Hot answers tagged

87

This is an attempt to exploit the current remote code execution issue in the EXIM mail server, i.e. CVE-2019-10149. See The Return of the WIZard: RCE in Exim for details and also the kind of exploit you encountered. You are safe if you are not using EXIM or run a fixed version. From the linked article (emphasis added): This vulnerability is exploitable ...


1

Although these DMARC reports show that both DKIM and SPF verifications failed (this should be reassuring, right?), I'm a bit worried of what it actually means. The main point of a DMARC report is to get notified when somebody tries to spoof your domain. This is what happened here. Since your policy is explicitly "none" the mail got likely delivered like ...


1

Postfix ... Can I use SSH public keys instead of SASL password? In short, no. Postfix uses SASL, and while SASL supports a variety of different authentication mechanisms, SSH pubkeys is not one of them. That being said, SASL does support a number of sophisticated mechanisms that would serve your purpose of making login non-trivial for attackers to attempt....


1

Unfortunately, .tk is one of the TLDs that are notoriously associated with certain threat actors and are used by malware to establish C2 channels (malware home-calling). SNORT and Suricata (two most widely-used opensource IDS/IPS solutions) even have detection rules written for .tk, .pw and .ru URLs, it would generate an alert for the SOC analysts every ...


1

The documentation of Postfix is very specific in that the problem occurs if a client offers ciphers which the client does not implement properly. To cite from the documentation: ... some SSL clients have listed lower priority ciphers that they did not implement correctly. If the server chooses a cipher that the client prefers less, it may select a cipher ...


1

Postfix and Dovecot rely on OpenSSL. TLS 1.3 is supported since OpenSSL 1.1.1 which is not the OpenSSL which comes with CentOS 7. This means you would need to compile your own version OpenSSL and compile all the tools which should use it against it. Postfix 3.3.2 supports TLS 1.3 - see http://www.postfix.org/announcements/postfix-3.3.2.html There is no ...


1

There's also a 3rd option to consider: an authentication framework. Instead of having separate user credentials for the database and mail server that need to be kept in sync, have a central authentication service that the database and mail servers defer to when a user attempts to authenticate. There's quite a few options to choose from, but you'll probably ...


1

Looks like I've found answer to my own question, apparently fail2ban-client status will say that service is enabled, even if there is no filter rule for that particular ban. The solution was to create postfix-sasl.conf in /etc/fail2ban/filter.d/postfix-sasl.conf With following contents: # Fail2Ban filter for postfix authentication failures # [INCLUDES] ...


Only top voted, non community-wiki answers of a minimum length are eligible