Vilx-'s questions

I've set up a mailserver with Postfix, Roundcube and Dovecot. All works well - almost.

In my country there's a popular free email service by the name of inbox.lv. And they have an anti-spam rule set up that when a new server tries to send emails to them, they first greylist it for 10 minutes and require the server to re-send the email. Fair enough.

However when using Postfix to send outgoing emails (either from Roundcube or Thunderbird) it doesn't queue the message. Instead it immediately returns with an error. There's also a log entry (newlines/spacing added by me for legibility; IP and email addresses redacted for privacy):

May 31 23:17:18 21 postfix/smtpd[24814]: NOQUEUE: reject: RCPT from unknown[MY.IP.ADDRESS.HERE]: 
    450 4.1.1 <[email protected]>: Recipient address rejected: unverified address:
    host mx1.inbox.lv[194.152.32.74] said: 450 4.7.1 <unknown[SERVER.IP.ADDRESS.HERE]>:
    Client host rejected: greylisted, please retry in 597 seconds (in reply to RCPT TO command);
    from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<[192.168.1.216]>

All the queue settings are left at defaults. Postfix version is 2.10.1.

Why is this happening and how can I make Postfix queue the messages and retry in 10 minutes?

Added: Postfix config (anonymized):

[root@myserver etc]# postconf mail_version
mail_version = 2.10.1

[root@myserver etc]# postconf -n
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
debug_peer_level = 2
debugger_command = PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin ddd $daemon_directory/$process_name $process_id & sleep 5
html_directory = no
inet_interfaces = all
inet_protocols = all
mail_owner = postfix
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
message_size_limit = 100000000
milter_default_action = accept
mydestination = localhost
mydomain = mydomain.lv
myhostname = mydomain.lv
mynetworks_style = host
myorigin = $mydomain
newaliases_path = /usr/bin/newaliases.postfix
non_smtpd_milters = $smtpd_milters
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix-2.10.1/README_FILES
sample_directory = /usr/share/doc/postfix-2.10.1/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtpd_milters = inet:127.0.0.1:8891
smtpd_recipient_restrictions = reject_unverified_recipient
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_path = private/auth
smtpd_sasl_type = dovecot
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /etc/letsencrypt/live/mydomain.lv/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/mydomain.lv/privkey.pem
smtpd_tls_security_level = may
unknown_local_recipient_reject_code = 550
virtual_mailbox_domains = d1.lv d2.lv d3.lv d4.lv
virtual_mailbox_limit = 0
virtual_transport = lmtp:unix:/var/run/dovecot/lmtp

[root@myserver etc]# postconf -M
smtp       inet  n       -       n       -       -       smtpd
submission inet  n       -       n       -       -       smtpd
smtps      inet  n       -       n       -       -       smtpd
pickup     unix  n       -       n       60      1       pickup
cleanup    unix  n       -       n       -       0       cleanup
qmgr       unix  n       -       n       300     1       qmgr
tlsmgr     unix  -       -       n       1000?   1       tlsmgr
rewrite    unix  -       -       n       -       -       trivial-rewrite
bounce     unix  -       -       n       -       0       bounce
defer      unix  -       -       n       -       0       bounce
trace      unix  -       -       n       -       0       bounce
verify     unix  -       -       n       -       1       verify
flush      unix  n       -       n       1000?   0       flush
proxymap   unix  -       -       n       -       -       proxymap
proxywrite unix  -       -       n       -       1       proxymap
smtp       unix  -       -       n       -       -       smtp
relay      unix  -       -       n       -       -       smtp
showq      unix  n       -       n       -       -       showq
error      unix  -       -       n       -       -       error
retry      unix  -       -       n       -       -       error
discard    unix  -       -       n       -       -       discard
local      unix  -       n       n       -       -       local
virtual    unix  -       n       n       -       -       virtual
lmtp       unix  -       -       n       -       -       lmtp
anvil      unix  -       -       n       -       1       anvil
scache     unix  -       -       n       -       1       scache
[root@myserver etc]#

While chatting with a sysadmin colleague of mine about setting up a small server for me, I found out something interesting - most servers these days apparently contain an internal USB port which can be used for attaching a boot flash drive. On one hand this makes sense - the OS doesn't need to use its disk much, and all the data is being kept on actual fast hotswap drives. We've successfully eliminated the need for an extra drive bay.

On the other hand - flash drives? Really? Is this safe? Seems so weird. Is this really common practice today?

I'm trying to make a mailserver with postfix/dovecot but I'm stuck. The problem is I cannot connect to some of the ports I want open, for example 587. As far as I can tell the port is open and listening, and the firewall has the port opened. I know that some years ago the ISP blocked all ports except those explicitly requested as opened, but now they swear that they're not blocking anything anymore.

If I try to connect locally via telnet localhost 587 I get a proper connection. The same if I replace localhost with the external IP address (don't know if it matters).

Here's some diagnostic information showing that it should work:

> netstat -an4
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 0.0.0.0:25              0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:4190            0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:993             0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:995             0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:3306            0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:587             0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:110             0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:143             0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:465             0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:21              0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN
udp        0      0 127.0.0.1:323           0.0.0.0:*

> firewall-cmd --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: enp5s0
  sources:
  services: dhcpv6-client ssh
  ports: 21/tcp 443/tcp 80/tcp 49152-65534/tcp 25/tcp 110/tcp 143/tcp 993/tcp 995/tcp 465/tcp 587/tcp
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

> ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: enp5s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether xx:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff
    inet xxx.xxx.xxx.xxx/24 brd xxx.xxx.xxx.255 scope global noprefixroute enp5s0
       valid_lft forever preferred_lft forever
    inet6 xxxx::xxxx:xxxx:xxxx:xxxx/64 scope link noprefixroute
       valid_lft forever preferred_lft forever

And last but not least, the raw dump from iptables - this one I'm not skilled enough to decipher, but perhaps someone can notice a problem there.

> iptables --list -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
INPUT_direct  all  --  0.0.0.0/0            0.0.0.0/0
INPUT_ZONES_SOURCE  all  --  0.0.0.0/0            0.0.0.0/0
INPUT_ZONES  all  --  0.0.0.0/0            0.0.0.0/0
DROP       all  --  0.0.0.0/0            0.0.0.0/0            ctstate INVALID
REJECT     all  --  0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
FORWARD_direct  all  --  0.0.0.0/0            0.0.0.0/0
FORWARD_IN_ZONES_SOURCE  all  --  0.0.0.0/0            0.0.0.0/0
FORWARD_IN_ZONES  all  --  0.0.0.0/0            0.0.0.0/0
FORWARD_OUT_ZONES_SOURCE  all  --  0.0.0.0/0            0.0.0.0/0
FORWARD_OUT_ZONES  all  --  0.0.0.0/0            0.0.0.0/0
DROP       all  --  0.0.0.0/0            0.0.0.0/0            ctstate INVALID
REJECT     all  --  0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
OUTPUT_direct  all  --  0.0.0.0/0            0.0.0.0/0

Chain FORWARD_IN_ZONES (1 references)
target     prot opt source               destination
FWDI_public  all  --  0.0.0.0/0            0.0.0.0/0           [goto]
FWDI_public  all  --  0.0.0.0/0            0.0.0.0/0           [goto]

Chain FORWARD_IN_ZONES_SOURCE (1 references)
target     prot opt source               destination

Chain FORWARD_OUT_ZONES (1 references)
target     prot opt source               destination
FWDO_public  all  --  0.0.0.0/0            0.0.0.0/0           [goto]
FWDO_public  all  --  0.0.0.0/0            0.0.0.0/0           [goto]

Chain FORWARD_OUT_ZONES_SOURCE (1 references)
target     prot opt source               destination

Chain FORWARD_direct (1 references)
target     prot opt source               destination

Chain FWDI_public (2 references)
target     prot opt source               destination
FWDI_public_log  all  --  0.0.0.0/0            0.0.0.0/0
FWDI_public_deny  all  --  0.0.0.0/0            0.0.0.0/0
FWDI_public_allow  all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0

Chain FWDI_public_allow (1 references)
target     prot opt source               destination

Chain FWDI_public_deny (1 references)
target     prot opt source               destination

Chain FWDI_public_log (1 references)
target     prot opt source               destination

Chain FWDO_public (2 references)
target     prot opt source               destination
FWDO_public_log  all  --  0.0.0.0/0            0.0.0.0/0
FWDO_public_deny  all  --  0.0.0.0/0            0.0.0.0/0
FWDO_public_allow  all  --  0.0.0.0/0            0.0.0.0/0

Chain FWDO_public_allow (1 references)
target     prot opt source               destination

Chain FWDO_public_deny (1 references)
target     prot opt source               destination

Chain FWDO_public_log (1 references)
target     prot opt source               destination

Chain INPUT_ZONES (1 references)
target     prot opt source               destination
IN_public  all  --  0.0.0.0/0            0.0.0.0/0           [goto]
IN_public  all  --  0.0.0.0/0            0.0.0.0/0           [goto]

Chain INPUT_ZONES_SOURCE (1 references)
target     prot opt source               destination

Chain INPUT_direct (1 references)
target     prot opt source               destination
REJECT     tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 22 match-set fail2ban-sshd src reject-with icmp-port-unreachable

Chain IN_public (2 references)
target     prot opt source               destination
IN_public_log  all  --  0.0.0.0/0            0.0.0.0/0
IN_public_deny  all  --  0.0.0.0/0            0.0.0.0/0
IN_public_allow  all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0

Chain IN_public_allow (1 references)
target     prot opt source               destination
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:22 ctstate NEW
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:21 ctstate NEW
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:443 ctstate NEW
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:80 ctstate NEW
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpts:49152:65534 ctstate NEW
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:25 ctstate NEW
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:110 ctstate NEW
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:143 ctstate NEW
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:993 ctstate NEW
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:995 ctstate NEW
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:465 ctstate NEW
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:587 ctstate NEW

Chain IN_public_deny (1 references)
target     prot opt source               destination

Chain IN_public_log (1 references)
target     prot opt source               destination

Chain OUTPUT_direct (1 references)
target     prot opt source               destination

My question is - after all this, is there still some doubt that my server might be blocking the connections on its own? If yes, how do I find that out? Or is this conclusive enough that I need to go raise hell with the ISP?

I'm trying to set up postfix for the first time. Reading the basic configuration docs, right off the bat I'm faced with two settings that I cannot understand - mydomain and myhostname. I've got the simplest possible situation - a single server for a single domain. Let's call it example.com. My server serves the webpages for http://anything.example.com and I'd like it to receive email for [email protected] as well. (Sending too, but that will be only for authorized users; I'll come to that later)

So, in this case, what's the difference between mydomain and myhostname? Or should they both be simply set to example.com?

Also of note might be that my DNS provider (I don't host it myself) for some reason didn't allow me to put example.com in my MX record. That seemed to be more of a quirk of their system however. I have mail.example.com set there, but *.example.com maps to my IP anyway (in A records), so that shouldn't really matter, right?

I've got a small jack-of-all-trades server running CentOS 7 Linux. Now I need to add email support to it (SMTP/POP3/IMAP/webmail). Most of it is pretty clear, except for one thing - I'd like to separate linux users from email users. That is, for every email account I don't want to make a server user as well. Also, if there are emails [email protected] and [email protected], I'd like them to be separate accounts. And, of course, users should be able to use their email addresses as usernames for the mail-related services.

How can I do that? I don't even know what keywords to search for (yes, I've tried googling, but came up empty handed).

The previous administrator of a server that is now under my supervision made a mistake. He accidentally created a LVM volume (no more than pvcreate, I think, though not sure) on a disk that actually contained an Ext4 partition with data. How do I recover data from a mistake like this? I'm ready to read ext4 documentation and roll out my own, but perhaps I don't need to? A few tools that I tried were unable to find an Ext4 filesystem on it, so I guess I need something more serious.

I've got a little old server with CentOS 6.5 on it. The hardware is old and crappy, but enough for what it has to do. Which consists of SSH (+SFTP), Apache, PHP and MySQL.

Still, I'm trying to cut away all that I can. One thing that it does not need to do is to be an SMTP server. There are no mailboxes on it and nobody will ever route mail through it. However I do want it to send me an email when something goes wrong. Also, the webpages will send emails from PHP.

So that brings me to the question - can I set up the mail system in such a way that there isn't an expensive mailer daemon sitting in the background with queues and whatnotelse, but rather every email is directly and immediately delivered to an external SMTP server? And how do I go about it?

I've bought a domain, say mydomain.com. I'd like to set up google apps to work with it. As such, I'd like to create subdomains like mail.mydomain.com, docs.mydomain.com, etc. To integrate it with google, I must add to all of them CNAME records to ghs.google.com. However my domain registrar says that they can create only one CNAME in my domain, for which they chose mail.mydomain.com. The rest of them, they say, I must create as A type records.

Are they being lazy, or is there some limitation here that I'm not aware of?

I already posted this question on SO, but the nature of it is between programming and server configuration, so I'll re-post it here as well.

I'm trying to write a proof-of-concept application that performs Kerberos delegation. I've written all the code, and it seems to working (I'm authenticating fine), but the resulting security context doesn't have the ISC_REQ_DELEGATE flag set.

So I'm thinking that maybe one of the endpoints (client or server) is forbidden to delegate. However I'm not authenticating against an SPN. Just one domain user against another domain user. As the SPN for InitializeSecurityContext() I'm passing "[email protected]" (which is the user account under which the server application is running). As I understand, domain users have delegation enabled by default. Anyway, I asked the admin to check, and the "account is sensitive and cannot be delegated" checkbox is off.

I know that if my server was running as a NETWORK SERVICE and I used an SPN to connect to it, then I'd need the computer account in AD to have the "Trust computer for delegation" checkbox checked (off by default), but... this is not the case, right? Or is it?

Also - when the checkbox in the computer account is set, do the changes take place immediately, or must I reboot the server PC or wait for a while?

In a course about Windows Server administration that I took at the university they told us that a normal user could add 10 computers to a domain. Over the years however I've added and removed way more than 10 computers (virtual machines included) to the domain without any problems, while some colleagues of mine swear that they can't add any computers. My account is not priviledged in any aspect, I'm just a regular user like everyone else.

So... what are the rules governing this? Can they be changed by the admin? Is there any way I can find out with my user-level-priviledges?

Just curious. :)

I've got a little private webserver where I have several virtualhosts. I know that it's impossible to assign a certificate to each individual virtualhost, because the server finds out which virtualhost was requested only AFTER the SSL connection has been established. But is it possible to have a single SSL certificate which lists several domains? Or at least a wildcard domain, like *.example.com. If yes, what Linux commands do I have to write to make such a self-signed certificate?

Added: To clarify - I have just one IP address for all the virtual hosts.

For small businesses with less than 10 PCs it's often an overkill to even have a central server, much less buy a Windows Domain Server which costs heaps of cash. However the need remains for people to share files and printers amongst their computers.

The standard solution would be to share the folders publicly. But sometimes that can be undesireable, for example if some unauthorized laptops appear in the network regularly.

Another solution is to create the same users on all computers (including setting the same passwords). This allows for authorized access, but adding new users or chaning passwords is a pain.

It would be great if it was possible to set up one of the machines as a central "user database". Other computers could then authenticate against that computer, and even set permissions on shares. Is this possible somehow?

Is there any software that would test the reliability of a CPU? Like, check how all the instructions are working, verify that cache is not damaged, check for known CPU bugs, etc.

I've got a machine in which I suspect that the CPU might be failing, but the symptoms are weird enough that I'm not certain...

This is about Windows, but I'm sure it applies to other OS as well.

I've heard people say that if you want better performance, you should avoid swap file fragmentation. To do this, you can either manually specify a constant size for the swap file, or even move it to a dedicated partition/disk.

Will this really give any performance benefits? After all - the swap file is accessed in a randomized manner anyway, what's a bit more randomization? And if you're considering a separate disk for the swap file, then you would be far better off investing your money in more RAM instead. Unless you happen to get a free disk of course.

So - is there a point in fighting swap file fragmentation or not?

I have a linux box (Debian) which is up 24/7. I'd like to set it up in such a way, that once a day it connects to a specific FTP server and checks if any files have changed since the last check. If they have, it should send me an email with a list of the changed files.

The check doesn't have to be thorough - I'll be happy if it just compares file dates. But it has to be recursive.

How can I do this? I understand I can use cron to schedule the process, but what do I use to connect and check for changes?

I have a Windows Vista Business box at work and Windows XP Professional box at home. Both are updated to the teeth, but the problem still remains. The symptoms are:

• This happens when I connect from XP to Vista box;
• I copy a file from the Vista box to the XP box;
• This happens only when I copy the file via Windows Explorer. If I use Far Manager, even with "Use system copy routine" turned off, this does not happen;
• The file gets a few random junk bytes appended at the end. PHP files seem to get NULL bytes (zeroes); binary files just get junk.
• The larger the file, the more bytes get appended (and it doesn't seem to corresspond to any block sizes on the hard drives or anything)

For example, I just copied a MP3 file. The size on the Vista box is 66 373 042 bytes, but when copied on the XP box it is 66 387 968 bytes.

I have not been able to find anything remotely like this on Google. Any ideas?