Hot answers tagged

7

It is because smtpd_recipient_restrictions only apply to the mails received by smtpd daemon through an SMTP transaction. The mails submitted using sendmail or mailx command is queued in maildrop queue by postdrop command, which is picked up by pickup and fed to cleanup directly. You can't restrict recipients for the mails submitted through sendmail or ...


7

Your failregex is missing the special string <HOST> which you must insert in the place where the IP address will appear in the log entry. This is required so that fail2ban will know what IP address it should act on.


6

You'll be farther ahead by extending fail2ban by dropping in a custom configuration file into its .d config directory. Do as little work as possible!


6

You can use header_checks and body_checks to block on certain strings. More info here. You can use smtpd_sender_restrictions to block mails from certain users. More info here. #/etc/postfix/main.cf header_checks = regexp:/etc/postfix/header.re smtpd_sender_restrictions = check_sender_access hash:/etc/postfix/blacklisted_roles #/etc/postfix/header.re /^...


6

First of all, you had some typos in your code. The individual object of a list within a where-clause is addressed by $_, not $. And you were thinking around the corner. Your approach was a little complicated. Try this instead :) Get-ChildItem Z:\ -Recurse | where { $_.GetAccessControl().Owner -eq "DOMAIN\username"} | Remove-Item Although personally, I don'...


5

its because its specifying a single ip, you need to write it with the subnet: pass in from 111.111.0.0/16 man pf.conf should list a few methods of defining ranges and blocks. A side note, take care to ensure there are no drop quick kind of rules above your pass, and no rules below that could accidently match and block your packets.


5

From the syslog-ng administrators guide (v 2.0, which is old, but what you're using) When a log statement includes multiple filter statements, syslog-ng sends a message to the destination only if all filters are true for the message. In other words, the filters are connected with the logical AND operator. In the following example, no message arrives to ...


4

The question is rather old, but just in case someone comes across a similar problem. Parameter all can be used for protocol instead of ip to also filter for other traffic like arp. tc filter add dev $IF_LAN parent 1: protocol all prio 7 u32 match u32 0 0 flowid 1:190 Also match u32 0 0 is a shorter expression to filter all traffic.


4

As clement said, your restriction doesn't work because the email was queued via pickup. As workaround you can apply a solution from postfix-users mailing-list In master.cf look the pickup entry. Then add -o content_filter=smtp:[127.0.0.1]:12525 pickup fifo n - n 60 1 pickup -o content_filter=smtp:[127.0.0.1]:12525 ...


4

To my knowledge this isn't possible - the "Applies to" description is merely a string embedded in the adm(x) file. There's no "IF" processing for this - regardless of what version of Windows processes the Group Policy it'll set that setting, whether it has any impact or not. Group Policy is exceptionally quick at processing individual registry based ...


4

I just used the functionality in the tool, by right clicking one of the packets that was problematic, then selected the sub-menu "Apply as Filter" > then selected ".. and not Selected" (under the "Not Selected" grouping). It then changed the expression to look like this. (http) && !(ip.dst == 239.255.255.250) So with using the Expression popup, it ...


4

Like this tshark -e tcp.srcport -T fields


3

Yup that is intended behavior. Your bounce doesn't pass check_recipient_access because smtpd directive and from your log, the bounce email never touch smtpd at all (bounce -> qmgr -> lmtp) One possible solution of your problem is using transport_maps instead of check_recipient_access. This directive was invoked by trivial-rewrite process and all email ...


3

grep knows to take files as arguments. Please check the man. You could use egrep, instead of grep -e (which is the same): # egrep -v '^java.io|^\ {8}at' catalina.out | less


3

OK, genuinely interesting problem, given that it's got to function at the end of a pipe. There may be easier ways to do this, but I found this one worked (and it uses the sysadmin's Swiss Army Chainsaw, perl): tail -f catalina.out | perl -n -e '{ if (/^java.io.IOException: Server returned HTTP response code: 401/) { $ignore=1;} elsif ($ignore>=1 and $...


3

The only option to achieve this is to create an LDAP filter string to be used by the ldap_user_search_base config parameter (syntax: search_base[?scope?[filter][?search_base?scope?[filter]]*]). This must be a valid RFC 2254 filter, and will likely somehow incorporate your ldap_access_filter into the ldap_user_search_base. The reason for this is that ...


3

Set your transport_filter to bash/python/.. script transport_filter = /scripts/exim_add_signature.sh $sender_address See http://www.exim.org/exim-html-current/doc/html/spec_html/ch-generic_options_for_transports.html for documentation about transport_filter. In the script do the following (pseudo-code): no_signature_mails = ["bob@example.com"] if (argv[1]...


3

LDAP doesn't track this in the way you need. It can know when users authenticate (check into your hypothetical group), but not when they deauthenticate... it wouldn't know when to remove users from the group. Now you tagged the queston "Windows", so I'll add that an Active Directory LDAP implemention specifically can tell you this. However, you have to ...


3

It is often the case that the last rule in the INPUT chain is one that REJECTs or DROPs a packet unconditionally. When you use -A it causes the rule to be added to the end of the chain. This often means that it gets ignored because there is an earlier rule that is matched and that has a terminating target - at which point rule processing stops. Try ...


3

What you need is possible with squid starting at version 3.5, because you require feature 'peek-and-splice' introduced in that version. Your action called "peek": http://wiki.squid-cache.org/Features/SslPeekAndSplice . Use something like: https_port 3130 intercept ssl-bump ssl_bump peek all ssl_bump splice all intercept makes the proxy transparent. I am ...


2

rsync -a --exclude "__pycache__/" source/ destination/ You may also want to pass --delete-excluded to remove __pycache__ files that have been copied (of course it removes all other excluded files from the destination too too).


2

I don't have access to a Barracuda web filter, but the email appliance has a hidden "Expert Options" menu that you can access that may contain some additional settings. Login to the device, click the "Advanced" tab, and then add "&expert=1" to the end of the URL to access the hidden menu; my URL looked like this after the change: https://ipaddress/cgi-...


2

It is possible. I believe tc(8) man is not comprehensive. Citing from man7.org/tc(8): tc filters If tc filters are attached to a class, they are consulted first for relevant instructions. Filters can match on all fields of a packet header, as well as on the firewall mark applied by ipchains or iptables. Just checked on my Linux 5.0.3-zen1-2-zen ...


2

Old question, but looks like you never found the answer. I had an old filter config from before I created some trunks. The filter rules contained ports that were now in the trunk groups, and this was causing trouble for the switch. Switch51(config)# show config ; J9773A Configuration Editor; Created on release #YA.15.12.0007 hostname "Switch51" trunk 23-24 ...


2

I'm an old ASE and haven't done anything Procurve or switch related since nearly 8 years and starting to forget everything, so bear with me if I'm talking nonsense. That filter list tells me that you should remove the ports from the filters, not the other way.


2

The filter table is for, well, filtering... so to block a host that is the correct table. The nat table is for all things related to performing NAT actions, like the name indicates. The mangle table is for modifying packets in whatever way (besides NAT), e.g. changing the ToS (Type of Service) or marking the packet for routing purposes. The raw table is ...


2

If the errors are really being caused by the extra whitespace in the time_stamp field, you can use the mutate filter to strip it out. Your filter would then look like this: filter { if [type] == "squid" { grok { patterns_dir => [ "/etc/logstash/patterns" ] match => { message => "%{SQUID_LOG}" } } mutate { strip =&...


2

That can't be queried via LDAP, as the state "authenticated" isn't reflected into LDAP. The group "authenticated users" is something special, a kind of "virtual group" that contains all currently authenticated principals, but it's not an LDAP group. Among other things, this group would also contain local non-domain users currently logged into a client ...


2

One thing to do is not use invalid characters on the PowerShell commands. -and (-not(MemberOfGroup -eq ‘DDGExclude’)) should be: -and (-not(MemberOfGroup -eq 'DDGExclude')) Also: -and (ExtensionCustomAttribute10 -ne “NOSYNC”) should be: -and (ExtensionCustomAttribute10 -ne "NOSYNC")


Only top voted, non community-wiki answers of a minimum length are eligible