I don't have any problems receiving email from Gmail, or any of the mailing lists that I've signed up for, but for some reason Outlook refuses to send any email to my mailserver.

_handle_client readline: b'EHLO NAM02-BN1-obe.outbound.protection.outlook.com\r\n'                                                                                                           │
('52.100.160.208', 55618) >> b'EHLO NAM02-BN1-obe.outbound.protection.outlook.com'                                                                                                           │
('52.100.160.208', 55618) << b'250-0.0.0.0'                                                                                                                                                  │
('52.100.160.208', 55618) << b'250-SIZE 33554432'                                                                                                                                            │
('52.100.160.208', 55618) << b'250-8BITMIME'                                                                                                                                                 │
EHLO from 'NAM02-BN1-obe.outbound.protection.outlook.com'                                                                                                                                    │
('52.100.160.208', 55618) << b'250-AUTH PLAIN\n250-MAIL\n250 HELP'   

Initially I thought it might be because outlook was pulling some sort of shenanigans with TLS - but completely removing STARTTLS from the response doesn't help. With or without STARTTLS, Outook connects to my mailserver, issues EHLO, and then just... gives up? I don't actually know.

But it does tell me a lie:

1/29/2022 4:39:30 PM - Server at BYAPR05MB6069.namprd05.prod.outlook.com returned '550 5.4.317 Message expired, cannot connect to remote server(451 4.4.0
Socket error SocketError)'
1/29/2022 4:27:02 PM - Server at waynewerner.com (104.236.246.170) returned '450 4.4.317 Cannot connect to remote server [Message=451 4.4.0 Socket error
SocketError] [LastAttemptedServerName=waynewerner.com] [LastAttemptedIP=104.236.246.170:25] [BN7NAM10FT066.eop-nam10.prod.protection.outlook.com](451 4.4.0
Socket error SocketError)'

My server didn't return any 450 4.4.317 that I can see in my logs. I don't even see anywhere in my server source code that response is even supported. Outlook provides https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/mail-flow-intelligence-in-office-365?view=o365-worldwide in the failure email, but the following information:

Error code: 450 4.4.317 Cannot connect to remote server

Typically, this error means Microsoft 365 connected to the destination email server, but the server responded with an immediate error, or doesn't meet the connection requirements. The error details will explain the problem. For example:

    The destination email server responded with a "Service not available" error, which indicates the server is unable to maintain communication with Microsoft 365.
    The connector is configured to require TLS, but the destination email server doesn't support TLS.

Also seems like Outlook is doing something incorrect. Compare that with Google's perfectly reasonable approach:

_handle_client readline: b'EHLO mail-vk1-f175.google.com\r\n'
('209.85.221.175', 42948) >> b'EHLO mail-vk1-f175.google.com'
('209.85.221.175', 42948) << b'250-0.0.0.0'
('209.85.221.175', 42948) << b'250-SIZE 33554432'
('209.85.221.175', 42948) << b'250-8BITMIME'
('209.85.221.175', 42948) << b'250-STARTTLS'
EHLO from 'mail-vk1-f175.google.com'
('209.85.221.175', 42948) << b'250-AUTH PLAIN\n250-STARTTLS\n250 HELP'
_handle_client readline: b'STARTTLS\r\n'
('209.85.221.175', 42948) >> b'STARTTLS'
('209.85.221.175', 42948) << b'220 Ready to start TLS'
_handle_client readline: b'EHLO mail-vk1-f175.google.com\r\n'
('209.85.221.175', 42948) >> b'EHLO mail-vk1-f175.google.com'
('209.85.221.175', 42948) << b'250-0.0.0.0'
('209.85.221.175', 42948) << b'250-SIZE 33554432'
('209.85.221.175', 42948) << b'250-8BITMIME'
('209.85.221.175', 42948) << b'250-AUTH LOGIN PLAIN'
EHLO from 'mail-vk1-f175.google.com'
('209.85.221.175', 42948) << b'250-AUTH PLAIN\n250-STARTTLS\n250-MAIL\n250 HELP'
_handle_client readline: b'MAIL FROM:<[email protected]> SIZE=3159\r\n'

Here we see that Gmail:

• EHLO's
• Gets the response, including STARTTLS
• STARTTLS's
• Starts sending mail

Compared to Outlook that just:

• EHLO's
• Nothing else

I've even double checked and it doesn't look like Outlook is even sending one more byte of data after that.

After a couple of minutes the connection looks to timeout waiting for Outlook to send data:

[2022-01-31 18:04:54,355][mail.log][INFO] ('40.107.93.71', 64992) >> b'EHLO NAM10-DM6-obe.outbound.protection.outlook.com'
[2022-01-31 18:04:54,356][mail.log][DEBUG] ('40.107.93.71', 64992) << b'250-0.0.0.0'
[2022-01-31 18:04:54,356][mail.log][DEBUG] ('40.107.93.71', 64992) << b'250-SIZE 33554432'
[2022-01-31 18:04:54,357][mail.log][DEBUG] ('40.107.93.71', 64992) << b'250-8BITMIME'
[2022-01-31 18:04:54,358][mail.log][DEBUG] ('40.107.93.71', 64992) << b'250-STARTTLS'
[2022-01-31 18:04:54,359][mail.log][DEBUG] ('40.107.93.71', 64992) << b'250-AUTH PLAIN\n250-MAIL\n250 HELP'
[2022-01-31 18:04:54,359][mail.log][DEBUG] ('40.107.93.71', 64992) reading data...
[2022-01-31 18:04:54,360][mail.log][DEBUG] ('40.107.93.71', 64992) peeking
[2022-01-31 18:09:54,356][mail.log][INFO] ('40.107.93.71', 64992) connection timeout
[2022-01-31 18:09:54,358][mail.log][INFO] ('40.107.93.71', 64992) connection lost

Any clue what Outlook could be looking for here that I'm not providing?

I'm not entirely sure what it is I'm looking for here, so I'm not able to effectively search for my answer.

I'm using dehydrated for LetsEncrypt's TLS-ALPN challenges. I'm hosting the service behind nginx by using

stream {
    map $ssl_preread_alpn_protocols $tls_port {
        ~\bacme-tls/1\b 10443;
        default 3443;
    }

    server {
        listen 443;
        listen [::]:443;
        proxy_pass 127.0.0.1:$tls_port;
        ssl_preread on;
    }
}

server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name _;
    return 301 https://$host$request_uri;
}

server {
    listen 3443 ssl;
    listen [::]:3443 ssl;

    server_name wanderingwerners.com www.wanderingwerners.com;

    ssl_certificate /path/to/my/fullchain.pem;
    ssl_certificate_key /path/to/my/privkey.pem;

    index index.html;
    root /var/www/wanderingwerners.com/;
}

This works pretty great - I can get new certs with zero downtime, and my website is accessible. However, when I access my page it works fine. When I hover over a link it shows me https://www.wanderingwerners.com/a-beginning/

Clicking on that link, though, takes me to https://www.wanderingwerners.com:3443/a-beginning/

This is undesirable - I'd prefer it show up as plain ol' https://www.wanderingwerners.com/a-beginning/

I'm assuming that something I have setup here in nginx is what's causing the confusion, but I'm not positive.

Is there a way that I can update my nginx config to still allow the dehydrated server to work, but also tell the browser that :3443 isn't really what they should be connecting to? (Or at least, don't show it in the address bar)

Update

When I do curl https://www.wanderingwerners.com/a-beginning it gives me a 301 redirect. Something is definitely happening with my nginx config here.

Another Update

When I do curl https://www.wanderingwernerx.com/a-beginning/ it works just fine so it looks like it's doing something with the trailing /

I have a problem. chattr +e <file> does not work, if the file does not have the +e attr set on it, or if it's removed and re-added.

[root@ip-203-0-113-13 log]# df -Th
Filesystem     Type      Size  Used Avail Use% Mounted on
devtmpfs       devtmpfs  3.8G     0  3.8G   0% /dev
tmpfs          tmpfs     3.8G     0  3.8G   0% /dev/shm
tmpfs          tmpfs     3.8G  388K  3.8G   1% /run
tmpfs          tmpfs     3.8G     0  3.8G   0% /sys/fs/cgroup
/dev/nvme0n1p1 ext4       30G  1.2G   28G   5% /
tmpfs          tmpfs     763M     0  763M   0% /run/user/1000
[root@ip-203-0-113-13 log]# df -ih
Filesystem     Inodes IUsed IFree IUse% Mounted on
devtmpfs         950K   343  949K    1% /dev
tmpfs            953K     1  953K    1% /dev/shm
tmpfs            953K   389  953K    1% /run
tmpfs            953K    17  953K    1% /sys/fs/cgroup
/dev/nvme0n1p1   1.9M   97K  1.8M    6% /
tmpfs            953K     5  953K    1% /run/user/1000
[root@ip-203-0-113-13 log]# find /tmp -type f | wc -l
6126
[root@ip-203-0-113-13 tmp]# touch bar
[root@ip-203-0-113-13 tmp]# chattr -e bar
[root@ip-203-0-113-13 tmp]# chattr +e bar
chattr: No space left on device while setting flags on bar

Waaaaat?

There is plenty of space on the device and plenty of inodes free, so why is chattr +e failing? If it makes a difference, I'm seeing this failure on Fedora 28 on EC2. I'm not seeing on SUSE 42 on EC2 (yet?)

Update:

I ran strace on the command. I'm not sure if it's helpful, but it seems interesting...

I'm trying to configure Nginx to support Let's Encrypt with TLS-ALPN-01 using dehydrated. In their documentation they have the following for telling Nginx load balancing to direct the request to a server that can serve up the TLS-ALPN-01 challenge. This is the Nginx config:

stream {
  server {
    map $ssl_preread_alpn_protocols $tls_port {
      ~\bacme-tls/1\b 10443;
      default 443;
    }

    server {
      listen 443;
      listen [::]:443;
      proxy_pass 10.13.37.42:$tls_port;
      ssl_preread on;
    }
  }
}

When I put that in my /etc/nginx/nginx.conf it complained about the stream directive. I found some information that said to add this line to the top of my config:

load_module /usr/lib/nginx/modules/ngx_stream_module.so;

That got rid of that complaint, but with this config:

load_module /usr/lib/nginx/modules/ngx_stream_module.so;
user www-data;
worker_processes 4;
pid /run/nginx.pid;

events {
        worker_connections 768;
        # multi_accept on;
}

stream {
  server {
    map $ssl_preread_alpn_protocols $tls_port {
      ~\bacme-tls/1\b 10443;
      default 443;
    }

    server {
      listen 443;
      listen [::]:443;
      proxy_pass 10.13.37.42:$tls_port;
      ssl_preread on;
    }
  }
}

I get this error

nginx: [emerg] "map" directive is not allowed here in /etc/nginx/nginx.conf:13
nginx: configuration file /etc/nginx/nginx.conf test failed

So what do I need to do to correctly get this map working? Do I have to load another module?

I have the following python file:

 import time
 from datetime import datetime


 while True:
     time.sleep(1)
     print(datetime.now())

I've added it to a Dockerfile:

FROM python:3.7


WORKDIR /test
COPY test.py /test/
CMD ["python", "test.py"]

If I build this and run with

sudo docker run -it --name test myimage

everything is awesome. Every second or so it prints the current time.

On the other hand, if I run it with:

sudo docker run -d --name test myimage

It runs off into the background, but if I do...

sudo docker logs test

I get nothing! Not a darn thing.

Any clue why this is happening, or how I could figure it out? Both when I'm using -d and not when I run docker inspect it gives me "Type": "json-file", "Config": {}

I'm runing Docker 18.06.1-ce, build e68fc7a, on Ubuntu 18.04.

Unless every answer that I've read was plain wrong, SNI should make it possible to do what I want, yet every guide tells me to do exactly what I'm doing.

And yet nginx is serving the wrong certificate so I'm clearly doing something wrong.

❯ sudo nginx -V | grep SNI                                                                                                                                                                                                                                                            %1
nginx version: nginx/1.10.3
built with OpenSSL 1.1.0f  25 May 2017
TLS SNI support enabled
configure arguments: --with-cc-opt='-g -O2 -fdebug-prefix-map=/build/nginx-qJwWoo/nginx-1.10.3=. -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2' --with-ld-opt='-Wl,-z,relro -Wl,-z,now' --prefix=/usr/share/nginx --conf-path=/etc/nginx/ngi
nx.conf --http-log-path=/var/log/nginx/access.log --error-log-path=/var/log/nginx/error.log --lock-path=/var/lock/nginx.lock --pid-path=/run/nginx.pid --modules-path=/usr/lib/nginx/modules --http-client-body-temp-path=/var/lib/nginx/body --http-fastcgi-temp-path=/var/lib/nginx/fa
stcgi --http-proxy-temp-path=/var/lib/nginx/proxy --http-scgi-temp-path=/var/lib/nginx/scgi --http-uwsgi-temp-path=/var/lib/nginx/uwsgi --with-debug --with-pcre-jit --with-ipv6 --with-http_ssl_module --with-http_stub_status_module --with-http_realip_module --with-http_auth_reques
t_module --with-http_v2_module --with-http_dav_module --with-http_slice_module --with-threads --with-http_addition_module --with-http_geoip_module=dynamic --with-http_gunzip_module --with-http_gzip_static_module --with-http_image_filter_module=dynamic --with-http_sub_module --wit
h-http_xslt_module=dynamic --with-stream=dynamic --with-stream_ssl_module --with-mail=dynamic --with-mail_ssl_module --add-dynamic-module=/build/nginx-qJwWoo/nginx-1.10.3/debian/modules/nginx-auth-pam --add-dynamic-module=/build/nginx-qJwWoo/nginx-1.10.3/debian/modules/nginx-dav-
ext-module --add-dynamic-module=/build/nginx-qJwWoo/nginx-1.10.3/debian/modules/nginx-echo --add-dynamic-module=/build/nginx-qJwWoo/nginx-1.10.3/debian/modules/nginx-upstream-fair --add-dynamic-module=/build/nginx-qJwWoo/nginx-1.10.3/debian/modules/ngx_http_substitutions_filter_m
odule

Here's what my configs look like:

server {
  listen 443 ssl default_server;
  listen [::]:443 ssl;

  server_name one.example.com;

  ssl on;
  ssl_certificate       /etc/letsencrypt/live/one.example.com/fullchain.pem;
  ssl_certificate_key   /etc/letsencrypt/live/one.example.com/privkey.pem;

  index index.html;
  root /var/www/one.example.com/site;
}

server {
  #listen 443 ssl default_server;
  listen [::]:443 ssl;

  server_name two.example.com;

  ssl on;
  ssl_certificate       /etc/letsencrypt/live/two.example.com/fullchain.pem;
  ssl_certificate_key   /etc/letsencrypt/live/two.example.com/privkey.pem;

  index index.html;
  root /var/www/two.example.com/site;
}

If I have the listen 443 ssl default_server; directive in either server it will return the SSL cert for that server for BOTH domains. If I remove it from both domains then I just get nothing at all - both server domains refuse connections.

What do I have going wrong here? Do I just not understand how SNI works? My nginx has been built with SNI support enabled. And yet... I only get the ssl cert served for one subdomain.

I'm running postfix 3.1 and I just got some email from 183.8.202.206 that said it came from gmail. A quick lookup shows that unless Google has been sold to ChinaNet, that's probably a lie.

Most of the spam that I get comes from a mismatched IP and domain name - is there a way to configure postfix to say something like, "Only accept email from gmail/yahoo/outlook/hotmail addresses if it comes from these IP addresses"?

I've read the postfix docs time and time again, but I don't recall seeing that as a possibility.

According to this answer, the directive:

try_files $uri.html $uri/ =404;

Is supposed to make it so that

only one copy of the resource is served (that with no .html extension)

However, I have this directive in my config:

 server {
  listen 443 ssl default_server;
  listen [::]:443 ssl;

  server_name waynewerner.com www.waynewerner.com;

  ssl_certificate       /etc/letsencrypt/live/www.waynewerner.com/fullchain.pem;
  ssl_certificate_key   /etc/letsencrypt/live/www.waynewerner.com/privkey.pem;

  index index.html;
  root /var/www/waynewerner.com/site/;
  try_files $uri.html $uri/ =404;

  location ^~ /blog {
    alias /usr/share/blog/output;
    break;
  }

  location /.well-known {
    allow all;
    root /var/www/;
  }

  location /.hg {
    deny all;
    return 404;
  }
}

But you'll notice that you can go to both:

• https://waynewerner.com/photography
• https://waynewerner.com/photography.html

(At least that's how they appear in my Google Chrome address bar).

Is this something to worry about, or is Nginx doing the right thing?

I have a postfix setup like this:

     __________                     +-----+     |F|        +-----+
  __(          )____               /     /|     |I|       /     /|
 (___  (         ___)             /     / |     |R|      /     / |
    _(  Internet )     <=====>   +-----+  |  <==|E|==>  +-----+  |
   (___,     )   _)              |  M  |  |     |W|     |  H  |  |
       (_________)               |  A  |  +     |A|     |  O  |  +
                                 |  I  | /      |L|     |  S  | /
                                 |  L  |/       |L|     |  T  |/
                                 +--+--+        | |     +-----+

I have things configured right now to relay email from mail to host. Here's the output of postconf -n on mail:

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = no
config_directory = /etc/postfix
inet_interfaces = all
inet_protocols = ipv4
mailbox_size_limit = 0
message_size_limit = 41943040
mydestination =
myhostname = example.com
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 203.0.113.190
readme_directory = no
recipient_delimiter = +
relay_domains = host.example.com, example.com, example.org,
relayhost = [host.example.com]:587
smtp_tls_CApath = /etc/ssl/certs
smtp_tls_loglevel = 1
smtp_tls_security_level = may
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_banner = $myhostname ESMTP $mail_name
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination,
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, defer_unauth_destination,
smtpd_sasl_auth_enable = yes
smtpd_sasl_path = smtpd
smtpd_sasl_security_options = noanonymous, noplaintext,
smtpd_sasl_tls_security_options = noanonymous,
smtpd_sasl_type = cyrus
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file = /etc/ssl/private/ssl-cert-snakeoil.key
smtpd_tls_loglevel = 1
smtpd_tls_mandatory_ciphers = high
smtpd_tls_mandatory_exclude_ciphers = aNULL, MD5,
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3,
smtpd_tls_security_level = may
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
tls_preempt_cipherlist = yes

This works perfectly - I can send mail from gmail and other providers and they properly end out in my mailbox on host.

However, when I try to send email from host I'm pretty sure it's trying to relay the email back from mail to host. I see this in the host logs:

Dec 28 16:44:28 host postfix/submission/smtpd[29743]: warning: hostname mail2.example.com does not resolve to address 203.0.113.14: Name or service not known
Dec 28 16:44:28 host postfix/submission/smtpd[29743]: connect from unknown[203.0.113.14]
Dec 28 16:44:28 host postfix/submission/smtpd[29743]: Anonymous TLS connection established from unknown[203.0.113.14]: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
Dec 28 16:44:28 host postfix/submission/smtpd[29743]: NOQUEUE: reject: RCPT from unknown[203.0.113.14]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<example.com>
Dec 28 16:44:28 host postfix/submission/smtpd[29743]: disconnect from unknown[203.0.113.14]

And then on mail I'm getting these logs:

Dec 28 16:54:27 mail postfix/smtp[17899]: Untrusted TLS connection established to host.example.com[203.0.113.190]:587: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
Dec 28 16:54:28 mail postfix/smtp[17899]: 7B6A620FFB: to=<[email protected]>, relay=host.example.com[203.0.113.190]:587, delay=1064, delays=1063/0.01/0.71/0.08, dsn=4.7.1, status=deferred (host host.example.com[203.0.113.190] said: 454 4.7.1 <[email protected]>: Relay access denied (in reply to RCPT TO command))

On host, here's my postconf -n output:

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = no
config_directory = /etc/postfix
inet_interfaces = all
inet_protocols = ipv4
mailbox_size_limit = 0
message_size_limit = 41943040
mydestination = host, host.example.com, example.com
myhostname = host.example.com
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
readme_directory = no
recipient_delimiter = +
relay_domains = $mydestination
relayhost = example.com:587
smtp_tls_CApath = /etc/ssl/certs
smtp_tls_loglevel = 1
smtp_tls_security_level = may
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_banner = $myhostname ESMTP $mail_name
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination,
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, defer_unauth_destination,
smtpd_sasl_auth_enable = yes
smtpd_sasl_path = smtpd
smtpd_sasl_security_options = noanonymous, noplaintext,
smtpd_sasl_tls_security_options = noanonymous,
smtpd_sasl_type = cyrus
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file = /etc/ssl/private/ssl-cert-snakeoil.key
smtpd_tls_loglevel = 1
smtpd_tls_mandatory_ciphers = high
smtpd_tls_mandatory_exclude_ciphers = aNULL, MD5,
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3,
smtpd_tls_security_level = may
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
tls_preempt_cipherlist = yes
postconf: warning: /etc/postfix/main.cf: unused parameter: compatibility_level=2

Basically what I want:

On host or mail:

• if email is sent to wayne@host, wayne@mail, [email protected], [email protected], [email protected] I want that to be delivered to the local user on `host.
• if email is sent to anywhere else - [email protected], [email protected], [email protected] or wherever it happens to be - I want host to relay through mail, and I want mail to send the email to whatever server that it's supposed to send it to.

How do I configure postfix to properly do this?

I'm trying to use the manuale application to register my domains with Letsencrypt, but I'm running into this problem:

urn:acme:error:connection

Here's how I'm running it:

⚘ manuale authorize home.waynewerner.com waynewerner.com
Requesting challenge for home.waynewerner.com.
Requesting challenge for waynewerner.com.
DNS verification required. Make sure these TXT records are in place:
  _acme-challenge.waynewerner.com.  IN TXT  "<Some key>"
  _acme-challenge.home.waynewerner.com.  IN TXT  "<some other key>"

So I signed into my namecheap dashboard and in my host records I added two new TXT records. In the host field I tried it both ways, with @ and home and with _acme-challenge.waynewerner.com and _acme-challenge.home.waynewerner.com. Then the value fields contained <Some key> and <some other key> (without quotes).

And yet I still get:

home.waynewerner.com: waiting for verification. Checking in 5 seconds.
home.waynewerner.com: DNS problem: NXDOMAIN looking up TXT for _acme-challenge.home.waynewerner.com (urn:acme:error:connection)
waynewerner.com: waiting for verification. Checking in 5 seconds.
waynewerner.com: DNS problem: NXDOMAIN looking up TXT for _acme-challenge.waynewerner.com (urn:acme:error:connection)
0 domain(s) authorized, 2 failed.
Authorized: N/A
Failed: home.waynewerner.com waynewerner.com

What am I doing wrong here? I've verified that if I use the @ and home hosts then

dig -t txt home.waynewerner.com
dig -t txt waynewerner.com

both provide the keys that I set in my DNS.

At the top of /etc/audit/audit.rules on Centos7 it tells me:

## This file is automatically generated from /etc/audit/rules.d

Okay, so I went and looked, and found /etc/audit/rules.d/audit.rules. It had the following line

# Feel free to add below this line. See auditctl man page

Which I did, and found what looked like maybe it was the option:

 -R file
        Read rules from a file. The rules must be 1 per line and in the order that they are to be executed in. The rule file must  be
        owned  by  root  and not readable by other users or it will be rejected. The rule file may have comments embedded by starting
        the line with a '#' character. Rules that are read from a file are identical to what you would type on a command line  except
        they  are  not preceded by auditctl (since auditctl is the one executing the file) and you would not use shell escaping since
        auditctl is reading the file instead of bash.

But I ran auditctl -R /etc/audit/rules.d/audit.rules which seemed to work, however it didn't do anything to /etc/audit/audit.rules.

What's the right way to regenerate that file?

The Setup

I have this in my /etc/rsyslog.conf:

$template local1DynFile,"/path/to/my/log/%programname%.log.%NOW%
$template local1LogFormat,"%msg:2:$:%\n"

*,*;auth,authpriv,local0,local1.none          ~/var/log/syslog

local1.*                                      ?local1DynFile;local1LogFormat

Then I have the following Python script (test.py):

import logging
import logging.handlers

logger = logging.getLogger('pxet.foo')
logger.addHandler(logging.handlers.SysLogHandler(address='/run/systemd/journal/syslog', facility='local1'))
logger.handlers[0].setLevel(logging.DEBUG)
logger.setLevel(logging.DEBUG)

logger.debug('test cockroach is a bug')

The Problem

If I do the following:

rm -rf /path/to/my/log
systemctl restart rsyslog
python test.py

I get no log message. However:

mkdir -p /path/to/my/log
python test.py

And it all works.

The Question

Is it possible for me to make rsyslog create the directories if they do not exist, or do I have to do that myself?

I have a sneaking suspicion it has something to do with me mucking about with my rsyslog.conf, but I'm not 100% sure about that.

I am running Centos 7, and SELinux has been working A-OK. However, I tried to follow these instructions and SELinux did not deny.

I did the following:

useradd fnord
echo "fnord:user_u:s0-s0:c0.c1023" >> /etc/selinux/targeted/seusers
setsebool user_exec_content off
sudo su - fnord
cp /bin/ls /tmp
/tmp/ls

The /tmp/ls command worked just fine. I tried with and without the -P flag, but it doesn't make any difference.

I'm trying to trigger some SELinux log message, because /var/audit/audit.log is empty no matter what I do. I know that SELinux is enforcing things, because rsyslog is setup to send certain logs to /company/var/log/, but those logs do not get written. If I change SELinux to permissive instead of enforcing they do get written. But nothing writes to /var/audit/audit.log anymore. It definitely used to - I have audit.log.1 and other rolled over files.

I thought initially that it may have been /etc/rsyslog.d/listen.conf, I had changed the contents from $SystemLogSocketName /run/systemd/journal/syslog to $SystemLogSocketName /dev/log but I have since changed it back and restarted rsyslog. And still nothing shows up in audit.log.

How can I discover why this doesn't log right?

I have a VM created from Vagrant centos/7.

I'm trying to install docker, but it doesn't work. I tried with a SaltStack minion and just vagrant ssh and sudo yum install. But it tells me that it can't find these dependencies:

--> Finished Dependency Resolution
Error: Package: docker-engine-1.9.1-1.el7.centos.x86_64 (docker_repo)
           Requires: libcgroup
Error: Package: docker-engine-selinux-1.9.1-1.el7.centos.noarch (docker_repo)
           Requires: policycoreutils-python
 You could try using --skip-broken to work around the problem
 You could try running: rpm -Va --nofiles --nodigest

I don't think either of the suggested solutions will do what I need. I've Googled around but all I get are links to rpmfind or rpmbone and sure, they may provide an rpm I could download but I'm pretty sure these should be in a repository somewhere.

yum repolist gives me this:

repo id                                                                  repo name                                                                                             status
docker_repo                                                              Docker Repository                                                                                        14
*epel/x86_64                                                             Extra Packages for Enterprise Linux 7 - x86_64                                                        8,842
extras/7/x86_64                                                          CentOS-7 - Extras                                                                                       278
repo-saltstack-el7                                                       SaltStack EL7 Repo                                                                                       92
updates/7/x86_64                                                         CentOS-7 - Updates                                                                                    1,726
repolist: 10,952

I'm a bit of a HAProxy newbie - I've got 3 docker containers, one running HAProxy with the following config:

global                                                                             
  log 127.0.0.1 local0                                                             
  log 127.0.0.1 local1 notice                                                      
  chroot /var/lib/haproxy                                                          
  user haproxy                                                                     
  group haproxy                                                                    
  stats socket /var/run/haproxy.sock mode 600 level admin                          
  # daemon                                                                         

defaults                                                                           
  log global                                                                       
  mode http                                                                        
  option httplog                                                                   
  option dontlognull                                                               
  timeout connect 5000ms                                                           
  timeout client 50000ms                                                           
  timeout server 50000ms                                                           
  balance source                                                                   

listen stats :80                                                                   
  stats enable                                                                     
  stats uri /haproxy?stats                                                         
  stats realm Strictly\ Private                                                    
  stats auth test:test1234                                                         
  balance roundrobin                                                               
  #option forwardfor                                                               
  default_backend myserv-legacy                                                    

backend myserv-legacy                                                              
  cookie SERVERID insert indirect preserve                                         
  server myserv-A ${MYSERVA_PORT_8080_TCP_ADDR}:8080 cookie A check               
  server myserv-B ${MYSERVB_PORT_8080_TCP_ADDR}:8080 cookie B check  

The other two servers are running a webapp using Tomcat.

I brought my two servers down with sudo docker stop myservA myservB, and though I've started them and can connect to them through their exposed ports, they both show as down in HAProxy with a L4TOUT in 2000ms.

Any clue why they wouldn't be showing up as available?

edit:

If I run

$ sudo docker stop haprox && sudo docker start haprox

(haprox is the name of my HAProxy container) then my servers are available again...

One technique for preventing spammers hosing your SMTP server is to set your lowest MX record to something fake.

I'm having an issue with Postfix not being able to connect to the Meaningful Use Transport Testing Tool.

From mail.log:

Apr 7 12:03:11 myserver postfix/smtp[36868]: 1F119B60AEC: to=, relay=none, delay=265111, delays=265110/0.06/0/0, dsn=4.4.1, status=deferred (connect to transport-testing.dnsops.gov[129.6.24.80]:25: Connection refused)

I can send emails to the TTT from Outlook or Gmail, so I know that much works. Does Postfix try to hit the other MX records if it gets a connection refused?

I have the following setup in my Nginx (1.2.6 on Windows 7) conf file:

location ~ ^/FOO/(.*)$ {
    proxy_pass    http://server_two:8888/FOO/$1;
}

On server_two I have IIS7 running a WCF service that uses basic authentication. When I visit http://server_two:8888/FOO/Service.svc?wsdl I get the correct endpoint.

When I visit http://myhost/FOO/Service.svc?wsdl I get a user/pass box that pops up. I can enter my credentials until the cows come home and still nothing. I've also tried the following:

location ~ ^/FOO/(.*)$ {
    proxy_pass    http://server_two:8888/FOO/$1;
    proxy_set_header Host $host;
    proxy_set_header X-Accel-Expires 0;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

And several other variants, but as yet I'm not able to get the login process to work. Is this possible with Nginx? What am I missing?

UPDATE:

I forgot to mention, IIS is setup to do an HTTP 401 Challenge for Windows Authentication

I've installed OSSEC on my server and I've been getting reports similar to the following:

Jan 11 19:27:03 Daddy sshd[14459]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.215.184.93 user=root
Jan 11 19:26:54 Daddy sshd[14457]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.215.184.93 user=root

Repeated about 10 times per email. So far not a day has gone by without 3 or 4 of these emails from OSSEC. Of course my initial emotion is a bit of rage and "how dare they try to hack into my box!" but I guess that's the state of the 'net these days anyway. The other day I also had someone try with user bin

I also recieved this message:

Jan 12 02:04:07 Daddy sshd[16109]: reverse mapping checking getaddrinfo for static-52-53.mk-net.ru [91.211.52.53] failed - POSSIBLE BREAK-IN ATTEMPT!

(again, with multiple repeats)

I know at least one benign source of the reverse mapping comes from freenode when they try to make sure you're not a likely botnet, but I haven't gone checking about that source.

We're pretty sensitive about the issue of vulnerabilities, especially since a previous server was hacked (probably) via phpMyAdmin.

So obviously any advice/resources for securing our server would be appreciated, but my main question is this: should we be worried about these break-in attempts? The root user has no password (login disabled) so is it safe to ignore these failed logins? Is there anything else that I could or should do to limit the possible vulnerabilities along this avenue? This system is behind a router with only essential (e.g. services we're using) ports open (ssh, apache, and postfix).

I've noticed that when I add myself to a new group with usermod newgroup -g wayne I will have the group listed when I say groups, but if I were to do something such as

sudo mkidr /usr/local/grouptest
sudo chown root:newgroup /usr/local/grouptest
cd /usr/local/grouptest
touch test.txt
touch: cannot touch `test.txt': Permission denied

I get permission denied. When I'm connected across a ssh session, I have to re-connect and then the permissions are in effect for that directory. Is there a way to get around that? Especially since using GNU screen, I would have to kill and re-create all my windows which would be incredibly pesky.

Any help would be greatly appreciated!

I've got a box running Ubuntu 10.04, and I have Apache2 installed. When I'm on the box I can go to http://localhost/ and it connects to the web server fine. I can also go directly to my IP and connect no problem. However, if I try to connect from another computer on the network, either through the DNS or direct IP, my connection times out.

However, I can connect to the box via SSH just fine, as well as ping the box.

Any ideas?

Thanks

UPDATE:

When running nmap on the local computer I get the following:

wayne@media-box:~$ sudo nmap -sS -O -PI -PT 192.168.1.70

Starting Nmap 5.00 ( http://nmap.org ) at 2010-06-28 06:32 CDT
Interesting ports on media-box (192.168.1.70):
Not shown: 995 closed ports
PORT    STATE SERVICE
22/tcp  open  ssh
25/tcp  open  smtp
80/tcp  open  http
143/tcp open  imap
993/tcp open  imaps

However, if I run it from another box on the network:

Starting Nmap 5.00 ( http://nmap.org ) at 2010-06-28 06:32 CDT
Interesting ports on media-box (192.168.1.70):
Not shown: 998 filtered ports
PORT    STATE  SERVICE
22/tcp  open   ssh
113/tcp closed auth

So 80 is open to the box itself but not the outside world? How do I fix that?