From lewis at mail.msen.com  Sun Sep  6 02:17:48 2020
From: lewis at mail.msen.com (David T. Lewis)
Date: Sat, 5 Sep 2020 22:17:48 -0400
Subject: [Box-Admins] [squeak-dev] SqueakMap down?
In-Reply-To: <CAMJMOeh8-29Bzm9X13EN_1b+SJbFiJ3Q9NLQ9UKnBs5cZGCPiw@mail.gmail.com>
References: <CAMJMOeh8-29Bzm9X13EN_1b+SJbFiJ3Q9NLQ9UKnBs5cZGCPiw@mail.gmail.com>
Message-ID: <20200906021748.GA59072@shell.msen.com>

Forwarding to the box-admins list.

The web interface for map.squeak.org is not responding, and updating
a SqueakMap Package Loader from Squeak is not working. Presumably the
server needs to be bumped.

I'm not sure who has the keys to this?

Thanks,
Dave


On Sat, Sep 05, 2020 at 03:44:45PM -0400, Phil B wrote:
> It doesn't appear to be responding to requests (gateway time-out)
> 


From leves at caesar.elte.hu  Sun Sep  6 17:03:00 2020
From: leves at caesar.elte.hu (Levente Uzonyi)
Date: Sun, 6 Sep 2020 19:03:00 +0200 (CEST)
Subject: [Box-Admins] [squeak-dev] SqueakMap down?
In-Reply-To: <20200906021748.GA59072@shell.msen.com>
References: <CAMJMOeh8-29Bzm9X13EN_1b+SJbFiJ3Q9NLQ9UKnBs5cZGCPiw@mail.gmail.com>
 <20200906021748.GA59072@shell.msen.com>
Message-ID: <alpine.DEB.2.02.2009061855030.19089@login03.caesar.elte.hu>

Hi All,

(CC'd board as well)

I have restarted the image. It seemed to have been locked up by trying to 
send a password recovery email directly from the server instead of using 
our own mail server[1].
This is bad practice and the IP of the server has been rightfully added to 
some spam blacklists, hence the blocked image (which expects that email 
sending always succeeds...).
Outgoing emails should go through our own mail server. This needs to be 
changed ASAP, as I suppose a few more password reminders will result in a 
locked up image again.


Levente

[1] Relevant parts of the stack trace in case someone wants to have a look 
at the image:

SMUtilities class>>mail:subject:message:
SMUtilities class>>mailPassword:for:
[] in SMSqueakMapView>>mailnewpassword {[username value isEmptyOrNil
ifFalse: [account := model accountForUsername...]}


On Sat, 5 Sep 2020, David T. Lewis wrote:

> Forwarding to the box-admins list.
>
> The web interface for map.squeak.org is not responding, and updating
> a SqueakMap Package Loader from Squeak is not working. Presumably the
> server needs to be bumped.
>
> I'm not sure who has the keys to this?
>
> Thanks,
> Dave
>
>
> On Sat, Sep 05, 2020 at 03:44:45PM -0400, Phil B wrote:
>> It doesn't appear to be responding to requests (gateway time-out)
>>
>
>

From Das.Linux at gmx.de  Sun Sep  6 17:09:47 2020
From: Das.Linux at gmx.de (Tobias Pape)
Date: Sun, 6 Sep 2020 19:09:47 +0200
Subject: [Box-Admins] [squeak-dev] SqueakMap down?
In-Reply-To: <alpine.DEB.2.02.2009061855030.19089@login03.caesar.elte.hu>
References: <CAMJMOeh8-29Bzm9X13EN_1b+SJbFiJ3Q9NLQ9UKnBs5cZGCPiw@mail.gmail.com>
 <20200906021748.GA59072@shell.msen.com>
 <alpine.DEB.2.02.2009061855030.19089@login03.caesar.elte.hu>
Message-ID: <F86CA741-5EAC-4A99-811D-5584CE702519@gmx.de>

Hi

> On 06.09.2020, at 19:03, Levente Uzonyi <leves at caesar.elte.hu> wrote:
> 
> Hi All,
> 
> (CC'd board as well)
> 
> I have restarted the image. It seemed to have been locked up by trying to send a password recovery email directly from the server instead of using our own mail server[1].
> This is bad practice and the IP of the server has been rightfully added to some spam blacklists, hence the blocked image (which expects that email sending always succeeds...).
> Outgoing emails should go through our own mail server. This needs to be changed ASAP, as I suppose a few more password reminders will result in a locked up image again.

Maybe an outgoing iptables filter on port 25 for everything except adele.box alias mail.squeak.org would help avoid accidental blacklisting in the future ?
Best 
	-Tobias

> 
> 
> Levente
> 
> [1] Relevant parts of the stack trace in case someone wants to have a look at the image:
> 
> SMUtilities class>>mail:subject:message:
> SMUtilities class>>mailPassword:for:
> [] in SMSqueakMapView>>mailnewpassword {[username value isEmptyOrNil
> ifFalse: [account := model accountForUsername...]}
> 
> 
> On Sat, 5 Sep 2020, David T. Lewis wrote:
> 
>> Forwarding to the box-admins list.
>> 
>> The web interface for map.squeak.org is not responding, and updating
>> a SqueakMap Package Loader from Squeak is not working. Presumably the
>> server needs to be bumped.
>> 
>> I'm not sure who has the keys to this?
>> 
>> Thanks,
>> Dave
>> 
>> 
>> On Sat, Sep 05, 2020 at 03:44:45PM -0400, Phil B wrote:
>>> It doesn't appear to be responding to requests (gateway time-out)
>>> 
>> 
>> 



From ma.chris.m at gmail.com  Sun Sep  6 18:56:36 2020
From: ma.chris.m at gmail.com (Chris Muller)
Date: Sun, 6 Sep 2020 13:56:36 -0500
Subject: [Box-Admins] [Board]  [squeak-dev] SqueakMap down?
In-Reply-To: <alpine.DEB.2.02.2009061855030.19089@login03.caesar.elte.hu>
References: <CAMJMOeh8-29Bzm9X13EN_1b+SJbFiJ3Q9NLQ9UKnBs5cZGCPiw@mail.gmail.com>
 <20200906021748.GA59072@shell.msen.com>
 <alpine.DEB.2.02.2009061855030.19089@login03.caesar.elte.hu>
Message-ID: <CADTxDUisv1EmWGzQhrafRb_ywqGQA4xNYkT4hEW6rsuEiwr7Qw@mail.gmail.com>

How do we make Squeak use our own email server?  Is it a matter of
simply specifying the correct server name in the correct place?

How do mail servers know that the password request email was sent
directly from Squeak and therefore to block it?  I'm still learning,
thanks.

On Sun, Sep 6, 2020 at 12:03 PM Levente Uzonyi <leves at caesar.elte.hu> wrote:
>
> Hi All,
>
> (CC'd board as well)
>
> I have restarted the image. It seemed to have been locked up by trying to
> send a password recovery email directly from the server instead of using
> our own mail server[1].
> This is bad practice and the IP of the server has been rightfully added to
> some spam blacklists, hence the blocked image (which expects that email
> sending always succeeds...).
> Outgoing emails should go through our own mail server. This needs to be
> changed ASAP, as I suppose a few more password reminders will result in a
> locked up image again.
>
>
> Levente
>
> [1] Relevant parts of the stack trace in case someone wants to have a look
> at the image:
>
> SMUtilities class>>mail:subject:message:
> SMUtilities class>>mailPassword:for:
> [] in SMSqueakMapView>>mailnewpassword {[username value isEmptyOrNil
> ifFalse: [account := model accountForUsername...]}
>
>
> On Sat, 5 Sep 2020, David T. Lewis wrote:
>
> > Forwarding to the box-admins list.
> >
> > The web interface for map.squeak.org is not responding, and updating
> > a SqueakMap Package Loader from Squeak is not working. Presumably the
> > server needs to be bumped.
> >
> > I'm not sure who has the keys to this?
> >
> > Thanks,
> > Dave
> >
> >
> > On Sat, Sep 05, 2020 at 03:44:45PM -0400, Phil B wrote:
> >> It doesn't appear to be responding to requests (gateway time-out)
> >>
> >
> >

From leves at caesar.elte.hu  Sun Sep  6 23:07:26 2020
From: leves at caesar.elte.hu (Levente Uzonyi)
Date: Mon, 7 Sep 2020 01:07:26 +0200 (CEST)
Subject: [Box-Admins] [Board]  [squeak-dev] SqueakMap down?
In-Reply-To: <CADTxDUisv1EmWGzQhrafRb_ywqGQA4xNYkT4hEW6rsuEiwr7Qw@mail.gmail.com>
References: <CAMJMOeh8-29Bzm9X13EN_1b+SJbFiJ3Q9NLQ9UKnBs5cZGCPiw@mail.gmail.com>
 <20200906021748.GA59072@shell.msen.com>
 <alpine.DEB.2.02.2009061855030.19089@login03.caesar.elte.hu>
 <CADTxDUisv1EmWGzQhrafRb_ywqGQA4xNYkT4hEW6rsuEiwr7Qw@mail.gmail.com>
Message-ID: <alpine.DEB.2.02.2009062359340.19089@login03.caesar.elte.hu>

On Sun, 6 Sep 2020, Chris Muller wrote:

> How do we make Squeak use our own email server?  Is it a matter of
> simply specifying the correct server name in the correct place?

When you send an email with SMTPClient, you have to specify a server - aka 
a relay - you want to use to deliver emails. 
I just downloaded the SqueakMap image and it's using localhost as the mail 
server. Localhost has a mail server set up, but it's probably not 
configured properly to forward emails to mail.squeak.org.
Probably the best would be if SqueakMap sent mails directly to 
mail.squeak.org.

I don't know who installed exim on that machine and why, but it was very 
likely a mistake and unless there is an explanation for it (nothing in the 
admin log), I'll remove it soon.

>
> How do mail servers know that the password request email was sent
> directly from Squeak and therefore to block it?  I'm still learning,
> thanks.

That's quite complicated. When you connect to an SMTP server, the first 
command is EHLO (or HELO), in which you claim your domain name. That is 
the first thing the server will verify (along with your IP address) based 
on information available in DNS.
If you try to send an email from the SqueakMap server directly, you'll 
fail right at this point, because that server is not a legit source of
@squeak.org emails according to the DNS records.


Levente

>
> On Sun, Sep 6, 2020 at 12:03 PM Levente Uzonyi <leves at caesar.elte.hu> wrote:
>>
>> Hi All,
>>
>> (CC'd board as well)
>>
>> I have restarted the image. It seemed to have been locked up by trying to
>> send a password recovery email directly from the server instead of using
>> our own mail server[1].
>> This is bad practice and the IP of the server has been rightfully added to
>> some spam blacklists, hence the blocked image (which expects that email
>> sending always succeeds...).
>> Outgoing emails should go through our own mail server. This needs to be
>> changed ASAP, as I suppose a few more password reminders will result in a
>> locked up image again.
>>
>>
>> Levente
>>
>> [1] Relevant parts of the stack trace in case someone wants to have a look
>> at the image:
>>
>> SMUtilities class>>mail:subject:message:
>> SMUtilities class>>mailPassword:for:
>> [] in SMSqueakMapView>>mailnewpassword {[username value isEmptyOrNil
>> ifFalse: [account := model accountForUsername...]}
>>
>>
>> On Sat, 5 Sep 2020, David T. Lewis wrote:
>>
>>> Forwarding to the box-admins list.
>>>
>>> The web interface for map.squeak.org is not responding, and updating
>>> a SqueakMap Package Loader from Squeak is not working. Presumably the
>>> server needs to be bumped.
>>>
>>> I'm not sure who has the keys to this?
>>>
>>> Thanks,
>>> Dave
>>>
>>>
>>> On Sat, Sep 05, 2020 at 03:44:45PM -0400, Phil B wrote:
>>>> It doesn't appear to be responding to requests (gateway time-out)
>>>>
>>>
>>>
>

From leves at caesar.elte.hu  Sun Sep  6 23:32:08 2020
From: leves at caesar.elte.hu (Levente Uzonyi)
Date: Mon, 7 Sep 2020 01:32:08 +0200 (CEST)
Subject: [Box-Admins] [squeak-dev] SqueakMap down?
In-Reply-To: <F86CA741-5EAC-4A99-811D-5584CE702519@gmx.de>
References: <CAMJMOeh8-29Bzm9X13EN_1b+SJbFiJ3Q9NLQ9UKnBs5cZGCPiw@mail.gmail.com>
 <20200906021748.GA59072@shell.msen.com>
 <alpine.DEB.2.02.2009061855030.19089@login03.caesar.elte.hu>
 <F86CA741-5EAC-4A99-811D-5584CE702519@gmx.de>
Message-ID: <alpine.DEB.2.02.2009070107310.19089@login03.caesar.elte.hu>

Hi Tobias,

On Sun, 6 Sep 2020, Tobias Pape wrote:

> Hi
>
>> On 06.09.2020, at 19:03, Levente Uzonyi <leves at caesar.elte.hu> wrote:
>>
>> Hi All,
>>
>> (CC'd board as well)
>>
>> I have restarted the image. It seemed to have been locked up by trying to send a password recovery email directly from the server instead of using our own mail server[1].
>> This is bad practice and the IP of the server has been rightfully added to some spam blacklists, hence the blocked image (which expects that email sending always succeeds...).
>> Outgoing emails should go through our own mail server. This needs to be changed ASAP, as I suppose a few more password reminders will result in a locked up image again.
>
> Maybe an outgoing iptables filter on port 25 for everything except adele.box alias mail.squeak.org would help avoid accidental blacklisting in the future ?

Indeed. I've just set that up. But, I think it won't solve the problem.
SqueakMap connects to the local mail server which (as I understand) 
forwards all emails to mail.squeak.org - aka adele.
ted is not whitelisted on mail.squeak.org, so all emails are rejected by 
adele due to ted's IP being blacklisted on zen.spamhaus.org.
ted's IP is blacklisted due to policy, so that can't be changed:
https://www.spamhaus.org/pbl/query/PBL1660625

So, I think the solution is to either whitelist ted on adele, or make 
SqueakMap connect to adele directly. The latter won't solve the issue with 
other emails, like logwatch.

If other servers also have their own local relays, then more images 
sending emails will run into this issue.


Levente

> Best
> 	-Tobias
>
>>
>>
>> Levente
>>
>> [1] Relevant parts of the stack trace in case someone wants to have a look at the image:
>>
>> SMUtilities class>>mail:subject:message:
>> SMUtilities class>>mailPassword:for:
>> [] in SMSqueakMapView>>mailnewpassword {[username value isEmptyOrNil
>> ifFalse: [account := model accountForUsername...]}
>>
>>
>> On Sat, 5 Sep 2020, David T. Lewis wrote:
>>
>>> Forwarding to the box-admins list.
>>>
>>> The web interface for map.squeak.org is not responding, and updating
>>> a SqueakMap Package Loader from Squeak is not working. Presumably the
>>> server needs to be bumped.
>>>
>>> I'm not sure who has the keys to this?
>>>
>>> Thanks,
>>> Dave
>>>
>>>
>>> On Sat, Sep 05, 2020 at 03:44:45PM -0400, Phil B wrote:
>>>> It doesn't appear to be responding to requests (gateway time-out)
>>>>
>>>
>>>
>
>
>

From Das.Linux at gmx.de  Mon Sep  7 05:21:59 2020
From: Das.Linux at gmx.de (Tobias Pape)
Date: Mon, 7 Sep 2020 07:21:59 +0200
Subject: [Box-Admins] [squeak-dev] SqueakMap down?
In-Reply-To: <alpine.DEB.2.02.2009070107310.19089@login03.caesar.elte.hu>
References: <CAMJMOeh8-29Bzm9X13EN_1b+SJbFiJ3Q9NLQ9UKnBs5cZGCPiw@mail.gmail.com>
 <20200906021748.GA59072@shell.msen.com>
 <alpine.DEB.2.02.2009061855030.19089@login03.caesar.elte.hu>
 <F86CA741-5EAC-4A99-811D-5584CE702519@gmx.de>
 <alpine.DEB.2.02.2009070107310.19089@login03.caesar.elte.hu>
Message-ID: <0A3C55A5-BD59-4145-B595-26CD82067DDC@gmx.de>


> On 07.09.2020, at 01:32, Levente Uzonyi <leves at caesar.elte.hu> wrote:
> 
> Hi Tobias,
> 
> On Sun, 6 Sep 2020, Tobias Pape wrote:
> 
>> Hi
>> 
>>> On 06.09.2020, at 19:03, Levente Uzonyi <leves at caesar.elte.hu> wrote:
>>> 
>>> Hi All,
>>> 
>>> (CC'd board as well)
>>> 
>>> I have restarted the image. It seemed to have been locked up by trying to send a password recovery email directly from the server instead of using our own mail server[1].
>>> This is bad practice and the IP of the server has been rightfully added to some spam blacklists, hence the blocked image (which expects that email sending always succeeds...).
>>> Outgoing emails should go through our own mail server. This needs to be changed ASAP, as I suppose a few more password reminders will result in a locked up image again.
>> 
>> Maybe an outgoing iptables filter on port 25 for everything except adele.box alias mail.squeak.org would help avoid accidental blacklisting in the future ?
> 
> Indeed. I've just set that up. But, I think it won't solve the problem.
> SqueakMap connects to the local mail server which (as I understand) forwards all emails to mail.squeak.org - aka adele.
> ted is not whitelisted on mail.squeak.org, so all emails are rejected by adele due to ted's IP being blacklisted on zen.spamhaus.org.
> ted's IP is blacklisted due to policy, so that can't be changed:
> https://www.spamhaus.org/pbl/query/PBL1660625
> 
> So, I think the solution is to either whitelist ted on adele, or make SqueakMap connect to adele directly. The latter won't solve the issue with other emails, like logwatch.

Ted is whitelisted, as are all our servers, as long as they  use the private IP (starting with 10.) as originating IP:

adele% cat /etc/postfix/main.cf
…
mynetworks = 127.0.0.0/8 10.177.128.0/17 10.208.128.0/17 162.242.237.143/32
…

ted% ip a
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    inet 162.242.226.14/24 brd 162.242.226.255 scope global eth0
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    inet 10.176.130.111/19 brd 10.176.159.255 scope global eth1
…


In any case, the servers I set up, I _think_ I preferred postfix; however, I always put adele as relay. That als should fix it…

Best regards
	-Tobias

> 
> If other servers also have their own local relays, then more images sending emails will run into this issue.
> 
> 
> Levente
> 
>> Best
>> 	-Tobias
>> 
>>> 
>>> 
>>> Levente
>>> 
>>> [1] Relevant parts of the stack trace in case someone wants to have a look at the image:
>>> 
>>> SMUtilities class>>mail:subject:message:
>>> SMUtilities class>>mailPassword:for:
>>> [] in SMSqueakMapView>>mailnewpassword {[username value isEmptyOrNil
>>> ifFalse: [account := model accountForUsername...]}
>>> 
>>> 
>>> On Sat, 5 Sep 2020, David T. Lewis wrote:
>>> 
>>>> Forwarding to the box-admins list.
>>>> 
>>>> The web interface for map.squeak.org is not responding, and updating
>>>> a SqueakMap Package Loader from Squeak is not working. Presumably the
>>>> server needs to be bumped.
>>>> 
>>>> I'm not sure who has the keys to this?
>>>> 
>>>> Thanks,
>>>> Dave
>>>> 
>>>> 
>>>> On Sat, Sep 05, 2020 at 03:44:45PM -0400, Phil B wrote:
>>>>> It doesn't appear to be responding to requests (gateway time-out)



From leves at caesar.elte.hu  Mon Sep  7 15:15:54 2020
From: leves at caesar.elte.hu (Levente Uzonyi)
Date: Mon, 7 Sep 2020 17:15:54 +0200 (CEST)
Subject: [Box-Admins] [squeak-dev] SqueakMap down?
In-Reply-To: <0A3C55A5-BD59-4145-B595-26CD82067DDC@gmx.de>
References: <CAMJMOeh8-29Bzm9X13EN_1b+SJbFiJ3Q9NLQ9UKnBs5cZGCPiw@mail.gmail.com>
 <20200906021748.GA59072@shell.msen.com>
 <alpine.DEB.2.02.2009061855030.19089@login03.caesar.elte.hu>
 <F86CA741-5EAC-4A99-811D-5584CE702519@gmx.de>
 <alpine.DEB.2.02.2009070107310.19089@login03.caesar.elte.hu>
 <0A3C55A5-BD59-4145-B595-26CD82067DDC@gmx.de>
Message-ID: <alpine.DEB.2.02.2009071708370.12389@login03.caesar.elte.hu>

Hi Tobias,

On Mon, 7 Sep 2020, Tobias Pape wrote:

>
>> On 07.09.2020, at 01:32, Levente Uzonyi <leves at caesar.elte.hu> wrote:
>>
>> Hi Tobias,
>>
>> On Sun, 6 Sep 2020, Tobias Pape wrote:
>>
>>> Hi
>>>
>>>> On 06.09.2020, at 19:03, Levente Uzonyi <leves at caesar.elte.hu> wrote:
>>>>
>>>> Hi All,
>>>>
>>>> (CC'd board as well)
>>>>
>>>> I have restarted the image. It seemed to have been locked up by trying to send a password recovery email directly from the server instead of using our own mail server[1].
>>>> This is bad practice and the IP of the server has been rightfully added to some spam blacklists, hence the blocked image (which expects that email sending always succeeds...).
>>>> Outgoing emails should go through our own mail server. This needs to be changed ASAP, as I suppose a few more password reminders will result in a locked up image again.
>>>
>>> Maybe an outgoing iptables filter on port 25 for everything except adele.box alias mail.squeak.org would help avoid accidental blacklisting in the future ?
>>
>> Indeed. I've just set that up. But, I think it won't solve the problem.
>> SqueakMap connects to the local mail server which (as I understand) forwards all emails to mail.squeak.org - aka adele.
>> ted is not whitelisted on mail.squeak.org, so all emails are rejected by adele due to ted's IP being blacklisted on zen.spamhaus.org.
>> ted's IP is blacklisted due to policy, so that can't be changed:
>> https://www.spamhaus.org/pbl/query/PBL1660625
>>
>> So, I think the solution is to either whitelist ted on adele, or make SqueakMap connect to adele directly. The latter won't solve the issue with other emails, like logwatch.
>
> Ted is whitelisted, as are all our servers, as long as they  use the private IP (starting with 10.) as originating IP:
>
> adele% cat /etc/postfix/main.cf
> …
> mynetworks = 127.0.0.0/8 10.177.128.0/17 10.208.128.0/17 162.242.237.143/32

ted is not among those prefixes, as its IP address begins with 10.176.
Where are these ranges coming from?
Should I add ted there?

> …
>
> ted% ip a
> 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
>    inet 162.242.226.14/24 brd 162.242.226.255 scope global eth0
> 3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
>    inet 10.176.130.111/19 brd 10.176.159.255 scope global eth1
> …
>
>
> In any case, the servers I set up, I _think_ I preferred postfix; however, I always put adele as relay. That als should fix it…

adele's firewall rules didn't allow connections to port 25 from 
10.0.0.0/8. I just enabled that.

Also, ted is trying to connect the public IP of adele (via 
mail.squeak.org). Unless there's some routing magic in place right now 
redirecting packets to the internal network, ted will not be whitelisted 
on adele.
That can be changed, but then ted is still not whitelisted because of 
mynetworks.


Levente

>
> Best regards
> 	-Tobias
>
>>
>> If other servers also have their own local relays, then more images sending emails will run into this issue.
>>
>>
>> Levente
>>
>>> Best
>>> 	-Tobias
>>>
>>>>
>>>>
>>>> Levente
>>>>
>>>> [1] Relevant parts of the stack trace in case someone wants to have a look at the image:
>>>>
>>>> SMUtilities class>>mail:subject:message:
>>>> SMUtilities class>>mailPassword:for:
>>>> [] in SMSqueakMapView>>mailnewpassword {[username value isEmptyOrNil
>>>> ifFalse: [account := model accountForUsername...]}
>>>>
>>>>
>>>> On Sat, 5 Sep 2020, David T. Lewis wrote:
>>>>
>>>>> Forwarding to the box-admins list.
>>>>>
>>>>> The web interface for map.squeak.org is not responding, and updating
>>>>> a SqueakMap Package Loader from Squeak is not working. Presumably the
>>>>> server needs to be bumped.
>>>>>
>>>>> I'm not sure who has the keys to this?
>>>>>
>>>>> Thanks,
>>>>> Dave
>>>>>
>>>>>
>>>>> On Sat, Sep 05, 2020 at 03:44:45PM -0400, Phil B wrote:
>>>>>> It doesn't appear to be responding to requests (gateway time-out)
>
>
>

From leves at caesar.elte.hu  Mon Sep  7 16:53:37 2020
From: leves at caesar.elte.hu (Levente Uzonyi)
Date: Mon, 7 Sep 2020 18:53:37 +0200 (CEST)
Subject: [Box-Admins] [squeak-dev] SqueakMap down?
In-Reply-To: <alpine.DEB.2.02.2009071708370.12389@login03.caesar.elte.hu>
References: <CAMJMOeh8-29Bzm9X13EN_1b+SJbFiJ3Q9NLQ9UKnBs5cZGCPiw@mail.gmail.com>
 <20200906021748.GA59072@shell.msen.com>
 <alpine.DEB.2.02.2009061855030.19089@login03.caesar.elte.hu>
 <F86CA741-5EAC-4A99-811D-5584CE702519@gmx.de>
 <alpine.DEB.2.02.2009070107310.19089@login03.caesar.elte.hu>
 <0A3C55A5-BD59-4145-B595-26CD82067DDC@gmx.de>
 <alpine.DEB.2.02.2009071708370.12389@login03.caesar.elte.hu>
Message-ID: <alpine.DEB.2.02.2009071852070.12389@login03.caesar.elte.hu>

Hi All,

I've added ted to mynetworks. Mails from ted, including those from 
SqueakMap should now delivered properly.

Levente

On Mon, 7 Sep 2020, Levente Uzonyi wrote:

> Hi Tobias,
>
> On Mon, 7 Sep 2020, Tobias Pape wrote:
>
>> 
>>> On 07.09.2020, at 01:32, Levente Uzonyi <leves at caesar.elte.hu> wrote:
>>> 
>>> Hi Tobias,
>>> 
>>> On Sun, 6 Sep 2020, Tobias Pape wrote:
>>> 
>>>> Hi
>>>> 
>>>>> On 06.09.2020, at 19:03, Levente Uzonyi <leves at caesar.elte.hu> wrote:
>>>>> 
>>>>> Hi All,
>>>>> 
>>>>> (CC'd board as well)
>>>>> 
>>>>> I have restarted the image. It seemed to have been locked up by trying 
>>>>> to send a password recovery email directly from the server instead of 
>>>>> using our own mail server[1].
>>>>> This is bad practice and the IP of the server has been rightfully added 
>>>>> to some spam blacklists, hence the blocked image (which expects that 
>>>>> email sending always succeeds...).
>>>>> Outgoing emails should go through our own mail server. This needs to be 
>>>>> changed ASAP, as I suppose a few more password reminders will result in 
>>>>> a locked up image again.
>>>> 
>>>> Maybe an outgoing iptables filter on port 25 for everything except 
>>>> adele.box alias mail.squeak.org would help avoid accidental blacklisting 
>>>> in the future ?
>>> 
>>> Indeed. I've just set that up. But, I think it won't solve the problem.
>>> SqueakMap connects to the local mail server which (as I understand) 
>>> forwards all emails to mail.squeak.org - aka adele.
>>> ted is not whitelisted on mail.squeak.org, so all emails are rejected by 
>>> adele due to ted's IP being blacklisted on zen.spamhaus.org.
>>> ted's IP is blacklisted due to policy, so that can't be changed:
>>> https://www.spamhaus.org/pbl/query/PBL1660625
>>> 
>>> So, I think the solution is to either whitelist ted on adele, or make 
>>> SqueakMap connect to adele directly. The latter won't solve the issue with 
>>> other emails, like logwatch.
>> 
>> Ted is whitelisted, as are all our servers, as long as they  use the 
>> private IP (starting with 10.) as originating IP:
>> 
>> adele% cat /etc/postfix/main.cf
>> …
>> mynetworks = 127.0.0.0/8 10.177.128.0/17 10.208.128.0/17 162.242.237.143/32
>
> ted is not among those prefixes, as its IP address begins with 10.176.
> Where are these ranges coming from?
> Should I add ted there?
>
>> …
>> 
>> ted% ip a
>> 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state 
>> UP group default qlen 1000
>>    inet 162.242.226.14/24 brd 162.242.226.255 scope global eth0
>> 3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state 
>> UP group default qlen 1000
>>    inet 10.176.130.111/19 brd 10.176.159.255 scope global eth1
>> …
>> 
>> 
>> In any case, the servers I set up, I _think_ I preferred postfix; however, 
>> I always put adele as relay. That als should fix it…
>
> adele's firewall rules didn't allow connections to port 25 from 10.0.0.0/8. I 
> just enabled that.
>
> Also, ted is trying to connect the public IP of adele (via mail.squeak.org). 
> Unless there's some routing magic in place right now redirecting packets to 
> the internal network, ted will not be whitelisted on adele.
> That can be changed, but then ted is still not whitelisted because of 
> mynetworks.
>
>
> Levente
>
>> 
>> Best regards
>> 	-Tobias
>> 
>>> 
>>> If other servers also have their own local relays, then more images 
>>> sending emails will run into this issue.
>>> 
>>> 
>>> Levente
>>> 
>>>> Best
>>>> 	-Tobias
>>>> 
>>>>> 
>>>>> 
>>>>> Levente
>>>>> 
>>>>> [1] Relevant parts of the stack trace in case someone wants to have a 
>>>>> look at the image:
>>>>> 
>>>>> SMUtilities class>>mail:subject:message:
>>>>> SMUtilities class>>mailPassword:for:
>>>>> [] in SMSqueakMapView>>mailnewpassword {[username value isEmptyOrNil
>>>>> ifFalse: [account := model accountForUsername...]}
>>>>> 
>>>>> 
>>>>> On Sat, 5 Sep 2020, David T. Lewis wrote:
>>>>> 
>>>>>> Forwarding to the box-admins list.
>>>>>> 
>>>>>> The web interface for map.squeak.org is not responding, and updating
>>>>>> a SqueakMap Package Loader from Squeak is not working. Presumably the
>>>>>> server needs to be bumped.
>>>>>> 
>>>>>> I'm not sure who has the keys to this?
>>>>>> 
>>>>>> Thanks,
>>>>>> Dave
>>>>>> 
>>>>>> 
>>>>>> On Sat, Sep 05, 2020 at 03:44:45PM -0400, Phil B wrote:
>>>>>>> It doesn't appear to be responding to requests (gateway time-out)
>> 
>> 
>

From lewis at mail.msen.com  Wed Sep 23 15:09:46 2020
From: lewis at mail.msen.com (David T. Lewis)
Date: Wed, 23 Sep 2020 11:09:46 -0400
Subject: [Box-Admins] FYI - unusual unsubscribe activity from vm-dev
Message-ID: <20200923150946.GA64273@shell.msen.com>

Nothing this for information in case there may be a problem.

Today I received 18 unsubscribe notifications from vm-dev with the
following time stamps in my inbox:

	Date: Wed, 23 Sep 2020 09:42:54 +0000
	Date: Wed, 23 Sep 2020 09:34:44 +0000
	Date: Wed, 23 Sep 2020 09:35:30 +0000
	Date: Wed, 23 Sep 2020 09:36:51 +0000
	Date: Wed, 23 Sep 2020 09:43:57 +0000
	Date: Wed, 23 Sep 2020 09:46:06 +0000
	Date: Wed, 23 Sep 2020 09:47:40 +0000
	Date: Wed, 23 Sep 2020 09:41:19 +0000
	Date: Wed, 23 Sep 2020 09:41:50 +0000
	Date: Wed, 23 Sep 2020 09:40:11 +0000
	Date: Wed, 23 Sep 2020 09:31:55 +0000
	Date: Wed, 23 Sep 2020 09:48:30 +0000
	Date: Wed, 23 Sep 2020 09:48:57 +0000
	Date: Wed, 23 Sep 2020 09:49:25 +0000
	Date: Wed, 23 Sep 2020 09:49:56 +0000
	Date: Wed, 23 Sep 2020 09:50:20 +0000
	Date: Wed, 23 Sep 2020 09:51:23 +0000
	Date: Wed, 23 Sep 2020 10:07:09 +0000

This would have to have come from an automated process, so I am
mentioning it here in case it might be some new bot attack that
I have not seen before.

I occasionally do see new subscriptions that presumably come from
unfriendly activity, for example a recent subscription to vm-dev
was from americafirst at myloaninsurance.com. I set that one to
moderated and nomail, and have not seen any further activity from
it. But it's pretty clear that the attack bots know how to subscribe
to mailing lists these days, and I don't know what else they might
be up to.

FYI,
Dave


From leves at caesar.elte.hu  Wed Sep 23 16:16:50 2020
From: leves at caesar.elte.hu (Levente Uzonyi)
Date: Wed, 23 Sep 2020 18:16:50 +0200 (CEST)
Subject: [Box-Admins] [Board] FYI - unusual unsubscribe activity from
	vm-dev
In-Reply-To: <20200923150946.GA64273@shell.msen.com>
References: <20200923150946.GA64273@shell.msen.com>
Message-ID: <alpine.DEB.2.02.2009231801150.30293@login03.caesar.elte.hu>

Hi Dave,

On Wed, 23 Sep 2020, David T. Lewis wrote:

> Nothing this for information in case there may be a problem.
>
> Today I received 18 unsubscribe notifications from vm-dev with the
> following time stamps in my inbox:
>
> 	Date: Wed, 23 Sep 2020 09:42:54 +0000
> 	Date: Wed, 23 Sep 2020 09:34:44 +0000
> 	Date: Wed, 23 Sep 2020 09:35:30 +0000
> 	Date: Wed, 23 Sep 2020 09:36:51 +0000
> 	Date: Wed, 23 Sep 2020 09:43:57 +0000
> 	Date: Wed, 23 Sep 2020 09:46:06 +0000
> 	Date: Wed, 23 Sep 2020 09:47:40 +0000
> 	Date: Wed, 23 Sep 2020 09:41:19 +0000
> 	Date: Wed, 23 Sep 2020 09:41:50 +0000
> 	Date: Wed, 23 Sep 2020 09:40:11 +0000
> 	Date: Wed, 23 Sep 2020 09:31:55 +0000
> 	Date: Wed, 23 Sep 2020 09:48:30 +0000
> 	Date: Wed, 23 Sep 2020 09:48:57 +0000
> 	Date: Wed, 23 Sep 2020 09:49:25 +0000
> 	Date: Wed, 23 Sep 2020 09:49:56 +0000
> 	Date: Wed, 23 Sep 2020 09:50:20 +0000
> 	Date: Wed, 23 Sep 2020 09:51:23 +0000
> 	Date: Wed, 23 Sep 2020 10:07:09 +0000
>
> This would have to have come from an automated process, so I am
> mentioning it here in case it might be some new bot attack that
> I have not seen before.

That was me. I removed addresses which do not exist anymore according to 
their mail servers to minimize bounces.
I didn't expect you to get notifications as I supressed them to avoid 
generating more bounced emails.


Levente

>
> I occasionally do see new subscriptions that presumably come from
> unfriendly activity, for example a recent subscription to vm-dev
> was from americafirst at myloaninsurance.com. I set that one to
> moderated and nomail, and have not seen any further activity from
> it. But it's pretty clear that the attack bots know how to subscribe
> to mailing lists these days, and I don't know what else they might
> be up to.
>
> FYI,
> Dave
>
>

From lewis at mail.msen.com  Wed Sep 23 16:39:04 2020
From: lewis at mail.msen.com (David T. Lewis)
Date: Wed, 23 Sep 2020 12:39:04 -0400
Subject: [Box-Admins] [Board] FYI - unusual unsubscribe activity from
	vm-dev
In-Reply-To: <alpine.DEB.2.02.2009231801150.30293@login03.caesar.elte.hu>
References: <20200923150946.GA64273@shell.msen.com>
 <alpine.DEB.2.02.2009231801150.30293@login03.caesar.elte.hu>
Message-ID: <20200923163904.GA77906@shell.msen.com>

Hi Levente,

On Wed, Sep 23, 2020 at 06:16:50PM +0200, Levente Uzonyi wrote:
> Hi Dave,
> 
> On Wed, 23 Sep 2020, David T. Lewis wrote:
> >
> >Today I received 18 unsubscribe notifications from vm-dev with the
> >following time stamps in my inbox:
> >

> 
> That was me. I removed addresses which do not exist anymore according to 
> their mail servers to minimize bounces.
> I didn't expect you to get notifications as I supressed them to avoid 
> generating more bounced emails.
>

Oh good, thank you very much. 

Sorry for the alarm, these robot hackers make me nervous nowadays.

Dave