Our company uses AWS, however the owners are not technical people. Legal aspect aside, is it possible to gain access to an AWS organization if the CTO doesn't want to give back username and password?
Let's keep in mind that private keys, cli access, ARM everything is on CTO's hand.
If so what is the procedure?
I have a nice VPS with 4 cores, 180ssd, 8gb of ram.
My website is a custom website, that autogenerates from a database, and on the first run it is cached in memory using redis.
The issue that I am having is that sometimes, specially after I flush redis, I get 503 on the website, I have some other domains on the same server and they are fine.
I am using Apache2 and nginx as a proxy to apache.
I have checked logs for errors, and nothing strange there, I enabled slow queries on mariadb to see if any query was killing the server and nothing there too.
What steps can be performed to debug a possible cause for this?
I started received a small number of queries from my website so I believe I maybe having this issue a lot but never noticed it before.
I've a new VPS, and since then I haven't been able to send email notifications. At first the port 25 for outbound traffic was blocked, now it is ok. But my ip was added to a black list, with this reason:
CBL Lookup Utility
IP Address xx.xx.xx.xx is listed in the CBL. It shows signs of being
infected with a spam sending trojan, malicious link or some other form of botnet.
It was last detected at 2016-11-08 03:00 GMT (+/- 30 minutes), approximately 10
hours ago.
This IP address is HELO'ing as "localhost.localdomain"
which violates the relevant standards (specifically: RFC5321).
The CBL does not list for RFC violations per-se. This _particular_ behaviour,
however, correlates strongly to spambot infections.
In other words, out of thousands upon thousands of IP
addresses HELO'ing this way, all but a handful are infected
and spewing junk. Even if it isn't an infection, it's a misconfiguration that
should be fixed, because many spam filtering mechanisms
operate with the same rules, and it's best to fix it
regardless of whether the CBL notices it or not.
DO NOT TELNET TO YOUR SERVER TO SEE WHAT IT SAYS.
Telnet will show you the banner, not the HELO."
So in the maillog I have something like this:
(mxeue002) Nemesis ESMTP Service not available 554-No SMTP service 554-IP
address is black listed. 554 For explanation visit
When I telnet the server, I get:
Escape character is '^]'.
220 localhost.localdomain ESMTP Postfix
The provider is 1and1. I have full root control in the server.
I have been struggle with an issue for the last 3 weeks. I've recently acquired a new vps server, and for some reason something is blocking port 25 and I cannot find what.
Step to reproduce:
telnet smtp.1and1.es 25
I checked - DNS and are fine as the domain is converted to the ip, and ping work as expected.
I have disabled fail2ban and firewall by doing:
service fail2ban stop service firewalld stop
Tried again, telnet smtp.1and1.es 25
And same result timeout.
All maillogs show unreachable host on port 25, for all emails notifications.
It is a VPS so there is an external firewall, the external firewall is all open.
So I wondering what else cloud be blocking the port?
It is definitely an issue with outgoing traffic on 25. But I can't find what is blocking it.
iptables -L
Chain INPUT (policy DROP)
target prot opt source destination
f2b-plesk-wordpress tcp -- anywhere anywhere multiport dports http,https,empowerid,7081
f2b-plesk-login tcp -- anywhere anywhere multiport dports cddbp-alt,pcsync-https
f2b-BadBots tcp -- anywhere anywhere multiport dports http,https,empowerid,7081
f2b-apache tcp -- anywhere anywhere multiport dports http,https,empowerid,7081
f2b-plesk-roundcube tcp -- anywhere anywhere multiport dports http,https,empowerid,7081
f2b-plesk-horde tcp -- anywhere anywhere multiport dports http,https,empowerid,7081
f2b-plesk-dovecot tcp -- anywhere anywhere multiport dports imap,imap3,imaps,pop3,pop3s,sieve
f2b-plesk-postfix tcp -- anywhere anywhere multiport dports smtp,urd,submission
f2b-plesk-proftpd tcp -- anywhere anywhere multiport dports ftp,ftp-data,ftps,ftps-data
f2b-recidive tcp -- anywhere anywhere
f2b-SSH tcp -- anywhere anywhere tcp dpt:ssh
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
REJECT tcp -- anywhere anywhere tcp flags:!FIN,SYN,RST,ACK/SYN state NEW reject-with tcp-reset
DROP all -- anywhere anywhere state INVALID
ACCEPT all -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere tcp dpt:12443
ACCEPT tcp -- anywhere anywhere tcp dpt:11443
ACCEPT tcp -- anywhere anywhere tcp dpt:11444
ACCEPT tcp -- anywhere anywhere tcp dpt:8447
ACCEPT tcp -- anywhere anywhere tcp dpt:pcsync-https
ACCEPT tcp -- anywhere anywhere tcp dpt:cddbp-alt
ACCEPT tcp -- anywhere anywhere tcp dpt:http
ACCEPT tcp -- anywhere anywhere tcp dpt:https
ACCEPT tcp -- anywhere anywhere tcp dpt:ftp
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
ACCEPT tcp -- anywhere anywhere tcp dpt:submission
ACCEPT tcp -- anywhere anywhere tcp dpt:smtp
ACCEPT tcp -- anywhere anywhere tcp dpt:urd
ACCEPT tcp -- anywhere anywhere tcp dpt:pop3
ACCEPT tcp -- anywhere anywhere tcp dpt:pop3s
ACCEPT tcp -- anywhere anywhere tcp dpt:imap
ACCEPT tcp -- anywhere anywhere tcp dpt:imaps
ACCEPT tcp -- anywhere anywhere tcp dpt:poppassd
ACCEPT tcp -- anywhere anywhere tcp dpt:mysql
ACCEPT tcp -- anywhere anywhere tcp dpt:postgres
ACCEPT tcp -- anywhere anywhere tcp dpt:ogs-server
ACCEPT tcp -- anywhere anywhere tcp dpt:glrpc
ACCEPT udp -- anywhere anywhere udp dpt:netbios-ns
ACCEPT udp -- anywhere anywhere udp dpt:netbios-dgm
ACCEPT tcp -- anywhere anywhere tcp dpt:netbios-ssn
ACCEPT tcp -- anywhere anywhere tcp dpt:microsoft-ds
ACCEPT udp -- anywhere anywhere udp dpt:openvpn
ACCEPT udp -- anywhere anywhere udp dpt:domain
ACCEPT tcp -- anywhere anywhere tcp dpt:domain
ACCEPT icmp -- anywhere anywhere icmptype 8 code 0
ACCEPT all -- anywhere anywhere
Chain FORWARD (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
REJECT tcp -- anywhere anywhere tcp flags:!FIN,SYN,RST,ACK/SYN state NEW reject-with tcp-reset
DROP all -- anywhere anywhere state INVALID
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
Chain OUTPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
REJECT tcp -- anywhere anywhere tcp flags:!FIN,SYN,RST,ACK/SYN state NEW reject-with tcp-reset
DROP all -- anywhere anywhere state INVALID
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
Chain f2b-BadBots (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
Chain f2b-SSH (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
Chain f2b-apache (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
Chain f2b-plesk-dovecot (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
Chain f2b-plesk-horde (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
Chain f2b-plesk-login (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
Chain f2b-plesk-postfix (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
Chain f2b-plesk-proftpd (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
Chain f2b-plesk-roundcube (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
Chain f2b-plesk-wordpress (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
Chain f2b-recidive (1 references)
target prot opt source destination
REJECT all -- 223.71.208.114 anywhere reject-with icmp-port-unreachable
REJECT all -- 221.229.172.75 anywhere reject-with icmp-port-unreachable
REJECT all -- 278660.customer.zol.co.zw anywhere reject-with icmp-port-unreachable
REJECT all -- 118.70.168.251 anywhere reject-with icmp-port-unreachable
RETURN all -- anywhere anywhere
I've recently upgraded my VPS to a 4cores, 8gb ram and 180gb ssd. This VPS comes with 500 free email accounts with 2gb each. This weekend I will migrate from the old VPS to this new VPS everything, so I will recreate all email accounts, etc, and I am now questioning myself if should I still using the free email accounts or use the VPS as mail server too, the only reason why I would like to have my own mail server is because I would like to authenticate my emails with DKIM and SPF, as some of them are currently going to Spam I believe this will improve the delivery rate. So my question is, is it possible to authenticate those free accounts DKIM and SPF if I have access to the DNS of my domain, please note I have no control at all of those emails, the only control I have is that I can create and delete accounts, but I mean I don't console access or anything to mail server. For your context, the VPS is with 1and1 and the free accounts too.
Please note I have no experience with Mail Servers and DNS, I am php developer.