Messages

16

General Discussion / Re: MAIL SERVER (postfix plugin ?)

« on: May 07, 2020, 07:48:36 pm »

franco said people will ask for recovery/backup of mails, feature after feature, issues with upstream software involved, Microsoft compatibility issues....

I can understand he doesn't want to provide tech support for that...

17

General Discussion / Re: MAIL SERVER (postfix plugin ?)

« on: May 07, 2020, 06:54:24 pm »

Thanks but IMHO, a hypervisor is able to act as a keylogger, take screenshots, include a backdoor, especially closed code sources from commercial companies. I won't add any additional security risk.

"The use of hypervisor technology by malware and rootkits installing themselves as a hypervisor below the operating system, known as hyperjacking, can make them more difficult to detect because the malware could intercept any operations of the operating system (such as someone entering a password) without the anti-malware software necessarily detecting it (since the malware runs below the entire operating system). Implementation of the concept has allegedly occurred in the SubVirt laboratory rootkit (developed jointly by Microsoft and University of Michigan researchers) as well as in the Blue Pill malware package. However, such assertions have been disputed by others who claim that it would be possible to detect the presence of a hypervisor-based rootkit. In 2009, researchers from Microsoft and North Carolina State University demonstrated a hypervisor-layer anti-rootkit called Hooksafe that can provide generic protection against kernel-mode rootkits.

18

General Discussion / Re: MAIL SERVER (postfix plugin ?)

« on: May 07, 2020, 01:16:02 pm »

It's a pity but I understand, no problem.

Maybe it can be clearly specified that no help/tech support will be provided for recovery/backup of mails, issues with upstream software involved, Microsoft compatibility issues.... A sort of plugin "as is" like many new others that would correspond to this category... You could offer 2 plugin categories :

1) the standard one, where people can ask for tech support.
2) the non-standard one, where people will clearly be informed that no tech support will be provided whatsoever.
This makes me think of linux distribution repos, officials ones and others.

By the way. I like Arch linux (Manjaro) and I'm wondering if it is better for security or not.
I haven't been following Unix for a while, but I've learnt it at the very beginning (UNIX System V Release 3.2 (1987) & Minix & Xinu!!

Thank you for your good work anyways.

19

General Discussion / Re: MAIL SERVER (postfix plugin ?)

« on: May 07, 2020, 12:55:14 pm »

Even if it is in the firewall DMZ? I mean there should be a way to isolate it from the firewall... without having to buy another computer to make a mail server run + all the additional tiresome routing configuration and maintenance that it will imply... please francisco?

20

General Discussion / Re: MAIL SERVER (postfix plugin ?)

« on: May 07, 2020, 10:46:53 am »

Wikipedia says Postfix is a mail transfer agen (MTA), what you call a relay from my quick understanding. Correct?
So it's not enough, what about adding "Dovecot" as a plugin to OPNSense?
If "Dovecot" would be available, then would it be enough to run a simple mail server?
https://www.freebsddiary.org/dovecot.php
What about "iRedMail"? https://docs.iredmail.org/install.iredmail.on.freebsd.html
Thanks

21

General Discussion / MAIL SERVER (postfix plugin ?)

« on: May 07, 2020, 10:06:34 am »

Hi!

I'd like to set up my own mail server.
I just need to be able to send and receive emails for my personal use.
As a client, I use Thunderbird SMTP POP3 IMAP running on my Windows which is behind OPNsense.
In spite of the fact that I have some unix skills, I don't know much about mail servers.
I know that OPNsense wasn't designed to become a mail server and, of course, that it isn't its primary usage goal but, at the same time, I've noticed that postfix was available as a plugin, so, after all, it'd be very convenient to run my own mail server as well.
If I configure the postfix plugin, will it be enough?
If not, what else do I need to do?

Thanks!

22

20.7 Legacy Series / Re: Unbound OVERRIDE DOMAIN : ALIASES please! (new feature request)

« on: May 06, 2020, 09:54:05 am »

Just  use an internal webserver, or github account, create your own list as a text file and load it via the manual blacklist link. Easy.

thanks mate!
However it's not convenient at all if you want to temporarily disable/enable a group of domains under one alias...

23

20.7 Legacy Series / Re: Unbound OVERRIDE DOMAIN : ALIASES please! (new feature request)

« on: May 05, 2020, 10:52:42 am »

Anyways, IMHO, unbound shouldn't crash whatever the settings are between OPNsense standard override settings and the plugin.

There should be a solution to fix this, such as Host Overrides settings that would prevail over the plugin blacklists for instance, it's just a quick idea.

You still don't get it? Seriously? The tracking lists are far from being perfect and everyone should be able to create their own list without risking unbound to crash.

For example, I hate Facebook, I consider it is nothing else than a US government agency asking people over the world to fill their own information/intelligence sheet/card for the benefit of NSA databases (you know? the motherf*ckers on the planet - https://prism-break.org/en/)

See the attachment:

24

20.7 Legacy Series / Re: Unbound OVERRIDE DOMAIN : ALIASES please! (new feature request)

« on: May 05, 2020, 08:03:57 am »

Good try.

The problem is it crashes unbound if you activate os-unbound-plus 1.1_1 DNSBL plugin.

In Host Overrides, add these domains to block:
host=*   domain=windowsupdate.com    ip=0.0.0.0
host=*   domain=microsoft.com    ip=0.0.0.0

Now install this unbound additional plugin (see above) and select these 3 BL :
WindowsSpyBlocker (spy)
WindowsSpyBlocker (update)
WindowsSpyBlocker (extra)

...now enable the blacklist plugin

2020-05-04T08:26:46    unbound: [92889:0] fatal error: Could not set up local zones
2020-05-04T08:26:46    unbound: [92889:0] error: local-data in redirect zone must reside at top of zone, not at 00015e-1.l.windowsupdate.com A 0.0.0.0
2020-05-04T08:26:46    unbound: [92889:0] debug: duplicate acl address ignored.
2020-05-04T08:26:46    unbound: [92889:0] debug: duplicate acl address ignored.
2020-05-04T08:26:46    unbound: [92889:0] debug: drop user privileges, run as unbound
2020-05-04T08:26:46    unbound: [92889:0] debug: chroot to /var/unbound
2020-05-04T08:26:46    unbound: [92889:0] debug: chdir to /var/unbound
2020-05-04T08:26:45    unbound: [69721:0] debug: switching log to stderr
2020-05-04T08:26:45    unbound: [69721:0] info: 0.262144 0.524288 12

I've talked to Michael Muenz, but he didn't find any workaround:
> No idea, sorry. Maybe you can ask in the forums

Moreover, if you have a long list of domains to override, it is very tiresome to add them one by one.
Instead, loading a text file would be cool... and deleting all the domains under one alias.

25

20.7 Legacy Series / Re: Unbound OVERRIDE DOMAIN : ALIASES please! (new feature request)

« on: May 05, 2020, 07:41:29 am »

I'm afraid you're wrong: I'm talking about Domain Overrides, not Host Overrides.

26

20.7 Legacy Series / Unbound OVERRIDE DOMAIN : ALIASES please! (new feature request)

« on: May 05, 2020, 07:02:27 am »

It would ALSO be very convenient to load a list of domains or hosts to override directly from a text file...
Aliases are very convenient to quickly enable/disable a group of domains to override included in one alias.
Thanks for your good work.

27

20.1 Legacy Series / Re: VPN: OpenVPN: Log File Loading...

« on: February 29, 2020, 10:38:24 pm »

Thanks very much AdSchellevis! I confirm, log is working again.

28

20.1 Legacy Series / Re: VPN: OpenVPN: Log File Loading...

« on: February 29, 2020, 01:45:47 pm »

Plain View under Firewall and Unbound DNS also seem to be affected. They all just show "loading..."

I confirm!!! Same problem here.

29

20.1 Legacy Series / Re: VPN: OpenVPN: Log File Loading...

« on: February 29, 2020, 01:42:54 pm »

I forgot to mention this other problem:

My OPNsense is currently running on a standalone fanless computer that I use as a router.

Before I upgraded to 20.1.1, when I switched it on, my OpenVPN clients automatically connected to my VPN provider without any problem.

Now, when I switch it on, the VPN connection fails. I have to enter into my OPNsense setup, go to https://192.168.X.X/vpn_openvpn_client.php , disable my OpenVPN client and re-enable it, and then, it works...

30

20.1 Legacy Series / VPN: OpenVPN: Log File Loading...

« on: February 29, 2020, 08:25:55 am »

Hi,

For some reason, lately, I cannot access anymore to my OpenVPN log file.

My OpenVPN clients work perfectly, I can connect, but when I click on "Log File" (https://192.168.X.X/ui/diagnostics/log/core/openvpn), I always get "Loading...".

Of course, I have tried to clear/flush the log and then "Refresh", reboot, etc. Nothing works.

I run the latest updates :
OPNsense 20.1.1-amd64
FreeBSD 11.2-RELEASE-p16-HBSD
LibreSSL 3.0.2

Any idea what's wrong?

Thanks!