First, we want to remove all the RPM stuff. A general note here. We are removing the RPMs, because we want to write all of the articles from the perspective of a generic Linux distribution as much as possible. True, we rely on the default file structure and general layout of Red Hat; however, by […]

In this article, we upgraded Postfix to 2.2.5 via RPMs; however, if a later version is needed, and you are running Red Hat Enterprise Linux Version 3 (RHEL 3), an RPM needs to be created from source. There is a source RPM for 2.2.6 available here: http://postfix.wl0.org/ftp/official/2.2/SRPMS/ To use the RPM, install it: [root@s root]# […]

It is quite easy to email security or traffic reports automatically. We will use mpack, sendmail, and cron, but certainly the techniques could be combined with other utilities. The challenge with emailing files is that you have to encode the attachments into the email message using MIME. For the nitty gritty on MIME, see http://www.nacs.uci.edu/indiv/ehood/MIME/MIME.html. […]

First off, Pine rocks when it comes to reading mail quickly, particularly on a server where a GUI is not available. Second of all, it often doesn’t come with GNU/Linux distributions anymore. I suppose that part of the problem is that pine includes a version of IMAP that can cause problems if it coexists with […]

Outlook is nice and all, particularly when dealing with, oh, 90 percent of the email clients out there. The same thing that makes it nice, also makes it insecure. Some of the email accounts we monitor have been quite public, and receive not only a lot of spam, but also a lot of viruses. If […]

The opportunists who send unsolicited bulk email (UBE) use tools that do not follow standards. This can work to an advantage in that improper configuration can allow quite a bit of filtering to be done on inbound email. For instance, the following entries in main.cf for postfix will dramatically cut down on email from misconfigured […]

If you have a sendmail server that has a hostname that isn’t resolvable, you may need to masquerade as a different host. This is often the case if you are running sendmail on your internal workstation. We also ran into this while bringing up a Squirrel Mail web based mail system. Simply add these lines […]

There is an excellent discussion of the Blue Security DDOS attack here, including a copy of discussion from those behind the DDOS here. There is more information on Blue Frog and related issues on Wikipedia here. If you somehow missed this, it is probably in your best interest to be aware of what is going […]

All of the DNS blacklists we used a couple years ago are defunct. There are, however, a slew of new DNS-based blacklists that can help protect your users from spam. Understand that with any blacklist there is a chance that legitimate email will be blocked. Balancing this against the cost and annoyance of spam is […]

If you have bad messages in your Postfix mail queue, you can list them with the postqueue command: [root@svr-1 mail]# postqueue -p -Queue ID- –Size– —-Arrival Time—- -Sender/Recipient——- 4C63F2300BA 876 Mon Jun 5 09:31:54 user@somedomainsomewhere.com (connect to example.com[192.0.34.166]: Connection timed out) differentuser@example.com — 1 Kbytes in 1 Request. You will need the Queue Id to […]

Make sure that you are not running an old version of formmail.pl. Check your cgi-bin directory to make sure. Even though the fix for formmail has been out since last August, we are still getting scanned for this on our webservers. Old versions of formmail.pl can be used to send spam. For more info, check […]

Postfix has the ability to reject mail based on regular expression matching in the header of the incoming mail message. To enable this, add these lines to main.cf: header_checks = regexp:/etc/postfix/header_checks header_checks = pcre:/etc/postfix/header_checks We stuck these after the alias line. Add the header content matches and actions to header_checks (usually in /etc/postfix) and restart […]

If you are using an email client besides Outlook (gasp!), you have most likely run into the attachment winmail.dat. Supposedly this can be prevented on the client side by sending mail in plain text; however, this doesn’t appear to work with attachments. We ran across a cool utility at Fentun that will extract attachments out […]

When migrating from an internal email system to Google Apps, it’s nice to have the option of running a pilot program including a few of your users to try it out, and then to move the rest of the users over when problems with the transition have been identified and addressed. This is pretty easy […]

As systems administrators, we abhor spam. It bogs down servers, floods our personal mailboxes, and wastes our user’s time. As web content providers, we also are extremely annoyed that email contact information is blatently reaped and abused. The Internet can be so much more than a cesspool of spam. On the other hand, the Internet […]

As you may or may not know, Washington State has a spam law that forbids deceptive email practices. For more info on this law see this area of the Attorney General of Washington’s website. Well, a landmark case regarding this law has just been decided. We put a copy of the release up on NetAdminTools […]

One good trick to use when testing your email server is to use telnet. To send email, you can just telnet into the destination email server directly: u-1@srv-1 u-1 $ telnet yourmailserver.com 25 Trying 21.40.23.46… Connected to yourmailserver.com. Escape character is ‘^]’. 220 mx.yourmailserver.com ESMTP Sendmail 8.12.9/8.12.9; Thu, 12 Jun 2003 10:06:19 -0700 helo frommail.com […]

Due to DDoS attacks on Osirusoft, Osirusoft decided to reject all. So, if you are using Osirusoft to block spam, stop! Well, hats off to the valiant efforts of Osirusoft. Can’t really blame them for their reaction to this world of shit. The beautiful thing is that sysadmins and others in our community will find […]

It is truly amazing how many resources are taken up on a server by other rogue boxes searching for an open relay, or simply sending dictionary attempts at finding local users. Watch-maillog is a perl script that uses IPtables to block mail servers that abuse your server. Watch-maillog helps with this by blocking servers that […]

We often need to mail brief messages from servers to send config files, or quick messages to other sysadmins. Pine works well for this, and the installation is mostly a single binary. We usually are logged in on some account that isn’t the email address we wish replies to come to. It turns out that […]