I migrated my sites to a new server! Hopefully this means that the next dist-upgrade will work without a hitch.
Debian 9 “Stretch” it is!
If you notice any of my sites misbehaving, let me know. For now I’m proud of the A+ rating by SSL Labs.
Related: 2018-03-09 OpenVZ Pains, Sibirocobombus Setup.
2018-03-09 OpenVZ Pains
Sibirocobombus Setup
Bonus: I just realized how much simpler my setup has become now that I’m no longer self-hosting an email server!
To remind myself and others of the giant pain email has become, I’m copying the relevant stuff I deleted from my *Sibirocobombus Setup* page and the comments on that page.
☯
You need to add reverse DNS entry on the web site.
“Mailing to remote domains not supported.”
alex@sibirocobombus:~$ mail kensanata@gmail.com
Subject: test from sibirocobombus
hi
.
Cc:
alex@sibirocobombus:~$ mail
No mail for alex
alex@sibirocobombus:~$ sudo exim -bp
0m 1.2K 1bQDA7-0000As-S4 <> *** frozen ***
alex@sibirocobombus
alex@sibirocobombus:~$ fg
-bash: fg: current: no such job
alex@sibirocobombus:~$ exiwhat
-bash: exiwhat: command not found
alex@sibirocobombus:~$ exim -Mvl 1bQDA7-0000As-S4
-bash: exim: command not found
alex@sibirocobombus:~$ sudo exim -Mvl 1bQDA7-0000As-S4
2016-07-21 14:33:11 Received from <> R=1bQDA7-0000Ao-RS U=Debian-exim P=local S=1230
2016-07-21 14:33:11 kensanata@gmail.com <alex@sibirocobombus> R=nonlocal: Mailing to remote domains not supported
*** Frozen (delivery error message)
I guess this means we need to fix exim?
First, comment the crontab on my Raspberry Pi such that it will no longer update my zonefile.
Setting up Exim using these rules:
- https://wiki.debian.org/Exim#Things\ you\ might\ want\ to\ configure
- Copying the dkim private and public keys from my Raspberry Pi to `/etc/exim4/dkim` and `chown Debian-exim.Debian-exim dkim.*` to change their owners.
- edit `/etc/exim4/exim4.conf.localmacros` and add the following:
1. https://debian-administration.org/article/718/DKIM-signing_outgoing_mail_with_exim4
2. note that the selector is something in your zone file, ie. dkim._domainkey for me DKIM_CANON=relaxed DKIM_SELECTOR=dkim DKIM_DOMAIN=alexschroeder.ch DKIM_PRIVATE_KEY=/etc/exim4/dkim/dkim.private
- edit `/etc/exim4/exim4.conf.template` and add some stuff for Spam Assassin as described in the Debian documentation and in the Exim documentation; remember that you need to `apt-get install exim4-daemon-heavy` like I did up above! This is what I use:# https://wiki.debian.org/Exim#Spam_scanning and # http://www.exim.org/exim-html-current/doc/html/spec_html/ch-content_scanning_at_acl_time.html#SECID206 # put headers in all messages (no matter if spam or not) warn spam = nobody:true add_header = X-Spam-Score: $spam_score ($spam_bar) add_header = X-Spam-Report: $spam_report # add second subject line with *SPAM* marker when message # is over threshold warn spam = nobody add_header = Subject: ***SPAM (score:$spam_score)*** $h_Subject: # reject spam at high scores deny message = This message scored $spam_score spam points. spam = nobody:true condition = ${if >{$spam_score_int}{60}{1}{0}}
- I’m eager to deny spam mails. The example they have used 120 (spam score > 12) and I’m using much less.
- `service exim4 restart`
- if we’re on blocklists, check http://www.spamhaus.org/lookup/ and https://senderscore.org/blacklistlookup/
- `mail kensanata@gmail.com` and try it
- make sure your spam filter works by by sending yourself an email containing the magic string and verify that you see the appropriate response in `/var/log/exim4/rejectlog`
- if you’re sure that it works and you’re not being flooded by spam, you can think about automatically forwarding all emails by creating a `~/.forward` file in every user’s home directory containing nothing but the new email address; watch out: if you forward too much spam, Gmail will start to refuse mails from your domain!
- `sudo -u claudia mail` # to read mails for other users and delete spam
- if you’ve waited for a while and verified that you’re not being flooded by spam and you’ve setup the forwarding info so that future mails can be read elsewhere, it’s time to resend mails already delivered using `formail` (which is part of `procmail`):sudo cat /var/spool/mail/claudia | formail -k
-X From:
-X Subject:
-X Message-Id:
-X Date:
-X To:
-X Content-Type:
-I "To: kensanata@gmail.com"
-s /usr/sbin/sendmail -t -f kensanata@gmail.com
https://wiki.debian.org/Exim#Things\ you\ might\ want\ to\ configure
https://debian-administration.org/article/718/DKIM-signing_outgoing_mail_with_exim4
Debian documentation
in the Exim documentation
https://wiki.debian.org/Exim#Spam_scanning
http://www.exim.org/exim-html-current/doc/html/spec_html/ch-content_scanning_at_acl_time.html#SECID206
http://www.spamhaus.org/lookup/
https://senderscore.org/blacklistlookup/
magic string
resend mails
I’m trying to improve SpamAssassin and found the wiki page Improve Accuracy. `spamassassin -D --lint 2>&1 | grep -i failed` produces a few Perl modules:
Improve Accuracy
- `sudo apt-get install libssl-dev`
- `cpanm Digest::SHA1 Geo::IP Razor2::Client::Agent Mail::DKIM DBI Encode::Detect Net::Patricia`
- edit `/etc/default/spamassassin` and set `CRON=1`
*Watch out!* Perhaps you’ll be getting daily mail with the following:
/etc/cron.daily/spamassassin:
channel: could not find working mirror, channel failed
sa-update failed for unknown reasons
On ServerFault, I found the suggestion that some of the files in `/var/lib/spamassassin` had the wrong owner. It should be `debian-spamd`. And they were right!
On ServerFault
This listed `/var/lib/spamassassin/3.004000` and all its files belonging to root:
sudo find /var/lib/spamassassin -user root
To fix it:
sudo find /var/lib/spamassassin -user root -exec chown debian-spamd:debian-spamd '{}' ';'
I’m not sure why those files ended being there, owned by root. Perhaps I had run `sudo sa-update` just to “test” it?
☯
Time to get tough on spam! This is not funny.
alex@sibirocobombus:~$ mail
Mail version 8.1.2 01/15/2001. Type ? for help.
"/var/mail/alex": 332 messages 332 new
>N 1 Oneill.12731@gree Tue Sep 13 23:19 446/30612 Equipment receipts
N 2 Herman4@habit-rea Tue Sep 13 23:29 226/14170 payment copy
N 3 Nichole7@hudsonpl Tue Sep 13 23:35 225/14073 payment copy
N 4 Mariana2@sprintin Tue Sep 13 23:53 223/13877 payment copy
N 5 huixinsoft40@foxm Wed Sep 14 01:33 100/6194 =?utf-8?B?dGhlIGRpcmVjdCBmYWN0b3J5IGl
N 6 dgvsd876dvs@126.c Wed Sep 14 01:43 75/4277 =?utf-8?B?UHJvbW90aW9uYWwgYXBwYXJlbCB
N 7 Diann630@totalind Wed Sep 14 02:36 222/13874 payment copy
N 8 dkhaaabgupxy@ens. Wed Sep 14 02:42 97/5898 =?GB2312?B?UHJvZmVzc2luYWwgVGFibGV0IF
N 9 mnsh@cichzeowtnre Wed Sep 14 03:13 72/3877 =?GB2312?B?UkU6SGlnaCBxdWFsaXR5IGFuZC
N 10 mpybenrgvr@uouqb. Wed Sep 14 03:13 74/4043 =?GB2312?B?UkU6SGlnaCBxdWFsaXR5IGFuZC
N 11 Corine67@kbr.mx Wed Sep 14 03:35 222/13797 payment copy
N 12 Karyn405@imagodep Wed Sep 14 04:08 224/13999 payment copy
N 13 Ray79@excluservic Wed Sep 14 04:11 224/13924 payment copy ***SPAM (score:5.3)*** p
N 14 Adolfo902@slsterl Wed Sep 14 04:18 233/14625 payment copy ***SPAM (score:5.9)*** p
N 15 d4gdfv@yeah.net Wed Sep 14 04:38 73/4129 =?utf-8?B?UkU6IGJ1c2luZXNzIG1hcmtldCB
N 16 Rene216@sk-sigurd Wed Sep 14 04:41 224/13935 payment copy ***SPAM (score:5.3)*** p
N 17 hulsingcrm37@aliy Wed Sep 14 05:58 82/4756 =?utf-8?B?UkU6IHF1b3RlIHByaWNl?=
N 18 ybgup@bdmpxxybdln Wed Sep 14 06:37 62/3257 =?GB2312?B?UmU6IHByb2Zlc3Npb25hbCBzdG
I usually just run `p root` to see if I got anything from root. The Tiger reports, for example.
& p root
Message 186:
From root@alexschroeder.ch Sun Sep 18 02:01:18 2016
Envelope-to: root@alexschroeder.ch
Delivery-date: Sun, 18 Sep 2016 02:01:18 +0200
From: "Tiger automatic auditor at sibirocobombus" <root@sibirocobombus>
To: root@alexschroeder.ch
Subject: Tiger Auditing Report for sibirocobombus
Date: Sun, 18 Sep 2016 02:01:18 +0200
1. Performing check of user accounts...
NEW: --WARN-- [acc021w] Login ID colord appears to be a dormant account.
1. Performing check of passwd files...
But really, pages and pages of spam is not good. What can I do?
I edited `/etc/exim4/exim4.conf.localmacros` and added the following:
1. http://www.chew.ch/leoluc/software/debian/#AntiSpam
CHECK_RCPT_VERIFY_SENDER=yes
CHECK_RCPT_REVERSE_DNS=yes
CHECK_RCPT_SPF=yes # requires spf-tools-perl
CHECK_DATA_VERIFY_HEADER_SENDER=yes
CHECK_RCPT_IP_DNSBLS=bl.spamcop.net:zen.spamhaus.org
Reload the config file using `sudo service exim4 reload`, perhaps? I wasn’t sure and did the following, instead:
alex@sibirocobombus:~$ sudo update-exim4.conf
alex@sibirocobombus:~$ sudo service exim4 restart
My plan is to now lean back and watch `/var/log/exim4/rejectlog`.
Actually, there’s a test you can do according to DNS Blacklist with Exim: send a mail to nelson-pbl-test@crynwr.com from your mail server; the reply should get blocked.
DNS Blacklist with Exim
alex@sibirocobombus:~$ mail nelson-pbl-test@crynwr.com
Subject: testing blacklist
Thanks for the bot.
.
Cc:
OK, checking my log file... `/var/log/exim4/mainlog` now says:
2016-09-21 13:30:35 1bmfjX-0006Xh-Kg <= alex@alexschroeder.ch U=alex P=local S=413
2016-09-21 13:30:40 1bmfjX-0006Xh-Kg SMTP error from remote mail server after RCPT TO:<nelson-pbl-test@crynwr.com>: host ns1.crynwr.com [192.203.178.14]: 451 https://www.spamhaus.org/query/ip/192.71.233.105
2016-09-21 13:30:40 1bmfjX-0006Xh-Kg russnelson.com [192.203.178.57] Connection refused
2016-09-21 13:30:41 1bmfjX-0006Xh-Kg == nelson-pbl-test@crynwr.com R=dnslookup T=remote_smtp defer (111): Connection refused
Oops, my server is itself listed! 😢
192.71.233.105 is not listed in the SBL
192.71.233.105 is not listed in the PBL
192.71.233.105 is listed in the XBL, because it appears in:
CBL
I followed the instructions:
instructions
alex@sibirocobombus:~$ mail helocheck@abuseat.org
Subject: test
CBL
.
Cc:
And I did get back the following:
From MAILER-DAEMON Wed Sep 21 13:36:53 2016
Envelope-to: alex@alexschroeder.ch
Delivery-date: Wed, 21 Sep 2016 13:36:53 +0200
X-Failed-Recipients: helocheck@abuseat.org
Auto-Submitted: auto-replied
From: Mail Delivery System <Mailer-Daemon@alexschroeder.ch>
To: alex@alexschroeder.ch
Subject: Mail delivery failed: returning message to sender
Date: Wed, 21 Sep 2016 13:36:53 +0200
This message was created automatically by mail delivery software.
A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:
helocheck@abuseat.org
SMTP error from remote mail server after RCPT TO:<helocheck@abuseat.org>:
host mail.abuseat.org [54.93.50.35]: 550 *** The HELO for IP address 192.71.233.105 was 'localhost.localdomain' (invalid syntax) ***
OK, following their instructions on naming issues.
naming issues
alex@sibirocobombus:~$ uname -n
sibirocobombus
alex@sibirocobombus:~$ hostname -s
sibirocobombus
alex@sibirocobombus:~$ hostname -d
localdomain
alex@sibirocobombus:~$ hostname -f
localhost.localdomain
This makes me sad.
alex@sibirocobombus:~$ cat /etc/hosts
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
192.121.170.192 kallobombus
127.0.0.1 localhost.localdomain localhost sibirocobombus alexschroeder.ch
1. Auto-generated hostname. Please do not remove this comment.
192.71.233.105 sibirocobombus communitywiki.org emacswiki.org campaignwiki.org rpg.alexschroeder.ch korero.org arabisch-lernen.org oddmuse.org alexschroeder.ch
::1 localhost ip6-localhost ip6-loopback
alex@sibirocobombus:~$ cat /etc/hostname
sibirocobombus
I changed the `127.0.0.1` line to say the following:
127.0.0.1 alexschroeder.ch localhost sibirocobombus
I’m not sure what I expect the names to be.
alex@sibirocobombus:~$ uname -n; hostname -s; hostname -d; hostname -f; hostname
sibirocobombus
sibirocobombus
ch
alexschroeder.ch
sibirocobombus
It seems to have done the thing, however. When I send another email to `helocheck@abuseat.org`, I get a positive reply:
From MAILER-DAEMON Wed Sep 21 13:50:57 2016
Envelope-to: alex@alexschroeder.ch
Delivery-date: Wed, 21 Sep 2016 13:50:57 +0200
X-Failed-Recipients: helocheck@abuseat.org
Auto-Submitted: auto-replied
From: Mail Delivery System <Mailer-Daemon@alexschroeder.ch>
To: alex@alexschroeder.ch
Subject: Mail delivery failed: returning message to sender
Date: Wed, 21 Sep 2016 13:50:57 +0200
This message was created automatically by mail delivery software.
A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:
helocheck@abuseat.org
SMTP error from remote mail server after RCPT TO:<helocheck@abuseat.org>:
host mail.abuseat.org [54.93.50.35]: 550 *** The HELO for IP address 192.71.233.105 was 'alexschroeder.ch' (valid syntax) ***
So now, I’ll remove myself from the CBL and wait an hour or two before testing again.
Also note: those test results seem to take ages to get back. It’s far easier to simply check `/var/log/exim4/mainlog` and look for entries like the following:
2016-09-21 16:20:40 no host name found for IP address 186.5.5.146
2016-09-21 16:20:42 H=([186.5.5.146]) [186.5.5.146] Warning: 186.5.5.146 is listed at bl.spamcop.net (127.0.0.2: Blocked - see http://www.spamcop.net/bl.shtml?186.5.5.146)
#Web #Administration