Reputation
16,591
Top tag
Next privilege 20,000 Rep.
Access 'trusted user' tools
Badges
1 10 32
Newest
 Revival
Impact
~1.2m people reached

2d
comment Workarounds for maximum DNS-Interactive terms limit exceeded in SPF record?
@JeffAtwood Normally DKIM is is signed by the sending domaim. If you use a subdomain, then sign with the sub-domain. However, it is legimiate to sign for a subdomain, but may not get the processing. DKIM records need to be created relative to the signing domain. It is also common for the originator to sign the document to allow origin verification.
Aug
17
comment Block outgoing emails from Postfix from non-existent users
@JeremyWarne Second link looks like the fix, if it isn't a spambot on your server.
Jul
24
comment Apache2 Server should be SSL-aware but has no certificate configured [Hint: SSLCertificateFile] for wild card SSL certificate
@Tanmay See updates
Jul
18
comment Exim - password disclosure by world-readable exim.conf - is that necessary?
@sa289 Yes, however root always has access. The only time exim should need passwords is when it is running as the user it is programmed to use when processing message for or from its queue.
Jul
18
comment Exim - password disclosure by world-readable exim.conf - is that necessary?
@sa289 Users are less likely to invoke exim than programs they use. One well defined method of delivering email is to invoke sendmail (exim is symlinked) and use it to start the message on its way. Programs like mail and mailx typically use the sendmail interface to deliver mail.
Jul
18
comment Exim - password disclosure by world-readable exim.conf - is that necessary?
@sa289 Your password is used in an authenticator block, but it should not be defined there. It should be in one of the password files: /etc/exim/passwd or /etc/exim/passwd.client. The password files should be appropriately secured. Ubuntu/Debian leaves the generated configuration file with 644 access, which agrees with my understanding that it may need to be run using almost anyone's privileges.
Jul
9
comment Fixing invalid DNS records for mail server with SSL certificate
@DanielGibbs rDNS validation passes for Google, Apple, Microsoft and StackOverflow. Microsoft has a problem getting their servers to identify themselves by the name in their PTR record. I gather stats and >99% of hosts sending me ham pass rDNS, and >90% identify themselves the name in the PTR record. A few large server farms that trace back to Microsoft skew the last certificate. Both failures get penalized in my spam filtering (and catch most spambots). It is not necessary (or recommended) to change the hostname, just publish the MX name and related PTR.
Jul
8
comment Fixing invalid DNS records for mail server with SSL certificate
The PTR record for 12.34.56.78 should return mail.example.com if you are sending email from this server. This will allow rDNS (reverse DNS) validation.
Jun
30
comment Creating a virtual network for KVM guests spanning multiple host machines
@Sha You a separate network, or route them over the existing routing structure. You can add alias addresses with the Internet addresses, which would have the default route. (Local traffic will bind to the smaller 192.168.* address.) To access local addresses, use whatever naming scheme you choose: a separate domain, service based domains for the internet (www.example.com, mail.example.com), or alternate names. Firewall configuration is trickier when you have multiple addresses with different security requirements on the same port.
Jun
22
comment Two DNS zones: one for internal, the other for DMZ servers, is it possible?
The OP is looking at two zones, one for the intranet and another for the Intranet. This is classing split DNS. Whether they server the same or different namespaces is irrelevant to split DNS.
Jun
19
comment Why are many mail servers using subdomains like mail.example.com?
@joeqwerty example.com is a subdomain of com. example.com is one of several domains reserved for documentation. That aside, organizations with large server may farms under, may have subdomains under mail or smtp that they use for sending email. It is unusual, and not recommended, to name a host mail, in which case the domain name mail.example.com could be the FQDN (Fully Qualified Domain Name) of a host.
Jun
4
comment CentOS 5.5 32 bit “service ntpd restart” issue or not?
@JennyD Updated.
May
31
comment Redirect subdomains to services on different ports of same server
@user2370460 this? Not clear what you are asking. I assume you have control of the services. They should provide information on how to configure IP addresses and ports.
May
31
comment Redirect subdomains to services on different ports of same server
@user2370460 In that case, controlling published ports would be appropriate. I would use a port other than 8080, as that will receive a lot of HTTP probes. 8080 is a common alternative or internal port for web services.
May
31
comment How to tell if someone is trying to use my IP Address?
The program arpwatch can be configured to email you on a number of events, one of which is IP address conflicts.
May
29
comment iptables actively refused everything despite exceptions
@MSQLnoob020983 You will be actively rejected (blocked) on all ports that don't have a service listening on them. If you only have SSH running then all other ports will be blocked. This is how TCP/IP works, nothing is wrong with your system. IPTables reject rule behave the same as a port that has no listener.
May
3
comment ntpd: servers stuck on .INIT
The rule for ntp should allow outgoing traffic. Responses should be covered by a ctstate RELATED,ESTABLISHED input rule.
May
1
comment fail2ban keeps trying to ban again
@Michael Try setting the ban file in /tmp. If fail2ban is not running as root it can't create the file in /etc.
May
1
comment fail2ban keeps trying to ban again
@Michael Updated answer with a tested script. Remove pattern should be '^$2\$' rather than '^$2$'. It is testable from the keyboard,
May
1
comment fail2ban keeps trying to ban again
@Michael I've updated my answer with a sample script and related actions. I did not test the script, you should verify it manually before putting it into production. Under high volumes of ban/unban traffic it may not update the blacklist file correctly.