comfreak's questions

My ISP assigns me an IPv4 address via DHCP and an IPv6 subnet through SLAAC.

I set up my pfSense box to use NAT and DHCPv4 for my LAN network which works fine. However, on the IPv6 side, my LAN computers only configure themselves with the standard link-local fe80.. address and don't get any global IPv6 address from the /64 pool my ISP assigned me.

I am fairly new to IPv6, so I tried a few options in pfSense like setting the LAN interface to SLAAC as well or setting it to a static IPv6 in the fc00.. range and enabling DHCPv6. Both of which didn't work for me. Also none of the options in the router advertisement tab helped either.

I'd be happy if someone with experience in setting up pfSense for my scenario could give me a hint to how I need to configure it.

I set up my (authoritative) BIND nameserver for DNSSEC and installed one ZSK for my currently only zone. In order to test if I can use multiple ZSKs for a single zone, I generated a new key pair and copied that into the same folder like the first key pair. After doing a reload, the server found the new ZSK key pair and signed the zone with both ZSKs.

Now I noticed that I don't need two ZSKs at the same time and thought that I could delete the new ZSK the same way I added it and deleted the corresponding files in the configuration directory.

Unfortunately, this didn't remove the newer ZSK from the system and after a reload the nameserver is missing the files and is still responding with both ZSKs over DNS.

Now my question is, how can I remove BIND's knowledge of the second ZSK and return to signing with a single ZSK?

I would like to set up a master and a slave BIND nameserver, where the master is hidden and currently on a dynamic IP. I set up a dynamic DNS service on a separate domain for it.

So far the documentation I've read only shows IP addresses and no host names in the masters field of the zone section.

Is it possible to use host names there too?

I set up Unbound in my local network as a local DNS resolver. I noticed that it will not filter any private IP addresses in the resolved domains and forward any IP address that a domain resolves to.

In order to protect against DNS rebinding, I would like to make Unbound not return any private IP addresses from public domains to the clients, however I haven't found any information on that from the official documentation. Apparently dnsmasq does this protection by default.

I set up a SMB/CIFS share on my FreeNAS box (Xeon E3-1220v5, 8GB DDR4 RAM) and I noticed that transfer rates are limited to ~70 MB/s, while I can easily get around 110 MB/s via WebDAV and using iperf I can achieve the complete theoretical maximum of my gigabit connection with ~940 MBit/s. The NIC is a "Intel Corporation Ethernet Connection (2) I219-LM (rev 31)" according to lspci.

My disks on both test computers are fast enough and could easily saturate the gigabit speeds. I checked the CPU and memory usage on the server side while transferring files and they both seem fine. It doesn't go higher than around 12% on the CPU. I also ran a ping test to get the average latency on the link to my server:

3221 packets transmitted, 3221 received, 0% packet loss, time 656878ms
rtt min/avg/max/mdev = 0.083/0.131/0.321/0.028 ms

My question is now, how can I find out what is limiting the speed from going higher? I was expecting at least something around 90 MB/s.

Here is the output of testparm -vvv:

# Global parameters
[global]
    bind interfaces only = No
    config backend = file
    dos charset = CP437
    enable core files = Yes
    interfaces = 
    multicast dns register = Yes
    netbios aliases = 
    netbios name = FREENAS
    netbios scope = 
    realm = 
    server services = s3fs, rpc, nbt, wrepl, ldap, cldap, kdc, drepl, winbindd, ntp_signd, kcc, dnsupdate, dns
    server string = FreeNAS Server
    share backend = classic
    unix charset = UTF-8
    workgroup = WORKGROUP
    browse list = Yes
    domain master = Auto
    enhanced browsing = Yes
    lm announce = Yes
    lm interval = 60
    local master = Yes
    os level = 20
    preferred master = Auto
    ads dns update = Yes
    allow dns updates = secure only
    dns forwarder = 
    dns update command = /usr/local/sbin/samba_dnsupdate
    machine password timeout = 604800
    nsupdate command = /usr/local/bin/samba-nsupdate -g
    rndc command = /usr/sbin/rndc
    spn update command = /usr/local/sbin/samba_spnupdate
    mangle prefix = 1
    mangling method = hash2
    max stat cache size = 256
    stat cache = Yes
    client ldap sasl wrapping = sign
    ldap admin dn = 
    ldap connection timeout = 2
    ldap delete dn = No
    ldap deref = auto
    ldap follow referral = Auto
    ldap group suffix = 
    ldap idmap suffix = 
    ldap machine suffix = 
    ldap page size = 1000
    ldap passwd sync = no
    ldap replication sleep = 1000
    ldap server require strong auth = Yes
    ldap ssl = start tls
    ldap ssl ads = No
    ldap suffix = 
    ldap timeout = 15
    ldap user suffix = 
    lock spin time = 200
    oplock break wait time = 0
    smb2 leases = No
    debug class = No
    debug hires timestamp = Yes
    debug pid = No
    debug prefix timestamp = No
    debug uid = No
    ldap debug level = 0
    ldap debug threshold = 10
    log file = 
    logging = file
    log level = 2
    max log size = 51200
    syslog = 1
    syslog only = No
    timestamp logs = Yes
    abort shutdown script = 
    add group script = 
    add machine script = 
    add user script = 
    add user to group script = 
    allow nt4 crypto = No
    delete group script = 
    delete user from group script = 
    delete user script = 
    domain logons = No
    enable privileges = Yes
    init logon delay = 100
    init logon delayed hosts = 
    logon drive = 
    logon home = \\%N\%U
    logon path = \\%N\%U\profile
    logon script = 
    reject md5 clients = No
    set primary group script = 
    shutdown script = 
    add share command = 
    afs token lifetime = 604800
    afs username map = 
    allow insecure wide links = No
    async smb echo handler = No
    auto services = 
    cache directory = /var/db/samba4
    change notify = Yes
    change share command = 
    cluster addresses = 
    clustering = No
    config file = 
    ctdbd socket = 
    ctdb locktime warn threshold = 0
    ctdb timeout = 0
    default service = 
    delete share command = 
    homedir map = auto.home
    kernel change notify = No
    lock directory = /var/lock
    log writeable files on exit = No
    message command = 
    nbt client socket address = 0.0.0.0
    ncalrpc dir = /var/run/samba4/ncalrpc
    NIS homedir = No
    nmbd bind explicit broadcast = Yes
    panic action = /usr/local/libexec/samba/samba-backtrace
    perfcount module = 
    pid directory = /var/run/samba
    registry shares = No
    remote announce = 
    remote browse sync = 
    reset on zero vc = No
    smbd profiling level = off
    state directory = /var/db/samba4
    usershare allow guests = No
    usershare max shares = 0
    usershare owner only = Yes
    usershare path = /var/db/samba4/usershares
    usershare prefix allow list = 
    usershare prefix deny list = 
    usershare template share = 
    utmp = No
    utmp directory = 
    wtmp directory = 
    addport command = 
    addprinter command = 
    cups connection timeout = 30
    cups encrypt = No
    cups server = 
    deleteprinter command = 
    disable spoolss = Yes
    enumports command = 
    iprint server = 
    load printers = No
    lpq cache time = 30
    os2 driver map = 
    printcap cache time = 750
    printcap name = /dev/null
    show add printer wizard = Yes
    cldap port = 389
    client ipc max protocol = default
    client ipc min protocol = default
    client max protocol = default
    client min protocol = CORE
    client use spnego = Yes
    dcerpc endpoint servers = epmapper, wkssvc, rpcecho, samr, netlogon, lsarpc, spoolss, drsuapi, dssetup, unixinfo, browser, eventlog6, backupkey, dnsserver
    defer sharing violations = Yes
    dgram port = 138
    disable netbios = No
    enable asu support = No
    eventlog list = 
    large readwrite = Yes
    max mux = 50
    max ttl = 259200
    max wins ttl = 518400
    max xmit = 65535
    min receivefile size = 0
    min wins ttl = 21600
    name resolve order = lmhosts wins host bcast
    nbt port = 137
    nt pipe support = Yes
    nt status support = Yes
    read raw = Yes
    rpc big endian = No
    server max protocol = SMB3
    server min protocol = LANMAN1
    server multi channel support = No
    smb2 max credits = 8192
    smb2 max read = 8388608
    smb2 max trans = 8388608
    smb2 max write = 8388608
    smb ports = 445 139
    svcctl list = 
    time server = Yes
    unicode = Yes
    unix extensions = Yes
    use spnego = Yes
    web port = 901
    write raw = Yes
    algorithmic rid base = 1000
    allow dcerpc auth level connect = No
    allow trusted domains = Yes
    auth methods = 
    check password script = 
    client ipc signing = default
    client lanman auth = No
    client NTLMv2 auth = Yes
    client plaintext auth = No
    client schannel = Auto
    client signing = default
    client use spnego principal = No
    dedicated keytab file = 
    encrypt passwords = Yes
    guest account = nobody
    kerberos method = default
    kpasswd port = 464
    krb5 port = 88
    lanman auth = No
    log nt token command = 
    map to guest = Bad User
    map untrusted to domain = No
    ntlm auth = Yes
    ntp signd socket directory = /var/run/samba4/ntp_signd
    null passwords = No
    obey pam restrictions = Yes
    old password allowed period = 60
    pam password change = No
    passdb backend = tdbsam
    passdb expand explicit = No
    passwd chat = *new*password* %n\n *new*password* %n\n *changed*
    passwd chat debug = No
    passwd chat timeout = 2
    passwd program = 
    password server = *
    preload modules = 
    private dir = /var/db/samba4/private
    raw NTLMv2 auth = No
    rename user script = 
    restrict anonymous = 0
    root directory = 
    samba kcc command = /usr/local/sbin/samba_kcc
    security = USER
    server role = standalone server
    server schannel = Auto
    server signing = default
    smb passwd file = /var/db/samba4/private/smbpasswd
    tls cafile = tls/ca.pem
    tls certfile = tls/cert.pem
    tls crlfile = 
    tls dh params file = 
    tls enabled = Yes
    tls keyfile = tls/key.pem
    tls priority = NORMAL:-VERS-SSL3.0
    tls verify peer = as_strict_as_possible
    unix password sync = No
    username level = 0
    username map = 
    username map cache time = 0
    username map script = 
    aio max threads = 100
    deadtime = 15
    getwd cache = Yes
    hostname lookups = Yes
    keepalive = 300
    max disk size = 0
    max open files = 233687
    max smbd processes = 0
    name cache timeout = 660
    socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=65536 SO_SNDBUF=65536
    use mmap = Yes
    get quota command = 
    host msdfs = Yes
    set quota command = 
    create krb5 conf = Yes
    idmap backend = tdb
    idmap cache time = 604800
    idmap gid = 
    idmap negative cache time = 120
    idmap uid = 
    neutralize nt4 emulation = No
    reject md5 servers = No
    require strong key = Yes
    template homedir = /home/%D/%U
    template shell = /bin/false
    winbind cache time = 300
    winbindd privileged socket directory = /var/run/samba4/winbindd_privileged
    winbindd socket directory = /var/run/samba4/winbindd
    winbind enum groups = No
    winbind enum users = No
    winbind expand groups = 0
    winbind max clients = 200
    winbind max domain connections = 1
    winbind nested groups = Yes
    winbind normalize names = No
    winbind nss info = template
    winbind offline logon = No
    winbind reconnect delay = 30
    winbind refresh tickets = No
    winbind request timeout = 60
    winbind rpc only = No
    winbind sealed pipes = Yes
    winbind separator = \
    winbind trusted domains only = No
    winbind use default domain = No
    dns proxy = No
    wins hook = 
    wins proxy = No
    wins server = 
    wins support = No
    idmap config *: range = 90000001-100000000
    idmap config * : backend = tdb
    comment = 
    path = 
    administrative share = No
    browseable = Yes
    case sensitive = Auto
    default case = lower
    delete veto files = No
    hide dot files = Yes
    hide files = 
    hide special files = No
    hide unreadable = No
    hide unwriteable files = No
    mangled names = Yes
    mangling char = ~
    map archive = Yes
    map hidden = No
    map readonly = yes
    map system = No
    preserve case = Yes
    short preserve case = Yes
    store dos attributes = Yes
    veto files = 
    veto oplock files = 
    blocking locks = Yes
    csc policy = manual
    fake oplocks = No
    kernel oplocks = No
    kernel share modes = Yes
    level2 oplocks = Yes
    locking = Yes
    oplock contention limit = 2
    oplocks = Yes
    posix locking = Yes
    strict locking = No
    afs share = No
    available = Yes
    copy = 
    delete readonly = No
    dfree cache time = 0
    dfree command = 
    directory name cache size = 0
    dmapi support = No
    dont descend = 
    dos filemode = Yes
    dos filetime resolution = No
    dos filetimes = Yes
    fake directory create times = No
    follow symlinks = Yes
    fstype = NTFS
    include = 
    magic output = 
    magic script = 
    postexec = 
    preexec = 
    preexec close = No
    root postexec = 
    root preexec = 
    root preexec close = No
    spotlight = No
    volume = 
    wide links = No
    cups options = 
    default devmode = Yes
    force printername = No
    lppause command = 
    lpq command = lpq -P'%p'
    lpresume command = 
    lprm command = lprm -P'%p' %j
    max print jobs = 1000
    max reported print jobs = 0
    printable = No
    print command = lpr -r -P'%p' %s
    printer name = 
    printing = bsd
    printjob username = %U
    print notify backchannel = No
    queuepause command = 
    queueresume command = 
    use client driver = No
    acl allow execute always = Yes
    acl check permissions = Yes
    acl map full control = Yes
    durable handles = Yes
    ea support = Yes
    map acl inherit = No
    nt acl support = Yes
    profile acls = No
    access based share enum = No
    acl group control = No
    admin users = 
    create mask = 0666
    directory mask = 0777
    force create mode = 0000
    force directory mode = 0000
    force group = 
    force unknown acl user = No
    force user = 
    guest ok = No
    guest only = No
    hosts allow = 
    hosts deny = 
    inherit acls = No
    inherit owner = No
    inherit permissions = No
    invalid users = 
    only user = No
    read list = 
    read only = Yes
    smb encrypt = default
    username = 
    valid users = 
    write list = 
    aio read size = 0
    aio write behind = 
    aio write size = 0
    allocation roundup size = 1048576
    block size = 1024
    max connections = 0
    min print space = 0
    strict allocate = No
    strict rename = No
    strict sync = No
    sync always = No
    use sendfile = No
    write cache size = 0
    msdfs proxy = 
    msdfs root = No
    msdfs shuffle referrals = No
    ntvfs handler = unixuid, default
    vfs objects = 

[...]

Here is a screenshot of top with activity per core when I transfer one big file:

Because of a suggestion from an answer, I enabled jumbo frames (9000) and increased the TCP window size to about 4 times higher numbers than what it was, but I still have no better results.

UPDATE: I set up a Fedora 25 machine and ran the same tests and for some reason I am getting the full gigabit speed there. So my guess is that it has to do with the protocol (?) Ubuntu (which I used for testing so far) is using.

My question is similar to this one, but I am running a newer version of Postfix and the answers there didn't really answer my question.

I am running a Debian Jessie server with Postfix 2.11.

So far I understood that Postfix has these checks:

• smtpd_client_restrictions
• smtpd_helo_restrictions
• smtpd_sender_restrictions
• smtpd_relay_restrictions
• smtpd_recipient_restrictions

From what I read, Postfix will process them in the mentioned order.

1. Now my question is, what happens when an entry in any restriction matches to OK? Does it mean that Postfix will skip the remaining checks from that specific *_restriction or will it skip all *_restrictions all together?

2. Are there any other results that can occur apart from OK and REJECT or what are proper values for these checks?

3. What are the other _restrictions used for, if most tutorials only mention smtpd_client_restrictions or smtpd_recipient_restrictions?

What I want to achieve is this:

• Block MTA clients that are known for sending spam (e.g. dynamic IPs or other clients listed in blacklists) and/or are not compliant with the RFC (e.g. non-FQDN address etc.).
• At the same time allow certain clients to bypass this based on a whitelist
• Only allow SASL-authenticated clients to relay mail to other servers and not every whitelisted domain
• Block clients that are impersonating other servers (meaning SPF), including those previously whitelisted (in other words, let whitelisted servers only deliver their mail)
• Add a delay to new servers to further enhance spam protection (Postgrey). This already works quite well and I also created the necessary whitelists for it.

Now, if you answer question 1 either way, putting all checks into one of the *_restrictions mentioned above, will most likely not do the trick, since a whitelist would override the SPF check for example.

Therefore, my configuration looks something like this:

# basic configuration (myorigin, mydomain, etc.)

smtpd_helo_required = yes

smtpd_client_restrictions = check_client_access hash:/etc/postfix/blackwhitelists/whitelisted_client_addresses, 
    check_reverse_client_hostname_access hash:/etc/postfix/blackwhitelists/blacklisted_reverse_hostnames, 
    reject_rbl_client zen.spamhaus.org, reject_rbl_client bl.spamcop.net,
    reject_rbl_client dnsbl.sorbs.net, reject_unknown_client

smtpd_helo_restrictions = permit_sasl_authenticated, permit_mynetworks,
    reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname,
    reject_unknown_helo_hostname, reject_unauth_pipelining

smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks,
    check_sender_access hash:/etc/postfix/blackwhitelists/blacklisted_sender_addresses

smtpd_relay_restrictions = permit_sasl_authenticated, permit_mynetworks,
    reject_unauth_destination

smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks,
    reject_unauth_destination, reject_unauth_pipelining, 
    check_sender_access hash:/etc/postfix/blackwhitelists/whitelisted_sender_addresses, reject_non_fqdn_sender,
    reject_unknown_sender_domain, check_policy_service unix:private/policyd-spf, 
    check_policy_service unix:/var/spool/postfix/postgrey/socket

smtpd_etrn_restrictions = permit_sasl_authenticated, permit_mynetworks, reject

# more basic configuration

As you can see, many options repeat themselves right now, because I am not sure, if I need them in other restrictions too. All in all, I would consider it quite a mess too.

I am also running SpamAssassin for the mail that passes all of these checks.

Since I would like to set the "must staple" attribute in my SSL certificates, I was doing some research to find out if all of my services support OCSP stapling. So far I found out, that Apache does which I was able to confirm using SSLLabs.com.

But apart from that, I wasn't able to confirm, if my two other services (SMTP and IMAP) also support OCSP stapling. Now my question is, do Postfix and Dovecot also support it?

PS: I know that certificates don't seem to be crucial when it comes to mail transport, but I would like to avoid any possible issues, if I do add the attribute and a client might refuse to work because of that, while others could benefit from it.

I updated this post since I replaced the processor, but the core of my question (and unfortunately the results as well) are the same.

I built my first FreeNAS box and wanted to use ECC RAM since I want to store critical data. Because I am on a budget, I wanted to go for the most affordable solution that would still support ECC RAM.

After doing some research, I found out, that I need a motherboard, memory and a CPU that supports ECC. My motherboard of choice is the "Gigabyte X150M-Pro ECC" which has the C232 chipset, DDR4 and a LGA1151 socket.

I also bought a kit of two DIMMs made by Kingston with the model number "KVR21E15S8K2/8" (spec sheet). Gigabyte published a list of tested memory modules and my modules seem to be supported with working ECC (list of supported modules).

Since I am on a budget I needed an affordable Skylake CPU that supports ECC. According to Intel the Celeron G3900 does support ECC, so I went with that one.

After building the computer, I wanted to verify that my system is indeed running with ECC memory and entered the motherboard's BIOS. From various internet sites, I found out that some motherboards have a special section which should tell if ECC is working, but my motherboard doesn't seem to have that. I checked all menus and I couldn't find a similar section.

After doing some more research and found a post over on the Unix&Linux stackexchange which didn't solve my problem. I tried the latest memtest86+ which from what I could tell, doesn't even show the value "ECC". I tried the older 4.20 version that Puget systems used which showed "ECC: off". However after reading the previously mentioned post, I doubt that it tells the truth (maybe that's why the feature was removed?). Both version also didn't read out the correct speed and latency of the DIMM which adds to my doubts towards memtest86+.

Another popular way to find out, if ECC is working, was to issue the dmidecode -t memory command and read out the Total Width and Data Width. My results were 128 Bits and 64 Bits respectively. One part of the output showed details about the memory array which had a key-value pair of Error Correction Type: Single-bit ECC.

I was expecting 72 bits for the Total Width, so I thought it might be related to dual channel and moved the memory modules into two adjacent slots which should prevent dual channel, but the result was the same. Here is the full output of dmidecode -t memory.

I even tried out the interesting C-program that Puget systems published, but the result was 0, indicating no ECC support.

Now I am starting to doubt that the data on Intel's own website is correct and my CPU doesn't actually support ECC. Both the memory and the motherboard are specifically branded with "ECC", so I can rule out those.

Is it possible that the BIOS version needs an update (currently there is none) to enable ECC or is ECC actually already working and I was just not able to verify it? Or is my choice of CPU wrong, if I want to run ECC memory and Intel's website is wrong/misleading?

If my CPU turns out to be the wrong choice, what would be the next best choice for a "budget ECC CPU"?

UPDATE: I saw some new indication that my system actually might be running with ECC enabled and the dmidecode tool just reports weird data. Over at the FreeNAS forum the user Dusan is using server grade hardware (SuperMicro MB, Xeon CPU, Kingston DIMM) and has a similar output with 128 Bits. But he wrote that he is not sure himself, if it actually works.

UPDATE 2: As yagmoth555 mentioned in his answer to this question, it seems that my motherboard only supports ECC with Xeon processors, though I thought that note was a relict from previous manuals that got copied over. I guess that means that I need to look into a Xeon processor.. :-/

UPDATE 3: I bought a Xeon E3-1220v5 now which of course supports ECC and should meet the requirement from the manual. I ran all the tests again to check for ECC functionality and the results are basically identical:

From the comments at Puget Systems, it also seems like that the ecc_check.c program doesn't work on Xeon and Core i7 processors.. :-/

I checked out memtest86+ some more this time and I am fairly certain that it doesn't support DDR4 or the C232 chipset at all, since it reports not only the wrong speed and timings but also DDR3 instead of the installed DDR4. However, it detected processor just fine, but I still got the same end result with both versions of memtest86+:

Version 4.20 doesn't even detect my processor properly..

Any ideas on how else I can test for ECC are very much appreciated.

I am currently using certificates from StartCom for my hosted virtual server. Since StartCom's OCSP servers are quite unstable at times, I was considering moving to Let's Encrypt. Their service is also less troublesome to use.

As far as I found out, the Let's Encrypt certbot creates new key pairs when I request a new certificate, at least for the first time of using it.

Since my server is running with the HPKP header, I can't just replace the key pair, since I configured it to pin the public key.

Now my question is, can I tell the Let's Encrypt certbot to use a given key for the new certificates? Or is there another solution for switching to Let's Encrypt with HPKP?

Update: I just found a post on the Let's Encrypt community forum which says that it's is currently not supported by the Let's Encrypt client as of November 2015. https://community.letsencrypt.org/t/hpkp-best-practices-if-you-choose-to-implement/4625 The only option right now is to pin the intermediate public key, with a backup key for using with a different CA.

If someone knows some more recent news or has a different idea, I am happy to hear.

I am running an email server which is currently set up to use TLS if possible, when sending and receiving emails.

When you read in the documentation about this, there is also the option to enforce TLS and not accept plain text transmission of emails. It also warns you that some mail servers might not support encryption yet and enforcing encryption could block these servers.

But is this still an issue one should think about or is it safe to say that enforcing encryption won't be a problem anymore?

Is there possibly some big provider who is already doing this or what do you consider best practice these days?

I have my Debian (7.9 "wheezy") E-Mail-server (Postfix 2.9.6-2) setup to sign and verify DKIM signatures in e-mail messages using OpenDKIM (version 2.6.8-4).

When I send myself an e-mail from my GMail account, I get the following result in the header of the e-mail:

Authentication-Results: mydomain.com; dkim=fail
    reason="verification failed; insecure key"
    header.d=googlemail.com [email protected] header.b=eKjydWve;
    dkim-adsp=none (insecure policy); dkim-atps=neutral

After researching for a while, I figured out that this is most likely due to lack of DNSsec on my server. Is there a simple way to work around this, or is the only solution, that I set up a local DNS server on it? And how does OpenDKIM know if I use DNSsec and can I just use 8.8.8.8 since it verifies DNSsec?

Edit: Just to clarify, my version of OpenDKIM should be compiled with libunbound since it is a dependency in the Debian package manager.

I am running a Debian 7.9 server with Postfix 2.9.6 and Spamassassin 3.3.2.

One of the standard checks Spamassassin does, is to check for a rDNS record. I am assuming that it gets that info from the Received: from ... header in the message passed on from Postfix.

Now quite often Postfix fails to resolve a hostname for an IP address which unnecessarily gives a worse score than it deserves, since almost all of the times, a hostname actually exists. If I check these messages manually, I can see that the mentioned header often says Received: from example.com (unknown [1.2.3.4]) by ... while at the same time if I try to resolve the IP address myself (in the server's shell) it works without a problem.

What is the issue here? Is there a maybe a too aggressive timeout that doesn't give it enough time? If so, is there a way to adjust this timeout? My server is not getting thousands of messages per minute, so waiting a few more seconds wouldn't hurt. Would switching to DNS over TCP help this issue? If so, how can I tell Postfix to use TCP for DNS queries?

I have my Debian (7.9 "wheezy") E-Mail-server (Postfix 2.9.6-2) setup to sign and verify DKIM signatures in e-mail messages using OpenDKIM (version 2.6.8-4).

My server passes the DKIM test at GMail when I send a mail from my server to their service but when I send a fresh mail back, my server fails to verify the DKIM signature with the following error in the /var/log/mail.log-logfile:

opendkim[3680]: ABCDEF1234: no signing table match for '[email protected]'
opendkim[3680]: ABCDEF1234: s=20120113 d=googlemail.com SSL error:04091068:rsa routines:INT_RSA_VERIFY:bad signature
opendkim[3680]: ABCDEF1234: bad signature data

When I try the same with my Yahoo-Mail address it works as expected and my server verifies the Yahoo-message successfully:

opendkim[3680]: ABCDEF1235: no signing table match for '[email protected]'
opendkim[3680]: ABCDEF1235: DKIM verification successful

Is this an error of the GMail servers or what could I be doing wrong? Could Spamassassin possibly alter the mail before OpenDKIM would process it, in a way that's different from Yahoo's messages, to make the test fail there?

Edit: I had an issue with my DNS on the server but that's now solved. However I am still getting the same result. GMail's messages fail to verify while Yahoo's messages pass without a problem and verify successfully:

opendkim[31437]: ABCDEF123456: nm45-vm6.bullet.mail.ne1.yahoo.com [98.138.121.70] not internal
opendkim[31437]: ABCDEF123456: not authenticated
opendkim[31437]: ABCDEF123456: DKIM verification successful

I'm running a local Debian 8.1 installation with a DNSSEC-validating DNS-Resolver called dnsmasq (version 2.72-3+deb8u1).

I set it up to return a SERVFAIL if it isn't able to validate a DNSSEC-enabled domain, i.e. if the domain has a DNSSEC entry it must validate correctly in order to be forwarded on to the client.

While I was browsing today I wanted to visit the rather famous site of the IETF but I couldn't because the domain couldn't be resolved. I checked with the commandline to verify this and I got indeed a SERVFAIL. I checked with the Google DNS server (8.8.8.8) and got no SERVFAIL but the IP address.

After that I enabled logging for each dns request and checked the results. It seems that my feeling was right and the DNSSEC validation failed, even though it got the same response from the DNS forwarders like I got from Google.

Here the corresponding lines of my syslog:

Sep  5 13:27:13 dnsmasq: query[A] www.ietf.org from 192.168.1.10
Sep  5 13:27:13 dnsmasq: forwarded www.ietf.org to 81.3.21.188
Sep  5 13:27:13 dnsmasq: forwarded www.ietf.org to 178.63.73.246
Sep  5 13:27:13 dnsmasq: dnssec-query[DNSKEY] ietf.org to 81.3.21.188
Sep  5 13:27:13 dnsmasq: dnssec-query[DS] ietf.org to 81.3.21.188
Sep  5 13:27:13 dnsmasq: dnssec-query[DNSKEY] org to 81.3.21.188
Sep  5 13:27:13 dnsmasq: dnssec-query[DS] org to 81.3.21.188
Sep  5 13:27:13 dnsmasq: dnssec-query[DNSKEY] . to 81.3.21.188
Sep  5 13:27:13 dnsmasq: reply . is DNSKEY keytag 1518
Sep  5 13:27:13 dnsmasq: reply . is DNSKEY keytag 19036
Sep  5 13:27:13 dnsmasq: reply org is DS keytag 21366
Sep  5 13:27:13 dnsmasq: reply org is DS keytag 21366
Sep  5 13:27:13 dnsmasq: reply org is DNSKEY keytag 19629
Sep  5 13:27:13 dnsmasq: reply org is DNSKEY keytag 21366
Sep  5 13:27:13 dnsmasq: reply org is DNSKEY keytag 9795
Sep  5 13:27:13 dnsmasq: reply org is DNSKEY keytag 12023
Sep  5 13:27:13 dnsmasq: reply ietf.org is DS keytag 45586
Sep  5 13:27:13 dnsmasq: reply ietf.org is DS keytag 45586
Sep  5 13:27:13 dnsmasq: reply ietf.org is DNSKEY keytag 45586
Sep  5 13:27:13 dnsmasq: reply ietf.org is DNSKEY keytag 40452
Sep  5 13:27:13 dnsmasq: dnssec-query[DNSKEY] cloudflare-dnssec.net to 81.3.21.188
Sep  5 13:27:13 dnsmasq: dnssec-query[DS] cloudflare-dnssec.net to 81.3.21.188
Sep  5 13:27:13 dnsmasq: dnssec-query[DNSKEY] net to 81.3.21.188
Sep  5 13:27:13 dnsmasq: dnssec-query[DS] net to 81.3.21.188
Sep  5 13:27:13 dnsmasq: reply net is DS keytag 35886
Sep  5 13:27:13 dnsmasq: reply net is DNSKEY keytag 45464
Sep  5 13:27:13 dnsmasq: reply net is DNSKEY keytag 35886
Sep  5 13:27:13 dnsmasq: reply cloudflare-dnssec.net is DS keytag 537
Sep  5 13:27:13 dnsmasq: reply cloudflare-dnssec.net is BOGUS DNSKEY
Sep  5 13:27:13 dnsmasq: validation result is BOGUS
Sep  5 13:27:13 dnsmasq: reply www.ietf.org is <CNAME>
Sep  5 13:27:13 dnsmasq: reply www.ietf.org.cdn.cloudflare-dnssec.net is 104.20.0.85
Sep  5 13:27:13 dnsmasq: reply www.ietf.org.cdn.cloudflare-dnssec.net is 104.20.1.85

Now I am not sure if the domain is temporarily misconfigured or my connection is being tampered with or if my DNS server is misconfigured, even though every other domain so far worked fine, including "ietf.org" (without the www).

If someone could help me trace the issue, I would be thankful.

I am currently trying to figure out how I can delete old e-mails in one folder of a Maildir installation on a Debian server. Basically what I want to do is to run a cron job every day or so that checks a specific folder in the Maildir for old e-mails and deletes them if they are older than a set amount of days.

Is there a simple way to filter e-mails from a Maildir by date or do I have to read in every e-mail as text, look for the timestamp, convert it, subtract the mentioned amount of days and then compare it to the current date?

I don't want to invent the wheel if there are already better wheels out there, so I would be glad if someone could help me out in doing this.

Thanks!

Note: I am using Debian 7.8 with Postfix 2.9.6 & Dovecot 2.1.7

Hello members of StackExchange,

I am running a Debian 8.0 server with Full-Disk-Encryption and while I was doing some hardening I went through the /etc/fstab and I was wondering if some partitions were really necessary to be mounted automatically.

After some research I found out that apparently it is not necessary to auto-mount the /boot partition since it is being read otherwise and I would not want some program potentially writing in this rather critical area.

But since my filesystem is encrypted, I am not sure if that is still the case and if in general that answer was correct.

I would be happy if someone could give me an answer on that.

Thanks in advance!