Recent Questions - Server Fault |
- Postfix relay to M365: two hosts lists, one auth to send external and other internal only
- Roundcube with Dovecot - disappearing/not present inbox and emails
- Redirect works, pass-through does not
- Debian: "apt install build-essential" fails because of unmet dependencies
- Perfect SSL Labs score with nginx and TLS 1.3?
- Ansible: find and replace with remote IP
- How can I use a virtual host to redirect https subfolders to different ports in apache?
- HAProxy SSL Handshake failure on one server but not the other
- SSH to VM rejecting password, works from virt-manager console
| Postfix relay to M365: two hosts lists, one auth to send external and other internal only Posted: 06 Feb 2022 11:30 AM PST I'm a security admin with mailboxes on Exchange Online (aka Microsoft 365), not seasoned to postmail, but I have to deploy a postmail service on premises to allow some devices (internal applications, switches, etc) to send e-mail through Exchange Online. My preferred approoach is an internal device (example: printer) or application (ex: some on premises server) talks SMTP with my on premises postfix that in turn talks SMTP to Exchange Online. I have everything configured on Exchange side to this, with a relay connector, no problem receiving e-mail. I configured postfix to relay and at first it's working ok, allowing only hosts on a file to use the service:
But I want to mantain two authorization lists: List1: hosts authorized to relay only to Exchange internal mailboxes... The criteria is mail to my domain (example: mycorpdomain.com). List2: hosts authorized to relay to all domains (i.e.: gmail.com, hotmail.com, etc.com) I'm struggling with smtpd_recipient_restrictions and smtpd_relay_restrictions but I got all mail denied when using them. Do you know how to state this two authorizations on main.cf? |
| Roundcube with Dovecot - disappearing/not present inbox and emails Posted: 06 Feb 2022 11:15 AM PST Versions: Debian 11 5.10.92-1 x86_64 - nginx/1.21.6 - mysql 15.1 10.5.12-MariaDB - PHP 7.4.25 (cli) - dovecot-core/stable,now 1:2.3.13+dfsg1-2 I've got my postfix/dovecot configration working for receiving emails. After switching from rainloop to roundcube, I can't see any inbox emails in roundcube web. But occasionally I will login to roundcube and I will see all my emails in the inbox, but if I click on anything or refresh the page, they all disappear. Sending emails from roundcube also just results in an endless loading wheel with no timeout. Unfortunately roundcube has no error logs, and dovecot only has successful login logs. Nothing to indicate that anything is broken; other than the dissapearing emails.
I am pretty sure its something with IMAP on dovecot, since login works, but the retrieval of emails only works about 10% of the time. Without any error logs to troubleshoot, I don't know where to go from here, other than trial and error messing with config files. Can anyone please help? . I have excluded a lot of the configs because of how massive they are. I can add any additional conf files, but I thought these were most relevant. Roundcube Configuration: Dovecot configuration: |
| Redirect works, pass-through does not Posted: 06 Feb 2022 11:12 AM PST Our CMS has a handler named We'd like requests for "naked" domain (http://example.com) to be handled by that same handler automatically -- without requiring What I expected to "just work" -- results in a 404: The best I can come up with is a redirect, which exposes the name How can I do this without redirecting? I tried adding |
| Debian: "apt install build-essential" fails because of unmet dependencies Posted: 06 Feb 2022 11:09 AM PST Using Debian Stretch v9.11. I try to install build-essential, but fails because of unmet dependencies: apt-cache policy shows: I have following content in /etc/apt/sources.list: EDIT1: apt-cache policy libc6-dev shows: apt-cache policy g++ shows: EDIT2: I had I remember, that once I had to install a newer mc, which had specific bugfix. EDIT3: EDIT4: EDIT5 Still the same result. In the meantime I upgraded to Debian v9.12. May I try How can I fix the unmet dependencies? |
| Perfect SSL Labs score with nginx and TLS 1.3? Posted: 06 Feb 2022 10:09 AM PST I have created an nginx config that got a perfect score on Qualsys SSL Labs using only TLS v1.2, and I'd like to try and get a perfect score using both TLS v1.2 and v1.3. Consider this snippet of the version of the nginx.conf that is part of the A+ and 100% score: It complains about a couple of the cipher suites, but it still gives an otherwise perfect score:
Now, if I add TLS v1.3 to the mix as the only config change, the score changes. The cipher strength gets scored as a 90%: I assume it's mad about those weak CBC ciphers: There's not really a good way to remove the CBC mode ciphers perfectly, but maybe excluding SHA1, SHA256, and SHA384 will work. The config line becomes:
Let's look at the new score: The cipher suite strength is still 90%. It's no longer mad at the strength of the cipher suites: But apparently it's unhappy about the failing handshakes that worked before: Which brings us to... the same cipher suites that are required for a successful handshake for older devices/apps are listed as "weak" and pass when only TLS 1.2 is enabled. Somehow enabling TLS 1.3 makes those same weak ciphers that pass before start failing. It seems like the choice is: either enable TLS 1.2 only to get a perfect score, or, enable TLS 1.3 too but get dinged for the necessary cipher suites? It's a Kobayashi Maru of sorts. Is it possible to get a perfect 100% score with nginx and TLS 1.2 and 1.3 enabled? |
| Ansible: find and replace with remote IP Posted: 06 Feb 2022 12:04 PM PST I am using Ansible for auto apache configuration in which i have own app.conf. Now I have app.conf in ansible server and want ansible to replace the existing ip address with remote ip address. my app.conf look like this. Now I want 10.10.10.10 to be replaced by remote ip address. can we do this using lineinfile module. |
| How can I use a virtual host to redirect https subfolders to different ports in apache? Posted: 06 Feb 2022 11:04 AM PST I have a web service running on port 8112 and I can redirect a subdomain eg http://myapp.mydomain.com to 127.0.0.1:8112 using a virtual host by setting the ServerAlias, proxypass and proxypassreverse parameters. I acheive this with the virtual host outlined below: However, I would like to use https and set a subfolder to be redirected to it instead. ie I would like to be able to expose https://secure.mydomain.com/myapp I dont want to redirect an https subdomain because I want to do this for several different services I'm running at the same ip and I only have certs for one secure subdomain. I'm guessing some kind of rewrite? but it's too different from a starting point of the proxypass method for me to figure out. I looked at these examples but none seemed to apply. My ssl certs are all good and my ssl virtual host is happily pointing at a root directory with a hello world in it but I cant figure out what to add to get my subfolders to redirect to services running on different ports the way I can with subdomains over http |
| HAProxy SSL Handshake failure on one server but not the other Posted: 06 Feb 2022 11:04 AM PST I've been searching the net extensively but I'm not able to find a solution to this problem. I have setup two servers behind KeepAlived and HAProxy. When both servers are up, I can see that both servers are hit (looking at the application logs) and that both work fine. However, when I take down the primary server, the clients are not able to connect to the second server and fail with SSL Handshake failure. Both servers have identical configurations for HAProxy and their SSL certificates are both identical. My partial HAProxy configuration is: To re-iterate, serv1 on its own or together with serv2 works fine. It's only when I take down serv1 that I get the SSL failures. The HAProxy log for the failure is:
Would anyone be able to help me? Many thanks in advance, |
| SSH to VM rejecting password, works from virt-manager console Posted: 06 Feb 2022 12:04 PM PST First of all, I'm sorry if there is a duplicate post somewhere. I searched for a while but none of the posts I found fixed my problem. It's fairly annoying. I created a new VM on our network and when using virt-manager I can log into the VM fine with the username and password. When I try to ssh to the VM from anywhere else it rejects the password, but I know the password is correct. I've even changed it multiple times to make sure its correct. The address I'm ssh'ing to is definitely pointing at the right VM as well, I've tested all this. It's still usable, but the virt-manager console is very limited so the sooner I can get to the bottom of this the better. VM is running ubuntu 12.04 btw. EDIT 1 Checked the auth.log and all I'm getting is "sshd[29304]:Connection closed by 'server.ip.address' [preauth]". I also tried allowing logging in as root, and even turned off password auth altogether in sshd_config and still nothing! I then turned on "AllowEmptyPasswords", still a whole lot of nothing. |
| You are subscribed to email updates from Recent Questions - Server Fault. To stop receiving these emails, you may unsubscribe now. | Email delivery powered by Google |
| Google, 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States | |
No comments:
Post a Comment