hMailServer forum

Snorkasaurus

Oh I read those... my setup is realtime, has no database requirement, fits my existing ban management strategy, standardizes log locations, requires no vbscript or powershell, does not leave stray "TCP" connection log entries in the hMailServer logs, and makes me happy. You're welcome not to use it ...

Snorkasaurus

Greetings Earthlings, For a few years I had been using hMailServer for my IMAP, POP3, and outbound SMTP services, but Linux with postfix, postgrey, and spamassassin for my inbound SMTP. I used Fail2ban on the inbound mail server to auto-ban various annoying behaviour based on the content of my postf...

Snorkasaurus

Thanks a bunch Jim, much appreciated!
I am just checking out port25 right now (thanks tochi).
s.

Snorkasaurus

Be warned, people. Hey Jim, Thanks for the warning. I got notification of your reply by email and thought I should log in [been a while] to perhaps delete the link, or at least make it harder to get to - but do not see a way to edit the post. If a moderator felt so compelled, I would be happy (base...

Snorkasaurus

Teksavvy does block port 25 on dynamic addresses, but not on static addresses (which cost $4 a month last time I checked). There was a time when Teksavvy was considered "The Cat's Ass" for Canadian geeks who want to do things like run mail servers, but frankly there are times it seems like they are...

Snorkasaurus

Wanted to let folks know that I just tried the log analyzer at

http://log.damnation.org.uk/

and it seems to be back up and running. Thank you to Doom and any others that helped in getting it back up again... much appreciated!

S.

Snorkasaurus

Hey Ben Kenobi, For login attempts like that the hMailServer autoban feature should work just fine. Except, as percepts points out, the feature is not quite real-time, so if a large number of attempts are all sent at once the autoban may not kick in right away... though your logs look as though you ...

Snorkasaurus

[12/Oct/2014 06:31:28] SMTP: User user@*******.co.uk doesn't exist. Attempt from IP address 220.133.83.172 [12/Oct/2014 06:31:36] SMTP: User support@*******.co.uk doesn't exist. Attempt from IP address 220.133.83.172 [12/Oct/2014 06:31:44] SMTP: User contact@*******.co.uk doesn't exist. Attempt fro...

Snorkasaurus

Lefty wrote:Having Java on the Server is not the best idea one could have. But thats only my opinion.

Mine too.
S.

Snorkasaurus

Yeah, exactly... just like the hMailServer internal auto-ban mechanism. Currently my admin interface is not accessible from outside of the network that the mail server sits on, if I were to open a web-admin interface to the outside world (so I could avoid putting a browser on my server) I would like...

Snorkasaurus

It does... Been going through the code but have not yet figured out how they do it, they don't use the standard Perl modules for running a webserver but OTOH it's a purpose built interface that do not need to support every aspect of a "normal" webserver. True, it is not like you can add things like...

Snorkasaurus

LesD wrote:Is ASSP running some web server or using some other magic to support the web based admin? I somehow doubt that a web server is involved.

Sounds like ASSP has its own web server according to this post.
S.

Snorkasaurus

As Master Yoda would put it; " A strong resistance against evolution, I sense " :wink: I believe that my resistance would be the evolution from an MTA that I can use on my crappy old P4 to serve private email for my friends and family along with other services like http, ssh, irc, and teamspeak to ...

Snorkasaurus

Or... By using the REST API you could make a Java based GUI distributed via Java Web Start. Just like Cisco do with their products... Something completely different - high availability... Split hMailServer into multiple services (DB, Main app, SMTP, IMAP and POP3) connected via a common "bus" to al...

Snorkasaurus

If you were to use a browser and a webserver there would not be a need for an API per se. REST API... <Application>-<HTML connector>---(TCP/IP)---<HTML connector>-<Server> |<----------- Any OS -------------->|<--------- Windows ----------->| As it is now.. (if I'm not completely mistaken...) <Appli...

Snorkasaurus

Let's say you're using hMailServer with IMAP. The server goes down. Incoming email will still be queued up even if you just have a single MX record (hopefully), but now you can't access your email (because the server where the messages resides is down). If it were possible to host a single hMailSer...

Snorkasaurus

The REST API looks quite nice and the major change is that HTML is used to replace RPC/COM. By using the REST API it will be possible to run a GUI on Windows/Linux/Android/iOS and IF hMailServer is to have an embedded HTML server/engine running on a non-standard IP port... Well... I am not sure wha...

Snorkasaurus

I have a NO vote for the first suggestion - to remove the built-in hMS Admin interface. I guess when I initially read that first option I didn't pay enough attention to the "ditch" part - I would also vote no on this (if I were allowed a third vote)... or at least provide an option during the insta...

Snorkasaurus

LAWL! You mean the email address I created specifically for messagesystems.com?

S.

Snorkasaurus

When I signed up for this service I did not check the box that says "Keep me updated on Message Systems". It has been 6 days and they just sent me an email anyways.

Just sayin'.
S.

Snorkasaurus

I'm voting for "cross-platform" and "other" because I wanted to add the point that if hMailServer were to be going cross platform I would much prefer that it not be dependent on supporting applications like Java, Python, Perl, .NET, Ruby, etc. My mail server also provides http, sshd, irc, mysql, and...

Snorkasaurus

Greetings Earthlings, Over the years I have seen a number of messages in the forums here about hMailServer users having their mail flagged as spam by some well known big email providers like Google, Microsoft, and Yahoo!. There are obviously a plethora of reasons this might occur (which the users of...

Snorkasaurus

if its always the same IP you can ask your isp to block it, you may even be able to do it yourself from isp account panel. Hey percepts, Have you ever successfully got an ISP to block traffic for you? I had an IP in China that was generating over 200GB of traffic per month trying to authenticate to...

Snorkasaurus

percepts wrote:This happens all the time and there is little you can do about it except enable greylisting which may stop it.

Hey percepts,

That would be "auto-ban" rather than "greylisting" right?

S.

Snorkasaurus

How do you know that you are sending out spam? If you can't find it in your logs then is it possible that a computer other than your mail server is infected with a virus that is sending spam? If you are behind a NAT gateway/router then all of your internal devices will appear to be the same IP addre...

Snorkasaurus

I actually do something fairly similar in my nightly script... but I am enough of an anti-spam-nazi that I shut down hMailServer for the intervening few seconds.

PS: I had a quick look at that KAM.cf and will have to look at it a little more in depth. Good find there.

S.

Snorkasaurus

I use a custom ruleset (KAM.cf) that appear to be updated daily, so I do daily updates... net stop spamassassin sa-update.exe -v --nogpg --channelfile UpdateChannels.txt --refreshmirrors wget -q http://www.pccc.com/downloads/SpamAssassin/contrib/KAM.cf -O c:\spamassassin\etc\spamassassin\KAM.cf net...

Snorkasaurus

"SMTPD" 3052 539 "2013-12-30 14:54:54.930" "212.143.81.62" "SENT: 220 mail.snork.ca ESMTP NO UCE WASSUP" "SMTPD" 3608 539 "2013-12-30 14:54:55.273" "212.143.81.62" "SENT: 250 OK" "SMTPD" 2184 539 "2013-12-30 14:54:55.429" "212.143.81.62" "RECEIVED: RCPT TO:<doesnotexist@snork.ca>" "SMTPD" 2184 539 ...

Snorkasaurus

SorenR wrote:I did play with it but I found it not really following the thresholds - or maybe I just lacked the patience

I think SA does require a fair bit of patience, and a willingness to feed it a large amount of both ham and spam so it can profile your mail.

S.

Snorkasaurus

PokemonPets wrote:i am not gonna send spam but i am gonna send a lot of mails

...

PokemonPets wrote:i have over 1m registered members since 2009 but i don't verify emails

ROFLCOPTER! Anybody care to redirect the Wikipedia page for "spam" to this post?

S.

Snorkasaurus

SorenR wrote:Did you try 17.*.*.* ?

Hey SorenR,

I'll try that out right now and monitor for subsequent connections. Thanks for the idea.

S.

Snorkasaurus

Greetings Earthlings, I have 17.* greylist-whitelisted as seen here: http://i.imgur.com/GeTuo4i.png but I am still seeing traffic from addresses in that range being greylisted in my logs "SMTPD" 1600 5737 "2014-08-06 19:06:26.562" "17.171.37.65" "SENT: 220 mail.snork.ca ESMTP NO UCE WASSUP" "SMTPD" ...

Snorkasaurus

Hey Jim, If you enable greylisting, your system would send "SENT: 451 Please try again later" immediately after the remote system sends you "RCPT TO: your_account@yourdomain.com". So in your first scenario greylisting would not happen at all because the conversation never gets that far. In the secon...

Snorkasaurus

I wanted to start a new thread since it appears as though we have inadvertently hijacked a previous question in Tips N Tricks about stopping spammers with a particular HELO string. In this other thread , jimimaseye was asking about greylisting. Q: So greylisting only applies AFTER authentication has...

Snorkasaurus

Nope... GreyListing is an Anti-SPAM tool, not a Security tool. Auto-Ban is a Security tool. Exactly, external to local is simply "mail delivery", while authentication is typically for outbound mail (a user of yours is trying to send mail to an external destination). While it is true that spammers m...

Snorkasaurus

Hmm.... How did we go from brute force logon attempts on SMTP port 25 to Greylisting ?? :mrgreen: Hmmm, we did kind of hijack this one. :-( Snork, I read the manual as this: Minutes to defer deliver attempts - (default is 30) Specify how many minutes hMailServer should wait before accepting a messa...

Snorkasaurus

If I may elaborate a bit... The reason I do not have "bypass on SPF" enabled is because I had a wave of spam [more than a year ago now] that was coming from SPF'ed domains. The spammers basically found some domains that had a +all in their SPF records, allowing delivery from anywhere. The spam was b...

Snorkasaurus

Greetings Folks, My understanding is that all normal decent SMTP server delivering messages would 'understand' that when it cannot deliver the first time round, that it will try again without complaining (of which it would then be successful). And most spambotd are NOT coming from decent SMTP server...

Snorkasaurus

Hey percepts... thanks for the quick answer, mucho appreciato.

S.

Snorkasaurus

Greetings Earthlings, I was doing a little reading and noticed that the "latest" docs still show tarpitting as an available feature. Would it be true that this should be removed from the docs? http://www.hmailserver.com/documentation/latest/?page=reference_antispam PS: I did a quick forum search and...

Snorkasaurus

Hey guys, I think I may have found something that I can live with. The last few messages got me thinking... why not try to block this at the firewall level? After a little testing I came up with this: iptables -I FORWARD -p tcp --dport 25 -m string --string 'rcpt to: crappy.address@mydomain.ca' --ic...

Snorkasaurus

Hey percepts, But I also download maxminds csv file, run an sql select on country and use powershell to create firewall rules allowing only those IPs I want into my websites. Also maintain some other firewall rules to allow a few search engine bots through. I much prefer blocking inbound "bad traffi...

Snorkasaurus

Hey percepts, Thanks for the link, it looks pretty cool. I am actually already blocking some countries by using lists from IPDeny and some ipset rules on my firewall (which gives me the added bonus of being able to block them from other services like http at the same time). If anyone cares to see ho...

Snorkasaurus

Hey mattg, Hmmm, perhaps I should have elaborated... I do have a catch-all on the domain, but I do not have a catch-all on this backup MX server that is now essentially acting as a "greylisting/backup MX" machine. Even if I do disable the catch-all address I still get: "SMTPD" 1884 8144 "2014-07-24 ...

Snorkasaurus

Don't get me wrong, I like logging... I just want to remove the 80% or more of my logs that are for greylisting. ;-) I think my solution might be to maintain a primary hMailServer that handles real mail and client activity while using a secondary hMailServer that acts as a backup MX and handles all ...

Snorkasaurus

@percepts: Unfortunately I don't have the IP addresses ahead of time, and the activity seems to be coming from numerous different and changing IP's. I admit that I haven't actually checked, but my guess is that they are mostly virus-infected zombie PC's. :-( I have tried something like that in OnSMT...

Snorkasaurus

Hey percepts, Here's a common log file example: "SMTPD" 3936 2157 "2014-07-23 23:34:37.057" "190.29.138.62" "SENT: 220 mx1.snork.ca ESMTP" "SMTPD" 3936 2157 "2014-07-23 23:34:37.229" "190.29.138.62" "RECEIVED: EHLO static-adsl190-29-141-23.une.net.co" "SMTPD" 3936 2157 "2014-07-23 23:34:37.229" "190...

Snorkasaurus

Hey mattg, I do, however the messages I am referring to never make it to that mailbox. Actually, I just checked that mailbox and all six of the emails that landed in that account this month were destined for addresses that were at one time legitimate and intentionally deleted (implying that none wer...

Snorkasaurus

Greetings Earthlings, Looking through my logs [yes, I have no life] I see numerous attempts to deliver mail that are stopped by greylisting that I would like to stop before the greylist happens, and I would like to auto-create a temporary ban on the offending IP address. Over and over I see repeated...

Snorkasaurus

Hey A_bhishek,

If Roundcube was also relocated with hMailServer you may need to reconfigure it to point to the new IP address (which you can find in config\main.inc.php). If this is the case I would bet that your users' address books have disappeared and can be restored as described here.

S.

Snorkasaurus

SorenR wrote:This is where a backup MX comes in handy

I would +1 to the backup MX idea... not a bad idea to design it right in to your setup permanently so you don't have to worry about it for future maintenance windows (just make sure you also have spam filtering on the backup MX).

S.

Snorkasaurus

Hey percepts, I admit that I was a little hesitant at first, but it worked just fine. Here is the process in case anyone else needs to perform this [unsupported as previously mentioned] copy of the greylist-whitelist with MySQL as your db: On the server that has the populated greylist-whitelist mysq...

Snorkasaurus

Greetings Earthlings,

I have a reasonably long list of IP's that I have "whitelisted against greylisting" that I would like to copy to another hMailServer v5.4.2-B1964 installation, is there any easy way to avoid having to retype the list?

S.

Snorkasaurus

Hey jimimaseye, I might be a little confused... could you please clear up a few questions for me: You want all emails coming from Italian IP addresses to be marked as spam, when the message comes from a mail server in Italy your spam detection does mark it properly and when it is picked up via POP3 ...

Snorkasaurus

Hey jimimaseye,

Do you have this set?

S.

Snorkasaurus

I've used wine for things but it always seemed barely usable. I'm not sure what would need to be changed. You look into it & let me know. :D The places I recall that were the biggest issue with trying to port to nix was use of ATL & maybe COM or BOOST but BOOST should be available on nix just not s...

Snorkasaurus

Hey Bill... what about the possibility of changes that would make hMailServer functional under wine ? There are plenty of nix mail servers. Yeah, but boy are they a pain in the ass. There are plenty of tutorials that can be found which explain how to setup Linux mail servers but ultimately it all co...

Snorkasaurus

Sorry for the delay in responding. I think you are right - as that seems to be the only possibility left. Hey LesD, By the way, if you turn on your IMAP logging and are checking through it - I would suggest checking out Doom's analyzer . It is quite popular with the folks around here (including me)...

Snorkasaurus

Ok, so here's a plan: I have a machine that is almost an exact duplicate of this machine and it has nothing to do. So I guess I could setup this extra machine with my current 5.3 running hMailServer configuration and then experiment with the upgrade to 5.4 (while at the same time maintaining mail s...

Snorkasaurus

Q2u2 wrote:Bro...that is a beautiful write-up.

Glad to be of service... let me know if you have any questions or suggestions eh.

S.

Search found 190 matches