Hot answers tagged

27

Determine your exposure Taking your output from the netstat command, what looks like a lot of services is actually a very short list: $ netstat -lntup | awk '{print $6 $7}'|sed 's/LISTEN//'| cut -d"/" -f2|sort|uniq|grep -v Foreign avahi-daemon:r dhclient dropbox nmbd rpcbind rpc.statd smbd sshd Getting a lay of the land Looking at this list there are ...


27

When using smtp submission on port 587, the value for smtp_url should start with "smtp://", i.e. not with "smtps://". It is also important to make sure ssl_starttls is set to "yes", as correctly done in the config above. While setting up my own server I got the exact same problem. Having access to logs on both the client & the server side, made it ...


19

You have a rule to let the traffic out, but you don't have a rule to let the return traffic in. I'm guessing you meant for these 2 rules to be -A INPUT instead: iptables -A OUTPUT -p tcp --sport 25 -j ACCEPT iptables -A OUTPUT -p tcp --sport 587 -j ACCEPT However using the source port as a method of allowing return traffic in is a bad way to secure the ...


17

That error message is appearing because the mail client is sending only a bare hostname ("PLLAMNAZIFE") rather than a fully-qualified hostname (e.g. "PLLAMNAZIFE.example.com") in the HELO/EHLO part of the SMTP transaction, and your Postfix server is configured to reject such mail. Many mail client programs do not send correctly formatted, fully-qualified, ...


15

mailx supports setting the smtp server on the CLI... echo "message" | mailx -S smtp=$smtphost:$smtpport -s "subject line" -v foo@baa.com Nothing needs to be installed, provided your smtp server lets you send un-authenticated mail. There is no one answer that sets the smtp server for all the bits of software you might have on your Linux box. Each email ...


15

WARNING: The request does not follow best security practice because you disable TLS (encryption) on your main mail relay port, exposing data sent through that port to third-party listeners and/or in-flight modification. The answer below satisfies the request, but best practice requires STARTTLS for the port 25 connection as well. The master.cf file (usually ...


13

Have a look at the smtpd_sender_restrictions and smtpd_sender_login_maps settings. The former can prevent malformed from addresses, while the latter can force the sender address to match the login name. # Prevent malformed senders smtpd_sender_restrictions = reject_non_fqdn_sender # Ensure correct mail addresses reject_unknown_sender_domain # ...


12

127.0.0.1 is not the "outside world", it is looking around inside the house. Check your firewall configuration (iptables in Linux today), most of them shouldn't be accessible from the ouside. Don't run services you don't need. Uninstall all not required software. Change passwords to be stronger. Check your usage of the system, don't go chasing any ...


10

You can bypass HELO restrictions for authenticated users by inserting permit_sasl_authenticated before rejecting rules in the smtpd_helo_restrictions list: smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, permit


10

Best bet is to use a service like uptime robot. Free tier will cover less than 50 sites, pro plan is quite cheap. It'll do a simple ping check or even HTTP status code check The upshot of this is that you're not adding an additional point of failure (that you can control). You've no longer got to maintain and update a monitoring service


9

Unless explicitly configured otherwise, mail will be transmitted over port 25. You can route mail using other ports, or even other protocols than SMTP but that will typically only work within your own network. The mailservers from your intended recipients will most likely only accept incoming email via SMTP on port 25. For instance when I configure ...


8

RFC 5321 defines this in section 3.2: So basically you can send EHLO which should be answered by the mailserver with a list of extended capabilities, including valid encryption algorithms. Should the server not understand EHLO, it is propably an older system, that just accepts HELO. I did not read any further than this, whether the old systems can be asked ...


8

You're sending email to gmail accounts from this address: Admin@validdomain.com The domain "validdomain.com" you're sending from does not have an SPF record setup for it. You have 1 of 2 options: Change the server's mailer so that its outgoing mail uses a domain that is allowed Set up an SPF record for validdomain.com You can use this tool to see what ...


8

The first thing to do in case of SMTP problems where the configuration seems to be OK is that you can actually reach the SMTP server. Use: telnet gmail-smtp-in.l.google.com 25 you should see: Trying 173.194.69.27... Connected to gmail-smtp-in.l.google.com. Escape character is '^]'. 220 mx.google.com ESMTP lv5si9142984bkb.114 - gsmtp (after that type ...


7

I had the same thing and this is what worked for me. set ssl_starttls=yes set ssl_force_tls=yes set imap_user = "user@example.com" set imap_pass = "!HASHEDPASSWORD!" set folder = imap://mail.example.com/ set spoolfile = imap://mail.example.com/INBOX # SMTP user auth # # fill in the right user and pass based on your setup # # protocols: smtp for TLS (25/...


7

You may use sendmail or "sendmail look alike" provided by postfix/exim/... . /usr/sbin/sendmail -i -- $recipients < message_file -i - do not treat lines with leading dot specially You may use more exotic "sendmail look alike" (e.g. provided by msmtp) to send directly via another smtp host without "system wide" configuration....


6

If you are asking "What is the way to connect to an SMTP server using SSH instead of telnet?" the answer is there is none. SSH only communicates over ports using the SSH protocol. Using it to connect to any other port will fail, because SSH will try to speak the SSH protocol, which will not be understood by an SMTP server (or FTP, or other server processes)....


6

Just replace all routers by one manualroute that points directly to the new MX: begin routers redir: driver = manualroute domains = * transport = remote_smtp route_list = * 12.34.56.78 Here 12.34.56.78 - is an IP-address of your new MX where all messages should go.


6

Try the following test command/script #!/bin/sh /usr/sbin/sendmail -i -v -- myemail@mail.com <<END subject: test test END


6

The message "... is not yet authorized to deliver mail from ..." is similar to a greylist implementation described in Adding Greylisting Support. If the destination server implement similar script, you can send your mail by flushing your queue to retry sending soon. $ postqueue -f The greylist implementation works as follows; If a mail come from an ...


6

The forward and reverse DNS need to match. The name itself does not matter. For example in my domain (ziobro.info) I have a record: rack2 IN A 162.219.7.27 My provider has a record: 27 PTR rack2.ziobro.info. in their corresponding in-addr.arp file. One of my mail domains (ziobro.rochester.ny.us) has the appropriate ...


6

sendmail would not send mail by itself. You either have another program running that is using sendmail to send out mail, or you have sendmail listening on a port and relaying mail to outside. Use mailq to see if you have any mail pending in the queue. Look at /var/log/maillog to see what log messages are written by sendmail Try netstat -nlatup|grep ...


5

SMTP and ESMTP (the underlying protocols) that handle mail delivery have extensive RFCs (the original being RFC821, and more modern update RFC2821 and a Internet standards track protocol in RFC5321). How mail servers deal with errors during delivery varies from mail server to mail server. Adding to the complication is the fact that a lot of them are ...


5

In the Unix/Linux world you won't find tools that "do everything", as that violates the single responsibility principle. However, to "orchestrate" all the tools together in a single configuration panel, there are projects like Webmin that provide this functionality. For this specific task of mail/groupware, I have the following suggestion. You could look at ...


5

The format of the message is RFC 2282, the Internet Message Format. The file format sounds like you're describing the mbox format, which is RFC 4155. According to RFC 4155, a new message in an mbox database begins with the From keyword, a single space then the address of the reported sender, a single space and the UTC date of when the message was received. ...


5

0010 - 77 ... win.ch hello [62 0020 - 2e ... .203.230.235], p From this you can see that openssl is connecting with IPv4, whereas ... $ telnet corti.li 25 Trying 2a01:4f8:c17:3bac::2... with telnet you are obviously using IPv6. Thus my guess is that the ISP is intercepting IPv4 connections but not IPv6 connections. You can check this out by enforcing ...


5

It's not a third way. It's the first of two ways: running a well-known program and giving it the envelope and message as inputs, or making a TCP connection to a remote/local SMTP Submission server and speaking the SMTP Submission protocol. (A third way would be speaking the Old-Fashioned Mail Injection Protocol to a local/remote server, but I like to ...


4

The biggest difference between POP3 and IMAP from a user's perspective is that POP3 is designed to hold mail until the client (Thunderbird in this case) downloads the mail, at which point it's removed from the POP3 server (it can be configured to do otherwise, but that's not the norm). IMAP on the other hand, is the opposite. It is designed to be the ...


Only top voted, non community-wiki answers of a minimum length are eligible