Setting up your firewall with fail2ban

Fail2ban scans log files (e.g. /var/log/apache/error_log) and bans IPs that show the malicious signs -- too many password failures, seeking for exploits, etc. Generally Fail2Ban is then used to update firewall rules to reject the IP addresses for a specified amount of time, although any arbitrary other action (e.g. sending an email) could also be configured. Out of the box Fail2Ban comes with filters for various services (apache, courier, ssh, etc).

I will show shortly how to install and configure fail2ban to ban malicious IPs, expecially those related to the qmail-dnsrbl patch. This will avoid to be banned ourselves by spamhaus, which is free up to 100.000 queries per day.

Roundcube webmail

Roundcube is a full featured webmail with a nice interface.

RoundCube 0.8 showing its new skin

Patching qmail

Changelog

The complete changelog is inside the patch file.

  • 2014-04-14
    -added qmail-maxrcpt patch, which allows you to set a limit on how many recipients are specified
  • 2014-03-10
    -added qmail-smtpd-liberal-lf patch, which allows qmail-smtpd to accept messages that are terminated with a single \n instead of the required \r\n sequence. This should avoid some "read failed" reject.
  • 2013-12-30
    -added qmail-SRS patch. You have to install libsrs2 now.
    -the character "=" in the sender address is now considered valid by chkuser in order to accept SRS
  • 2013-12-18
    -added qmail-date-localtime patch
    -added qmail-hide-ip patch
    -the original greetdelay by e.h. has been replaced with the improved patch by John Simpson. Now
    communications trying to send commands before the greeting will be closed. Premature disconnections will be
    logged as well.
    -CHKUSER_SENDER_FORMAT enabled to reject fake senders without any domain declared (like <foo>)
    -chkuser logging: I slightly modified the log line adding the variables' name just to facilitate its interpretation
    -added qmail-moreipme patch
    -added qmail-dnsbl patch (more info here)
  • 2013-12-05
    added two patches to make qmail rfc2821 compliant
  • 2013-11-23
    any-to-cname patch added

I have created a combined patch including the latest versions of several commonly-used qmail patches:

[Follow the patch details here]

Other patches:

Merry Christmas and happy new... patch!

These days I had the opportunity to exchange ideas with a friend out there and take a look at his work and his customized jumbo patch. Some of the patches I came across have appeared to me very useful and I convinced myself to add some of them into my package.

The changelog is quite long this time! :)

Have fun!

Slackware guest on Linux-Vserver

Linux-Vserver is an open source software which acts as a virtual private server implementation done by adding operating system-level virtualization capabilities to the Linux kernel.

This means that all guests share the same kernel and they don't need to provide hardware support.

The purpose of this note is to show how to setup a guest based on Slackware into a Slackware host. What follows was tested on Slackware 14.1, 14.0, 13.37 and 13.1 (both 32b and 64b). I will assume that you have a Linux-Vserver box working. You can find here a quick and easy howto concerning Linux-Vserver installation and configuration (patching the kernel + utils-vserver installation).

Howto avoid being "cut off" by spamhaus.org

As you probably know spamhaus limits your smtp and DNS traffic (http://www.spamhaus.org/organization/dnsblusage/ for more info) and in case of big servers this can be a serious problem.

Luckily, Costel Balta sent me a solution to the problem that I'm going to copy below. In short, he suggests to dinamically create firewall rules via iptables (or better shorewall) to avoid connections from suspicious IPs in order to decrease the number of requests to the RBL lists of about 80%.

ipsets and swatch are also needed to manage iptables rules and scan your logs respectively.

A big thanks to Costel Balta for the following tutorial; this is not the first time that he posts an original idea.

How to backup a website with rsync via ssh login without password

Rsync is a fast and extraordinarily versatile file copying tool.  It can copy locally, to/from another host over any remote shell, or to/from a remote rsync daemon.
It offers a large number of options that control every aspect of its behavior and permit very flexible specification of the set of files to be copied.  It is famous for  its  delta-transfer algorithm, which reduces the amount of data sent over the network by sending only the differences between the source files and the existing files in the destination.  Rsync is widely used for backups and mirroring and as an improved copy command for everyday use.
Rsync finds files that need to be transferred using a "quick check" algorithm (by default) that looks for files that have changed in size or in last-modified  time.
Any  changes  in  the  other preserved attributes (as requested by options) are made on the destination file directly when the quick check indicates that the file's data does not need to be updated.

Syndicate content