Christopher's Broom Cupboard header image

Setting up a secure Postfix server in 2019 - what to consider?

Postfix is great, and widely used, but freshly installed it's like a newborn child. Nowadays there's a lot of work required to get it to an acceptable level to face the wild west of the Internet.

NB: This is a living document and will probably change over time as I revise my own methods for managing my servers.

Running an MTA to an 'acceptable' standard now requires lots of additional config and tuning, but it's satisfying once done. Be prepared to learn lots about DNS, TLS, certificate structure, mail filtering (miltering), regular expression and monitoring - crucial once your system is operational.

Once you've had your fill of the RFCs (https://www.fastmail.com/help/technical/standards.html), there's plenty other stuff to learn. http://www.emailarchivestaskforce.org/documents/guide-to-email-standards/ is worth a read, and are you sure you know how to validate an email address? https://haacked.com/archive/2007/08/21/i-knew-how-to-validate-an-email-address-until-i.aspx/

For newcomers, important areas to cover are:

  • understanding quirks of different email clients, some of the odd scenarios with specific email services
  • familiarising oneself with the certificate process
  • how TLS is employed with email
  • Hands-on experience is crucial!
  • Doing dry runs with a dev system is invaluable - you must be able to make and break things without taking down customers' email 🙂

I administer shared Postfix servers for numerous clients. Some are newest releases of Postfix, and some, due to legacy requirements, are older. Nothing necessarily wrong with that, but some configuration options aren't always available.

If I was setting up a new Postfix server today, I'd go through these steps:

(more…)

Frameserving from Premiere Pro CC 2019 to FFmpeg - yes we can!

A while ago, when I was regularly working on video edits, I came to the realisation that frameserving is simply the best, most flexible way to encode. But time marches on, and so did my software - eventually I came to a new machine, new Premiere Pro and - catastrophe - no frameserve ability.

However, cleverer people than me have solved this problem, so for those of you editing in Premiere CC 2019 it's once again fairly easy to frameserve encode! However, it did take a bit of sleuthing to figure out a few things - this tutorial should help you to avoid the same problems I encountered.

(more…)

MaxMind GeoLite v1 databases discontinued - install GeoLite2

I noticed recently that a few web sites are miscategorising my ISP's static IP as being in the wrong country. I knew it was a recent reallocation of a new block and suspected the web sites were using a stale version of a GeoIP database - probably MaxMind's GeoLite v1 offering.

However, as I also run a few servers which themselves use the GeoIP tool (with

geoipupdate
) I wondered about how to update to the latest version. Sure enough, with the old v2 of geoipupdate I was using, the databases were definitely not available (and HTTP error codes were being returned when I tried to run an update).

When I started Googling in more detail, I discovered MaxMind has fully discontinued and removed the GeoLite databases. Yowzer.

But no matter! GeoLite2 is now available from the MaxMind Developers site - I

--force
installed the RPM, as yum was requesting to also uninstall ProFTPd, which I wasn't impressed by). Backed up the old binary and config just in case, but it was unnecessary. Verified the install afterwards with
geoipupdate -V
, then ran it with
geoipupdate -v
-- all good.

Getting Postfix working for outbound emails via SMTP and local relay for cron reports

I recently had to diagnose a couple of servers running Postfix which emailed results of rsync cronjobs when they returned a non-OK value. While Postfix was emailing the recipients on rsync failure, I noticed that the cronjob STDOUT was not being locally relayed correctly to the root mail.

I documented my fix on ServerFault, hopefully it's useful for someone else.

Having fixed local root cron reports, I then noticed on the CentOS7 box that the AIDE service was running, had been scanning for integrity checks against the original postfix install (subsequently upgraded to Postfix 3) and as such was throwing errors every night for no real reason, quite annoying.

To fix this I tried running

aide --update

but it didn't work (probably my fault from doing an

--init

first). I had to rm the

/var/lib/aide/aide.db.gz

and

/var/lib/aide/aide.db.new.gz

files, then

run aide --init

and rename the newly-made

aide.db.new.gz

to

aide.db.gz

. After that, it was happy.

Canon XF305 MXF problems in Premiere? Transcode your clips to ProRes with FFMPEG!

Recently encountered a weird problem with 1080i MXFs straight out of a Canon XF305. The files would play in VLC, but Premiere Pro CC 2017 on a brand new MacBook Pro or iMac failed soon after starting to decode the video, with a horrible red frame and MXF frame decode errors in the Log. It's pretty nasty, but I'm sure we can wield FFmpeg to fix this for us. (more…)

I footnotes