Hot answers tagged

92 votes
Accepted

Unusual mail headers show evidence of MTA attack. Have I been pwned?

This is an attempt to exploit the current remote code execution issue in the EXIM mail server, i.e. CVE-2019-10149. See The Return of the WIZard: RCE in Exim for details and also the kind of exploit ...
3 votes
Accepted

DMARC report for mails I didn't send

Although these DMARC reports show that both DKIM and SPF verifications failed (this should be reassuring, right?), I'm a bit worried of what it actually means. The main point of a DMARC report is to ...
2 votes
Accepted

Is `tls_preempt_cipherlist = yes` in postfix a good idea nowadays?

The documentation of Postfix is very specific in that the problem occurs if a client offers ciphers which the client does not implement properly. To cite from the documentation: ... some SSL ...
2 votes

How should output of fail2ban postfix-sasl look like

Looks like I've found answer to my own question, apparently fail2ban-client status will say that service is enabled, even if there is no filter rule for that particular ban. The solution was to ...
2 votes
Accepted

Unauthorized access postfix "lost connection after MAIL from unknown[127.0.0.1] "

My concern is why is it from the localhost? That is impossible for us to say. Very possibly you have an automated process on your system that tried to send mail. Alternately, something like an FTP ...
  • 72k
1 vote

My postfix server is getting DOSed, what can I do?

As you don't give much about your environment we must assume you want to mitigate the DDOS through Postfix itself. In that case there are some settings you can try. Limit the number of inbound and ...
1 vote
Accepted

POST requests are bypassing PHP checks

The pastebin posts help a lot. First of all, we see from the unsanitized user inputs that you posted, that the spammer actually isn't entering inputs containing the @ character, after all, in 'name' ...
  • 19.9k
1 vote
Accepted

Postfix SMTP - Can I use SSH public keys instead of sasl password

Postfix ... Can I use SSH public keys instead of SASL password? In short, no. Postfix uses SASL, and while SASL supports a variety of different authentication mechanisms, SSH pubkeys is not one of ...
  • 72k
1 vote

Why are my emails going to spam?

Unfortunately, .tk is one of the TLDs that are notoriously associated with certain threat actors and are used by malware to establish C2 channels (malware home-calling). SNORT and Suricata (two most ...
1 vote

Is TLS 1.3 supported in Dovecot 2.3.4 and Postfix 3.3.2?

Postfix and Dovecot rely on OpenSSL. TLS 1.3 is supported since OpenSSL 1.1.1 which is not the OpenSSL which comes with CentOS 7. This means you would need to compile your own version OpenSSL and ...
1 vote

Linking mail server with application database

There's also a 3rd option to consider: an authentication framework. Instead of having separate user credentials for the database and mail server that need to be kept in sync, have a central ...
  • 654

Only top scored, non community-wiki answers of a minimum length are eligible