An average guy's IT (mis)adventures

I was enabling Exim on my IONOS VPS to deliver email through a smarthost and encountered the error message in this post's title (unable to send to Gmail users.. It's always them!)

After fiddling a while with DMARK and SPF I reconfigured Exim itself to rewrite sender address, so that emails coming from "spacenest.it" (IONOS domain) were sent as coming from "woodpeckersnest.eu", the smarthost and real email server.

Everything is done via this command:

# dpkg-reconfigure exim4-config

And the resulting configuration in /etc/exim4/update-exim4.conf is:

dc_eximconfig_configtype='smarthost'
dc_other_hostnames='cassandra.spacenest.it;spacenest.it'
dc_local_interfaces='127.0.0.1'
dc_readhost='woodpeckersnest.eu'
dc_relay_domains=''
dc_minimaldns='false'
dc_relay_nets=''
dc_smarthost='pandora.woodpeckersnest.space::587'
CFILEMODE='644'
dc_use_split_config='false'
dc_hide_mailname='true'
dc_mailname_in_oh='true'
dc_localdelivery='mail_spool'

On OVH's postfix I just had to modify this line in /etc/postfix/main.cf:

mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 94.143.138.27/32

where that last IP is the IP Address of my IONOS server.

I had previously discussed this issue on XMPP and on my Schleuder Mailing List, but there's news.

My ".space" domain is blacklisted by Google and others top email services because it is considered spammy - I still don't understand how you can blacklist a whole tld for spam but that's how it goes..

So I purchased a new ".eu" domain and set it up as virtual host in postfix.. But I was still using a third party relay to deliver emails to Gmail, Hotmail and iCloud. This relay works with "credits", each email you send using their free service is equal to 1 credit and you get 1000 credits per month (BIG Thanks to Kévin from Delta Chat for helping me out with this).

Now, I haven't ever reached the maximum allowed quota but I felt like removing the casters at least for Gmail, since this .eu domain should do the job just fine and because I cannot actually remove Hotmail, since they have my server IP banned for whatever reason.

So, I removed the gmail line in my transport file for postfix, ran postmap and reloaded postfix.service. Finally I sent a Ping over to "Delta Chat Italian Offtopic Group" where there are 2 people with gmail accounts and everything was fine, no email returned back to sender.

I'll keep going like this until problems!!

Now, if anyone is interested on how my transport file looks like, I'll share 😀

outlook.com smtp:[outbound.mailhop.org]:587
hotmail.com smtp:[outbound.mailhop.org]:587
outlook.fr smtp:[outbound.mailhop.org]:587
hotmail.it smtp:[outbound.mailhop.org]:587
mail.icloud.com smtp:[outbound.mailhop.org]:587
*   :

You need an account on DuoCircle and you need to authenticate yourself (in postfix) for their smtp to accept emails from your server.

wg0.conf

[Interface]
# specify generated private key for server
PrivateKey = <privkey>
# IP address for VPN interface
Address = 172.16.100.1/32
MTU = 1420
# UDP port WireGuard server listens
ListenPort = 51820

# set routing rules like follows to access to local network via VPN session
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o ens3 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o ens3 -j MASQUERADE
# change "ens3" with your interface

[Peer]
# specify public key for client
PublicKey = <pubkey>
# clients' VPN IP addresses you allow to connect
# possible to specify subnet ⇒ [172.16.100.0/24]
AllowedIPs = 172.16.100.6

client.conf

[Interface]
# Private IP Address
Address = 172.16.100.6/32
# Client's Private Key
PrivateKey = <privkey>
# Server's listening port
ListenPort = 51820

[Peer]
# Server's Public Key
PublicKey = <pubkey>
AllowedIPs = 0.0.0.0/0
# Server's IP:port
Endpoint = 51.195.43.203:51820

If you want to scan a QR code on your phone to load the client.conf, do as follows: # apt install qrencode $ qrencode -t utf8 < client.conf

A QR code will appear, scan it.

Thanks to "to_red" for helping me out with the configuration 😉

Using the Maildir mailbox format, emails are stored in under the recipient user’s home folder /home/<username>/Maildir.

# postconf -e 'home_mailbox = Maildir/'

You might also want to add the Maildir setup to the user home directory template so that it is automatically configured when a new user account is created:

# maildirmake.dovecot /etc/skel/Maildir
# maildirmake.dovecot /etc/skel/Maildir/.Drafts
# maildirmake.dovecot /etc/skel/Maildir/.Sent
# maildirmake.dovecot /etc/skel/Maildir/.Trash
# maildirmake.dovecot /etc/skel/Maildir/.Templates

The same Maildir can be added to the current user with the commands below. Replace the $USER with any existing username:

# cp -r /etc/skel/Maildir /home/$USER/
# chown -R $USER:$USER /home/$USER/Maildir
# chmod -R 700 /home/$USER/Maildir
# adduser $USER mail

Also create a “.muttrc” file under /etc/skel and copy paste this content in it:

set mbox_type=Maildir
set folder="~/Maildir"
set mask="!^\\.[^.]"
set mbox="~/Maildir"
set record="+.Sent"
set postponed="+.Drafts"
set spoolfile="~/Maildir"

I'm going to paste my working Monit configuration file for anyone attempting to make it work under Debian

  set daemon  120
  set log /var/log/monit.log
  set idfile /var/lib/monit/id
  set statefile /var/lib/monit/state

set ssl {
     verify     : enable
 }

  SET MAILSERVER
        pandora.woodpeckersnest.space
        PORT 465
        USERNAME <username> PASSWORD <password>
        using SSL

  set eventqueue
     basedir /var/lib/monit/events
     slots 100

  set alert <username>@woodpeckersnest.space not on { instance }

  set httpd port 2812 and
   use address 0.0.0.0
   allow 0.0.0.0/0.0.0.0
   allow admin:<password>
   with ssl {
         pemchain: /etc/monit/fullchain.pem
         pemkey: /etc/monit/privkey.pem
        }

  check system PANDORA
    if cpu usage > 95% for 10 cycles then alert
    if memory usage > 85% then alert
    if swap usage > 50% then alert

  check network ens3 with interface ens3
    if link down then alert
    if changed link then alert
    if saturation > 90% then alert

  check filesystem rootfs with path /
    if space usage > 80% then alert
    if space usage > 85% then alert
    if space usage > 90% then alert
    if space usage > 95% then alert

  check host pandora.spacenest.it with address 94.143.138.27
    if failed ping then alert
    if failed port 22 protocol ssh
    then alert

Then there are files under /etc/monit/conf.d/* and/or /etc/monit/conf-enabled/*. I only have 3:

nginx:

 check process nginx with pidfile /var/run/nginx.pid
   group www-data
   start program = "/etc/init.d/nginx start"
   stop program = "/etc/init.d/nginx stop"

postfix:

 check process postfix with pidfile /var/spool/postfix/pid/master.pid
     start program = "/etc/init.d/postfix start"
     stop  program = "/etc/init.d/postfix stop"
     if failed
        port 25
        protocol smtps
        username "<your_username>"
        password "<your_password>"
     then alert

sshd:

 check process sshd with pidfile /var/run/sshd.pid
   start program  "/etc/init.d/sshd start"
   stop program  "/etc/init.d/sshd stop"
   if failed port 22 protocol ssh then restart

Monit manual is very helpful, you should check it out.

Swap File

1. To create a 2GB swap file we can use "dd" command like this:

# dd if=/dev/zero of=/mnt/swapfile bs=1024 count=2097152

bs=1024 means read and write up to 1024 bytes at a time and count it's the size of the file (1024 x 2048)MB

2. Then set the appropriate permissions on the file; make it readable only by root user:

# chmod 600 /mnt/swapfile

3. Now prepare the file for swap with the mkswap command:

# mkswap /mnt/swapfile

4. Next, enable the swap file

# swapon /mnt/swapfile

5. Afterwards, enable the swap file to be mounted at boot. Edit the /etc/fstab file and add the following new line in it:

/mnt/swapfile swap swap defaults 0 0

You can also disable the swapfile at runtime, any time you want; just make sure it doesn't exceed your available RAM:

# swapoff /mnt/swapfile

Last but not least, this is how to check your swap usage by process:

$ for file in /proc/*/status ; do awk '/VmSwap|Name/{printf $2 " " $3}END{ print ""}' $file; done | sort -k 2 -n -r | less