giorgio79's questions

PS: I seem to have solved this issue by adding all my domains to $mydestinations. I still do not understand why virtual_alias_maps seems to be ignored when looking for valid mydestinations.

After updating postfix, it started rejecting emails from external domains to my virtual domains (managed by Virtualmin / Webmin) on the server. My virtual domains in turn just forward these messages to gmail.

Mar 26 13:48:08 CentOS-72-64-minimal postfix/smtpd[10252]: connect from nm3-vm8.bullet.mail.gq1.yahoo.com[98.136.218.151]
Mar 26 13:48:08 CentOS-72-64-minimal postfix/smtpd[10252]: NOQUEUE: reject: RCPT from nm3-vm8.bullet.mail.gq1.yahoo.com[98.136.218.151]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<nm3-vm8.bullet.mail.gq1.yahoo.com>
Mar 26 13:48:09 CentOS-72-64-minimal postfix/smtpd[10252]: disconnect from nm3-vm8.bullet.mail.gq1.yahoo.com[98.136.218.151]

I understand based on these issues (all related)

• NOQUEUE: reject: RCPT from on freebsd and postfix
• SMTP don't work when try to send mail from mail client

that this error is due to defer_unauth_destination default postfix setting.

However, I have a working virtual_alias_maps, but this map seems to be ignored by postfix as [email protected] is present in there and is set to forward to [email protected].

Here is my postconf -n

[root@host ~]# postconf -n
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
debug_peer_level = 2
debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin ddd $daemon_directory/$process_name $process_id & sleep 5
html_directory = no
inet_protocols = all
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
newaliases_path = /usr/bin/newaliases.postfix
readme_directory = /usr/share/doc/postfix-2.10.1/README_FILES
sample_directory = /usr/share/doc/postfix-2.10.1/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
unknown_local_recipient_reject_code = 550
virtual_alias_maps = hash:/etc/postfix/virtual

Would you have any tips what I need to do to get this working?

I have CentOS 7 with firewalld. I installed fail2ban and using the firewallcmd-new action. I am seeing bans in the fail2ban logs, and I want to check in firewallcmd if they are blocked. How can I do it?

When running

[root@host ~]# firewall-cmd --get-active-zones
[root@host ~]#
[root@host ~]# firewall-cmd --get-default-zone
public

I am not getting any active zones. How can I activate a zone?

I am seeing such an error when starting the postfix server, and also lots fo failures when watching the maillog. How can I solve this issue?

Jan 13 22:43:46 CentOS-72-64-minimal postfix/master[1651]: warning: process /usr/libexec/postfix/smtp pid 1297 exit status 1
Jan 13 22:43:46 CentOS-72-64-minimal postfix/master[1651]: warning: /usr/libexec/postfix/smtp: bad command startup -- throttling
Jan 13 22:43:47 CentOS-72-64-minimal postfix/qmgr[1653]: warning: private/smtp socket: malformed response
Jan 13 22:43:47 CentOS-72-64-minimal postfix/qmgr[1653]: warning: transport smtp failure -- see a previous warning/fatal/panic logfile record for the problem description

Here is the result of postconf -n

[root@host ~]# postconf -n
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
allow_percent_hack = no
broken_sasl_auth_clients = yes
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
debug_peer_level = 2
debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin ddd $daemon_directory/$process_name $process_id & sleep 5
home_mailbox = Maildir/
html_directory = no
inet_interfaces = localhost
mail_owner = postfix
mailbox_command = /usr/bin/procmail-wrapper -o -a $DOMAIN -d $LOGNAME
mailbox_size_limit = 0
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
mydestination = $myhostname, localhost.$mydomain, localhost
newaliases_path = /usr/bin/newaliases.postfix
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix-2.10.1/README_FILES
sample_directory = /usr/share/doc/postfix-2.10.1/samples
sender_bcc_maps = hash:/etc/postfix/bcc
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtp_generic_maps = hash:/etc/postfix/generic
smtpd_recipient_restrictions = permit_mynetworks permit_sasl_authenticated reject_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
unknown_local_recipient_reject_code = 550
virtual_alias_maps = hash:/etc/postfix/virtual

PS Running

 postmap /etc/postfix/generic

seems to have solved the issue...

I changed the ssh port to an arbitrary number, and noticed firewalld no longer allowed ssh login. I assume the port 22 is hardcoded in the ssh service definition for firewalld. Is it enough if I allow the new port for TCP traffic, or should I define a new service for the custom ssh port?

I would like to add ".googlebot.com" to the ignore iplist for fail2ban since the ignoreip explanation mentions DNS host as an accepted input. Is this a proper format?

# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.

I am seeing this SPF softfail for emails sent from my server, and I notice that 2a01:4f8:121:2062::2 is an IPV6 address. When I check 2a01:4f8:121:2062::2 it is translated as 0.0.0.2 ipv4, so that ipv6 address seems bogus.

I have a Centos server that does not have ipv6 configured, and I left everything at default.

How can I solve this? Should I disable ipv6 on my server? Is postfix responsible for this? Why postfix sends mail with ipv6 when I never configured it?

As requested (I redacted my valid ipv4 address with XX)

[root@host ~]# ifconfig -a

eth0      Link encap:Ethernet  HWaddr XX:XX:XX:2B:97:82
          inet addr:XX.XXX.XXX.XX  Bcast:XX.XXX.XXX.XX  Mask:255.255.255.255
          inet6 addr: 2a01:4f8:121:2062::2/64 Scope:Global
          inet6 addr: fe80::4261:86ff:fe2b:9782/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:5906959065 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3933424961 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:6766726597523 (6.1 TiB)  TX bytes:1315274953503 (1.1 TiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:34502551 errors:0 dropped:0 overruns:0 frame:0
          TX packets:34502551 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:37797695084 (35.2 GiB)  TX bytes:37797695084 (35.2 GiB)`

I am using webmin (which uses yum) to install updates on my server, and it somestimes updates kernel as well including kernel-firmware and kernel-headers. Do I need to restart the server after a kernel update?

I created a swap file with root on a running server, using swapfile creation guides which I found on the net (http://blog.serverbuddies.com/adding-additional-swap-space-to-your-linux-server/m Create swap file on a running Linux machine, and http://www.cyberciti.biz/faq/linux-add-a-swap-file-howto/)

I made sure that I have plenty of disk space

df -h

showed

[root@host /]# df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/md2             1016G  338G  628G  35% /
/dev/md1              496M  116M  356M  25% /boot
/dev/md3              1.7T  169G  1.5T  11% /home

, and after issuing the command

dd if=/dev/zero of=/swapfile bs=1024 count=8290304

The putty terminal became unresponsive, and the server became unresponsive as well (apache and other services crashed, network connections were closed). So, I executed a hardware reset, and everything is back and working fine. I can see the /swapfile with a zero size, and /var/log/messages has no info on this event. Is it safe to delete that file and reattempt creating it? Also why would a server crash at all with a dd command? I had no swap file prior to this config attempt.

UPDATE: Based on symcbean's answer I run the command again with success! The load did go up to 20 while dd was running, so that may have caused issues the last time...

[root@host /]# dd if=/dev/zero of=/swapfile1 bs=1024 count=8290304
8290304+0 records in
8290304+0 records out
8489271296 bytes (8.5 GB) copied, 135.989 s, 62.4 MB/s

I have php 5.3.10 (and CentOS 6) and as I understand enchant automatically comes with it. When I try to run an example like

$tag = 'en_US';
$r = enchant_broker_init();
$bprovides = enchant_broker_describe($r);
echo "Current broker provides the following backend(s):\n";
print_r($bprovides);

I get this php fatal error: PHP Fatal error: Call to undefined function enchant_broker_init()

I can also see this in my php configure command outputted with phpinfo

-with-enchant=shared,/usr' '--with-recode=shared,/usr'

Do I need to add sg perhaps to php.ini?

When I try to traceroute to a remote ip, I get send: Operation not permitted When I stop iptables, traceroute works fine. So, I assume I need some ip rule for send. What would that rule be?

I did find a solution here http://forums.fedoraforum.org/showthread.php?t=112516, and I add it to my iptables, restart it, but then after a while CSF seems to block send again. Something overwrites that rule.

I have received 47 000 hits in the past couple of hours from a single domain. I researched FunWebProducts but it seems to be some kind of a plugin, not sure how this is possible?

89.70.25.120 - - [03/Sep/2012:07:19:12 +0200] "POST /user/login HTTP/1.0" 200 18127 "http://xxxyyyzzzsitename.com/user/login" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; FunWebProducts; MRA 4.6 (build 01425); .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
89.70.25.120 - - [03/Sep/2012:07:19:13 +0200] "POST /user/login HTTP/1.0" 200 18127 "http://xxxyyyzzzsitename.com/user/login" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; FunWebProducts; MRA 4.6 (build 01425); .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
89.70.25.120 - - [03/Sep/2012:07:19:14 +0200] "POST /user/login HTTP/1.0" 200 18127 "http://xxxyyyzzzsitename.com/user/login" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; FunWebProducts; MRA 4.6 (build 01425); .NET CLR 1.1.4322; .NET CLR 2.0.50727)"

I notice occasional spikes on my server load and when I check access logs I notice a pattern for some automated forum poster that tries to repeatedly access a comment/reply URL. What would be the best way to throttle /ban these for a few minutes / hours? Can CSF for example do sg like this? I am really looking for a quick and dirty solution.

When I run the following yum command I get this error:

Package: git-1.7.10.1-1.el5.rf.x86_64 (rpmforge)
           Requires: libcurl.so.3()(64bit)"

I read that this error is due to running an el5 rpmforge or having some el5 installed packages.

How can I solve this problem?

$ yum install git
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
 * base: centos.kiewel-online.ch
 * epel: fedora.kiewel-online.ch
 * extras: centos.kiewel-online.ch
 * rpmforge: mirror.de.leaseweb.net
 * updates: centos.kiewel-online.ch
Setting up Install Process
Resolving Dependencies
--> Running transaction check
---> Package git.x86_64 0:1.7.10.1-1.el5.rf will be installed
--> Processing Dependency: perl-Git = 1.7.10.1-1.el5.rf for package: git-1.7.10.1-1.el5.rf.x86_64
--> Processing Dependency: perl(Git) for package: git-1.7.10.1-1.el5.rf.x86_64
--> Processing Dependency: libexpat.so.0()(64bit) for package: git-1.7.10.1-1.el5.rf.x86_64
--> Processing Dependency: libcurl.so.3()(64bit) for package: git-1.7.10.1-1.el5.rf.x86_64
--> Running transaction check
---> Package compat-expat1.x86_64 0:1.95.8-8.el6 will be installed
---> Package git.x86_64 0:1.7.10.1-1.el5.rf will be installed
--> Processing Dependency: libcurl.so.3()(64bit) for package: git-1.7.10.1-1.el5.rf.x86_64
---> Package perl-Git.x86_64 0:1.7.10.1-1.el5.rf will be installed
--> Finished Dependency Resolution
Error: Package: git-1.7.10.1-1.el5.rf.x86_64 (rpmforge)
           Requires: libcurl.so.3()(64bit)
 You could try using --skip-broken to work around the problem
 You could try running: rpm -Va --nofiles --nodigest

My host mailbox is filled up with 1 GB of lfd notifications like:

• excessive resource usage notifications
• Suspicious process running under user XXXX

How can I disable these?

There was no lfd tag and I cannot create one...

PS: I am using Webmin, can I do it from there?

It seems set_time_limit function call has no effect when php is running with mod_fcgid (the default in webmin). Can someone tell me how to make it work?

I have been reading a while the web trying to find out about opcode caches for fcgid. As I understand so far APC is not a good solution for fcgid, since APC with fcgid caches only per process and that is inefficient. (ref: https://stackoverflow.com/questions/598444/how-to-share-apc-cache-between-several-php-processes-when-running-under-fastcgi)

So I guess that leaves eaccelerator and xcache. Xcache seems to talk explicitly about fcgid so I am leaning towards that. Can someone confirm this?

I moved to an unmanaged server that uses fcgid (before I was using mod_php), and in the error logs I see tons of such errors:

[Mon Apr 23 21:17:12 2012] [warn] [client 66.249.68.233] mod_fcgid: read data timeout in 31 seconds [Mon Apr 23 21:17:12 2012] [error] [client 66.249.68.233] Premature end of script headers: index.php

[Mon Apr 23 17:59:51 2012] [warn] [client 74.117.180.58] mod_fcgid: read data timeout in 31 seconds [Mon Apr 23 17:59:51 2012] [warn] [client 74.117.180.58] (110)Connection timed out: mod_fcgid: ap_pass_brigade failed in handle_request_ipc function

There seem to be more of these when the load is higher (2-3) during backups, and I even managed to replicate this during a load of 3 when tar / mysqldump was running during a backup (the user sees a 500 error message after 30 seconds). Could the server be overloaded? This question seems to be related PHP + Fcgid hangs if download interrupted but not the same.

This is a top notch server, and I am surprised this would be too much. Here are some specs: 6-7 Drupal sites with Webmin

• Intel® Core™ i7-2600 Quadcore incl. Hyper-Threading Technology
• RAM 16 GB DDR3 RAM
• Hard disks2 x 3 TB SATA 6 Gb/s HDD 7200 rpm (Software-RAID 1)
• NIC1 Gbit OnBoard connected at 100 Mbit

Most guides recommend mysqldump and simple SQL for copying one table to anoter db. How about linux shell cp? Can I just simply do

cp /db1/mytable.frm /db2/mytable.frm

I have read at several blogs now that one should remove passwords from SSL certificates in order to avoid password prompts during Apache restarts.

Is this true and does this pose any security risks?