWTO at http://tldp.org/HOWTO/TransparentProxy-6.html has some good links for the two "extreme" cases: a three (or more) machine setup which has a client, router, and proxy, and a single machine setup where all three on the same machine.

In my setup, I have a machine (called foo), with an IP of 192.168.1.100. Normally, it connects to the internet through a router at 192.168.1.1, which does NAT and has a public IP. In this case, foo also is connected via an OpenVPN tunnel (foo's tunnel address is 10.8.0.5/6) to a machine called bar (remote address 10.8.0.1), which runs squid. I want to use iptables to route all outgoing packets from foo headed for port 80 to bar's squid proxy, on port 3128.

I haven't been able to figure out which chain and which targets to use; all my attempts have either been illegal (-A OUTPUT without -t nat and --to-destination) or just not done any good (various combinations of -A PREROUTING, OUTPUT, POSTROUTING, etc).

EDIT: The closest I think I got was this:

iptables -t nat -A OUTPUT -p tcp --dport 80 -j DNAT --to 10.8.0.1:3128

Now, no port 80 traffic gets anywhere, but at least it's getting processed. Using -A PREROUTING fails... maybe because the packets originate locally instead of being routed through the machine?

Mikeage

Asked: 2009-05-04 17:48:27 +0800 CST

What's the sneakiest thing you ever had to deal with as a sysadmin?

16

What's the most devious thing a user has ever done that you've had to deal with? Obviously, we've all seen quite a lot of malice from unfriendly users, but how about from so-called friendly users?

In my case, I think it would have to be ping tunnel: using outgoing ICMP packets to carry an SSH tunnel to circumvent the firewall. [Full disclosure: I contributed toward the Windows port of this tool ;) ]

(reopened as community wiki)

Mikeage

Asked: 2009-05-01 03:18:56 +0800 CST

Munin with intermittent clients

2

I'm currently using munin to monitor a bunch of linux servers (as well as a few WinXP clients). However, munin does its data collection sequentially, and seems to be very susceptible to timing out when clients disconnect in the middle.

Are there any parallel versions?

Is there any way to handle the case of a disconnected client quicker?

Right now, many of my data collection tasks take longer than the 5 minutes until the next collection starts, leading to both warnings and missed data points.

Forward messages to Gmail (postfix+SRS) has DMARC failure even though SPF and DKIM succeed

cloud hosted sync with free file system integration

Forcing all traffic through OpenVPN from the client on Windows XP

Debugging UPnP / DLNA via Wireshark

Link Aggregation (Bonding) of OpenVPN TAP devices in Windows XP

Sharing an IP pool for two openvpn instances (one TCP and one UDP)

Resolving DNS queries for two disconnected, private, networks

Tuning mysql's query cache

SRS / Sender Rewriting when forwarding mail through postfix

update XML from the command line [windows]

OpenVPN + iptables / NAT routing

Transparent Proxy with Squid / iptables

What's the sneakiest thing you ever had to deal with as a sysadmin?

Munin with intermittent clients

Can you pass user/pass for HTTP Basic Authentication in URL parameters?

Ping a Specific Port

Check if port is open or closed on a Linux server?

How to automate SSH login with password?

How do I tell Git for Windows where to find my private RSA key?

What's the default superuser username/password for postgres after a new install?

What port does SFTP use?

Command line to list users in a Windows Active Directory group?

What is a Pem file and how does it differ from other OpenSSL Generated Key File Formats?

How to determine if a bash variable is empty?