2018-03-12 New Server

I migrated my sites to a new server! Hopefully this means that the next dist-upgrade will work without a hitch.

Debian 9 “Stretch” it is!

If you notice any of my sites misbehaving, let me know. For now I’m proud of the A+ rating by SSL Labs.

Related: 2018-03-09 OpenVZ Pains, Sibirocobombus Setup.

Bonus: I just realized how much simpler my setup has become now that I’m no longer self-hosting an email server!

To remind myself and others of the giant pain email has become, I’m copying the relevant stuff I deleted from my Sibirocobombus Setup page and the comments on that page.

You need to add reverse DNS entry on the web site.

“Mailing to remote domains not supported.”

alex@sibirocobombus:~$ mail kensanata@gmail.com
Subject: test from sibirocobombus
hi
.
Cc:
alex@sibirocobombus:~$ mail
No mail for alex
alex@sibirocobombus:~$ sudo exim -bp
 0m  1.2K 1bQDA7-0000As-S4 <> *** frozen ***
           alex@sibirocobombus

alex@sibirocobombus:~$ fg
-bash: fg: current: no such job
alex@sibirocobombus:~$ exiwhat
-bash: exiwhat: command not found
alex@sibirocobombus:~$ exim -Mvl 1bQDA7-0000As-S4
-bash: exim: command not found
alex@sibirocobombus:~$ sudo exim -Mvl 1bQDA7-0000As-S4
2016-07-21 14:33:11 Received from <> R=1bQDA7-0000Ao-RS U=Debian-exim P=local S=1230
2016-07-21 14:33:11 kensanata@gmail.com <alex@sibirocobombus> R=nonlocal: Mailing to remote domains not supported
*** Frozen (delivery error message)

I guess this means we need to fix exim?

First, comment the crontab on my Raspberry Pi such that it will no longer update my zonefile.

Setting up Exim using these rules:

1. https://debian-administration.org/article/718/DKIM-signing_outgoing_mail_with_exim4
1. note that the selector is something in your zone file, ie. dkim._domainkey for me
DKIM_CANON=relaxed
DKIM_SELECTOR=dkim
DKIM_DOMAIN=alexschroeder.ch
DKIM_PRIVATE_KEY=/etc/exim4/dkim/dkim.private
  # https://wiki.debian.org/Exim#Spam_scanning and
  # http://www.exim.org/exim-html-current/doc/html/spec_html/ch-content_scanning_at_acl_time.html#SECID206
  # put headers in all messages (no matter if spam or not)
  warn spam = nobody:true
      add_header = X-Spam-Score: $spam_score ($spam_bar)
      add_header = X-Spam-Report: $spam_report
  # add second subject line with *SPAM* marker when message
  # is over threshold
  warn spam = nobody
      add_header = Subject: ***SPAM (score:$spam_score)*** $h_Subject:
  # reject spam at high scores
  deny message = This message scored $spam_score spam points.
      spam = nobody:true
      condition = ${if >{$spam_score_int}{60}{1}{0}}
sudo cat /var/spool/mail/claudia |
    formail -k                \
            -X From:          \
            -X Subject:       \
            -X Message-Id:    \
            -X Date:          \
            -X To:            \
            -X Content-Type:  \
	    -I "To: kensanata@gmail.com" \
	    -s /usr/sbin/sendmail -t -f kensanata@gmail.com

I’m trying to improve SpamAssassin and found the wiki page Improve Accuracy. spamassassin -D --lint 2>&1 | grep -i failed produces a few Perl modules:

Watch out! Perhaps you’ll be getting daily mail with the following:

/etc/cron.daily/spamassassin:
channel: could not find working mirror, channel failed
sa-update failed for unknown reasons

On ServerFault, I found the suggestion that some of the files in /var/lib/spamassassin had the wrong owner. It should be debian-spamd. And they were right!

This listed /var/lib/spamassassin/3.004000 and all its files belonging to root:

sudo find /var/lib/spamassassin -user root

To fix it:

sudo find /var/lib/spamassassin -user root -exec chown debian-spamd:debian-spamd '{}' ';'

I’m not sure why those files ended being there, owned by root. Perhaps I had run sudo sa-update just to “test” it?

Time to get tough on spam! This is not funny.

alex@sibirocobombus:~$ mail
Mail version 8.1.2 01/15/2001.  Type ? for help.
"/var/mail/alex": 332 messages 332 new
>N  1 Oneill.12731@gree  Tue Sep 13 23:19  446/30612 Equipment receipts
 N  2 Herman4@habit-rea  Tue Sep 13 23:29  226/14170 payment copy
 N  3 Nichole7@hudsonpl  Tue Sep 13 23:35  225/14073 payment copy
 N  4 Mariana2@sprintin  Tue Sep 13 23:53  223/13877 payment copy
 N  5 huixinsoft40@foxm  Wed Sep 14 01:33  100/6194  =?utf-8?B?dGhlIGRpcmVjdCBmYWN0b3J5IGl
 N  6 dgvsd876dvs@126.c  Wed Sep 14 01:43   75/4277  =?utf-8?B?UHJvbW90aW9uYWwgYXBwYXJlbCB
 N  7 Diann630@totalind  Wed Sep 14 02:36  222/13874 payment copy
 N  8 dkhaaabgupxy@ens.  Wed Sep 14 02:42   97/5898  =?GB2312?B?UHJvZmVzc2luYWwgVGFibGV0IF
 N  9 mnsh@cichzeowtnre  Wed Sep 14 03:13   72/3877  =?GB2312?B?UkU6SGlnaCBxdWFsaXR5IGFuZC
 N 10 mpybenrgvr@uouqb.  Wed Sep 14 03:13   74/4043  =?GB2312?B?UkU6SGlnaCBxdWFsaXR5IGFuZC
 N 11 Corine67@kbr.mx    Wed Sep 14 03:35  222/13797 payment copy
 N 12 Karyn405@imagodep  Wed Sep 14 04:08  224/13999 payment copy
 N 13 Ray79@excluservic  Wed Sep 14 04:11  224/13924 payment copy ***SPAM (score:5.3)*** p
 N 14 Adolfo902@slsterl  Wed Sep 14 04:18  233/14625 payment copy ***SPAM (score:5.9)*** p
 N 15 d4gdfv@yeah.net    Wed Sep 14 04:38   73/4129  =?utf-8?B?UkU6IGJ1c2luZXNzIG1hcmtldCB
 N 16 Rene216@sk-sigurd  Wed Sep 14 04:41  224/13935 payment copy ***SPAM (score:5.3)*** p
 N 17 hulsingcrm37@aliy  Wed Sep 14 05:58   82/4756  =?utf-8?B?UkU6IHF1b3RlIHByaWNl?=
 N 18 ybgup@bdmpxxybdln  Wed Sep 14 06:37   62/3257  =?GB2312?B?UmU6IHByb2Zlc3Npb25hbCBzdG

I usually just run p root to see if I got anything from root. The Tiger reports, for example.

& p root
Message 186:
From root@alexschroeder.ch Sun Sep 18 02:01:18 2016
Envelope-to: root@alexschroeder.ch
Delivery-date: Sun, 18 Sep 2016 02:01:18 +0200
From: "Tiger automatic auditor at sibirocobombus" <root@sibirocobombus>
To: root@alexschroeder.ch
Subject: Tiger Auditing Report for sibirocobombus
Date: Sun, 18 Sep 2016 02:01:18 +0200

1. Performing check of user accounts...
NEW: --WARN-- [acc021w] Login ID colord appears to be a dormant account. 
1. Performing check of passwd files...

But really, pages and pages of spam is not good. What can I do?

I edited /etc/exim4/exim4.conf.localmacros and added the following:

1. http://www.chew.ch/leoluc/software/debian/#AntiSpam
CHECK_RCPT_VERIFY_SENDER=yes
CHECK_RCPT_REVERSE_DNS=yes
CHECK_RCPT_SPF=yes # requires spf-tools-perl
CHECK_DATA_VERIFY_HEADER_SENDER=yes
CHECK_RCPT_IP_DNSBLS=bl.spamcop.net:zen.spamhaus.org

Reload the config file using sudo service exim4 reload, perhaps? I wasn’t sure and did the following, instead:

alex@sibirocobombus:~$ sudo update-exim4.conf
alex@sibirocobombus:~$ sudo service exim4 restart

My plan is to now lean back and watch /var/log/exim4/rejectlog.

Actually, there’s a test you can do according to DNS Blacklist with Exim: send a mail to nelson-pbl-test@crynwr.com from your mail server; the reply should get blocked.

alex@sibirocobombus:~$ mail nelson-pbl-test@crynwr.com
Subject: testing blacklist
Thanks for the bot.
.
Cc: 

OK, checking my log file... /var/log/exim4/mainlog now says:

2016-09-21 13:30:35 1bmfjX-0006Xh-Kg <= alex@alexschroeder.ch U=alex P=local S=413
2016-09-21 13:30:40 1bmfjX-0006Xh-Kg SMTP error from remote mail server after RCPT TO:<nelson-pbl-test@crynwr.com>: host ns1.crynwr.com [192.203.178.14]: 451 https://www.spamhaus.org/query/ip/192.71.233.105
2016-09-21 13:30:40 1bmfjX-0006Xh-Kg russnelson.com [192.203.178.57] Connection refused
2016-09-21 13:30:41 1bmfjX-0006Xh-Kg == nelson-pbl-test@crynwr.com R=dnslookup T=remote_smtp defer (111): Connection refused

Oops, my server is itself listed! :'(

192.71.233.105 is not listed in the SBL
192.71.233.105 is not listed in the PBL
192.71.233.105 is listed in the XBL, because it appears in:
    CBL

I followed the instructions:

alex@sibirocobombus:~$ mail helocheck@abuseat.org
Subject: test
CBL
.
Cc: 

And I did get back the following:

From MAILER-DAEMON Wed Sep 21 13:36:53 2016
Envelope-to: alex@alexschroeder.ch
Delivery-date: Wed, 21 Sep 2016 13:36:53 +0200
X-Failed-Recipients: helocheck@abuseat.org
Auto-Submitted: auto-replied
From: Mail Delivery System <Mailer-Daemon@alexschroeder.ch>
To: alex@alexschroeder.ch
Subject: Mail delivery failed: returning message to sender
Date: Wed, 21 Sep 2016 13:36:53 +0200

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

  helocheck@abuseat.org
    SMTP error from remote mail server after RCPT TO:<helocheck@abuseat.org>:
    host mail.abuseat.org [54.93.50.35]: 550 *** The HELO for IP address 192.71.233.105 was 'localhost.localdomain' (invalid syntax) ***

OK, following their instructions on naming issues.

alex@sibirocobombus:~$ uname -n
sibirocobombus
alex@sibirocobombus:~$ hostname -s
sibirocobombus
alex@sibirocobombus:~$ hostname -d
localdomain
alex@sibirocobombus:~$ hostname -f
localhost.localdomain

This makes me sad.

alex@sibirocobombus:~$ cat /etc/hosts
ff02::1		ip6-allnodes
ff02::2		ip6-allrouters

192.121.170.192 kallobombus
127.0.0.1 localhost.localdomain localhost sibirocobombus alexschroeder.ch
1. Auto-generated hostname. Please do not remove this comment.
192.71.233.105 sibirocobombus communitywiki.org emacswiki.org campaignwiki.org rpg.alexschroeder.ch korero.org arabisch-lernen.org oddmuse.org alexschroeder.ch
::1		localhost ip6-localhost ip6-loopback
alex@sibirocobombus:~$ cat /etc/hostname 
sibirocobombus

I changed the 127.0.0.1 line to say the following:

127.0.0.1 alexschroeder.ch localhost sibirocobombus

I’m not sure what I expect the names to be.

alex@sibirocobombus:~$ uname -n; hostname -s; hostname -d; hostname -f; hostname
sibirocobombus
sibirocobombus
ch
alexschroeder.ch
sibirocobombus

It seems to have done the thing, however. When I send another email to helocheck@abuseat.org, I get a positive reply:

From MAILER-DAEMON Wed Sep 21 13:50:57 2016
Envelope-to: alex@alexschroeder.ch
Delivery-date: Wed, 21 Sep 2016 13:50:57 +0200
X-Failed-Recipients: helocheck@abuseat.org
Auto-Submitted: auto-replied
From: Mail Delivery System <Mailer-Daemon@alexschroeder.ch>
To: alex@alexschroeder.ch
Subject: Mail delivery failed: returning message to sender
Date: Wed, 21 Sep 2016 13:50:57 +0200

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

  helocheck@abuseat.org
    SMTP error from remote mail server after RCPT TO:<helocheck@abuseat.org>:
    host mail.abuseat.org [54.93.50.35]: 550 *** The HELO for IP address 192.71.233.105 was 'alexschroeder.ch' (valid syntax) ***

So now, I’ll remove myself from the CBL and wait an hour or two before testing again.

Also note: those test results seem to take ages to get back. It’s far easier to simply check /var/log/exim4/mainlog and look for entries like the following:

2016-09-21 16:20:40 no host name found for IP address 186.5.5.146
2016-09-21 16:20:42 H=([186.5.5.146]) [186.5.5.146] Warning: 186.5.5.146 is listed at bl.spamcop.net (127.0.0.2: Blocked - see http://www.spamcop.net/bl.shtml?186.5.5.146)

Tags:

Comments


Please make sure you contribute only your own work, or work licensed under the GNU Free Documentation License. Note: in order to facilitate peer review and fight vandalism, we will store your IP number for a number of days. See Privacy Policy for more information. See Info for text formatting rules. You can edit the comment page if you need to fix typos. You can subscribe to new comments by email without leaving a comment.

To save this page you must answer this question:

Please say HELLO.