15,573 reputation
11030
bio website systemajik.com
location Gatineau, Canada
age 59
visits member for 5 years, 1 month
seen 2 hours ago
I have over 30 years experience in all phases of software development and delivery. I have administered a variety of midrange servers, and worked with systems from PCs to Mainframes.

Mar
13
answered configuing sendmail to use virtual hostname
Mar
13
answered Subdomain with different ip on same server
Mar
12
comment How to block IP addresses from port 25
It can be easily done in a connect ACL which denies all connections not from the desired IP addresses. I haven't used the McAfee spam solution, but they should have the requisite A and PTR records in place to pass rDNS validation. You can use then block any incoming connection on port 25 not from their domain. (This is should be more reliable than blocking by IP address.)
Mar
11
answered Blocking spam with SpamAssassin
Mar
11
answered How to block IP addresses from port 25
Mar
10
comment Catch incoming email and then deliver to original recipient on sendmail
Email aliases can handle incoming mail. It should be possible to add an alias that copies the email to a second address.
Mar
6
comment Is there any standard for DNS <-> IP authentication?
@mahai Websites with access restrictions don't publish what addresses they accept connections from. (This is critical security data.) While I may know the address of the website. I don't get a list of address than I can connect from. This is valuable as cracking any one of them may be an easier way to attack the site than trying to attack the site directly.
Mar
6
comment Is there any standard for DNS <-> IP authentication?
@mihai Hosts listed in SPF are usually already public (MX). SPF limits the hosts that can send for the domain, not who can access. And yes, mail server do get hacked.
Mar
6
comment Is there any standard for DNS <-> IP authentication?
@mihai I can't think of any reason to publish your security policy in DNS. Web servers already handle the restrictions, and there are a number of other services than can restrict which addresses/domains can connect. If people can look up the TXT records, they can lookup up the IP. It just tells me where I need to break into so I can pivot onto your systems.
Mar
4
revised Are separate dns records necessary for web and mail on a single server?
Fix typo
Mar
4
revised In SMTP, how does one choose between “Accept than Bounce” vs “Bounce at the edge”?
Clarify
Mar
4
revised SPF - should I implement?
Fix typo
Mar
4
revised Fighting Spam - What can I do as an: Email Administrator, Domain Owner, or User?
Fix typo
Mar
3
revised Understanding Postfix Mail Log
edited body
Mar
3
comment Do the SSH or FTP protocols tell the server to which domain I am trying to connect?
@kasperd For IPv4 the client would need credentials of some sort for the intermediate server. This could be a key which is configured on the intermediate server to force the forwarding, with a separate key for each host. Its a little difficult to configure but once working may simplify the dual stack requirement.
Mar
3
answered Understanding Postfix Mail Log
Mar
3
comment Do the SSH or FTP protocols tell the server to which domain I am trying to connect?
@kasperd You may be able to do this by configuring the client to use the ssh tunneling option '-W' to chain the connection to the appropriate server.
Feb
27
awarded  Yearling
Feb
26
awarded  Nice Answer
Feb
26
answered Risk of starting NTP on database server?