- Users - KICTANet

pleased so far
by Helmut Fritz 19 Apr '16

19 Apr '16

Gordon, So far I am REALLY liking the exim4u setup. SPAM has become non-existent on the domain I have moved over to the exim4u server. This work is very much appreciated, and a big thanks to the vexim people too as well and anyone else that has contributed Anyone (if you get to this before Gordon!), A couple emails have come in (I see them in the logs) that my wife wants ( ugh ) that the rest fo the world, including myself, would consider spam. How to ensure these come through? Can she add to whitelist herself through her account management? I logged in as her but only saw a block filter customization? Is this something only to be done through webmail? 2016-04-15 23:21:18 H=outbound-191-242.usw2.aws.post.pinterest.com [54.149.191.242] X=TLSv1.2:ECDHE-RS A-AES256-GCM-SHA384:256 CV=no F=<bounces-457326674569107362(a)explore.pinterest.com> rejected RCPT <mywife(a)fritz.us.com>: Spammer rejected. DNSBL listed at bl.spamcop.net at Blocked - see http://www.spamcop.net/bl.shtml?54.149.191.242. Ratelimit incremented. Also, is there a spam/ham training facility either for the server as a whole, per domain, or per user? i.e. ham@ and spam@ to which emails can be sent to for training? Am I missing a portion of documentation to read? I am fine with someone stating to RTFM, please tell me where the M is. J Thx. Helmut

4 20

issues with php-extesions install
by Helmut Fritz 16 Apr '16

16 Apr '16

OK, first issue, probably minor. I get this installing the default php: "This port is deprecated; you may wish to reconsider installing it: PHP 5.4 is End of Life http://php.net/supported-versions.php. It is scheduled to be removed on or after 2016-01-15." Figuring I should go to the latest version then, I installed php56 and then progressed to php56-extensions. All good except that I found two of the extensions listed as required in the appendix for BSD are not present in the extensions setup to select. Those two are: php-spl php-pcre unfortunately the same issue is present in the base/default php-extensions as I went back there to see if they were present. I also get a STOP when php-mbstring comes up, saying it has vulnerabilities in the latest php56. I get a deprecated in the base/default php-extensions build. While compiling the default/base php5-extensions I get a STOP on building php5-phar. This is not in the list of required extensions but is listed as a dependency for php5-pdo (during its make). "===> php5-phar-5.4.45 has known vulnerabilities: php5-phar-5.4.45 is vulnerable: php -- multiple vulnerabilities CVE: CVE-2015-7804 CVE: CVE-2015-7803 WWW: https://vuxml.FreeBSD.org/freebsd/c1da8b75-6aef-11e5-9909-002590263bf5.html" So maybe three questions: 1. Should I use the deprecated (but seemingly default/base) php5 (5.4.x) or the newer php56? 2. Do the two missing extensions matter? if so, where do I get them? (see 2.a below!) 3. For the default php5-phar, am I safe setting 'DISABLE_VULNERABILITIES=yes' for make? I could do the same for the newer version and ignore the mbstring vulnerability. 2.a. Interestingly enough when I run php -m, it shows both SPL and pcre as loaded - I think they are actually in core for quite a long while now? perhaps they should be removed from the required list (unless it is assumed people are smarter than I and know they are part of core?)? So this whole thing is probably OK except for the issues with mbstring and phar vulnerabilities?

4 17

CentOS7/systemd
by Helmut Fritz 06 Apr '16

06 Apr '16

Hello, First message here. I am looking to get off of qmailtoaster (been running it for many, many years) since even it is not well maintained any more. I am looking at either postfix or exim, and an easy tool to manage them (limited free time=hobby business). I ran across exim4u and it looks like it might fit the bill. Other platforms I am looking at are ISPConfig and BlueOnyx (yes, I know, sendmail), Xeams, Virtualmin. I know all of those are not email only, but I hope I can just ignore the other portions of those application stacks. I do like that exim4U is first for email, exactly what I want/need. I do have a couple questions: 1. Is it maintained and being further developed? I am not concerned if it is slow development, but what exists should be relatively solid. 2. Will it run on CentOS7 or other systemd platforms? Seems they are all pretty much going that way unfortunately. Thx! Helmut

6 16

Re: [Exim4U] Facing a problem with false positives using uribl.com Blacklisting?
by Gordon Dickens 31 Mar '16

31 Mar '16

1 0

Facing a problem with false positives using uribl.com Blacklisting?
by valki＠valki.com 30 Mar '16

30 Mar '16

Hi there! I just upgraded to exim4u 3 weeks ago and seem to have a problem regarding false positives when using uribl within exim4u. After some reading through the docs I found a topic regarding the problem when the mailserver is using a "big" public nameserver and therefore the requests may be blocked. So I installed quickly a forwarding bind99 - but still the problem persists. As an example: Incoming Email: 2016-03-29 14:42:57 1aksz2-000JNC-RN H=mx.bmi.gv.at [78.41.149.30] X=TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F= rejected during MIME ACL checks: Blacklisted URL in message. (polizei.gv.at) in. See http://lookup.uribl.com. It claims that polizei.gv.at (austrian authority for racecontrol for autobahns) should be on a blacklist? Dont think so... [root(a)mail /]# nslookup polizei.gv.at.multi.uribl.com Server: 144.76.161.138 Address: 144.76.161.138#53 Non-authoritative answer: Name: polizei.gv.at.multi.uribl.com Address: 127.0.0.1 As far as I learned this should mean that its on the "gold" list eg. NOT on the blacklist. And as there is no 127.0.0.255 I assume that my local bind is doing its job well. So how can I find out why that email is being refused? kind regards, Valki

3 6

Not authorized by SPF
by Kebba Foon 01 Feb '16

01 Feb '16

Dear list, Am receiving below error for this particular user, i don't understand why spf is rejecting this address or how to white-list it from spf check: 2016-02-01 10:38:47 H=mail-wm0-f52.google.com [74.125.82.52] F=<hamada_hegazy(a)lighttec.com.eg> rejected RCPT <********(a)qcell.gm>: Sender address not permitted - SPF.: Not authorized by SPF

3 2

MySQL-5.5.x glitch
by Odhiambo Washington 24 Jan '16

24 Jan '16

I encountered the error detailed here[0] today and had to make the suggested changes to the table 'blocklists' for an e-mail to be delivered. [0] http://stackoverflow.com/questions/1008287/illegal-mix-of-collations-mysql-… -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 "Oh, the cruft."

1 0

esmtps/esmtpsa misconfiguration?
by emkay 21 Aug '15

21 Aug '15

Hello everyone, I’m having a weird issue with my server running exim4u 2.1.1 on Debian Squeeze and I just can’t get my head around this. I know this might be more of an Exim question but since I use Exim4u I’ll try my luck here first. the problem: For a few days now I have one single user sending out spam mails. Not many - only about 5x a day. All sent to the domain’s aliases and one other local domain. But: they seem to 'multiply' because simultaneously the same rubbish is sent from multiple external IPs to what seems to be his whole addresses book, using his account’s email address as sender. First I thought: sure thing - a compromised account. So I changed his password. But the following day it happened again. So I changed his pw again and told him not to update the pw on his computer but only use his mobile for a day. About 36h later it happened again. I have checked the logs and he indeed didn’t connect using his macbook for the whole day. Just a told him. So this should rule out a compromised machine, right? There are no relay servers in my exim4u installation and connections are only accepted on SSL/TLS (993/587). The eximu4 web interface is not public. I keep the box up to date and have all Debian LTS packages installed and have a rather tight iptables based firewall running. Plus I think I can exclude dictionary attacks because I have fail2ban blacklisting IPs after a couple of failed attempts. Long story short: I’m running out of excuses. My last glimps of hope: I noticed in the exim mainlog that the rogue connections used „P=esmtps“: 2015-08-18 01:20:36 1ZSDMy-0002RD-MY <= user(a)example.com H=s115.panelboxmanager.com [184.107.100.85] P=esmtps X=TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32 S=7303 id=b0795df60e0f65f5.3b60fdmy(a)example.com T="Fw: important" Rather than „P=esmtpsa“, which is used when a regular, _a_uthenticated user sends out mail. http://www.gossamer-threads.com/lists/exim/users/98628#98628 So my question is: does the 'missing a' indicate that the mail was sent without authentication? could this be an Exim/Exim4U ACL issue/misconfiguration? It would be great to get some feedback or hints regarding this because neither the spamming pattern (local / remote) nor the password-change-ignoring connections make any sense to me. thanks i.a. Mika

2 4

UTF-8 change in Exim4U Version 3.0.0,
by William Marcelo Piovezan 06 Jul '15

06 Jul '15

Hi, Following the Exim4u v3.0.0 upgrade instructions I´ve changed the Mysql tables and database collation to utf-8 charset. After that, I´m getting a problem with Brazilian accented characters (é, á, í, etc) in Vacation/Auto-reply messages. If I try to set up a new message the accented characters are not saved in the MySQL Users table. If only enabling old messages already saved before the utf-8 conversion, the message goes to the sender with wrong chars (example below): Original message: Olá Encontro-me de férias no período de 06/07/2015 à 20/07/2015 Sent message: Ol=C3=A1 Encontro-me de f=C3=A9rias no per=C3=ADodo de 06/07/2015 =C3=A0 20/07/2015. My question: What the reason motivated the UTF-8 DB/tables conversion? Do you know any other way to keep the UTF-8 collation and solve the accent characters in Vacation and Auto-Reply messages? Best Regards, William.

2 1

Re: [Exim4U] What certificate filename should I choose for MY_IP var in MULTI_IP = YES setup in case of IPv6?
by Seidel, Michael 03 Jun '15

03 Jun '15

Hello Gordon, Hello List, Thank you very much for the hint about the DNS Lookup, I will set it up and test it and come back to you with some data. IMHO: pushing the problem because of few mail servers use it won't help :-) If nobody addresses IPv6 "problems" and quirks nobody going to use it, ever. Kind Regards, Michael Seidel System Administrator FAI rent-a-jet AG http://www.fai.ag >-----Ursprüngliche Nachricht----- >Von: users [mailto:users-bounces(a)exim4u.org] Im Auftrag von Gordon Dickens >Gesendet: Dienstag, 2. Juni 2015 23:17 >An: Exim4U General Discussion >Betreff: Re: [Exim4U] What certificate filename should I choose for MY_IP var in MULTI_IP = YES setup in case of IPv6? > >On 06/02/2015 10:34 AM, Seidel, Michael wrote: >> Hi List! >> >> Could somebody please clarify which filename I should choose for certificates in MULTI_IP = YES setup in case of IPv6? >> >> ⇒ /etc/pki/tls/exim_tls/exim.MY_IP.key >> >> What’s $MY_IP in the case of this example: >> >> 1) FE80:0000:0000:0000:0202:B3FF:FE1E:8329 >> 2) FE80::0202:B3FF:FE1E:8329 >> 3) FE80::202:B3FF:FE1E:8329 >> >> Is it always 1) because computer do not short it, EVER? >> /etc/pki/tls/exim_tls/exim.FE80:0000:0000:0000:0202:B3FF:FE1E:8329.key ? >> > >Hi Michael, > >The MULTI-IP capabilities were developed and tested for IPv4. That's not to say that it would not work for IPv6, however, I have not tested MULTI-IP with IPv6 and am not aware of anybody else who has >tested it. >So, to be honest, I am not certain that it works or not. Nevertheless, >IPv6 obviously needs to be addressed and sorted out since it is indeed the future for DNS. However, the reality is that, up to now, very few mail servers are using IPv6 so there has not been much of a need >yet to sort these issues out.> > >To give you a more direct answer to your question; the IP address that is used by Exim4U is the DNS lookup for the domain name. So, my first stab at answering your question would be to do a DNS lookup >for the domain with the "nslookup" or "dig" command and then try the same IPv6 syntax as the results. > >Gordon

1 0