Re: [Openvpn-users] TLS key negotiation failed to occur ISP screws up the VPN

? Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature ___ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-users

Re: Uppercase username emails are rejected

oe etc. etc.. They rarely object to plussed user addresses or single-person-owned domains that could have a catchall configured, though ... (I *should* have tried a user part with "ß" on an upcaseing online service back when that umlaut officially *didn't have* an uppercase version ...

Re: [Openvpn-users] PC connects to the server but not Android

might want to try reducing the MTU configured in your client. Other than that, do you see any packets of a connection *attempt* arrive on the server, or corresponding log entries? Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature

Re: [Openvpn-users] [ext] Re: DNS Round-robin-records vs. "Preserving recently used remote address"

stro, and Other Parameters May Vary" Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature ___ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net https://lists.sourceforge.net/li

Re: [Openvpn-users] DNS Round-robin-records vs. "Preserving recently used remote address"

oblem. ... as long as the VPNs are running in UDP mode, and the server goes through an *orderly* shutdown ... Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature ___ Openvpn-users mailin

Re: [EXT] Re: How to get a memory pointer in the core process

having a plugin run amok and cause the master dovecot process to abort due to OOM sounds like creating an even worse problem, frankly ... Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature ___

Re: Bug/Warning not sure which

would choose to fail the POP requests? Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature ___ dovecot mailing list -- dovecot@dovecot.org To unsubscribe send an email to dovecot-le...@dovecot.org

Re: [Openvpn-users] Client history

pn/scripts(/.*)? system_u:object_r:openvpn_unconfined_script_exec_t:s0 Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature ___ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net https://lists.sourceforge.net/list

Re: [Openvpn-users] Increase data transmission

their VPNs. (Also, the capabilities of nation-level censors vary with the nation in question, and you have never mentioned - maybe for good reason - *which* nation we're talking about ...) Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic

Re: [Openvpn-users] Increase data transmission

rt of file upload service would probably fit the bill best. You still shouldn't upload the same file over and over, or in regular intervals, though, if you want to fool the national censors. Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic

Re: [Openvpn-users] Client history

a problem in that OpenVPN doesn't try to write to the log in the first place.) Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature ___ Openvpn-users mailing list Openvpn-users@lists.sourc

Re: [Openvpn-users] OpenVPN and ChaCha20-Poly1305 encryption

as in more resistant to cryptanalysis ... no idea. People around me tend to value the recommendations of the BSI more than my CYA-fu and cipherpunkness, anyway. Try https://www.schneier.com/ for a second opinion. Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description:

Re: [Openvpn-users] OpenVPN and ChaCha20-Poly1305 encryption

to the point, OpenSSL 3.0.9.) Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature ___ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo

Re: [Openvpn-users] How to hide the number of connections to the server?

give them *exact* names including the number in the OpenVPN configs) on the server, enable forwarding there as well, and finally, either MASQUERADE on the server or push a proper set of routes to the VPN clients. Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description

Re: [Openvpn-users] How to hide the number of connections to the server?

On 08.02.24 19:04, Peter Davis wrote: On Thursday, February 8th, 2024 at 3:45 PM, Jochen Bern wrote: On 08.02.24 11:36, Peter Davis via Openvpn-users wrote: Can an intermediate server do this? Instead of connecting directly to the final server, people connect to an intermediate server

Re: [Openvpn-users] How to hide the number of connections to the server?

, and ideally many more servers) does ... ? Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature ___ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net https://lists.sourceforge.net

Re: [Openvpn-users] A few questions about revoking keys

oo. What's the rationale to limit a CRL installed *there* to a lifetime of one week, if that's a burden to ops? Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature ___ Openvpn-users mailing li

Re: [Openvpn-users] Can a configuration item be cleared in the server.conf file

$ locale -a | wc -l 873 Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature ___ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-users

Re: [Openvpn-users] OpenVPN on port 443

On 27.01.24 19:27, Peter Davis wrote: On Thursday, January 25th, 2024 at 1:25 AM, Jochen Bern wrote: Also, don't forget to configure the VPN server with --port-share, in case one of the nation-level censors you're trying to fool gets the idea of looking at your "interesting website&quo

Re: [Openvpn-users] Can a configuration item be cleared in the server.conf file

*.rpmnew file when the update finds the current version manually changed.) Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature ___ Openvpn-users mailing list Openvpn-use

Re: [Openvpn-users] Two questions about key generation for clients

ink I've *once* seen a case where it was necessary to use "sudo -s" instead. Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature ___ Openvpn-users mailing list Openvpn-users@lists.

Re: [Openvpn-users] OpenVPN on port 443

--port-share, in case one of the nation-level censors you're trying to fool gets the idea of looking at your "interesting website" himself ... Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature _

Re: [Openvpn-users] OpenVPN on port 443

te servers while they're deep-diving might well be the *idea*. :-3 Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature ___ Openvpn-users mailing list Openvpn-users@lists.sourceforge

Re: [Openvpn-users] iptables rules required for OpenVPN and Tor

On 22.01.24 12:01, Peter Davis wrote: On Monday, January 22nd, 2024 at 10:41 AM, Jochen Bern wrote: On 20.01.24 07:24, Peter Davis wrote: When someone connects to this server with OpenVPN and uses the Internet, then all his\her Internet connections are tunneled through Tor. I want to know

Re: [Openvpn-users] Can a configuration item be cleared in the server.conf file

way of having the logs collected, across servers, in a central (tamper proof) location. Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature ___ Openvpn-users mailing list Openvpn-users@l

Re: [Openvpn-users] iptables rules required for OpenVPN and Tor

On 20.01.24 07:24, Peter Davis wrote: On Friday, January 19th, 2024 at 5:04 PM, Jochen Bern wrote: On 19.01.24 13:59, Peter Davis via Openvpn-users wrote: I want to tunnel OpenVPN on Tor and I found the following iptables rules: # export OVPN=tun0 # IPTABLES -A INPUT -i $OVPN -s 10.8.0.0/24

Re: [Openvpn-users] iptables rules required for OpenVPN and Tor

normal VPN clients try to send through the server. Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature ___ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net https://lists.sourcefo

Re: [Openvpn-users] Limit the number of users based on the key

*do* need separate cert+privkey pairs for every *device* connecting to the VPN. Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature ___ Openvpn-users mailing list Openvpn-users

Re: [Openvpn-users] Limit the number of users based on the key

Not Want To Do That™. (Disclaimer: Talking about "key"s as in "client privkey+cert" here. Per-department *secrets* for HMAC auth are a different beast.) Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cry

Re: [Openvpn-users] I have a question about Easy-RSA

a command/procedure to create a CA cert that way. Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature ___ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net https://lists.sourceforge.net

Re: [Openvpn-users] I have a question about Easy-RSA

nfirmed by the issuer, but it seems that your national authorities ceased to exist". Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature ___ Openvpn-users mailing list O

Re: [Openvpn-users] I have a question about Easy-RSA

On 08.01.24 07:19, Peter Davis wrote: On Sunday, January 7th, 2024 at 10:52 PM, Jochen Bern wrote: On 07.01.24 06:50, Peter Davis via Openvpn-users wrote: Now if I ignore the warning message above, what is the risk? Then you'll lose the content of those files that only the CA needs

Re: [Openvpn-users] I have a question about Easy-RSA

haddya mean we have no process for that!?" happen. ¹ https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act ² i.e., the leaf cert will turn inoperational when the *CA* cert expires, *not* on the (later) day the leaf cert's n

Re: [Openvpn-users] I have a question about Easy-RSA

, you'll be unable to have a new one created by the same CA, thus requiring a config change on *every* client - wherever and in whosever hands it is - before it'll be able to connect to the VPN again. Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME

Re: [Openvpn-users] OpenVPN and outside clients

will be located, ... Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature ___ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn

Re: [Openvpn-users] Reference manual for OpenVPN 2.6 PDF

) in them. Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature ___ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-users

Re: [Openvpn-users] Reference manual for OpenVPN 2.6 PDF

/wiki/Paper_size#/media/File:A_size_illustration2_with_letter_and_legal.svg There are printers that outright *refuse* to print out a PDF stating a sheet size different from the paper actually sitting in the tray, etc.. Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s

Re: Geofencing

on them? ;-) Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature ___ dovecot mailing list -- dovecot@dovecot.org To unsubscribe send an email to dovecot-le...@dovecot.org

Geofencing (was: Anyone Watching Actvity from this network? ...)

e no info for an IP you look up, or some that's plain wrong. And *then* there are things like Anycast or BGP hijacking or VPN services to obscure one's origin or ... Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature ___

Re: [Openvpn-users] How to solve the TLS key negotiation failed error?

w to solve it? So the client tries to encrypt the control channel packets, on top of the HMAC auth, but the server doesn't do any extra (en- or) decryption, I'd guess ... Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic

Re: [Openvpn-users] OPenVPN 2.5 - How to allow client access to the web but not to the local LAN?

cess to the router's *admin interfaces*, of course. Preferably with belt (client IP whitelist on the router), suspenders (having iptables filter out attemps through the VPN), *and* superglue (strong authentication mechanisms). Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s

Re: [Openvpn-users] Using easyrsa3 - how to set longer expiration than 10 years?

day one, but to make sure that you got keypair/cert/CRL rollovers implemented end-to-end and well-tested while you still have a nominal devel budget for the project. Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature ___

Re: [Openvpn-users] Migrating to new CA

-noout -text | grep -B 1 CA: X509v3 Basic Constraints: critical CA:TRUE, pathlen:0 Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature ___ Openvpn-users mailing

Re: [Openvpn-users] Migrating to new CA

-to-date are your client installations? (I still take care to get expired CAs removed from configs before their final CRL expires as well, just in case.) Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature

Re: [Openvpn-users] URL forwarding and blacklisting

, DuckDuckGo.com does *not* have IPv6 addresses, so be prepared to run a 6-to-4 gateway as well ... Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature ___ Openvpn-users mailing list Openvpn-users

Re: DOvecot requires both IPv4 and IPV6 to start

local IPv6 addresses assigned - at which point IPv6 LISTENs will work, too. Of course, if you "disabled" IPv6 by compiling a kernel without the code relevant to it (is it still possible to do that?), various things might break *hard* ... Kind regards, -- Jochen Bern Systeminge

Re: [Openvpn-users] Using username/password authentication

ed* as well. User+pass does not provide for encryption keys. ¹ And I mean *certificates*, half of what you list aren't. Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature ___ Openvpn-users mailing

Re: [Openvpn-users] Revoke a certificate and reuse it

On 27.08.23 20:43, Jason Long wrote: On Sun, Aug 27, 2023 at 1:33 PM, Jochen Bern that seems correct, but as I said, I don't use EasyRSA myself. Hello,Thanks again.Can you show me the OpenSSL commands that you use to generate the server and client certificates? I'm not using bare OpenSSL

Re: [Openvpn-users] Revoke a certificate and reuse it

a POSIX Bourne-style shell https://unix.stackexchange.com/questions/368944/what-is-the-difference-between-env-setenv-export-and-when-to-use that seems correct, but as I said, I don't use EasyRSA myself. Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cry

Re: [Openvpn-users] Revoke a certificate and reuse it

e to send a new key to clients automatically when client key is revoked? Not with one OpenVPN connection alone (as revoking the key means that you do not trust that client anymore, and thus should hand over a new one to the (re-)verified holder by *different*, still-trusted means).

Re: [Openvpn-users] Revoke a certificate and reuse it

t have the CA issue a *new* cert instead. *Revoked* certs do *not* count against the guideline of "there shouldn't be two certs by the same CA for the same DN with overlapping validity periods". Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description:

Re: [Openvpn-users] ccd-exclusive does not work

ey lose your trust. Etcetera. Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature ___ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-users

Re: [Openvpn-users] ccd-exclusive does not work

irst place would be it - which is exactly what you're trying to do, without ever explaining *why* you would want to do that. Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature ___ Openvpn-us

Re: [Openvpn-users] How to use ccd-exclusive statement?

like "JasonLong_privCell" instead. Not that it should be much news to you how *I* would name CA, server, and client certs, respectively, if you had read my previous posts ... Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signa

Re: [Openvpn-users] How to use ccd-exclusive statement?

./easyrsa sign-req server NAME" commands. Right? NO. Reread what I wrote about the (hint: different) roles the certs generated by these two sets of commands have. Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description:

Re: [Openvpn-users] How to use ccd-exclusive statement?

VPN clients usually aren't expected to *have* a long-term-stable FQDN, so I would suggest naming the certs by user and/or device, like "Jason Long's private cell phone".) Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature ___

Re: [Openvpn-users] How to use ccd-exclusive statement?

ecause it assumes that you made sure to have it created and installed in the correct location with the intended CN "client2" beforehand and don't *need* to check "now which cert did this client happen to end up with?". Kind regards, -- Jochen

Re: [Openvpn-users] How to use ccd-exclusive statement?

ng* cert, or you misnamed the certs as you created them (even more than that how-to instructs you to). Anyway, in order to create a CCD file for your client using the cert it uses *now*, the CCD file would need to be named "server". Kind regards, -- Jochen Bern Systemingenieur Bine

Re: [Openvpn-users] How to use ccd-exclusive statement?

ks about the cert the client presents, you'll have to have the client make an attempt to connect, and then grab the logs from *those* couple seconds. Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature _

Re: [Openvpn-users] How to use ccd-exclusive statement?

would nonetheless recommend that you look at the server log (of suitable verbosity) for a line telling what cert/CN the client has actually sent, though. Kind regards -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature

Re: [Openvpn-users] A question about "Local" option

with *no packets* being sent yet. Hence, your iptables setup is entirely irrelevant there. Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature ___ Openvpn-users mailing list Openvpn-use

Re: [Openvpn-users] A question about the VPN providers

astructure. And proper per-customer network isolation doesn't scale well to only a *few* end-to-end-transparent public IPs per range/country.) Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature _

Re: [Openvpn-users] OpenVPN and NIC with multiple IP Addresses

shown us only what you *actively changed* (no info on the chains' policies, for example), and the question what SRC IP the through traffic is MASQUERADEd to (to compare that with the filter rules) is still open. Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S

Re: [Openvpn-users] OpenVPN and NIC with multiple IP Addresses

route to 8.8.8.8, so the pings *should* have gone into the VPN, as intended. Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature ___ Openvpn-users mailing list Openvpn-users@lists.sourceforge.net

Re: [Openvpn-users] Server configuration file vs server

I said, it's *your* trade-off (vulnerable monoculture vs. maintenance complexity, yadda yadda) to make. Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature ___ Openvpn-users mailing list Openv

Re: [Openvpn-users] Server configuration file vs server

ther hand, if someone manages to hack a server (VM) and grabs the keys there, you have an interest to disable only *that* server, and not others just because they use the same now-compromised keypair. That trade-off is essentially yours to gauge ... Kind regards, -- Jochen Bern Systemingenieur B

Re: [Openvpn-users] Multiple OpenVPN server on one NIC

dress the client has "in the Internet". It's important to keep all these addresses and their roles separate, as their choice/design follows different requirements. Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description:

Re: [Openvpn-users] Multiple OpenVPN server on one NIC

quot; statements in your server-side configs state what IPs the *clients* will be assigned to use for the traffic *inside* the VPN, once they have connected. You very probably want to put different IP ranges into every single config file, *regardless* of whether "port" matches between two conf

Re: [Openvpn-users] How to run multiple configuration files at the same time?

., from a "template" unit file installed with OpenVPN, you derive one systemd service for each config file, and administrate those like you would a "standalone" service. Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cry

[Openvpn-users] Updating OpenSSL broke OpenVPN's Support for CApath ... ?

[ClientCertFile]", "OK"s all combinations. (As it should.) How can I try to further narrow down the root cause? Thanks in advance, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature ___ Open

Re: No-novice with Dovecot, but need novice-like advice (was Dovecot cracked?!)

nd an equivalent for the *virtual* accounts' password backend ... (Yes, it'd be better to have it seamlessly integrated into the IMAP protocol, but don't forget that you'd need the *MUAs* to start supporting it as well before the general public will ever even learn about the new feature ...

Re: LMTP server client certificate validation

as things, especially the number of such fourth parties to support by the same CA, start to scale up IMHO. Which promptly brings us back to you running the CA yourself ... Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic

Re: SPF DNS Error / R_SPF_DNSFAIL

ot;no A or RRs found", in fact, I'm getting an NXDOMAIN for the FQDN). Regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature

Re: CVE-2022-3602 and CVE-2022-3786 Critical OpenSSL 3.0.x security vulnerabilities

tall it so as to install a current version from a different source. Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature

Re: Dovecot mail-crypt webmail can't read encrypted messages

en inside encryption (that a MitM may or may not be able to crack), so it's not a clear all-out FAIL to use those. Whether the password is still in cleartext *when written to / read from disk* is another question, but that would be a negligible defense against someone who rooted your server. Kind reg

Re: Thunderbird can't connect to Dovecot (bad certificate: SSL alert number 42) - sni

hark) without having to crack any crypto ... Kind regards, -- Jochen Bern Systemingenieur Binect GmbH

Re: pre-define or alter list of IMAP keywords

was "how many users may there be who flag incoming e-mails with the due date for the request contained in them, rather than using a separate calendar or to-do-list application?" ...) Regards -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature

Re: Is multi factor authentication practical/feasible?

On 01.07.22 20:02, Jochen Bern wrote: *Totally* theorizing here, but as far as I'm aware, the SMTP (AUTH), POP, and IMAP protocol definitions do not provide elbow room to make *two* rounds of authentication. (Ever pondered why the admin can require O365 users to "use 2FA",

Re: Is multi factor authentication practical/feasible?

o communicate with the token directly (ideally so that the user gets the password-to-enter via the token, say, per SMS, but for *that* to work out, you need that *every* piece of software used is willing and able to forward the info "user X wants to make an attempt at auth" *before* i

Re: Force TCP socket disconnect on imap login failure?

ISHED-ACCEPT rule's priority (it's some additional burden to the CPU to match *all* incoming IMAP(S) packets against the blocklist, after all), you could always render it effectively unusable by setting a (blackhole) host route for the IP. Regards, -- Jochen Bern Systemingenieur Bin

Re: RE: Certificate and showing a sign-cert not there

rts, so MitM attacks are definitely possible. [Still vividly remembers finding that a certain camping ground's WiFi transparently redirects geusts' SMTP/IMAP to a snooping, SSL-enabled server ...] Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature

Re: Non-unique Message ID in mail messages

ch have a Message-ID of their own, with the IDs of the earlier e-mails appearing in In-Reply-To: and References: headers to support threading in MUAs.) Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature

Re: Can dovecot be leveraged to exploit Solr/Log4shell?

v1, in the meantime - at least by Red Hat - downgraded to *not* be a *Remote* Code Execution (RCE) vuln) ... Regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature

[stunnel-users] Re: Is it possible to inhibit writing the stunnel logs to the / var / log / messages file?

, too. In either case, keep in mind that you'll have to set up other mechanisms (e.g., logrotate, logwatch, ...) to work on the new file, too. Regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature

[stunnel-users] Re: Need a clean way to reject a client IP

(backing off) way, either. Cutting the worst of them off by other means, like iptables, is the way to go IMHO ... Regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature ___ stunnel-users mailing list

Re: SSL errors after certificate renewal

nner like sslyze against the server.) Regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature

Re: Why do so many dovecot list mails fail dmarc?

From:Cc:Reply-To:Subject:In-Reply-To:References:From; > > [...] I do not know why Reply-to and From are both listed twice. (That's Reply-To: (the address(es) to which to send replies) and *In-*Reply-To: (the Message-ID of the mail that *this* e-mail replies to), FWIW.) Regards, -- Jochen

[stunnel-users] Re: stunnel ignores chroot /etc/hosts

ost:80 > connect = svchost:443 > ; > > Alas, stunnel still resolves svchost from the global /etc/hosts - not from > chroot's!: Why wouldn't you just put "connect = 1.2.3.4:443" into your stunnel config ... ? Regards, -- Jochen Bern Systemingenieur Binect GmbH

[stunnel-users] Re: stunnel and rsyslog

ntOS 6 Platform for ~8 years (until it was upgraded to CentOS 8) without a problem (other than that it didn't use RELP, which was not yet production ready in rsyslog at the time the platform was set up) ... Regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptog

Re: What imap ssl/auth settings work best with MS Outlook?

you NOT have an SMTP-out server for this account at all!" etc..) Regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature

[stunnel-users] Re: Fwd: Re: Local socket keeps listening

quot;ss"/"netstat" for the server's LISTEN and simply terminates stunnel if it isn't found. Or even better, have the server *restarted* automatically whenever it croaks ... Regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description

Re: Obtaining the IMAP GUID from a sieve script

On 18.01.21 12:18, @lbutlr wrote: > On 18 Jan 2021, at 04:12, Jochen Bern wrote: >> (Also, you can legally have several e-mails with the same Message-ID in >> your mailbox; e.g., someone addressed it to two aliases that both expand >> to you, just to name one possibilty wh

Re: Obtaining the IMAP GUID from a sieve script

; e.g., someone addressed it to two aliases that both expand to you, just to name one possibilty where *both* go through *sieve* as well.) Regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature

Re: openssl-users Digest, Vol 73, Issue 29

quot;problem" by appending A,B,C,... to the CN - which was possible because we're using *actual CAs* there. For server certs, where you need the CN to match the FQDN, you might want to add an OU with a timestamp so as to have the *DN* as a whole differ ... Kind regards, Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature

Re: How to rotate cert when only first matching cert been verified

issued, so at least the server admin would prefer to have the old SC revoked but *not* the new one. Kind regards, -- Jochen Bern Systemingenieur Binect GmbH smime.p7s Description: S/MIME Cryptographic Signature

Re: Looking for a guide to collect all e-mail from the ISP mail server

mail loops. If you don't know *exactly* what you're doing, maintain your myriad of users/mailboxes *both* at the ISP and on your internal servers and put the "mails in ISP mailbox X *all* go into internal mailbox Y, and nowhere else!" relations "hardcoded" into your retrieval t

Re: encrypt incoming emails with public gpg key before they are stored to maildir

_pipe_exec_t:s0 gpgit gpgit 12141 > May 11 2015 gpgit.pl Needless to say, you'll have to "su - gpgit" and "gpg --import ..." the various(?) recipients' public keys, too. And *monitor* them there, if there are any with a limited lifetime ... Kind regards, -- Jochen Be

Re: Remove All Software Generators

ack randomization, SSH logins from remote that fail, etc. etc.. Kind regards, -- Jochen Bern Systemingenieur E jochen.b...@binect.de W www.binect.de

Re: Internal IP Exposed

(and, if present, reverse proxy solution) you're using. Regards, -- Jochen Bern Systemingenieur www.binect.de www.facebook.de/binect smime.p7s Description: S/MIME Cryptographic Signature

Re: Re: regarding ssl certificates

edirect to www.mydom.ain). Regards, -- Jochen Bern Systemingenieur www.binect.de www.facebook.de/binect smime.p7s Description: S/MIME Cryptographic Signature

  1   2   3   >