Ramblings from MostlyChris

Blocking Spam With Postfix

December 27, 2011 Chris No comments

I stole this from Here.

Also see this.

I think it's well worth configuring Postfix with these options (tuned to your exact needs, of course) to block SPAM.

Blocking spammers with Postfix alone
The battle between email admins and spammers is an ongoing arms race. The spammers are at a disadvantage because by and large, they have to rely on exploiting vulnerable systems to send their mail. With the ever growing size of botnets, they have a pretty large pool of exploited systems to send from, but Postfix can be configured to weed out most of that.
I’ve used the following configuration for many systems that were being plagued by spam problems. In many cases, SpamAssassin was doing the job, but it was having to process so much junk that it was putting an amazing amount of load on the server. After adding this to the Postfix configuration, Postfix was able to reject mail before it came into the queue, thereby reducing the amount of mail that made it through to SpamAssassin.
Add to /etc/postfix/main.cf
smtpd_delay_reject = yes
smtpd_helo_required = yes
disable_vrfy_command = yes

smtpd_helo_restrictions =
permit_mynetworks,
reject_non_fqdn_helo_hostname,
reject_invalid_helo_hostname,
#reject_unknown_helo_hostname,
permit

smtpd_sender_restrictions =
permit_sasl_authenticated,
permit_mynetworks,
reject_non_fqdn_sender,
reject_unknown_sender_domain,
permit

smtpd_client_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
reject_unauth_pipelining,
reject_rbl_client bl.spamcop.net,
reject_rbl_client zen.spamhaus.org,
permit

smtpd_recipient_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
check_recipient_access hash:/etc/postfix/denied_recipients,
reject_non_fqdn_recipient,
reject_unknown_recipient_domain,
reject_unauth_destination,
permit

Listing Users in mysql

May 14, 2011 Chris No comments

I usually just take a look at the users' table in mysql to determine what users have access to databases and from what hosts. I ran across this nifty command today that will print it all out nicely in an ssh shell.

mysql -u root -B -N -p -e "SELECT user, host FROM user" mysql

mysql mysql commands

Logging from Cisco Firewall to Linux

February 11, 2011 Chris No comments

Logging from a firewall to linux is fairly simple. First, enable logging on the firewall with something along these lines (your options may vary):

(config)# logging on 

(config)# logging standby 

(config)# logging timestamp 

(config)# logging trap notifications 

(config)# logging facility 19 

(config)# logging host inside <Your server IP address>

Notice that the firewall uses facility 19. That will need to be converted to binary in order to determine what to set up in the syslog.conf file. Since syslog only uses local0 through local7 you must use a corresponding facility. In the case of the above configuration, it is local3.

16 = 00010000 = local0
17 = 00010001 = local1
18 = 00010010 = local2
19 = 00010011 = local3
20 = 00010100 = local4
21 = 00010101 = local5
22 = 00010110 = local6
23 = 00010111 = local7

On the server, edit the /etc/syslog.conf file. Add the following line:

local3.*       <location of your log file>

In my case I use /var/log/firewall.log for the location of the log.

Make sure you use a tab between the local3.* and the log file location or it won't work.

You also need to enable remote logging in syslog if not already enabled. Open /etc/sysconfig/syslog and look for this line:

SYSLOGD_OPTIONS="-m 0 -r"

Make sure the '-r' is one of the options. If not, add it to the options line.

Restart syslog:

/etc/init.d/syslog restart

Check to make sure you are now logging.

tail -f /var/log/firewall.log

Linux cisco, logging, syslog

Where in the heck do I get those intermediate/root certs?

January 7, 2011 Chris No comments

I am forever trying to find the link to the root/intermediate certificates when I install an SSL certificate on a server. Since the root certificate is now required I spend too much time trying to locate it. To save myself some time, I am putting the link(s) for the certs here so I know exactly where they are.

Thawte's Certs

General none

Change RAID Battery Learn Cycle (DELL)

December 8, 2010 Chris No comments

The battery learn cycle causes some i/o headaches and slows things down. If you would like to change the times that the learn cycle runs, thus allowing the cycle to run when other items are not needing to use more i/o, throw this in cron.

0 4 1 1,3,5,7,9,11 * /usr/bin/omconfig storage battery

action=startlearn controller=0 battery=0