OpenBsd 6.2 - pf
I'm trying to set up an smtp relay to gmail.
since my connections are ok, i thought "ok... add smtp"... Bin non ! :/
Everything works fine if I empty /etc/pf.conf (so gmail connector is ok, /etc/mail/smtpd.conf and secrets.db too).
# OpenBSD 6.2 : pf.conf,v 1.54
int_if = "alc0"
tcp_ok = "{domain,ssh,smtp,auth,ntp,https,mysql}"
udp_ok = "{domain,ntp}"
set skip on lo
block all
pass proto tcp to any port $tcp_ok keep state
pass proto udp to any port $udp_ok keep state
Can't figure out what is wrong adding smtp port knowing that everything is ok without this service.
Thanks.
Ok...
Re-examining the logs /var/log/maillog I saw :
[...]mta event=connecting address=tls://108.177.15.16:587
So
grep -w 587 /etc/services
to get...
submission 587/tcp ... # mail message submission
submission 587/udp ... # mail message submission
Updated :
tcp_ok = "{domain,ssh,smtp,submission,auth,ntp,https,mysql}"
udp_ok = "{domain,ntp,submission}"
Reloaded pf rules :
pfctl -f /etc/pf.conf
Ok... :D
Related
I am installing sendmail/dovecot on my mail sever.
I edited file /etc/mail/sendmail.mc
and add the below lines to make sure the domain name is used in sending mail
#add for domain email by deo malamo
define(`confDOMAIN_NAME', `desaonline.co.tz')dnl
FEATURE(`relay_entire_domain')dnl
#end add domail based email by deo malamo
i installed and Used tls/ssl from Let's Encrypt
#add for Let's Encrypt ssl by deo malamo
define(`confAUTH_OPTIONS', `A p')dnl
TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
define(`CERT_DIR', `/etc/letsencrypt/live/mail.desaonline.co.tz/')dnl
define(`confCACERT', `CERT_DIR/chain.pem')dnl
define(`confCACERT_PATH',`/etc/ssl/certs/')dnl
define(`confCLIENT_CERT', `CERT_DIR/cert.pem')dnl
define(`confCLIENT_KEY', `CERT_DIR/privkey.pem')dnl
define(`confSERVER_CERT', `CERT_DIR/cert.pem')dnl
define(`confSERVER_KEY', `CERT_DIR/privkey.pem')dnl
FEATURE(`no_default_msa')dnl
DAEMON_OPTIONS(`Port=smtps, Name=TLSMTA, M=s')dnl
#DAEMON_OPTIONS(`Port=smtp, Name=MTA')dnl
#DAEMON_OPTIONS(`Port=submission, Name=MSA, M=Ea')dnl
#end add Let's Encrypt ssl by dmalamo
MY PROBLEM is the ports 25,465 and 587 are coming up and then shutdown because of port already in use ,Can any one assist me to fix this problem?
When i save the config (/etc/mail/sendmail.mc) and restart sendmail ,port 465 seems to be used and shutdown the whole outgoing ports 25,465 and 587.
logs file have the below entries
daemon TLSMTA: problem creating SMTP socket
Feb 9 13:26:43 mail sm-mta[20646]: NOQUEUE: SYSERR(root): opendaemonsocket: daemon TLSMTA: cannot bind: Address already in use
NOQUEUE: SYSERR(root): opendaemonsocket: daemon TLSMTA: cannot bind: Address already in use
daemon TLSMTA: problem creating SMTP socket
NOQUEUE: SYSERR(root): opendaemonsocket: daemon TLSMTA: server SMTP socket wedged: exiting
MY PROBLEM is the ports 25,465 and 587 are coming up and then shutdown because of port already in use ,Can any one assist me to fix this problem?
Short list to check...
1st) have You compiled sendmail.mc into sendmail.cf ?
2nd) TLSMTA: cannot bind: Address already in use... means that one process already use this port (smtps: 465),
- check who is using port (e.g. "netstat -lntp|grep 465")
- and stop this, sometimes port can be in use by connection, maybe instead restart You should: stop, wait few sec./minutes and then start sendmail
- "netstat -lntp|grep sendmail" can be usefull to see sendmail's listening ports
- before start be sure that ports are not occupied (not in use)
- problem may also be in SELINUX (investigate how to allow program to use ports)
Regards
K.
I have a Centos server with exim installed. I am trying to send en email from the command line like this:
exim -v account#gmail.com
From: email#mydomain.com
To: account#gmail.com
Subject: test email
this is a test
^D
I have also tried:
echo 'test message' | mail -s Test1 account#gmail.com
as well as sending from a PHP script.
The result is the email times out. The logs indicate exim is timing out:
H=alt2.gmail-smtp-in.l.google.com [173.194.219.26] Connection timed out
I believe iptables are correct. I have scanned the server from an external IP and ports 25, 265 and 587 are open. (Not sure 587 needs to be since this will be a send-only situation most likely.)
I have also telnet'd to port 25 successfully. (Most of the successful resolutions I have found involved port 25 being blocked. I don't think that is the case here. I have also called my provider and checked. They claim port 25 connections are not blocked.)
I would appreciate some ideas.
Thank you.
I'm trying to create a catchall email address with Sendmail (it will be used to catch email bounces for Oceth's OEMPro).
First I started by creating a new user:
# useradd -s /bin/false bounces
# passwd bounces
Then I created & opened a virtusertable file with vim virtusertable and added:
bounces#sub.example.com bounces
#sub.example.com bounces#sub.example.com
Then I added the below line to sendmail.mc near the end but before the MAILER_DEFINITIONS of with
FEATURE(`virtusertable', `hash -o /etc/mail/virtusertable.db')dnl
Finally, I ran
# make
Updating databases ...
Reading configuration from /etc/mail/sendmail.conf.
Validating configuration.
Creating /etc/mail/databases...
Updating auth ...
sasl2-bin not installed, not configuring sendmail support.
To enable sendmail SASL2 support at a later date, invoke "/usr/share/sendmail/update_auth"
Creating /etc/mail/relay-domains
# Optional file...
Updating Makefile ...
Reading configuration from /etc/mail/sendmail.conf.
Validating configuration.
Creating /etc/mail/Makefile...
Updating sendmail.cf ...
The following file(s) have changed:
/etc/mail/sendmail.cf
** ** You should issue `/etc/init.d/sendmail reload` ** **
# service sendmail reload
* Reloading Mail Transport Agent (MTA) sendmail [ OK ]
# service sendmail restart
* Restarting Mail Transport Agent (MTA) sendmail [ OK ]
After all this it does not seem to be working, how can I test this properly. I've tried sending an email to bounces#sub.example.com but when I look in /var/mail/ I don't see the bounces user.
# ls /var/mail/
root www-data other-user
I created a MX DNS record for this too, e.g. sub.example.com.
The other indication it is not working correctly is that we are getting a 504 error when we try to use this email address as our POP3 Monitoring method in Oceth's OEMPro.
UPDATE
I tried running the below commands as root, in an attempt to debug the issue but I'm not clear what it's telling me.
root:/# sendmail -d60.5 -bv no-such-user#sub.example.com
map_lookup(dequote, other-user, %0=other-user) => NOT FOUND (0)
map_lookup(host, sub.example.com, %0=sub.example.com) => sub.example.com. (0)
no-such-user#sub.example.com... deliverable: mailer esmtp, host sub.example.com., user no-such-user#sub.example.com
root:/# sendmail -d60.5 -bv bounces#sub.example.com
map_lookup(dequote, other-user, %0=other-user) => NOT FOUND (0)
map_lookup(host, sub.example.com, %0=sub.example.com) => sub.example.com. (0)
bounces#sub.example.com... deliverable: mailer esmtp, host sub.example.com., user bounces#sub.example.com
I'm not sure why it first tries to look up another user on our system called other-user
UPDATE 2
After running # echo '$=w' | sendmail -bt I get the following result.
# echo '$=w' | sendmail -bt
ADDRESS TEST MODE (ruleset 3 NOT automatically invoked)
Enter <ruleset> <address>
> localhost
ip-1??-??-??-??5
[1??.??.??.??5]
ip-1??-??-??-??5.ec2.internal
[127.0.0.1]
ip-172-31-31-167.eu-west-1.compute.internal
In sendmail.mc I've changed FEATURE(virtusertable', hash -o /etc/mail/virtusertable.db')dnl to FEATURE(virtusertable', hash -o /etc/mail/virtusertable.db')dnl, basically I just removed the -o flag.
Then I updated /etc/mail/local-host-names to include sub.example.com, so now it reads:
localhost
ip-17?-??-??-?67.eu-west-1.compute.internal
sub.example.com
Then I ran:
# service sendmail restart
* Restarting Mail Transport Agent (MTA) sendmail
# echo '$=w' | sendmail -bt
ADDRESS TEST MODE (ruleset 3 NOT automatically invoked)
Enter <ruleset> <address>
> localhost
ip-1??-??-??-??5
[1??.??.??.??5]
ip-1??-??-??-??5.ec2.internal
[127.0.0.1]
sub.example.com
ip-17?-??-??-?67.eu-west-1.compute.internal
After sending an email to bunces#sub.example.com I still don't see the mailbox in /var/mail/
# ls /var/mail/
root www-data other-user
I also still get the 504 error in the OEMPro app when I try to configure it with these settings.
Sendmail consults virtusertable only for deliveries to local email domains (listed in $=w) and virtual domains (listed in $={VirtHost}). It seems that sub.example.com is not listed in any of them.
You can add sub.example.com to list of local email domains by listing it in file /etc/mail/local-host-names (one domain/name per line). After modifying the file restart sendmail daemon or send HUP signal to sendmail daemon.
You can check content of $=w by executing the following command as root:
echo '$=w' | sendmail -bt
Sendmail by default automagically adds some "guesswork" to $=w.
Extra hint:
Do not use -o (optional) flag in FEATURE(virtusertable). Without the flag sendmail refuses to start when compiled version of virtusertable is unawailable.
My CentOS server has postfix as MTA and it’s working.
When I type the command mail -s "testing" <my gmail address>, I receive the email.
However, Fail2ban is unable to send emails to my gmail address when an IP gets banned. I’m probably missing some configuration in jail.conf.
Here is part of my jail.conf file:
destemail = myaddress#gmail.com
sendername = fail2ban
mta = sendmail
protocol = tcp
action = %(action_mwl)s
I already tried mta = postfix and it didn’t work.
Thanks in advance for your help.
EDIT: I was able to make it work. None of the configuration above is correct for my fail2ban v0.8.10 and my linux CentOS 6. In fact, I removed all the lines above (garbage).
I found a pre-defined action in /etc/fail2ban/action.d/mail.conf file.
I noticed this action uses "mail -s" command which works on my server.
So, I decided to use this action in my jail.conf file as such:
[ssh-iptables]
enabled = true
filter = sshd
action = iptables[name=SSH, port=ssh, protocol=tcp]
mail[name=ssh, dest=my-address#gmail.com]
logpath = /var/log/secure
maxretry = 5
The only thing that needs to be change to get an email from fail2ban is to add that line below “action” that starts with “mail.” Very simple and easy.
You should change mta = sendmail to:
mta = mail
if you want email notifications with whois i found this solution
[sshd]
enabled = true
logpath = %(sshd_log)s
action = iptables-ipset-proto6[name=ssh, port=ssh, protocol=tcp, bantime=0]
mail-whois[name=sshd, dest=my-email#something.com]
findtime = 3600
bantime = -1
maxretry = 3
All of the above did not work for me.
What worked for me was adding second line under action =....
to be:
sendmail[mailcmd='/usr/sbin/sendmail -f "<sender>" "<dest>"', dest="email#recipient.com", sender="fail2ban", sendername="Fail2Ban", name="jail_name"]
Note: You may do so for various jails.
Also note, that if you would like to get an email notification for ModSecurity, you can do so, by setting a Fail2Ban jail for ModSecurity, and then get the email notifications.
I recently installed Postfix, Dovecot to setup a mail server on my own VPS ( using this tutorial: Email with Postfix, Dovecot, Mysql)
Imaps server uses port 993 for Authentication, and Postfix uses port 25 to send mails.
In this tutorial, users stored in a Database ( so imaps use mysql to authenticate users).
i'm sure every thing works fine with imaps and postfix , because few days ago i installed Kmail client (on my linux) and receive mails from my server. sending mails also works fine, i sent a mail to Gmail and google received it without a problem (in my "Gmail inbox" not spam folder)
So to get to my Emails from a web mail client, i installed Roundcube on /var/www/mail directory.
I configured Roundcube many times. but each time it gives me this Error:
IMAP Error: Login failed for [me#mydomain] from X.x.X.x . Empty
startup greeting (localhost:993) in
/var/www/mm/program/lib/Roundcube/rcube_imap.php on line 184 (POST
/mm/?_task=login?_task=login&_action=login)
When i do log in from roundcube, imap server says ( in /var/log/mail.log ):
May 20 07:05:16 my-server dovecot: imap-login: Disconnected (no auth
attempts): rip=::1, lip=::1, TLS handshaking: Disconnected
Here is my roundcube config file :
$config['db_dsnw'] = 'mysql://roundcubeuser:myPassword#localhost/roundcubemail';
// ----------------------------------
// IMAP
// ----------------------------------
$config['debug_level'] = 13;
$config['default_host'] = 'ssl://127.0.0.1';
$config['default_port'] = 993;
// ----------------------------------
// SMTP
// ----------------------------------
$config['smtp_server'] = 'ssl://localhost';
What's the problem? i really have no idea what is happening !
Thank you.
I'm using postfix + dovecot + roundcube a few months now and it's working for me. In my configuration, postfix rejects plaintext sessions, so roundcube has to connect with ssl - and it's working.
This is from my main.inc.php. I don't remember editing anything here, it's just the initial config created during the installation.
Now that I'm looking at it, default_port doesn't make any sense, I think it's just ignored.
// To use SSL/TLS connection, enter hostname with prefix ssl:// or tls://
// Supported replacement variables:
// %n - http hostname ($_SERVER['SERVER_NAME'])
// %d - domain (http hostname without the first part)
// %s - domain name after the '#' from e-mail address provided at login screen
// For example %n = mail.domain.tld, %d = domain.tld
// TCP port used for IMAP connections
$rcmail_config['default_port'] = 143;
$rcmail_config['default_host'] = array("ssl://localhost:993");
// TCP port used for IMAP connections
$rcmail_config['default_port'] = 143;
In case the other answer does not work, this is what worked for me. My config.inc.php now contains:
$config['default_host'] = 'ssl://localhost';
$config['default_port'] = 993;
NOTE: using tls://localhost did not work for me. I had to specify ssl:// as the URI scheme.
Via PhpMyAdmin, I also ran this SQL command (all my user accounts are on the same machine that runs RoundCube):
UPDATE `rc_users` SET `mail_host`='ssl://localhost'
I got the port number 993 from running sudo netstat -tulnp in order to determine the port on which Dovecot was listening.