spam protection
Postfix Spam Protection Improvements
Overview
Implemented multi-layer spam protection for mail server at mail.keisanki.net.
1. Fixed SpamAssassin Milter Socket
Problem: SpamAssassin milter socket path was incorrect, causing spam filtering to fail.
Solution: Created proper systemd service and fixed socket path.
File: /etc/systemd/system/spamass-milter.service
ssh client
~/.ssh/config
Host ALIAS
HostName HOST.DOM.TLD
User USER
# client_loop: send disconnect: Broken pipe # NAT/Firewall Termination
Host *
TCPKeepAlive yes
ServerAliveInterval 30
ServerAliveCountMax 5init
- ssh-keygen -t ed25519
- cat ~/.ssh/id_ed25519.pub
- ssh-copy-id -i $HOME/.ssh/id_ed25519.pub root@bubu
- echo "id_ed25519 ...
Incus Resource Limits Guide
This document explains how to prevent Incus containers from consuming all host resources by applying CPU, memory and process limits using profiles.
Containers share the host kernel. Without limits, any container process (for example ffmpeg in PeerTube) can use all available CPU cores and memory.
Using Incus profiles allows applying resource policies to many containers at once.
Inspect Current Container Limits
Check a container configuration:
opendkim
- ai opendkim opendkim-tools
- mkdir /var/spool/postfix/opendkim/
- chown opendkim /var/spool/postfix/opendkim
- usermod -aG opendkim postfix
- YEAR=$(date +'%Y')
- DOMTLD=DOM.TLD
- mkdir -p /etc/opendkim/keys/$DOMTLD
- cd /etc/opendkim/keys/$DOMTLD
- opendkim-genkey -s $YEAR -d $DOMTLD
- chown opendkim:opendkim *.private
- vim /etc/opendkim.conf
vim /etc/default/opendkim
RUNDIR=/var/spool/postfix/ru
Incus Networking on Routed /32 Hosts (Hetzner-style)
This document describes the correct and supported networking models for running Incus on hosts with a routed public IPv4 /32, such as Hetzner ARM and similar cloud servers. It also documents common pitfalls, misleading error messages, and the rationale behind the recommended setup.
1. Host Characteristics
Typical properties of these systems:
AH00558 Apache Warning
Problem
Beim Start von Apache erscheint:
AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.0.1.
Set the 'ServerName' directive globally to suppress this message
Ursache
Apache hat keinen global gesetzten ServerName.
Slimming Guide
This document describes how to safely reduce the size of an LXC container before migrating it to Incus or copying it to a remote server. It provides commands to identify large directories, remove unnecessary data, and clean up legacy components.
1. Identify Large Directories
Run these commands inside the container:
du -xhd1 /
du -xhd1 /var
du -xhd1 /var/lib
du -xhd1 /usr
Use ncdu for an interactive view:
Incus: Disable AppArmor
This page documents how to disable AppArmor confinement for existing and new Incus containers in the raid1 project. This eliminates AppArmor DENIED spam in kernel logs and journald.
Overview
Incus generates per-container AppArmor profiles. Many containers produce constant AppArmor DENIED messages (e.g. systemd-logind mount attempts). To stop this, containers can be switched to the unconfined AppArmor profile using:
autopostgresqlbackup
- ai autopostgresqlbackup
- dpkg -L autopostgresqlbackup
- mkdir /var/backups/autopostgresqlbackup
- vim /etc/default/autopostgresqlbackup
- /usr/sbin/autopostgresqlbackup
- l /var/backups/autopostgresqlbackup/*/*
PeerTube
- https://docs.joinpeertube.org/maintain/migration
- vim $(which autopostgresqlbackup) +361 #367
- su $SU_USERNAME -l -c "pg_dump -Fc $PGHOST $OPT $db -f $2"
- pg_dump -Fc --username=$USERNAME $PGHOST $OPT $db -f $2
PeerTube Migration btrfs Incus
Diese Dokumentation beschreibt das final empfohlene Setup für die PeerTube-Instanz auf at1 in Verbindung mit:
- einem btrfs‑RAID1 unter
/mnt/raid1, - klar getrennten btrfs‑Subvolumes,
- einem Incus‑Container (
peertubeoderpeertube4), - sauberem Host→Container‑Mounting via Incus‑Disk‑Device,
- korrekt eingerichtetem User‑Namespace‑Mapping.
Das Ziel ist ein robustes, snapshot‑fähiges, sauber getrenntes System, das Migrationen und Backups extrem erleichtert.
Parallel File Transfer
This documentation provides optimized and parallelized methods for transferring Peertube media data from an LXC container to a remote server. It focuses on speed, reliability, and efficient handling of large file sets. All examples assume the source directory:
/var/lib/lxc/CTNAME/rootfs/var/www/peertube/storage/
and the destination:
Incus Container Image
Diese Doku beschreibt, wie ein bestehender Incus-Container CTNAME in ein wiederverwendbares Image umgewandelt und auf einen anderen Server übertragen wird. Aus diesem Image kann auf dem Zielsystem wieder ein Container erstellt werden.
Es werden zwei Varianten gezeigt:
incus debug
incus start listmonk Error:
Failed start validation for device "net0": MAC address "00:16:3e:7f:0d:73" already defined on another NIC
incus config device unset listmonk net0 hwaddrincus shell web-test
Error while executing alias expansion: incus exec web-test -- su -l
Error: Instance not found
incus_remote_copy.sh
#!/bin/bash
# Script Version: 02
# Description: Automate migration of a single LXC container to Incus and push it to remote project
# Set variables
# ========
LXCHOSTNAME="$1"
REMOTE_NAME="at1"
TARGET_PROJECT="raid1"
DEBUG=1
# Safety checks
# ========
if [ -z "$LXCHOSTNAME" ]; then
echo "[ERROR] Usage: $0 <LXCHOSTNAME>"
exit 1
fi
# Functions
# ========
stop_lxc_container() {
echo "[DEBUG] Stopping LXC container $LXCHOSTNAME"
if lxc-info -n "$LXCHOSTNAME" &>/dev/null; then
lxc-stop -n "$LXCHOSTNAME" 2>/dev/null || true
else
spamd bind dnsmasq resolveconf
Die Kombination aus BIND9, dnsmasq und SpamAssassin so konfiguriert wird, dass:
Incus: Remote-Server mit Trust-Token
Diese Dokumentation beschreibt, wie ein lokaler Incus‑Client mit einem entfernten Incus‑Server per Trust‑Token verknüpft wird.
Beispielszenario:
incus_remote_rsync.sh
#!/bin/bash
# Script Version: 04
# Description: Incus migration helper (DEV state)
# ======= USAGE =======
# Usage: ./incus_remote_rsync.sh <container-name> <target-host> [project] [--snapshot] [--no-compress]
# Examples:
# ./incus_remote_rsync.sh zammad 80.109.18.113 raid1 --snapshot
# ./incus_remote_rsync.sh zammad 80.109.18.113
# ./incus_remote_rsync.sh peertube 80.109.18.113 raid1 --no-compress
# ======= ARGS & DEFAULTS =======
if [ -z "$1" ] || [ -z "$2" ]; then
echo "Usage: $0 <container-name> <target-host> [projectLXC2Incus
A comprehensive guide for system administrators, self‑hosters, and advanced Linux users who want to migrate from classic LXC to Incus. The process ensures reliable container management, persistent networking, and smooth integration with storage and firewall systems.
mailserver D13 Trixie Debug
disable remove
ap pyzor
grep -i pyzor /etc/spamassassin/*.cf
/etc/spamassassin/v310.pre:loadplugin Mail::SpamAssassin::Plugin::Pyzor
Virtueller Mailserver
Diese Dokumentation beschreibt den vollständigen Aufbau eines virtuellen Mailservers unter Debian 13 (Trixie) mit Postfix, Dovecot, LMTP‑Zustellung, TLS‑Absicherung, Alias‑Management und einem klaren Flat‑Mailstore‑Design. Der Fokus liegt auf Stabilität, Übersichtlichkeit und Erweiterbarkeit.
🔧 1. Pakete installieren (Postfix + Dovecot)
Für einen vollständigen virtuellen Mailserver werden folgende Pakete benötigt:
postfix main.cf
compatibility_level = 3.6
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
command_directory = /usr/sbin
daemon_directory = /usr/lib/postfix/sbin
data_directory = /var/lib/postfix
sendmail_path = /usr/sbin/postfix
newaliases_path = /usr/bin/newaliases
mailq_path = /usr/bin/mailq
mail_owner = postfix
myhostname = mail.bubuit.net
mydomain = bubuit.net
myorigin = $mydomain
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
setgid_group = postdrop
inet_interfaces = all
inet_protocols = ipv4
unknown_local_recipient_reject_code = 5515-mailboxes.conf
# These mailboxes are widely used and could perhaps be created automatically:
namespace inbox {
mailbox Drafts {
auto = subscribe
special_use = \Drafts
}
mailbox Junk {
special_use = \Junk
auto = subscribe
}
mailbox Templates {
auto = subscribe
}
mailbox Trash {
auto = subscribe
special_use = \Trash
}
mailbox Sent {
auto = subscribe
special_use = \Sent
}
mailbox Important {
auto = subscribe
special_use = \Important
}
mailbox Archive {
auto = subscribe
special_use = \Archive
}spamassassin
- ai spamassassin spamd sa-compile spamass-milter re2c pyzor libmail-spamassassin-perl libarchive-zip-perl libidn2-dev libgeo-ip-perl libgeoip-dev perl-doc cpanminus libnet-libidn2-perl libencode-detect-perl libnet-patricia-perl libio-compress-perl libmail-spf-perl libio-socket-inet6-perl libdbi-perl libdbd-sqlite3-perl libwww-perl liblwp-protocol-https-perl libbsd-resource-perl libemail-address-xs-perl libmail-dmarc-perl libdevel-cycle-perl libtext-diff-perl libnet-libidn-perl libmaxmind-db-reader-perl libmaxmind-db-reader-xs-perl libdigest-sha-perl
- usermod -a -G spamass-milter
milter_mail_macros
📨 Postfix & SpamAss-Milter Integration Guide
Overview
A complete guide to integrating Postfix with SpamAss-Milter on Debian for effective spam filtering. It covers macro configuration, testing, troubleshooting, and best practices for maintaining clean, reliable mail logs.
Btrfs – Optimized Configuration & Maintenance Guide
A refined, consistent, and practice-focused guide for running Btrfs efficiently on your at1 server. The structure emphasizes clarity, reliability, and long-term maintainability.
1. Overview
Btrfs is a modern copy-on-write filesystem designed for environments where integrity, snapshots, and flexibility are essential. It excels with:
Smartmontools
Smartmontools – Comprehensive Monitoring Guide
Overview
Smartmontools is an essential tool for monitoring SSDs and HDDs in modern server environments. It identifies early signs of hardware degradation, provides detailed diagnostics, and integrates seamlessly into automated maintenance workflows. This guide delivers a production‑ready configuration, clear threshold recommendations, structured troubleshooting, operational best practices, and an automated daily health‑check script for the server at1.
SMB/CIFS
This guide explains how to configure a Samba share on Debian 13 (Trixie) and connect to it from a Windows 10 laptop in the local LAN (192.168.0.0/24). It also covers integration with FireHOL firewall rules and using the share with BorgBackup.
Btrfs RAID1 mit Snapshots
Voraussetzungen
- Zwei leere Festplatten (z. B. /dev/sda und /dev/sdb)
- Root-Zugriff
- Debian 12 oder neuer
1. Vorbereitung: Platten löschen und partitionieren
wipefs -a /dev/sda
wipefs -a /dev/sdb
parted -s /dev/sda mklabel gpt
parted -s /dev/sda mkpart primary 0% 100%
parted -s /dev/sdb mklabel gpt
parted -s /dev/sdb mkpart primary 0% 100%
2.
bind9
- ai bind9 geoip-database
- vim /etc/bind/named.conf.options
- vim /etc/bind/named.conf.local
- mkdir /var/log/named/
- chown -R bind:bind /var/log/named/
- sc-restart named.service
- t /var/log/named/*
🛍 DNS-Referenz-Setup (ns1.dynproxy.net – 23.88.113.138)
🔐 Rollenverteilung
- Autoritativer DNS-Server für:
dynproxy.netbubuit.net
- Lokaler Resolver für:
127.0.0.1
📜 Wichti
bind_add_slave_zone_ns3.sh
#!/bin/zsh
# Version 01
# Script to add a new slave zone to /etc/bind/named.conf.local on ns3.dynproxy.net
# Script Name: bind_add_slave_zone_ns3.sh
# Variables
NAMED_CONF="/etc/bind/named.conf.local"
CACHE_DIR="/var/cache/bind"
# Check if a domain name argument is provided
if [ -z "$1" ]; then
echo "Usage: $0 <domain.tld>"
exit 1
fi
DOMAIN=$1
ZONE_FILE="$CACHE_DIR/$DOMAIN.db"
# Check if the zone configuration already exists
if grep -q "zone \"$DOMAIN\"" $NAMED_CONF; then
echo "Zone $DOMAIN already exists in $NAMED_CONF.bind_add_slave_zone.sh ns2
#!/bin/zsh
# Version 01
# Script to add a new slave zone to /etc/bind/named.conf.local on ns2.dynproxy.net
# Script Name: bind_add_slave_zone.sh
# Variables
NAMED_CONF="/etc/bind/named.conf.local"
CACHE_DIR="/var/cache/bind"
# Check if a domain name argument is provided
if [ -z "$1" ]; then
echo "Usage: $0 <domain.tld>"
exit 1
fi
DOMAIN=$1
ZONE_FILE="$CACHE_DIR/db.$DOMAIN"
# Check if the zone configuration already exists
if grep -q "zone \"$DOMAIN\"" $NAMED_CONF; then
echo "Zone $DOMAIN already exists in $NAMED_CONF.bind_checkzone.sh
#!/bin/zsh
# Version 29
# Variables
NAMED_CONF_LOCAL="/etc/bind/named.conf.local"
CHECKZONE_CMD="named-checkzone"
# Function to parse zones and file paths
parse_zones() {
awk '/zone/ {gsub(/[\";]/, ""); zone=$2} /file/ {gsub(/[\";]/, ""); file=$2; print file}' "$NAMED_CONF_LOCAL"
}
# Main function
main() {
echo "Parsing $NAMED_CONF_LOCAL for zone files"
parse_zones | while read -r ZONE_FILE; do
if [ -z "$ZONE_FILE" ]; then
echo "No file specified for zone"
continue
fi
if [ -f "$ZONE_FILE" ]; Resource Control Guide for Windsurf
Dieses Dokument liefert eine vollständig optimierte Anleitung, um Windsurf‑Remote‑Sessions auf Debian‑basierten VPS‑Systemen stabil und ressourcenschonend zu betreiben. Es zeigt, wie ripgrep (rg) gezielt eingegrenzt, übermäßige Dateisystem‑Scans verhindert und systemweite Speicherlimits gesetzt werden. Der Text wurde sprachlich geglättet, strukturell verfeinert und lesefreundlich gestaltet.
nginx jitsi proxy
server {
server_name jitsi.DOM.TLD;
listen 80;
ssl_session_cache shared:SSL:10m; # about 40000 sessions
add_header Strict-Transport-Security "max-age=7200";
firehol
- ai firehol firehol-tools ulogd2 conntrack
- sc-status firehol
- sc-start firehol
- sc-restart firehol
vim /etc/default/firehol
START_FIREHOL=YESvim /etc/firehol/firehol-defaults.conf +461
- t /var/log/ulog/syslogemu.log
# IPTABLES PACKETS LOGGING
# LOG mode for iptables
# Default: LOG
# Possible Values: LOG, ULOG, NFLOG
# LOG = syslog
# We recommend to install ulogd and use NFLOG.
FIREHOL_LOG_MODE="NFLOG"fail2ban
- ai fail2ban
- fail2ban-client status
- fail2ban-client status postfix
- fail2ban-client set postfix unbanip IP
- fail2ban-regex /var/log/mail.warn /etc/fail2ban/filter.d/postfix.conf
- fail2ban-regex systemd-journal "postfix[mode=aggressive]"
- vim /etc/fail2ban/jail.local
- fail2ban-client reload postfix
- service fail2ban restart
- fail2ban-customs
- f2b_status.sh
show my public ip
/etc/fail2ban/jail.d/mail.conf
vim /etc/fail2ban/jail.d/mail.conf
[postfix]
enabled = true
port = smtp,465,submission
filter = postfix[mode=aggressive]
logpath = /var/log/mail.log
maxretry = 4
[dovecot]
enabled = true
filter = dovecot[mode=aggressive]
# CUSTOM
[spamassassin]
enabled = true
filter = spamassassin
logpath = /var/log/mail.info
maxretry = 1
jail.local
vim /etc/fail2ban/jail.local
[Definition]
allowipv6 = auto
[DEFAULT]
ignoreip = 10.0.3.0/24
bantime = 1d
findtime = 2d
maxretry = 2
bantime.increment = true
bantime.factor = 2
[pam-generic]
enabled = true
backend = systemd
journalmatch = _SYSTEMD_UNIT=sshd.service
+ _SYSTEMD_UNIT=login.service
+ _SYSTEMD_UNIT=systemd-user-sessions.service
[recidive]
ignoreip = YOUR-LOCAL-CLIENT-IP-RANGE.0.0/16
enabled = true
f/etc/fail2ban/jail.d/nginx.conf
vim /etc/fail2ban/jail.d/nginx.conf
[nginx-bad-request]
enabled = true
filter = nginx-bad-request
[nginx-botsearch]
enabled = true
filter = nginx-botsearch
[nginx-404]
enabled = true
port = http,https
filter = nginx-404
logpath = /var/log/nginx/access.log
maxretry = 300
[nginx-http-auth]
enabled = true
port = http,https
filter = nginx-http-auth
logpath = /var/log/nginx/error.log
[nginx-botsearch]
enabled = true
port = http,https
filter = nginx-botsefail2ban customs
vim /etc/fail2ban/filter.d/nginx-probe-wp.conf
[Definition]
# Aggressive WP-probe blocker for non-WP hosts (NO 'feed' matches).
# Covers:
# - double slashes (//)
# - 0–3 arbitrary prefixes: blog/, web/, 2020/, wordpress/, wp/, shop/, ...
# - wp-admin[/setup-config.php|/install.php], wp-login.php, xmlrpc.php[?rsd]
# - trees: wp-includes/**, wp-content/**
# - leak/info files: wp-config.php, readme.html, license.txt, wlwmanifest.xml, ID3/license.txt
failregex = ^<HOST> - - \[.*?\] "\w+\s+/{1,2}(?:[A-Za-z0-9._-]+/){0,3}(?:wp-admin(?:/(?:setup-copostfix debug
Warning: Database is older than source file /etc/aliases
newaliases
postfix reload
DNS Standards
According to DNS standards (RFC 2181, Section 10.3), MX records should reference a domain name, not an IP address.
The domain name should then resolve to an IP address via an A or AAAA record.
Jitsi in Incus: Sysctl
Environment Overview
This setup runs with:
- Host: Debian Trixie
- Incus Container (Jitsi): Debian 12 (Bookworm)
These differences matter because sysctl capabilities depend on the host kernel version and Incus' container isolation model.
FireHOL & Conntrack
FireHOL is a powerful and intuitive firewall manager for Linux systems. It is widely used on servers, routers, gateways, virtualization hosts, and container environments where clear, stateful, and auditable firewall rules are essential. FireHOL automatically generates iptables/nftables rules and relies heavily on the Linux conntrack subsystem to enable stateful packet inspection and context‑aware filtering.
Backup and Restore of Manually Installed APT Packages
Backup and Restore of Manually Installed APT Packages
This documentation describes how to save and restore manually installed APT packages on a Debian-based system.
It uses the apt-mark showmanual command to generate a clean list of user-installed packages, which can be used to restore or clone systems.
Overview
A list of manually installed packages is created and stored at:
/etc/apt/packages.listThis file is overwritten each time the backup tool is executed.
DNSBL / dnsbl-ipset
Diese Seite dokumentiert die eigentliche dnsbl-ipset-Engine (FireHOL dnsbl-ipset.sh), die in Echtzeit IP-Adressen gegen verschiedene DNS-Blocklisten prüft und in ein ipset schreibt.
== Ziel
- Verdächtige Verbindungen aus dem Firewall-Log (ulogd) in Echtzeit gegen DNSBLs prüfen
- Treffer automatisiert in ein
ipsetschreiben - iptables-Regeln verwenden dieses
ipset, um IPs temporär zu blocken
== Komponenten
dnsbl-ipset
- https://github.com/firehol/firehol/wiki/dnsbl-ipset.sh
- /usr/share/doc/firehol-tools/examples/contrib/dnsbl-ipset.sh
/etc/firehol/firehol.conf
# dnsbl
ipset4 create dnsbl hash:ip timeout 1209600 maxelem 500000 prevent_reset_on_restart comment
action4 AUDIT_ACCEPT \
action ACCEPT state NEW log "AUDIT" \
next action ACCEPT
blacklist4 full inface "${wan}" ipset:dnsbl \
except src ipset:whitelistleider waren auch viele Letsencrypt
dnsbl.sh
DNSBL / dnsbl-ipset Auswertung
Diese Seite beschreibt das Auswertescript für dnsbl-ipset,
das auf dem Server wöchentlich Top-Statistiken aus `matches.log` erzeugt und per Mail verschickt.
Zweck Das Script verarbeitet die von `dnsbl-ipset.sh`
erzeugte Datei `/var/log/dnsbl-ipset/matches.log`
und erstellt daraus wöchentliche Reports:
postfix master.cf
# ==========================================================================
# service type private unpriv chroot wakeup maxproc command + args
# (yes) (yes) (no) (never) (100)
# ==========================================================================
smtp inet n - y - - smtpd
submission inet n - y - - smtpd
-o syslog_name=postfix/submission
-o smtpd_tls_security_level=encrypt
-o content_filter=spamassassin
spamassassin unix - n n - - pipe user=debian-spamd argvspamass-milter
- milter_mail_macros
- vim /etc/default/spamass-milter
# spamass-milt startup defaults
# OPTIONS are passed directly to spamass-milter.
# man spamass-milter for details
# Non-standard configuration notes:
# See README.Debian if you use the -x option with sendmail
# You should not pass the -d option in OPTIONS; use SOCKET for that.
# Default, use the spamass-milter user as the default user, ignore
# messages from localhost
OPTIONS="-u spamass-milter -i 127.0.0.1"
# Reject emails with spamassassin scores &DMARC
📧 DMARC and SPF Configuration for a Centralized Mail Server
Overview
This guide outlines how to configure SPF and DMARC for multiple domains that all send mail through a single centralized mail server — mail.bubuit.net. The goal is to maintain consistent authentication across all domains, simplify future maintenance, and prevent email spoofing.
1. Central Mail Server
Hostname: mail.bubuit.net
IPv4: 116.202.112.180
opendkim.sh
vim scripts/opendkim.sh
#!/bin/bash
# Script Version: 09
# Description: Generate and install OpenDKIM keys for a given domain and append KeyTable + SigningTable entries.doveadm
doveadm is the command-line administration tool for Dovecot, used for mailbox management, full-text search, quota checking, and replication tasks.
Syntax
doveadm [global options] <command> [command options]Example:
doveadm -u user@example.com fetch -A hdr subjectGlobal Options
Option | Description |
|---|---|
Move /home to a RAID11. Prepare the RAID Mount2. Copy Existing Data3. Backup and Replace |
