Morpheu5's questions

I'm running SpamAssassin as a milter in a Docker container separate from Postfix and Dovecot. Postfix and SA work together nicely, Postfix connects to spamass-milter, SA does its thing, mail gets flagged appropriately, all good.

Now, I'd like to be able to teach SA spam from ham when I move messages back and forth between Inbox and Junk, more or less like in this guide. I confirmed that sieve works by having a simple filter that moves spam to the Junk folder when flagged so by SA, and it seems to work. Dovecot also runs in its own Docker container.

That guide implies that the spamc command can connect to a SA instance via TCP, which would be great if only that didn't mean that I have to have spamc available inside the container running Dovecot, which means having to install SA inside that very container, which means in turn lots of unnecessary duplication.

Is there a way around this?

EDIT It was suggested that Ubuntu-based containers have a spamc package. However, I'm using a CentOS base image, which does not have a separate spamc package.

This is a follow-up from "Why is my opendmarc failing pretty much everything that comes through?". I'm really struggling to understand what is going on.

Outgoing mail is verified correctly by the receiving end (e.g., Gmail). Some incoming mail seems to be verified OK by my system (e.g., from Gmail, although sometimes my system fails gmail, not sure why).

Here is a full e-mail with all the headers as received by my mail client. This is sent from one domain that I control (unijobs.it) which has DKIM signing on, to another domain that I control (morpheu5.net) that doesn't have signing but the MTA is the same and configured to verify DKIM signatures, and DMARC with opendmarc, which also self-checks SPF records.

Return-Path: <[email protected]>
Delivered-To: [email protected]
Received: from mail.morpheu5.net ([172.18.0.14])
    by 9f813b9f7008 with LMTP
    id 5tWtJGjL4luwGQAA6DItRA
    (envelope-from <[email protected]>)
    for <[email protected]>; Wed, 07 Nov 2018 11:24:24 +0000
Received: from dhcp-10-248-111-49.eduroam.wireless.private.cam.ac.uk (global-5-142.nat-2.net.cam.ac.uk [131.111.5.142])
    (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
    (No client certificate requested)
    by mail.morpheu5.net (Postfix) with ESMTPSA id 24107100B2EB
    for <[email protected]>; Wed,  7 Nov 2018 11:24:24 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=unijobs.it; s=mail;
    t=1541589864; bh=2smQQPcPgnXpmp5mA1IMZoy38oz3CAJ+c7rCDD9nDJM=;
    h=From:Subject:Date:To:From;
    b=QqUwksIMLQSQ9GPbHAQcPj+4YpYYp63bHw48aar2ZOrYI47qYKSMnV6gm3d/zBoH2
     ylBBuHDu5JEkpFu5bOS/6a1TwnGfhKzAWc7mpDc9ZOb63Yg3g/E4DmmISfZ494i/fQ
     6JWB2QhKqwPurPSOxjgokSWq1AfHFQbQPHVXjzfw=
Authentication-Results: mail.morpheu5.net; dmarc=fail (p=quarantine dis=none) header.from=unijobs.it
Authentication-Results: mail.morpheu5.net; spf=fail [email protected]
From: "Andrea Franceschini (UniJobs.it)" <[email protected]>
Content-Type: text/plain;
    charset=us-ascii
Content-Transfer-Encoding: 7bit
Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\))
Subject: A test message for Server Fault
Message-Id: <[email protected]>
Date: Wed, 7 Nov 2018 11:24:23 +0000
To: [email protected]
X-Mailer: Apple Mail (2.3445.9.1)
X-Spam-Status: No, score=3.5 required=5.0 tests=DKIM_ADSP_ALL,
    DNS_FROM_AHBL_RHSBL,UNPARSEABLE_RELAY autolearn=no autolearn_force=no
    version=3.4.0
X-Spam-Level: ***
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on 226c07f01f2b

This is a drill. I repeat, this is a drill.

Please ignore.

The logs are most unhelpful:

postfix/submission/smtpd[109]: Anonymous TLS connection established from global-5-142.nat-2.net.cam.ac.uk[131.111.5.142]: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
postfix/submission/smtpd[109]: 24107100B2EB: client=global-5-142.nat-2.net.cam.ac.uk[131.111.5.142], sasl_method=PLAIN, [email protected]
postfix/cleanup[120]: 24107100B2EB: message-id=<[email protected]>
opendmarc[24]: 24107100B2EB: SPF(mailfrom): [email protected] fail
opendmarc[24]: 24107100B2EB: unijobs.it fail
opendkim[25]: 24107100B2EB: DKIM-Signature field added (s=mail, d=unijobs.it)
postfix/qmgr[97]: 24107100B2EB: from=<[email protected]>, size=849, nrcpt=1 (queue active)
postfix/lmtp[121]: 24107100B2EB: to=<[email protected]>, relay=mopsmailer_dovecot[172.18.0.20]:24, delay=0.53, delays=0.47/0.02/0.02/0.02, dsn=2.0.0, status=sent (250 2.0.0 <[email protected]> 5tWtJGjL4luwGQAA6DItRA Saved)
postfix/qmgr[97]: 24107100B2EB: removed

I am a little confused by the location of the SPF and DMARC failures before the "DKIM-Signature field added" line: is it that opendmarc is trying to validate the outgoing message while it is going out, and not the inbound message while it's coming in?

If I "ignore authenticated clients" I "solve" the issue of course, but that is only because the checks aren't being performed on messages sent from my MTA to itself. In principle, validation should work nevertheless, right?

Please refer to the other question (see top) for info on configuration.

I have this domain for which I set up SPF, DKIM, and DMARC stuff. Let's pretend the domain is example.com which has the following entries in its DNS zone:

example.com.                    600 IN  MX  1 mail.morpheu5.net.
example.com.                    600 IN  TXT "v=spf1 a mx -all"
_dmarc.example.com.         600 IN  TXT "v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; sp=none; ri=86400"
mail._domainkey.example.com.    600 IN  TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDSYXmE/aXew9wcS9dCZFYrPetCRC9rW3vVYRQo980JbC6pXbAkqnUd7ncWkUaQZgF2HKzrspUMklRN35rB1b9iHX3dHnf/gvxSURZPYcKT1DenFt+Vhplv2IuWCNWRSqTuXTXlVOnf+TwWLZayKNq62mCqU09sasP9kHXO5lyIbwIDAQAB"

mail.morpheu5.net is the local host/domain/thing for my postfix, and I'm managing example.com as a virtual domain. I'm running OpenDKIM and OpenDMARC as milters -- SpamAssassin too, but that's working alright.

OpenDKIM is working fine, all the messages get signed correctly and Gmail even shows the little "Signed by: example.com" and confirmation of standard encryption (TLS). In fact, if I inspect the original message, in Gmail, I get the following:

ARC-Authentication-Results: i=1; mx.google.com;
       dkim=pass [email protected] header.s=mail header.b=pixIC2KM;
       spf=pass (google.com: domain of [email protected] designates 79.137.83.28 as permitted sender) [email protected];
       dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=example.com
Return-Path: <[email protected]>
Received: from mail.morpheu5.net (mail.morpheu5.net. [79.137.83.28])
        by mx.google.com with ESMTPS id p67-v6si2567899wmd.147.2018.10.31.08.01.43
        for <[email protected]>
        (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
        Wed, 31 Oct 2018 08:01:43 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 79.137.83.28 as permitted sender) client-ip=79.137.83.28;
Authentication-Results: mx.google.com;
       dkim=pass [email protected] header.s=mail header.b=pixIC2KM;
       spf=pass (google.com: domain of [email protected] designates 79.137.83.28 as permitted sender) [email protected];
       dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=example.com

which, if I read it correctly, tells me that

• my SPF policy is OK (example.com designates mail.morpheu5.net as permitted sender),
• my DKIM signature is valid (sign that OpenDKIM is working fine), and
• my DMARC record is valid and the two previous checks passed.

Further down, if I inspect the headers generated by my own MTA, I see the following

DKIM-Filter: OpenDKIM Filter v2.11.0 mail.morpheu5.net 8E8CE100B2EB
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=example.com; s=mail; t=1540998102; bh=j1p26NHBiJxaCqvB8/JaswqiQuHCsG+QNIkoIUc8B+0=; h=From:Subject:Date:To:From; b=pixIC2KMsLYpq4KQn4gRIJ4wr3Tle+Iaq08lSVdIz82nrKDybFhOivpIrmtpKSXND
     rS4MPn7aNRV2D2KJPqG6Ru2tFAJEaBviC/7BNs2x3mIGlIxv5OzvD2EIvrJSJ8FA9U
     1Uf9YTdWgSF4FdytLD21Jus6dYt4evDc3ZZujvIU=
DMARC-Filter: OpenDMARC Filter v1.3.2 mail.morpheu5.net 8E8CE100B2EB
Authentication-Results: mail.morpheu5.net; dmarc=fail (p=none dis=none) header.from=example.com
                                           ^^^^^^^^^^- WHAT?!

That in itself is confusing, because it seems that OpenDMARC is running even for outgoing mail (remember, I sent this message from [email protected] to [email protected]). This however could be because of how I'm running the milter. This is the relevant bit in postfix's main.cf:

smtpd_milters =     inet:mopsmailer_spamassassin:784 inet:localhost:8893 inet:localhost:8891
non_smtpd_milters = inet:mopsmailer_spamassassin:784 inet:localhost:8893 inet:localhost:8891
                    ^- SpamAssassin                  ^- OpenDMARC        ^- OpenDKIM

I'm open to suggestions on this.

What is really driving me insane, though, is that OpenDMARC is failing pretty much everything that comes in through the door. This is a message I sent from another domain (that I have set up in a similar way to example.com)

Return-Path: <[email protected]>
Delivered-To: [email protected]
Received: from mail.morpheu5.net ([172.18.0.14])
    by 6c01c2ccb641 with LMTP
    id t10hEf7J2Vu3BQAAl2tFQA
    (envelope-from <[email protected]>)
    for <[email protected]>; Wed, 31 Oct 2018 15:27:58 +0000
Received: from porto.home (host109-154-219-15.range109-154.btcentralplus.com [109.154.219.15])
    (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
    (No client certificate requested)
    by mail.morpheu5.net (Postfix) with ESMTPSA id E0A22100B2EB
    for <[email protected]>; Wed, 31 Oct 2018 15:27:57 +0000 (UTC)
DKIM-Filter: OpenDKIM Filter v2.11.0 mail.morpheu5.net E0A22100B2EB
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=example.com;
    s=mail; t=1540999678;
    bh=47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=;
    h=From:Subject:Date:To:From;
    b=ulFaGLYp8hoosllX0rs+byXALUScldP5Of4Sf9/GxuuEqkz5VpCwPHib0TCXQNyqG
     yGqzlgBUoKB2SB0vRqbDW6vb+1UyG971DVeC0WfuRvoe7lKFLFmzD+V25rht/83TKv
     GFhIX2JMMobnw+wS++/6rS/l93/NLlTysiKECSfo=
DMARC-Filter: OpenDMARC Filter v1.3.2 mail.morpheu5.net E0A22100B2EB
Authentication-Results: mail.morpheu5.net; dmarc=fail (p=none dis=none) header.from=example.com
From: "example.com" <[email protected]>
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\))
Subject: 
Message-Id: <[email protected]>
Date: Wed, 31 Oct 2018 15:27:57 +0000
To: [email protected]

They are both served by the same postfix install, so draw your own conclusions. The only thing I see in the logs is a very laconic

Oct 31 15:27:58 bd85f6a3b2b6 opendmarc[20]: E0A22100B2EB: example.com fail

So I figured I must have screwed up something while delivering the message. I then sent one from my gmail.com address and lo and behold

Return-Path: <[email protected]>
Delivered-To: [email protected]
Received: from mail.morpheu5.net ([172.18.0.14])
    by 6c01c2ccb641 with LMTP
    id 3P0+CTjL2Vu7BQAAl2tFQA
    (envelope-from <[email protected]>)
    for <[email protected]>; Wed, 31 Oct 2018 15:33:12 +0000
Received: from mail-lf1-f51.google.com (mail-lf1-f51.google.com [209.85.167.51])
    (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
    (No client certificate requested)
    by mail.morpheu5.net (Postfix) with ESMTPS id 63728100B2EB
    for <[email protected]>; Wed, 31 Oct 2018 15:33:11 +0000 (UTC)
DKIM-Filter: OpenDKIM Filter v2.11.0 mail.morpheu5.net 63728100B2EB
Authentication-Results: mail.morpheu5.net;
    dkim=pass (2048-bit key) header.d=gmail.com [email protected] header.b="Yrnjbum2"
DMARC-Filter: OpenDMARC Filter v1.3.2 mail.morpheu5.net 63728100B2EB
Authentication-Results: mail.morpheu5.net; dmarc=fail (p=none dis=none) header.from=gmail.com
Received: by mail-lf1-f51.google.com with SMTP id p86so9773378lfg.5
        for <[email protected]>; Wed, 31 Oct 2018 08:33:11 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20161025;
        h=mime-version:from:date:message-id:subject:to;
        bh=fxtWSne+bN95BKwPxnuLE2Rr8rvPT03LkPGqL68IQSE=;
        b=Yrnjbum25r6EczXzozeQERktfI7380FH3ETaRQ574kjKWdI+gtL337nVsPH34hnkyy
         YZ3XuVBCyKpz2ulXqF6G9ipsk9Hh6cK6P/BGNO9fs1WRrz9U8BImKhiqJBTdv4J+K4Rq
         grpn4buL1q3lRqunfJzSPaTww0DnYPWR89ICeMiyIYGbNYA4uTBQhQm0GUQRMJz6J1Bm
         4FGL9dL2/sgexlOGga3AeP1dHyPoLag9FN2Vbr/nJThqml8BcC4kPdVb1iH4FZoNaTSh
         s4CeTREvW6XLEAVgSz5Q3DgFLR0V4iCuqYxKkkHDYNi1If/agXkbRBigRP6+HUsTw7mM
         8O7Q==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20161025;
        h=x-gm-message-state:mime-version:from:date:message-id:subject:to;
        bh=fxtWSne+bN95BKwPxnuLE2Rr8rvPT03LkPGqL68IQSE=;
        b=MPBwgFcsvJZ9gZbD0n0kfYMKpaHDQ3SkU30o5qVqs9Zwaqu3bTubSDkB+HCHsq8P8A
         6BZN3WARiL9zi9sdxKmvHYBvrf043htR1/jFEr6+1Wr5eO2ULZmKIxdKl609YffDmzM8
         vXXNzIw8pNYvEcaKUW04APzyEG5iEA9B5hrik4ivD9EWC0LHGuVf5jZuFT0LsKuWwydP
         n30LqX6Wra8XjSnbejgeD/m53xDWQpYckArRm6VA7+XqH1W7xnKgxc4MBmeX7gqYQrvV
         nmXMJyJAVtjiW9PXKDIE0SpP9XXryLn3FsguDCCwb46FS3rLJWW7i9SYSDKDb4N6iY3r
         NXUA==
X-Gm-Message-State: AGRZ1gIHySs3xex2WNMp2GByh7QqSOszi85+983Juw7ZJnOEDB28/jma
    iM0XrZTH6QjHeJajn8Zxx3UmFTkgAJ1MdBldxKeKiQ==
X-Google-Smtp-Source: AJdET5dvhrIXWjNNjZ2g5C7dSnHwXF95xuK/26l2o3C8fhT2r034Pos5Z776NyKi6JQvIAXpGCEkKe/WjOMaWWllzCM=
X-Received: by 2002:a19:13cc:: with SMTP id 73mr1902315lft.79.1540999989833;
 Wed, 31 Oct 2018 08:33:09 -0700 (PDT)
MIME-Version: 1.0
From: Andrea Franceschini <[email protected]>
Date: Wed, 31 Oct 2018 15:32:32 +0000
Message-ID: <CACY09wpao6XSxkjzNXytTJ3Z3SCrpnhQkUjoWHJzYd8sS23jmA@mail.gmail.com>
Subject: 
To: [email protected]
Content-Type: text/plain; charset="UTF-8"
X-Spam-Status: No, score=2.3 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
    DKIM_VALID_AU,DNS_FROM_AHBL_RHSBL,FREEMAIL_FROM,UNPARSEABLE_RELAY,
    URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0
X-Spam-Level: **
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on 226c07f01f2b

and this is what shows up in the logs

Oct 31 15:33:12 bd85f6a3b2b6 opendmarc[20]: 63728100B2EB: gmail.com fail

Please also note that SpamAssassin computed a bunch of DKIM scores for this message, while this did not happen before, so... time for more config files!

OpenDKIM to begin with

PidFile             /var/run/opendkim/opendkim.pid
Mode                sv
Syslog              yes
SyslogSuccess       yes
LogWhy              yes
UserID              opendkim:opendkim
Socket              inet:8891@localhost
Umask               002
SendReports         yes
SoftwareHeader      yes
Canonicalization    relaxed/relaxed
Selector            default
MinimumKeyBits      1024
KeyTable            /etc/opendkim/KeyTable
SigningTable        refile:/etc/opendkim/SigningTable
ExternalIgnoreList  refile:/etc/opendkim/TrustedHosts
InternalHosts       refile:/etc/opendkim/TrustedHosts
OversignHeaders     From
QueryCache          yes
AutoRestart         Yes

KeyTable seems OK to me

mail._domainkey.unijobs.it unijobs.it:mail:/etc/opendkim/keys/unijobs.it/dkim-private.pem
mail._domainkey.example.com example.com:mail:/etc/opendkim/keys/example.com/dkim-private.pem

I also have wildcard signing

*@unijobs.it mail._domainkey.unijobs.it
*@example.com mail._domainkey.example.com

and these as trusted hosts

127.0.0.1
::1
172.17.0.0/16
172.18.0.0/16

OpenDMARC is configured like this

AuthservID      mail.morpheu5.net
HistoryFile     /var/spool/opendmarc/opendmarc.dat
IgnoreHosts     /etc/opendmarc/ignore.hosts
RejectFailures  false
Socket          inet:8893@localhost
SoftwareHeader  true
Syslog          true
UMask           007
UserID          opendmarc:mail

With the following in ignore.hosts

localhost
172.17.0.0/16
172.18.0.0/16

So... why does OpenDMARC fails pretty much everything that comes through the door?

EDIT I ran opendmarc -t on one of these messages and the worst that happens is

opendmarc: mlfi_connect() returned SMFIS_ACCEPT

if I run it with the my custom config file, and

opendmarc: mlfi_connect() returned SMFIS_CONTINUE
opendmarc: mlfi_helo() returned SMFIS_CONTINUE
opendmarc: message: mlfi_envfrom() returned SMFIS_CONTINUE
opendmarc: message: line 1: mlfi_header() returned SMFIS_CONTINUE
opendmarc: message: line 2: mlfi_header() returned SMFIS_CONTINUE
opendmarc: message: line 3: mlfi_header() returned SMFIS_CONTINUE
opendmarc: message: line 8: mlfi_header() returned SMFIS_CONTINUE
opendmarc: message: line 13: mlfi_header() returned SMFIS_CONTINUE
opendmarc: message: line 14: mlfi_header() returned SMFIS_CONTINUE
opendmarc: message: line 15: mlfi_header() returned SMFIS_CONTINUE
opendmarc: message: line 16: mlfi_header() returned SMFIS_CONTINUE
opendmarc: message: line 23: mlfi_header() returned SMFIS_CONTINUE
opendmarc: message: line 24: mlfi_header() returned SMFIS_CONTINUE
opendmarc: message: line 26: mlfi_header() returned SMFIS_CONTINUE
opendmarc: message: line 27: mlfi_header() returned SMFIS_CONTINUE
opendmarc: message: line 28: mlfi_header() returned SMFIS_CONTINUE
opendmarc: message: line 29: mlfi_header() returned SMFIS_CONTINUE
opendmarc: message: line 30: mlfi_header() returned SMFIS_CONTINUE
opendmarc: message: line 31: mlfi_header() returned SMFIS_CONTINUE
opendmarc: message: line 34: mlfi_header() returned SMFIS_CONTINUE
opendmarc: message: line 35: mlfi_header() returned SMFIS_CONTINUE
opendmarc: message: line 37: mlfi_header() returned SMFIS_CONTINUE
opendmarc: message: line 38: mlfi_header() returned SMFIS_CONTINUE
### INSHEADER: idx=1 hname='Authentication-Results' hvalue='DEBUG-j; dmarc=fail (p=none dis=none) header.from=example.com'
opendmarc: message: mlfi_eom() returned SMFIS_ACCEPT
opendmarc: mlfi_close() returned SMFIS_CONTINUE

if I don't specify my custom config file (which is in a weird location because reasons).

EDIT Gmail now passes SPF, DKIM, and eventually opendmarc gives it a pass. Not sure what happened.

EDIT Follow-up: What is wrong with this e-mail which is failing SPF(mailfrom) and DMARC?

I'm well aware of how you deploy your own Docker registry, but I think in my case this might be an overkill. I was wondering if there is a way of packing up an image I build on one machine, and unpacking it in the server, ready for docker consumption? (aka, no need to pull it, just run it).

It seems that, when configuring HAProxy for hostname routing on HTTPS connections, it is crucial to include a tcp-request inspect-delay directive to "give HAProxy a chance to look into the connection". Is there a way to get NGINX to to the same, or should I start packing it up and move my whole server to HAProxy?

(For reference, this question comes from my previous misunderstanding expressed here)

EDIT

Michael, in the comments:

he seems to want to "sniff" SNI from the client's handshake attempt without actually terminating the TLS connection, in order to make a lower-layer connection-proxying decision and blindly carry the payload to a subsequent machine for termination of the TLS, because for some reason he doesn't want the TLS certs and keys on the proxy, or for the proxy to do the TLS at all -- just sniff the SNI and make an inward TCP connection using a rule derived from its content.

The rationale is that I need the certificates and keys within the backend applications (some require this for one reason or another), so I have to provide these to them. Having to set them up in the proxy too essentially doubles the maintenance work, and the chance for error. If I could do without maintaining access to the certificates for the proxy, it would make my architecture much easier, and lessen the chances for mistakes.

DISCLAIMER – I'm fishing for ideas, so I can see that some people will start downvoting and flagging this as unsuitable for SF, but hey, if you know of a better place to ask this question, there is a comment box down there, don't just hide behind your clicks.

I have this tiny production server that I'm sharing with colleagues and close clients. I've been asked to provide an e-mail service. I guess I never thought about this, but I was horrified to discover that the various mailbox formats store messages in clear text, and close to nobody seem to care very much. So I figured, those fancy providers must be doing something behind the scenes. I'm not necessarily thinking of ProtonMail, but I guess Google does store messages with some form of encryption – and yes, I realise these services might have developed their own software, but hey. So I started reading up, and the closest I got was a relatively complex Exim4 setup involving a GPG transport_filter with per-user key pairs.

The truth is that the messages that will likely go around the server will not be very confidential, and my colleagues and clients are savvy enough to use GPG themselves if need be. My main concern, rather, is that these messages are available in clear text for anybody – I can see this happening as soon as I won't be the only one managing the server, the occasional cat /var/mail/username (or whatever) will happen. Worst of all, the messages will be backed up in clear text – true, I can encrypt the backups.

As I said, I don't want to provide a protonmail-like service, I'm just looking for something that provides some form of smokescreen against careless admins. In particular, some form of clear text will be necessary during transit, for stuff like anti-virus and anti-spam. However, if you have compelling and uncomplicated solutions for something more secure, I'm open to all suggestions.

I have two containers, one of which is running NGINX as a reverse proxy for serveral other containers. One of the other containers is running Apache with SSL enabled and configured. I have seen several configuration examples in which, to the best of my understanding, NGINX handles the certificates instead of Apache, and merely pipes through everything else to some non-SSL Apache.

Now, I'd rather have Apache handle its own certificates, particularly because it makes my life easier when managing them them (using a dockerized letsencrypt, which mounts the volumes from the relevant Apache container and drops the certificates in all the right places).

The issue is that I can't find any example configuration for NGINX to just transparently proxy everything through to the Apache container.

I often have to re-build Docker images, and I do that inside the host I run my containers in. Occasionally I see that this puts considerable pressure on the CPU, so I thought I could run docker build under nice -n19, but this seems to make no difference in terms of how much docker yields when other processes need to run.

I'd rather not use Docker Hub repos, because this is private stuff and I'm trying to save every penny I can right now. I also know that I could set up another machine as a build/repo – I could use a machine at the office, for example – but I'm not sure how.

So, question: why does nice -n19 docker build ... seem to not be very helpful?

(bonus points for pointing me at docs on how to set up my own private build/repo machine)

I've been reading on firewalld for about the whole morning, and I came up with the following public zone:

<?xml version="1.0" encoding="utf-8"?>
<zone>
  <short>Public</short>
  <description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
  <source address="167.114.37.0/24"/>
  <source address="92.222.185.0/24"/>
  <source address="92.222.184.0/24"/>
  <source address="92.222.186.0/24"/>
  <source address="149.202.34.10/32"/>
  <service name="dhcpv6-client"/>
  <service name="http"/>
  <service name="ssh"/>
  <service name="https"/>
</zone>

The best I could figure is that this zone should only allow incoming connections on those ports/services, and provide full access to those subnets. However, when I scan my server with nmap, I get boatloads of open ports (and I am most definitely not in one of the whitelisted subnets).

PORT      STATE    SERVICE
1/tcp     open     tcpmux
3/tcp     open     compressnet
4/tcp     open     unknown
6/tcp     open     unknown
7/tcp     open     echo
9/tcp     open     discard
13/tcp    open     daytime
17/tcp    open     qotd
19/tcp    open     chargen
20/tcp    open     ftp-data
21/tcp    open     ftp
22/tcp    open     ssh
23/tcp    open     telnet
24/tcp    open     priv-mail
25/tcp    filtered smtp
26/tcp    open     rsftp
30/tcp    open     unknown
32/tcp    open     unknown
33/tcp    open     dsp
37/tcp    open     time
42/tcp    open     nameserver
43/tcp    open     whois
49/tcp    open     tacacs
53/tcp    open     domain
70/tcp    open     gopher
79/tcp    open     finger
80/tcp    closed   http
81/tcp    open     hosts2-ns
82/tcp    open     xfer
83/tcp    open     mit-ml-dev
84/tcp    open     ctf
85/tcp    open     mit-ml-dev
88/tcp    open     kerberos-sec
89/tcp    open     su-mit-tg
90/tcp    open     dnsix
99/tcp    open     metagram
100/tcp   open     newacct
106/tcp   open     pop3pw
109/tcp   open     pop2
110/tcp   open     pop3
111/tcp   open     rpcbind
113/tcp   open     ident
119/tcp   open     nntp
125/tcp   open     locus-map
135/tcp   filtered msrpc
139/tcp   filtered netbios-ssn

... the list goes on, I thought I'd stop there. What am I missing here?

EDIT If I try to access one of those open or filtered ports, say with curl, I get the following

$ curl myserver.example.com:125
curl: (7) Failed to connect to myserver.example.com port 125: Operation timed out

while I correctly get connection refused when I try to access one of the closed ports.

I have no idea where to start from so sorry in advance if this topic has already been discussed.

I usually develop web sites using my laptop as a development server, and recently I needed to test a web site using various mobile devices that can connect via wifi. Having no real AP, I set up a ad-hoc network using my laptop's wireless card and the devices can correctly browse the Internet and access the laptop's web server. The setup is as follows:

• subnet: 192.168.1.0/24
• gateway to the Internet (wired adsl router/modem): 192.168.1.1
• laptop: 192.168.1.64 (eth0, wired if connected to the gateway) and 192.168.1.32 (eth1, wifi if somewhat bridged to eth0)
• mobile devices (same for all, I only use one of them at any time for simplicity): 192.168.1.11 with default gw 192.168.1.1

Now, if I open either 192.168.1.32 or 192.168.1.64 from the mobile devices, I correctly get the default host of my Apache configuration. However I usually work with virtual hosts for many practical reasons, one of which being Drupal's peculiar implementation of multi-sites. For those who don't know how this works, Drupal takes the request's hostname and searches into its sites/ subdirectories for an appropriate configuration file. So, for example, suppose I request www.example.com, then Drupal would search for a config file in the following directories:

sites/www.example.com/
sites/example.com/
sites/com/
sites/default/

So I decided to adopt the following style of virtual hosts: if the website I'm working on will be accessible using www.example.com I set up a sites/www.example.com/ directory and create a virtual host for local.www.example.com so Drupal have no trouble finding it. I've been told this is suboptimal from a dns point of view since I'd have to create an authoritative entry for example.com and turn Bind on only when I'm supposed to access the local copy, which is weird. However, if this is the only path I can follow, I still have some problems with Bind's configuration, as I couldn't find any guide that tells me in a clear, noob-friendly way, how to set up such an entry. On the other hand, I was wondering if I could set up an authoritative entry for local, so I could access www.example.com.local and tell in some way (which I don't even know if this is possible) Apache to put www.example.com instead of www.example.com.local in the relevant environment variable.

Anyway, I have a last problem, sort of: when I launch Bind in debug mode with high verbosity, and make 192.168.1.32 as the primary dns for the devices, the output doesn't say anything about requests being made from the devices to Bind, so I'm not even sure it comes into play.

As you can see, I'm a complete noob at these matters, but I'm eager to learn, so any help/pointer will be appreciated.