I migrated my sites to a new server! Hopefully this means that the next dist-upgrade will work without a hitch.
Debian 9 “Stretch” it is!
If you notice any of my sites misbehaving, let me know. For now I’m proud of the A+ rating by SSL Labs.
Related: 2018-03-09 OpenVZ Pains, Sibirocobombus Setup.
=> 2018-03-09 OpenVZ Pains | Sibirocobombus Setup
Bonus: I just realized how much simpler my setup has become now that I’m no longer self-hosting an email server!
To remind myself and others of the giant pain email has become, I’m copying the relevant stuff I deleted from my Sibirocobombus Setup page and the comments on that page.
☯
You need to add reverse DNS entry on the web site.
“Mailing to remote domains not supported.”
alex@sibirocobombus:~$ mail kensanata@gmail.com
Subject: test from sibirocobombus
hi
.
Cc:
alex@sibirocobombus:~$ mail
No mail for alex
alex@sibirocobombus:~$ sudo exim -bp
0m 1.2K 1bQDA7-0000As-S4 <> *** frozen ***
alex@sibirocobombus
alex@sibirocobombus:~$ fg
-bash: fg: current: no such job
alex@sibirocobombus:~$ exiwhat
-bash: exiwhat: command not found
alex@sibirocobombus:~$ exim -Mvl 1bQDA7-0000As-S4
-bash: exim: command not found
alex@sibirocobombus:~$ sudo exim -Mvl 1bQDA7-0000As-S4
2016-07-21 14:33:11 Received from <> R=1bQDA7-0000Ao-RS U=Debian-exim P=local S=1230
2016-07-21 14:33:11 kensanata@gmail.com R=nonlocal: Mailing to remote domains not supported
*** Frozen (delivery error message) I guess this means we need to fix exim?
First, comment the crontab on my Raspberry Pi such that it will no longer update my zonefile.
Setting up Exim using these rules:
/etc/exim4/dkim and chown Debian-exim.Debian-exim dkim.* to change their owners.
/etc/exim4/exim4.conf.localmacros and add the following:
1. https://debian-administration.org/article/718/DKIM-signing_outgoing_mail_with_exim4
2. note that the selector is something in your zone file, ie. dkim._domainkey for me DKIM_CANON=relaxed DKIM_SELECTOR=dkim DKIM_DOMAIN=alexschroeder.ch DKIM_PRIVATE_KEY=/etc/exim4/dkim/dkim.private
/etc/exim4/exim4.conf.template and add some stuff for Spam Assassin as described in the Debian documentation and in the Exim documentation; remember that you need to apt-get install exim4-daemon-heavy like I did up above! This is what I use:# https://wiki.debian.org/Exim#Spam_scanning and # http://www.exim.org/exim-html-current/doc/html/spec_html/ch-content_scanning_at_acl_time.html#SECID206 # put headers in all messages (no matter if spam or not) warn spam = nobody:true add_header = X-Spam-Score: $spam_score ($spam_bar) add_header = X-Spam-Report: $spam_report # add second subject line with SPAM marker when message # is over threshold warn spam = nobody add_header = Subject: SPAM (score:$spam_score) $h_Subject: # reject spam at high scores deny message = This message scored $spam_score spam points. spam = nobody:true condition = ${if >{$spam_score_int}{60}{1}{0}}
service exim4 restart
mail kensanata@gmail.com and try it
/var/log/exim4/rejectlog
~/.forward file in every user’s home directory containing nothing but the new email address; watch out: if you forward too much spam, Gmail will start to refuse mails from your domain!
sudo -u claudia mail # to read mails for other users and delete spam
formail (which is part of procmail):sudo cat /var/spool/mail/claudia | formail -k
-X From:
-X Subject:
-X Message-Id:
-X Date:
-X To:
-X Content-Type:
-I "To: kensanata@gmail.com"
-s /usr/sbin/sendmail -t -f kensanata@gmail.com
=> https://wiki.debian.org/Exim#Things\ you\ might\ want\ to\ configure | https://debian-administration.org/article/718/DKIM-signing_outgoing_mail_with_exim4 | Debian documentation | in the Exim documentation | https://wiki.debian.org/Exim#Spam_scanning | http://www.exim.org/exim-html-current/doc/html/spec_html/ch-content_scanning_at_acl_time.html#SECID206 | http://www.spamhaus.org/lookup/ | https://senderscore.org/blacklistlookup/ | magic string | resend mails
I’m trying to improve SpamAssassin and found the wiki page Improve Accuracy. spamassassin -D --lint 2>&1 | grep -i failed produces a few Perl modules:
sudo apt-get install libssl-dev
cpanm Digest::SHA1 Geo::IP Razor2::Client::Agent Mail::DKIM DBI Encode::Detect Net::Patricia
/etc/default/spamassassin and set CRON=1
/etc/cron.daily/spamassassin: channel: could not find working mirror, channel failed sa-update failed for unknown reasons
On ServerFault, I found the suggestion that some of the files in /var/lib/spamassassin had the wrong owner. It should be debian-spamd. And they were right!
This listed /var/lib/spamassassin/3.004000 and all its files belonging to root:
sudo find /var/lib/spamassassin -user root
To fix it:
sudo find /var/lib/spamassassin -user root -exec chown debian-spamd:debian-spamd '{}' ';'I’m not sure why those files ended being there, owned by root. Perhaps I had run sudo sa-update just to “test” it?
☯
Time to get tough on spam! This is not funny.
alex@sibirocobombus:~$ mail Mail version 8.1.2 01/15/2001. Type ? for help. "/var/mail/alex": 332 messages 332 new >N 1 Oneill.12731@gree Tue Sep 13 23:19 446/30612 Equipment receipts N 2 Herman4@habit-rea Tue Sep 13 23:29 226/14170 payment copy N 3 Nichole7@hudsonpl Tue Sep 13 23:35 225/14073 payment copy N 4 Mariana2@sprintin Tue Sep 13 23:53 223/13877 payment copy N 5 huixinsoft40@foxm Wed Sep 14 01:33 100/6194 =?utf-8?B?dGhlIGRpcmVjdCBmYWN0b3J5IGl N 6 dgvsd876dvs@126.c Wed Sep 14 01:43 75/4277 =?utf-8?B?UHJvbW90aW9uYWwgYXBwYXJlbCB N 7 Diann630@totalind Wed Sep 14 02:36 222/13874 payment copy N 8 dkhaaabgupxy@ens. Wed Sep 14 02:42 97/5898 =?GB2312?B?UHJvZmVzc2luYWwgVGFibGV0IF N 9 mnsh@cichzeowtnre Wed Sep 14 03:13 72/3877 =?GB2312?B?UkU6SGlnaCBxdWFsaXR5IGFuZC N 10 mpybenrgvr@uouqb. Wed Sep 14 03:13 74/4043 =?GB2312?B?UkU6SGlnaCBxdWFsaXR5IGFuZC N 11 Corine67@kbr.mx Wed Sep 14 03:35 222/13797 payment copy N 12 Karyn405@imagodep Wed Sep 14 04:08 224/13999 payment copy N 13 Ray79@excluservic Wed Sep 14 04:11 224/13924 payment copy ***SPAM (score:5.3)*** p N 14 Adolfo902@slsterl Wed Sep 14 04:18 233/14625 payment copy ***SPAM (score:5.9)*** p N 15 d4gdfv@yeah.net Wed Sep 14 04:38 73/4129 =?utf-8?B?UkU6IGJ1c2luZXNzIG1hcmtldCB N 16 Rene216@sk-sigurd Wed Sep 14 04:41 224/13935 payment copy ***SPAM (score:5.3)*** p N 17 hulsingcrm37@aliy Wed Sep 14 05:58 82/4756 =?utf-8?B?UkU6IHF1b3RlIHByaWNl?= N 18 ybgup@bdmpxxybdln Wed Sep 14 06:37 62/3257 =?GB2312?B?UmU6IHByb2Zlc3Npb25hbCBzdG
I usually just run p root to see if I got anything from root. The Tiger reports, for example.