Adam's questions

I have a Postfix email server and multiple domains, each with its own IP & Reverse DNS, etc.

The problem is that when someone sends email to one of these domains and requests a "Develivery Status Notification" (DSN), the server will automatically reply from the first IP address set on the interface (the main IP provided by the ISP).

For normal email sending, I use transport_maps with "smtp_bind_address=" so there everything is OK.

The problem is with the DSN replies only. How can I set postfix to send DSN from specific IP address ?

Thank you.

We have an email server running Dovecot and Postfix.

I recieve a lot of spam email containing wierd chinese/japanese or other asian characters.

We don't need these emails in our organization and we do not communicate with people using asian characters.

How can we instruct Postfix to block out all emails containing asian characters ?

We already use "body_checks" to discard email containing some regex strings... but how can we do it for asian characters ?

Server [/etc/postfix] # cat body_checks
/free mortgage quote/     DISCARD
/repair your credit/      DISCARD
/From:.*<>/         DISCARD
Server [/etc/postfix] # cat main.cf |grep body
body_checks = pcre:/etc/postfix/body_checks
Server [/etc/postfix] #

I have some questions regarding the "dd" utility, if someone can help. Please answer only if you are sure about the answer !

I have a scenario here in which I have a HDD with Bad Sectors that I need to wipe in order to archive it. I want to decomission that respective HDD and I started to wipe it using one-pass zeros.

dd if=/dev/zero of=/dev/sda status=progress

at exactly 3.7 GB in the Wipe (the HDD has 500 GB capacity), it always throws me a "I/O Error" and the dd utility exists.

I ASUME there is a Bad Sector or something there...

Now, I have multiple questions/issues:

1. Is there a method to WIPE ALL the sectors of that respective HDD, even if there are bad sectors ? Or at least SKIP the bad ones and continue wiping the rest of the HDD which has good sectors ?... Using "conv=noerror" in "dd" does NOT do the trick, because, as I understand, "conv=noerror" only skips information in the "if" device (input device), not on the "of" device (output device). I read something about ddrescue and badblocks, and so on, but I did not have a clear answer in my mind...

2. I read somewhere that "dd" is not such a great tool to wipe HDDs... To be more precise, I have heard that "dd" skips some sectors that the Harddisk may have reserved if they are bad sectors, for example. I need "DD" to access ALL my HDD space.

What I want to say is that I use "dd" for 15 years to wipe all my hdds. Very few of them threw the "I/O Error", and those HDDs were archived and never given away, exactly because of the uncertainty of full wiping... So I did not take any chance... However, I had HDDs which I wiped completely and which didn't threw any I/O Errors.

Is there even a remote possibility that "DD" did not Wipe everything from these HDDs ? If I used "dd" and it went ALL THE WAY, until it threw the "No space left on device" message, can I safely asume that it wiped ALL the harddisk space ? Or even in these conditions, are there some sectors/blocks that might have been reserved and "dd" cannot touch these ? (in which case, it is a security concern)...

Thank you !

Adam.

I have 2 server that I installed with Ubuntu Server and I monitor them.

Suffice to say that I didn't configure the BIOSes initially. Somebody else was in charge of this operation.

Let's call these servers: Server1 and Server2.

Server1 is a Lenovo ThinkCentre M92P - This one has Intel Management Engine with AMT Server2 is a HP Proliant DL160 G6 - This one has IPMI (to my surprise, it doesn't have ILO).

I was in charge of the OS Section. I installed Ubuntu 20.04 on both of them, I secured them, firewall, VPN, and so on....

But I dind't pay attention to one single thing: the possibility of external access, independent of OS, via Intel ME/AMT and IPMI.

I disabled them both (Intel ME/AMT and IPMI) on both servers so I can have a good night sleep. And no, I do not need them. OS with Linux is enough, I don't need remote management features.

My questions are (I ASK THAT ONLY PEOPLE WHO KNOW THESE THINGS LIKE 100% TO ANSWER ME, OK ?)

1. CAN SOMEBODY HACK INTO MY SYSTEM USING THESE AND ACCESS THE CONTENTS OF MY HDD WHILE LINUX IS RUNNING ? (I am ONLY interested in information theft or virus/info writing on HDD). I don't care about CPU temperature, auto-reboots and sensors. Nothing happened that I should have noticed. I am only interested in remote exploits.

Is it possible ? Does Intel ME/AMT or IPMI allow for this ? (for externals to enter my system and read the HDD) ?

I also mention the following facts:

1st server (Intel ME/AMP):

• I think it only runs on the on-board NIC. I don't use the onboard LAN Card. Only PCIe LAN Cards. Does Intel ME/AMPT run only on on-board NIC ? If that is the case, I can stay relaxed.
• It looks like AMP had DHCP active, but my Card doesn't get DHCP, so I believe this is also a good point.
• Even configuring a local address, I wasn't able to access Intel ME/AMP from Linux or from on an external computer via the real IPs. Port scans reveal no open ports, aside from those opened by Linux

2nd server (IPMI):

• IMPI is set on BIOS to run on DEDICATED NIC. Not on Shared Onboard NIC. (but I don't saw a dedicated RJ-45 Port on the back of the server)
• Also, NO IP address is obtained via DHCP.
• I wasn't able to access Intel ME/AMP from Linux or from on an external computer via the real IPs. Port scans reveal no open ports, aside from those opened by Linux

I disabled the services now. I am interested if UNTIL NOW, could anyone have entered in some form or another to access my HDD ? I believe that in order to enter, an IP address must be configured. Intel ME/AMP and IPMI both used DHCP on an interface on which I didn't have an IP. But in my Internal LAN, I had an IP on a PCIe card. Could that have been a problem ?

If someone can help, please help me with these security concerns....

Thank you !

I have a wierd problem with SpamAssassin loggin a problem to mail.log Sometimes, SpamAssassin complains about "internal error, python traceback seen in response".

What can I do to resolve this problem ?

Example log:

Jan 10 11:06:31 scpej-hga spamc[365495]: connect to spamd on ::1 failed, retrying (#1 of 3): Connection timed out
Jan 10 11:06:31 scpej-hga spamc[365494]: connect to spamd on ::1 failed, retrying (#1 of 3): Connection timed out
Jan 10 11:06:31 scpej-hga spamc[365495]: connect to spamd on ::1 failed, retrying (#1 of 3): Connection timed out
Jan 10 11:06:31 scpej-hga spamc[365494]: connect to spamd on ::1 failed, retrying (#1 of 3): Connection timed out
Jan 10 11:06:31 scpej-hga spamd[350070]: spamd: connection from 127.0.0.1 [127.0.0.1]:53516 to port 783, fd 6
Jan 10 11:06:31 scpej-hga spamd[350071]: spamd: connection from 127.0.0.1 [127.0.0.1]:53518 to port 783, fd 6
Jan 10 11:06:31 scpej-hga spamd[350070]: spamd: setuid to debian-spamd succeeded
Jan 10 11:06:31 scpej-hga spamd[350071]: spamd: setuid to debian-spamd succeeded
Jan 10 11:06:31 scpej-hga spamd[350070]: spamd: processing message <[email protected]> for debian-spamd:125
Jan 10 11:06:31 scpej-hga spamd[350071]: spamd: processing message <[email protected]> for debian-spamd:125
Jan 10 11:06:33 scpej-hga spamd[365524]: util: setuid: ruid=125 euid=125 rgid=135 135 egid=135 135 
Jan 10 11:06:33 scpej-hga spamd[365523]: util: setuid: ruid=125 euid=125 rgid=135 135 egid=135 135 
Jan 10 11:06:34 scpej-hga spamd[350070]: internal error, python traceback seen in response
Jan 10 11:06:34 scpej-hga spamd[350071]: internal error, python traceback seen in response
Jan 10 11:06:34 scpej-hga spamd[350070]: spamd: clean message (4.1/5.0) for debian-spamd:125 in 3.8 seconds, 12458 bytes.
Jan 10 11:06:34 scpej-hga spamd[350070]: spamd: result: . 4 - DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HTML_MESSAGE,RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,SPF_HELO_PASS,SPF_PASS,URIBL_BLOCKED scantime=3.8,size=12458,user=debian-spamd,uid=125,required_score=5.0,rhost=127.0.0.1,raddr=127.0.0.1,rport=53516,mid=<[email protected]>,autolearn=no autolearn_force=no
Jan 10 11:06:34 scpej-hga spamd[350071]: spamd: clean message (4.1/5.0) for debian-spamd:125 in 3.8 seconds, 12458 bytes.
Jan 10 11:06:34 scpej-hga spamd[350071]: spamd: result: . 4 - DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HTML_MESSAGE,RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,SPF_HELO_PASS,SPF_PASS,URIBL_BLOCKED scantime=3.8,size=12458,user=debian-spamd,uid=125,required_score=5.0,rhost=127.0.0.1,raddr=127.0.0.1,rport=53518,mid=<[email protected]>,autolearn=no autolearn_force=no
Jan 10 11:06:34 scpej-hga spamd[350039]: prefork: child states: IB
Jan 10 11:06:34 scpej-hga spamd[350039]: prefork: child states: II

Ubuntu Server 20.04 LTS running SpamAssassin 3.4.4-1ubuntu1.

Thank you !

I was wondering if someone could help me with an odd problem...

I have a Lenovo ThinkCentre M92P Desktop PC, which has an Intel Onboard LAN Card that doesn't want to initialize and I don't know what the hell is the problem with it...

I'll post some of my configs:

lspci:

infosky [~] # lspci |grep Etherne
00:19.0 Ethernet controller: Intel Corporation 82579LM Gigabit Network Connection (Lewisville) (rev 04)

lshw:

infosky [~] # lshw -c network
  *-network UNCLAIMED
       description: Ethernet controller
       product: 82579LM Gigabit Network Connection (Lewisville)
       vendor: Intel Corporation
       physical id: 19
       bus info: pci@0000:00:19.0
       version: 04
       width: 32 bits
       clock: 33MHz
       capabilities: pm msi cap_list
       configuration: latency=0
       resources: memory:f7e00000-f7e1ffff memory:f7e35000-f7e35fff ioport:f080(size=32)

dmesg:

infosky [~] # dmesg |grep e1000
[    0.678546] e1000e: Intel(R) PRO/1000 Network Driver - 3.2.6-k
[    0.680549] e1000e: Copyright(c) 1999 - 2015 Intel Corporation.
[    0.688720] e1000e 0000:00:19.0: Interrupt Throttling Rate (ints/sec) set to dynamic conservative mode
[    1.951961] e1000e: probe of 0000:00:19.0 failed with error -2

uname -a:

Linux infosky 5.4.0-59-generic #65-Ubuntu SMP Thu Dec 10 12:01:51 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux

Ubuntu version:

Ubuntu 20.04.1 LTS

In BIOS, the Oboard LAN is enabled and LAN Booting is Disabled.

All updates are already performed. System up-to-date. LAN Card not recognized by driver, I assume. Something has to do with that "probe of 0000:00:19.0 failed with error -2" which I don't know what it means.

I was thinking about installing Intel's drivers from their website but this seems a little too much to do. The drivers should be naturally integrated in the kernel. If I install manual drivers, then this means that everytime I get a kernel update I must manually reinstall drivers ? This sucks...

If anyone can lend a helping hand, it would be very appreciated... :-)

Thanks !

I have a strange situation here. If anyone can help, please do so.

We're talking about a Linux Box running as Router using Ubuntu 18.04.3 LTS, with 2 interfaces: "lan" - which connects to my internal LAN and "wan" - which connects to my ISP.

However, my ISP requires PPPoE connection, so, basically, the "wan" interface is used only a starter for the ppp0 interface.

My problem is that I cannot get IPv6 global address on this server.

I am able to successfully connect to my ISP. I already followed the tutorial from here: http://gruffi.be/mediawiki/index.php/Ipv6_with_PPPoE_on_Ubuntu , but it doesn't work for me.

So, here is what I did:

1. /etc/ppp/options:

   +ipv6 ipv6cp-use-ipaddr
   

2. /etc/sysctl.conf:

   net.ipv6.conf.all.forwarding=1
   
   net.ipv6.conf.ppp0.accept_ra=2
   

3. /etc/wide-dhcpv6/dhcp6c.conf:

   interface ppp0 {
   
       send ia-pd 2;
       send ia-na 1;
   };
   
   # Use subnets from the prefix with id 0
   id-assoc pd 2 {
       prefix-interface lan {
           # Assign subnet 1 to eth0
           sla-len 8; # <----- BELANGRIJK: 8 omdat ons klein net 64 en ons groot 56 is en dat het verschil is
           sla-id 2;
       };
   };
   
   id-assoc na 1 { };
   

4. /etc/radvd.conf:

   interface lan
   {
       AdvSendAdvert on;
       prefix ::/64
       {
           AdvOnLink on;
           AdvAutonomous on;
           AdvRouterAddr on;
       };
   RDNSS 2001:4860:4860::8888  2001:4860:4860::8844
           {
                   # AdvRDNSSLifetime 3600;
           };
   };
   

My ISP told me that it doesn't use Router Advertisement, however it uses DHCPv6 Prefix Delegation and offers /64 subnets.

The problem is that I tried more configs from the net, non of them worked for me.

When I "ifconfig ppp0", it says:

inet 1.2.3.4 ...
inet6 fe80::xxxx:yyyy

No sign of a global IPv6 address.

If I turn on debugging on wide DHCP client and I examine /var/log/syslog, I see that it tries to send Solicit messages to ff02::1:2%ppp0 and the timers reset. I get no reply.

However, router advertisements are working, both on "ppp0" and on my internal lan, because I have a Default Route: "default via fe80::1" when I "ip -6 r". However, no global IPv6 address.

I suspect it something to do with DHCP. The address is not obtained correcly.

I can ping:

ping6 fe80::1%ppp0
64 bytes from...

But when trying to "ping6 google.com", it says: "Beyond scope of source address"

I need to do 2 things, in the long run:

1. Try to get a global IPv6 address on "ppp0" so my websites can be accesible from IPv6 addresses (DNS already taken care of)

2. I need to forward whatever /64 prefix my ISP gives me, let's say: "2001:abcd:dead:beef::/64" to my internal computers, but using a fixed part for the internal computers.[/COLOR]

For example:

Computer 1: 2001:abcd:dead:beef::1/64
Computer 2: 2001:abcd:dead:beef::2/64
Computer 3: 2001:abcd:dead:beef::3/64

I do NOT want EUI-64 addresses, NOR do I want Private Addresses. I want my computers assigned an ORDERly IPv6 address with the prefix given, regardless of the dynamic prefix.

For example, after reboot, I might get "2001:1234:beef:dead::/64". I want the same Host-part allocation using "::1", "::2", and so on...

Thank you !