Debian Configuration :: Exim4 Configuration For Local Addresses
Jun 17, 2010
I am working on a Debian 2.6.26-19 Distribution with exim4 as MTA. After a system restart a problem occurred with delivering emails to local addresses. These local addresses use a 1and1 mailserver for email. The MX records for the local domain are set correctly but exim does not use a DNS lookup for these addresses because it identifies them as local addresses. I figured this out by executing the exim4 -d -bt command. The dns lookup part of the result looks like this (I replaced the actual address with placeholders):
The eventual result of the exim4 -d -bt command is: [user]@[domain.ext] is undeliverable: Unrouteable address How can I make sure, that exim4 makes a DNS lookup for the local addresses instead of skipping it? I know that I have to edit a exim4 configuration file, but I could not figure out which and how.
I'm trying to set up a *simple* MTA in my local network. The only thing it should be able to do is send system / daemon mails to admin@mylocaldomain. but at the moment I'm pretty much overwhelmed by everything i *should* know in order to set up this MTA
I configured exim to be in "internet"-mode. now i have a variety of errors I can choose from (and a variety of solutions that i don't like ).. my test is always an email from test01.mylocaldomain:
echo "Hello World" | mail -s Testmail admin@mylocaldomain
- after running the config, i get the error: admin@mylocaldomain: all relevant MX records point to non-existent hosts --> google says, edit and udpate update-exim4.conf.conf --> dc_relay_domains='mylocaldomain' --> but this exim installation should not be a relay at all. it should only be able to SEND (to this domain), not deliver it. or do i get something wrong?
- after i added dc_relay_domains='mylocaldomain', i get --> SMTP error from remote mail server after RCPT TO:<admin@mylocaldomain>: host mail.mylocaldomain [192.168.x.x]: 550 5.1.1 <root@mylocaldomain>: Sender address rejected: User unknown in virtual mailbox table --> but i don't want to create an account on the mailserver for the SENDER...
- ...so i thought, i'd config exim with the domain "test01.mylocaldomain" (including the server name), so that the sender is clearly from another domain than the mail server handles (e.g. firstname.lastname@example.org).. but then i get this --> SMTP error from remote mail server after RCPT TO:<admin@mylocaldomain>: host mail.mylocaldomain [192.168.x.x]: 450 4.1.8 <email@example.com>: Sender address rejected: Domain not found
I really just wanna send mails in my local network.
Linux [URL] 2.6.26-2-686 #1 SMP Wed Feb 10 08:59:21 UTC 2010 i686 GNU/Linux Currently I have exim4 configured to use my mail server as a relay to send php emails. Though I don�t think I want this setup. My goal is to be able to track emails sent out to make sure that nothing happened and they got bounced back. I need to be able to find the emails that are bounced.
If I configure exim4 to send emails from the current (apache2 / php) server any emails that bounce will end up there, correct? We have clients that are expecting emails and are complaining they do not always get them so something is not 100% configured correctly. I am going to re-run #dpkg-reconfigure exim4-config
I've installed it properly until it works now, it does send emails and receive them, but heres the problem.
1) it does not send emails to a certain domain, unless i do dpkg-reconfigure on exim4 and put the domain on allowed relay... can't i just put something on settings which allow to send emails to ALL domains?
2) EVERYONE can connect to the server by telnet from any position, terminal or pc, and just use an existing user to send emails to anyone.... example, i have testuser123 setted up in debian/exim4 .. then they simply write "mail from:firstname.lastname@example.org" and the server accepts it.. without even request an authentication for that. And this is a problem, because everyone can use my email addresses to send emails to whoever.. heaven for spammers/hackers..
My debian server has been attacked due to a security breach in exim4 4.69-9 (probably applies to loads of other versions too). The security breach allows the attacker to get root access by creating a buffer overflow in a header which then can be used to inject code.
The securtiy breach is fixed with 4.69-9+lenny1 I want to share my actions with you on what I did to (hopefully) get rid of it. However at the time of writing this, the above website is down due to too much load (DDOS Attack?). How you can check if you've been attacked:
The attack creates a buffer overflow in exim4, which results in paniclog entries.
$ cat /var/log/exim4/paniclog 2010-12-17 07:34:11 string too large in xxxyyy() 2010-12-19 10:42:10 string too large in xxxyyy()
this would be an example of two attacks. One on 2010-12-17 and the other two days later 2010-12-19.with this information you can start find potentially infected files. There may be a better way, but I searched for them with this command:
$ find / -mtime 31 2>/dev/null # files,directories,links created 31 days ago (i.e. 2010-12-17)
I'm renting a server which comes with 5 IP addresses, but only one network device. From what I can understand I'm able to create aliases by adding entries to /etc/networks/interfaces, I haven't tried I'm in the planning stages. Hypothetically, 192.168.22.30 is my primary IP and I want to set eth0:1 to have 192.168.22.31, and then after that I want to create a virtual machine (using kvm/qemu) that is able to communicate bidirectionally to the internet over eth0:1, and leave eth0 strictly for administrating (not for VM traffic).
The qemu guides I'm finding seem to assume that I want to use TAP or VDE, what I want to use is a sub-ip/alias. One guide I saw had me eliminate everything from eth0 and put it under br0. That would leave me unable to ssh into my server (and unable to administrate). Is there a way I can do something along the lines of: qemu [options] -net [option] -netdev=eth0:1 ?
Related to my last post in that it is another email issue, but something else I am having a problem with.
Debian Lenny on virtual KVM (32-bit, v5.0.7)
With Postfix it is necessary to have an alias for root, eg: root: someuser
In theory, and as far as I am aware, this can also be something like: root: email@example.com
When I use the latter, though, the following happens whenever my system tries to redirect root email messages, but not when I use the root: someuser method in the aliases file (and, yes, I do know to use newaliases after amending the file).
The firewall is not an issue (tested with and without the firewall), nor are the resolvers, and the DNS for accounts on the box is all okay and fully propagated. Also, changing the email address to something like firstname.lastname@example.org does not work, either, - same error message.
Debian Testing host, Winduhs XP guest. Winduhs is not allowed to directly access The Internets, and I am not setting up bridging as that makes it possible for the guest to mount layer 2 attacks on the LAN. I need for the guest to tunnel through the host without being able to see anything on the host, so it can then get access to The Internets, while being protected by iptables (Shorewall).
Used to be with VMware I had host-only set and the guest in a different class c (192.168.2.1) from the host (192.168.1.1) I turned on ipforwarding, set Shorewall rules, and it all worked. Now I have everything set with VirtualBox, and it does not work. Guest can ping its interface but not host. Host can ping vboxnet0. Host is supposed to masquerade guest's 192.168.2.1 through to the default out at 192.168.1.1, but it's not. I think a clue is in routing, but I don't know what's wrong.
What would be necessary to run an ftp server (or a web server) on my local PC so that other people I know could access it and download stuff from it? The idea is to share photos, videos etc with friends/family where the files are a bit too big for email. (All 100% legal, own-content, no copyright issues, needless to say). Security isn't that vital, I'd just put files in the ftp directory, email the link and let them download the files, then remove them again. No passwords are required, and no uploads.
Obviously there's the problem that both computers have to be on at the same time, and I assume I'd have to change my computer's firewall settings and my router's settings to allow the traffic through, but my question is more basic than that - is it even possible? My internet connection is through a router, and as I understand it, my router has the IP address, not my computer. So I can connect through my router using my computer's IP address, but only my router knows my computer's IP address, and all the rest of the internet just sees my router and its IP address. Which means (I think) that I can't just send my IP address for my family to connect to, because that only gets them as far as my router, and the router would have no idea what to do with such requests. Am I right so far?
So is there any way for my family's computers to contact an FTP server or a web server running on my computer? Or does it require some kind of intermediary server to act as a traffic-forwarder? Is there such a thing? I'm assuming that setting up little private torrents would be fiddly and inefficient. Or would it be better/simpler to use one of the free filesharing services and put up with the (sometimes not too family-friendly) adverts associated with them?
Two nights ago I decided to switch from testing to unstable. Since then I am able to connect to the internet, but not to anything on my local network. I am unable to ping this computer from another one on the network. This computer is connected through wireless. I thought that something might have changed with iptables that was blockinghe localnetwork. I tried to "flush the iptables settings with "iptables -F". Since that didn't work I uninstalled iptables (which didn't work and I reinstalled iptables). In my browser I tried to connect to my router and that doesn't work either.I connect to this computer daily through ssh and connect to a NAS. Without ssh and my NAS I feel kinda lost
I'd like configuring NTP service on my Lenny Debian client to retrieve time from my local NTP server, so I thought to configure /etc/ntp.conf and to insert into crontab this command 'ntpd -qg', which is indicated in man. Can I run ntpd service to synchronize time for my client, avoiding to listen on port 123, beacuse my scope is to alignment time on client and to not give service to others, for this scope there is ntp server !
I can't get past the "scp -p id_rsa.pub" step; ssh fails with "Could not resolve hostname" errors. Both machines are connected with a hub. I've also tried using the IP address in the place of hostnames with no avail. Both machines can ping eachother successfully.The server has the "openssh-server" package installed.
I'll have 2 routers: - ADSL-router (D-link DSL-2640U) + NAT on (needed as one static IP from ISP) + Server's IP as 192.168.X.xxx + router firewall port-forwards set for needed ports (21,22, 80 etc) to 192.168.0.xxx - 2nd LAN-router
Is there any setting/file on Debian-user-machine, where I could fix that abc.mydomainXYZ.com/defg is always in something to do with 192.168.X.xxx
i rarely need my wireless, and i want it off by default, i am going to disable it during bootup with
echo 0 > /sys/devices/platform/acer-wmi/wireless
what would be the proper place for this? if i put it in rc.local it will be executed very late, i'd rather have it sooner. if add a new script to init.d, then run update-rc.d, i would have to adhere to the start|stop|reload structure of these scripts, right? or do i go a totally different way about this?
I have a new Debian 5.04/ppc install on a G5 tower and it's not able to browse the local network. The clean install could see the network, then I installed the Samba server, and it hasn't worked since. Samba server never really worked, and I'm guessing I messed something up. I've reinstalled network-manager, and removed / reinstalled samba.
I have a small home network (6 machines) running wired and/or wireless, pc/mac and linux.This machine can PING other machines by name and IP address.This machine can PING itself by name and IP address Other machines can PING this machine by IP address only, not by name.Nautilus network browser only shows the "Windows Network" icon, which, when clicked, shows an empty window.I've got networking up fine on all my other machines but this one is stumping me.
I have three Debian systems running, along with several XP laptops, PS3 and two DirecTV systems. I use two of the three Debian systems as media servers, and the third is an older system mostly for playing around with. My home network is running fine with the following nuisance. The two newer Debian (Lenny) systems are <barney> and <mitzi>, the older is named <oscar>, running Debian Sarge 3.1. From either locally or remote login to <barney> and <mitzi> I can ssh into either of the other two systems, however when logged into <oscar> I cannot ssh by name to either of the other systems. e.g. ssh: mitzi: Temporary failure in name resolution..However, from <oscar> I can ping outside my network (e.g. ping www.google.com) with no problems.I can also ssh to the other systems via IP address, just not by name.
I've compared the /etc/ssh/ssh_config, /etc/resolv.conf, /etc/ssh/sshd_config and other files between the two systems and not seeing anything peculiar. arp, route, etc., don't show different behavior between the systems either.
At home I have two computers running linux connected to the same router. I would like to be able to connect them so that I can move files between them and execute simple commands. What is the most simple way to access a prompt on the other computer or to mount a partition currently used by the other computer?Using the www it is possible to connect two computers using ssh, but it should be easier to do this over the LAN, right? I have been googling a lot but not found anything.
I am trying to create a local debian repo for 3rd party apps and my own deb's. I have done the following: dpkg-scanpackages debian | gzip -9c> debian/Packages.gz Which did create a file called Packages.gz in the directory However, when I do apt-get update on a client machine I get the following error: W: Failed to fetch [URL] Could not connect to 10.1.1.10:8080 (10.1.1.10). - connect (111: Connection refused) W: Failed to fetch [URL] Unable to connect to 10.1.1.10:8080: W: Some index files failed to download, they have been ignored, or old ones used instead.
I managed to set up an openvpn server, ip-forwarding and a nat iptable rule for that.
Almost everything works as expected, but my problem is:
Smartphone -> VPN -> Internet ==> works (by ip and hostname) Smartphone -> VPN -> machine in my local network by IP ==> works Smartphone -> VPN -> machine in my local network by its hostname => DOES NOT WORK Machine w/ VPN server -> ping to machine in local network by ip or hostname => works
So, i wonder why i cant access a local machine through the vpn by its hostname. I guess I'm missing a forwarding rule??
iptables dump: # Generated by iptables-save v1.4.21 on Sun Feb 7 20:56:52 2016 *nat :PREROUTING ACCEPT [786:59064] :INPUT ACCEPT [728:53047] :OUTPUT ACCEPT [19:1487] :POSTROUTING ACCEPT [20:1576] -A POSTROUTING -s 10.8.0.0/24 -j MASQUERADE COMMIT # Completed on Sun Feb 7 20:56:52 2016
I have a strange iptables issues. I have just built a new Debian install and starting adding some real basic rules (see below) the problem seems to be that the localhost itself can't get any returning traffic. That is, it seems to be allowed outgoing traffic but not the connected, returning traffic. Ordinarily allowing Established Connections would resolve this, see the rule below, but it hasn't. Why this doesn't work. Removing the last DROP in the INPUT chains obviously makes the traffic work!
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -j ACCEPT -p tcp --dport 22 iptables -A INPUT -j ACCEPT -s x.x.x.x iptables -A INPUT -j ACCEPT -s x.x.x.x iptables -A INPUT -j ACCEPT -s x.x.x.x -p tcp --dport 80 iptables -A INPUT -j ACCEPT -s x.x.x.x -p tcp --dport 8080 iptables -I INPUT 1 -i lo -j ACCEPT iptables -A INPUT -j DROP
I have used /etc/fonts/local.conf to control how the fonts looks like in my laptop, which runs a Gentoo. In particular, I don't want anti-aliasing. I copied the file to my Debian desktop, but it seems the file doesn't take effect, even after reboot. Do I need to do something else to make it take effect?
I have setup Postfix + Dovecot on my basic debian 5 server. If I send a message to a email@example.com from mutt, it delivers just fine and is visible when viewed through squirrelmail, I can also send just fine.
My issue is that irrespective of what options I set in main.cf, I cannot for the life of me get Postfix to stop erroring with "Recipient address rejected: User unknown in virtual alias table". I'm stumped.
My main.cf is as follows code...
I do not want to setup virtual hosting with MySQL or similar, I literally want to receive mail in local users mailboxes for a single domain. Any ideas on what's missing?
I have some beginner questions about DHCP, Avahi, and configuring a small home LAN.Suppose I have a dynamic IP address assigned by my ISP, which requires DHCP be enabled in my dsl modem/router/"firewall" [sic]. Suppose for simplicity I have just one PC behind the dsl modem.I think "enabling DHCP" in the modem/router means that a DHCP client runs on the router, which communicates with a DHCP server run by my ISP when I boot up a PC on my LAN. Is that guess correct? Can I get DHCP to assign a particular local IP, say 192.168.1.10 (which is not the one taken by the router--- for this discussion, let's say that is 192.168.1.0) to my PC each time I boot it up?
Now suppose I want to build a stand-alone firewall, so that my LAN will have the firewall and the first PC behind the modem, with the first PC virtually behind the firewall. By default, I think these will both have DHCP clients running which I need to configure properly. The firewall should also have a DHCP server which should control how local IP addresses are assigned, correct? I should try to arrange that the LAN has only DHCP server, only one NTP timeserver, only one DNS nameserver, correct?My first PC seems to have installed an autorun client called Avahi, which performs DNS multicast services and incorporates something called zeroconf which seems to have something to do with remote desktops, which I don't need and which is a potential security hazard. But it seems that Avahi is an intrinsic part of the KDE desktop and cannot be removed. Just want to be sure that Avahi can coexist comfortably with dhcp3-client, which is also installed on that PC. They perform different tasks, correct?If I can get the stand-alone firewall to work, I know I need to turn off the commercial firewall in the dslmodem/router/firewall device. Should I purchase a bridge and try to turn off the routing function also?
I am trying to set up a wireless 'test' box to use on a private club (11,000 acres). The initial tests won't need anything fancy, it will just be checking the visibility of a hotspot from a high-point in the middle of the property. But if it proves to have good visibility, later tests will be (hopefully) promoted by the club and made aware to members. I would like to set up a captive portal to redirect them to a comments page where they can post a quick message if they were able to connect ....
Most of the examples I see online of captive portal are based on having an internet connection and/or a NAT scheme set up. I just need a hotspot and a single web-page for these promotional tests. If possible, I would like to trigger any devices capable to suggest or otherwise open a browser to go to the promotional landing page ...
Also, one more quick question, this is to eventually be an 'open' internet for this test - most of the wpa set-up examples show using a passkey. Is making an open wifi as simple as not including the passkey or is there something else I would need to be doing?
I'm trying to TFTP router configurations to a server in the same local network without having to first make files in the server's TFTP directory . The transfer of a config file from router to server works perfectly if I make a file with touch and then chmod the file with 777. I found information that says to use the -c or --create option in the TFTP configuration file (/etc/default/tftpd-hpa) if you want TFTP to work without having to create the files first. The problem is, I have set this parameter and restarted TFTP , but it is not working.
I have installed apache php and mysql on my pc during debian installation... some of my friends complain they cannot access my webserver from their home and it's available only within my local network... Please help regarding this...
I am making backups and I need to make a cron job that mounts a 2nd local hard drive.
It is not listed in my fstab file and I mount it manually in nautilus (having to type a password). It is designated as /dev/sdb1 and /media/repo when it is mounted. Can I get cron to mount it and then add the password or do I have to add it to fstab?