Hits: 174

Introduction:

If you’re looking to improve your website’s performance and reliability, moving your DNS to Amazon Route 53 is a great choice. With its high availability and scalability, Amazon Route 53 offers a powerful solution for managing your DNS records. In this guide, we’ll walk you through the steps to move your DNS from GoDaddy to Amazon Route 53.

Why Move DNS to Amazon Route 53?

Amazon Route 53 offers a number of benefits over GoDaddy’s DNS service, including:

• Higher availability and scalability: Amazon Route 53 uses a global network of servers to provide fast, reliable DNS resolution.
• Better performance: Amazon Route 53 offers advanced traffic routing and latency-based routing to improve website performance.
• Improved security: Amazon Route 53 offers features like DNSSEC and AWS Shield to protect against DNS-based attacks.

Step 1: Sign Up for Amazon Route 53

The first step is to sign up for Amazon Route 53 if you haven’t already. You’ll need an AWS account to use Amazon Route 53.

Step 2: Add a New Hosted Zone

Once you’re logged into Amazon Route 53, you can create a new hosted zone for your domain. Go to the “Hosted Zones” section and click “Create Hosted Zone.” Enter your domain name and select a region for your DNS records. This works even if another service like Godaddy run the domain.

Enter the info needed, which is really just the Domain Name. Then click Create Hosted Zone.

Step 3: Retrieve Your DNS Records from GoDaddy

Next, you’ll need to retrieve your DNS records from GoDaddy. Log in to your GoDaddy account and go to the “DNS Management” page. Copy all of your DNS records, including the TTL values.

Step 4: Create Record Sets in Amazon Route 53

In Amazon Route 53, create record sets for each of your DNS records. Make sure to set the TTL values to match the values from GoDaddy. If you have a large number of DNS records, you can use the “Import Zone File” feature to import your records in bulk.

Step 5: Update Name Servers in GoDaddy

Finally, update the name servers for your domain in GoDaddy to point to Amazon Route 53. Go to the “Domain Management” page and click “Manage DNS.” Replace the existing name servers with the name servers provided by Amazon Route 53. Aftyer deleting the existing NameServers, You will want to copy the 4 AWS Nameservers into your godaddy account in “Manage DNS”. You can see these DNS entries in the image below, these are:

ns-695.awsdns-22.net.
ns-1838.awsdns-37.co.uk.
ns-1177.awsdns-19.org.
ns-11.awsdns-01.com.

PLease pay attention to the dot at the end. I am not sure if godaddy requires the dot or not.

Conclusion:

Moving your DNS from GoDaddy to Amazon Route 53 is a great way to improve your website’s performance and reliability. With its advanced features and high availability, Amazon Route 53 offers a powerful solution for managing your DNS records. By following the steps outlined in this guide, you can move your DNS to Amazon Route 53 quickly and easily.

Hits: 185

Important
If the current registrar for the domain is also the DNS service, be sure to transfer DNS service to Route 53 or another service provider before you transfer the domain.
Otherwise, the domain might become unavailable on the internet after it has been transferred.

Transferring a domain from GoDaddy to Amazon Route 53 is a straightforward process, but it’s essential to take certain steps to ensure a smooth transition without affecting your website’s search engine rankings. In this SEO blog, we’ll guide you through the steps for transferring your domain to Route 53.

Step 1: Verify Ownership of Your Domain

The first step is to verify that you are the owner of the domain. You will need to have access to your GoDaddy account to retrieve the domain’s authorization code, also known as an EPP code. This code is required to transfer the domain to Route 53.

Step 2: Prepare Your Domain for Transfer

Before you start the transfer process, make sure that your domain is ready for transfer. Check that your domain is at least 60 days old, not expired, and not locked. Also, disable any domain privacy services if enabled.

Step 3: Initiate the Transfer

Go into your AWS account Console and Open Route 53

https://aws.amazon.com/console/

Then Open Route 53. In  upper left, next to Services is  a search bar. type in Route 53, then click the first link.

To initiate the transfer, log in to your Amazon Route 53 account, and go to the “Registered Domains” tab.

Click “Transfer Domain,” and then enter the domain name you wish to transfer. Next, enter the authorization code you retrieved from your GoDaddy account.

Complete the checkout process and pay the transfer fee.

Step 4: Verify the Transfer

After initiating the transfer, you will receive an email confirmation from Amazon Route 53, and another email from GoDaddy asking you to approve the transfer. Follow the instructions in the email to approve the transfer.

Step 5: Wait for the Transfer to Complete

The transfer process may take up to ten days to complete. During this time, it’s important not to make any changes to your website, such as changing hosting providers or updating the DNS records. Doing so could cause your website to go offline or affect your search engine rankings.

Step 6: Update DNS Records

Once the transfer is complete, update your DNS records in Amazon Route 53 to point to your website’s new hosting provider. This step is crucial to ensure that your website remains accessible and doesn’t experience any downtime.

In conclusion, transferring a domain from GoDaddy to Amazon Route 53 is a relatively straightforward process. However, it’s important to follow the steps outlined above to ensure a smooth transition without negatively affecting your website’s search engine rankings. If you have any questions or concerns, don’t hesitate to reach out to Amazon Route 53 support for assistance.

Hits: 67

I got the following gibberish words when I pasted an image description from ChatGPT to Dalle2

This is the text:

The image could feature a computer or server with a large padlock overlay, symbolizing the enhanced security measures of a private email server. The computer or server could be depicted with an image of an email inbox, showcasing the functionality and benefits of a private email server. The text on the image could feature the title “Take Control of Your Business Communication with a Private Email Server!” and the description “Ensure the safety and security of your valuable data with a private email server. Save money and gain flexibility by customizing your email server to meet the unique needs of your business.” The image could also include a call-to-action, such as “Get started today and protect your business communication.”

Additionally, the colors used in the image could be professional and modern, such as navy blue, black, and gray, to convey the idea of security and reliability. Overall, the image should be eye-catching, informative, and visually appealing to draw the viewer’s attention and encourage them to learn more about the advantages of a private email server.

Hits: 420

Hits: 132

Hits: 92

Private Email Server gives you control and security

Easy Installation and easy to add users

Take Control

Hits: 151

Hits: 13484

Here are the instructions to install Docker Compose for Amazon Linux2.

Hi there, I am not going to waste you brains on stupid introductions, If you searched for how to install docker compose on Amazon LInux 2, I won’t add a 2000 word intro to fry your brains!

Amazon Linux 2 is nice and simple and small, but some things need extra attention to install. These commands work for both ARM64 Graviton, etc as well as regular AMD64 amazon linux 2. This also includes installing git and screen. Screen allows you to return to where you left off in disconnected ssh sessions.

Start installing our Cloud Email Server that is based on Docker Compose on Amazon Linux 2, launch the Complete Linux Email Server with Webmail in the AWS Cloud. You can also install ARM64 / Graviton Complete Linux Email Server with Webmail

Leave out this first shebang line if you are just pasting, it should also work as user data

#!/bin/bash
# SSM user didn't start in home dir, so go there
cd
sudo yum update -y
sudo yum install docker containerd git screen -y
sleep 1
wget https://github.com/docker/compose/releases/latest/download/docker-compose-$(uname -s)-$(uname -m)
sleep 1
sudo mv docker-compose-$(uname -s)-$(uname -m) /usr/libexec/docker/cli-plugins/docker-compose
sleep 1
chmod +x /usr/libexec/docker/cli-plugins/docker-compose
sleep 5
systemctl enable docker.service --now
sudo usermod -a -G docker ec2-user
sudo usermod -a -G docker ssm-user

Instructions to install Docker Compose on Amazon Linux 2 for both AMD64 and ARM64:

1. Log in to your Amazon Linux 2 instance.
2. Open a terminal and run the following command to update your system:
   sudo yum update -y

3. Install the required packages: Docker, containerd, git, and screen, by running the following command:
   sudo yum install docker containerd git screen -y

4. Download the latest version of Docker Compose by running the following command:
   wget https://github.com/docker/compose/releases/latest/download/docker-compose-$(uname -s)-$(uname -m)

5. Move the downloaded file to the CLI plugins directory of Docker by running the following command:
   sudo mv docker-compose-$(uname -s)-$(uname -m) /usr/libexec/docker/cli-plugins/docker-compose

6. Make the Docker Compose file executable by running the following command:
   chmod +x /usr/libexec/docker/cli-plugins/docker-compose

7. Start and enable the Docker service by running the following command:
   systemctl enable docker.service --now

8. Add both the ec2-user and ssm-user to the Docker group by running the following commands:
   sudo usermod -a -G docker ec2-user
sudo usermod -a -G docker ssm-user

9. Log out and log in again to apply the changes.
10. To verify the installation, run the following command:

Hits: 885

When preparing a public AMI for AWS EC2, you need to delete lots of security stuff, like public keys, hosts and history. Run this as ec2-user

login to a new session, as even after all of this your commands from this session are only written to the bash_history file when exiting.

sudo rm ~/.ssh/authorized_keys /home/ec2-user/.ssh/authorized_keys /root/.ssh/authorized_keys /root/.ssh/known_hosts ~/.ssh/known_hosts /home/ec2-user/.ssh/known_hosts
sudo shred -u /etc/ssh/*_key /etc/ssh/*_key.pub
sudo shred -u ~/.*history
shred -u ~/.*history

Also see from our Blog:

Reset AWS AMI Windows 2016 and 2019 Password for use in Marketplace

Follow https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/building-shared-amis.html and this https://docs.aws.amazon.com/marketplace/latest/userguide/best-practices-for-building-your-amis.html

https://docs.aws.amazon.com/marketplace/latest/userguide/product-and-ami-policies.html

Hits: 1241

The  instructions below  expect a bunch of stuff to be pre-installed on the Windows EC2 server!

• IIS
• FastCGI
• php
• mysql – Maria works too but needs some file copied from Oracle Mysql anyway
• Rouncube unzippped as the root of IIS
• wacs – certbot script that installs the certs into IIS and creates cert files for hmail
• Hmailserver
• It also needs the php.ini file in the correct place. The hmail.ini files need to be C:\Program Files (x86)\hMailServer\Bin\

$rcmail_config['default_host'] = 'localhost';
$rcmail_config['smtp_server'] = 'localhost';
$rcmail_config['smtp_port'] = 25;

powershellCopy code

Set-PSDebug -Trace 2; foreach ($i in 1..3) {$i}

$maildomain = "mail.float.i.ng"

$mailaddress = "admin@$maildomain"

$NEWPASS = (New-Object System.Net.WebClient).DownloadString("http://169.254.169.254/latest/meta-data/instance-id")

New-WebBinding -Name "Default Web Site" -IPAddress "*" -Port 80 -HostHeader "$maildomain"

cd "C:\Program Files\win-acme.v2.1.19.1142.x64"

.\wacs.exe --store certificatestore,pemfiles --pemfilespath c:\certs  --source manual --host $maildomain  --certificatestore My --installation iis --installationsiteid 1 --accepttos   --emailaddress $mailaddress --setuptaskscheduler

sleep 3

.\wacs.exe --setuptaskscheduler

$hm = New-Object -ComObject hMailServer.Application

Change the value of $NEWPASS  to your password that you set when you installed hamilserver.

$maildomain = "mail.float.i.ng"  ## ask question what domain ?

$mailaddress = "admin@$maildomain"

# for automated installations on EC2,  the password will be your instance ID
#$NEWPASS = (New-Object System.Net.WebClient).DownloadString("http://169.254.169.254/latest/meta-data/instance-id")

$NEWPASS = "INSTANCE-ID"

#Create Cert from Letsencrypt

#cd "C:\Program Files\win-acme"

cd "C:\Program Files\win-acme.v2.1.19.1142.x64"

.\wacs.exe --source manual --host $maildomain  --certificatestore My --installation iis --installationsiteid 1 --accepttos   --emailaddress $mailaddress --pemfilespath c:\certs  --verbose

$hm = New-Object -ComObject hMailServer.Application

## remember to actually create  this user so letsencrypt can email

$hm.Authenticate("Administrator","$NEWPASS")  | Out-Null

$hmAddDomain = $hm.Domains.Add()

$hmAddDomain.Name = "$maildomain"

$hmAddDomain.Active = $true

$hmAddDomain.Save()

$Windows_SSLCert_Name = $maildomain

$SSLCert_KEY_Private = "c:\certs\$maildomain-key.pem"

$SSLCert_CRT_Public = "c:\certs\$maildomain-crt.pem"

$hm_SSLCert_New = $hm.Settings.SSLCertificates.Add()

$hm_SSLCert_New.Name = $Windows_SSLCert_Name

$hm_SSLCert_New.PrivateKeyFile = $SSLCert_KEY_Private

$hm_SSLCert_New.CertificateFile = $SSLCert_CRT_Public

$hm_SSLCert_New.Save()

# Add mailbox to domain

$maildomain = $hm.Domains.ItemByName($maildomain)

$hmAccount = $maildomain.Accounts.Add()

$hmAccount.Address = $mailaddress

$hmAccount.Password = "$NEWPASS"

$hmAccount.Active = $true

$hmAccount.MaxSize = 100

$hmAccount.Save()

DISABLE windows firewall if it is enabled, you won’t have access. You can configure the Windows firewall to allow all 4 ports.

Easy is superior to following long instructions! You can have this done for you in a pre-installed EC2 AMI image. See it at: AWS Marketplace: Hmailserver with Roundcube Webmail – Complete Windows Email Server (amazon.com)

Now test whether you can receive and send emails, setup your favorite email client with user admin@YOURDOMAIN and the password is what is set in $NEWPASS in the above script (INSTANCE-ID)

Restart the hmail server

Since you already ran the above script open hmailserver admin

for smtp port 25 select starttls optional, otherwise you won’t be able to get email from servers without certs. For extra sensitive security like HIPA you will need to use required

Select your cert that the script created

Press save, then Select no until you have setup all 4 port with your cert.

You can get started with an Email Cloud Server that is wonderful combination of MS Windows Server  and Open Source Software. It is available through AWS Marketplace as Hmailserver on Windows Server with Roundcube Webmail so that you can check email anywhere and from any device.

For ports other than 25 select starttls required, 110, 143, 587

If your hmailserver is still not available, reboot your Windows Server

To start installing a similar Cloud Email Server,  launch the Complete Linux Email Server with Webmail in the AWS Cloud. You can also install ARM64 / Graviton Complete Linux Email Server with Webmail

Troubleshooting

Run the hmailserver troubleshooter, put your domain in the right side.

In my case I had neglected to make an MX record, so nothing worked.

test ports from any Windows Powershell with the following, change Computername to your FQDN and port to whichever you want to test 443, 25, 110, 587 or 443 for secure WWW

Test-NetConnection -ComputerName localhost -Port 443

also from linux

dig yourfqdn MX

in addition to forgetting MX record, I apparently left out setting the ssl cert for default IIS website.

My issue in the end was having default website for 443 mis-set

Run

Get-WebBinding

than remove the old ones, change the port and host name

Hits: 585

Using Roundcube exclusively gives “An Error occurred! Server Error: UID COPY: The folder could not be found” as it doesn’t create the Trash, although it does create a “sent mail” when you send your first email message and drafts if you save a message that you are editing. When you use the Outlook client it creates the “Trash” folder if it’s not found. I might have seen this with Linux mail servers.

I will add it to the standard instructions. It is , indeed , a proverbial pain in the beee-hind.

If you follow the instructions at this link , the email gets UTTERLY deleted instead of being placed in a deleted folder.

https://forums.cpanel.net/threads/roundcube-error-when-deleting-messages.243592/

You can see in the HmailServer panel that just saving without creating the Trash folder does not create the folder.

Instead, You need to manually create the Trash folder within each account in RoundCube.

When you try to delete the messages, you get the Error. “An Error occurred! Server Error: UID COPY: The folder could not be found”

In order fix this you need to add the Trash folder manually. So Click the cog in the bottom of the lower left panel then select manage folders.

Now Click the Plus button in the middle column,  Then Click the cog in the middle panel, and add a folder named “Trash” I always use a capital letter “T”, but am not sure if it will work with a small tee. Then click save.

Now the trash Folder will be created.

Deleted messages will be deleted.

If you followed other directions that tell you to just save the special folder settings before creating the settings, you will need to add the additional step of going back into the special folder settings, under preferences, and now select “Trash” from the Dropdown menu for Trash.

Hits: 143

Type N create certificate or just enter as it is the default

Select M for Manual input then 2

then type in your domain name that you already assigned with your DNS

press enter again, then select 2

2: [http-01] Serve verification files from memory

then take all of the default until you have a certificate installed

Once the cert is installed your site will magically have a lock to https:\\

This command also works

.\wacs.exe –source manual –host hmail.float.i.ng –certificatestore My –installation iis,script –installationsiteid 1 –script “Scripts\ImportRDSFull.ps1” –scriptparameters “{CertThumbprint}”

.\wacs.exe –source manual –host YOUR-FQDN  –certificatestore My –installation iis,script –installationsiteid 1 –script “Scripts\ImportRDSFull.ps1” –scriptparameters “{CertThumbprint}”

.\wacs.exe –installation iis,script –store CertificateStore,pemfiles –source manual –host mailsdf.float.i.ng –certificatestore My –installationsiteid 1 –script “Scripts\ImportRDSFull.ps1” –scriptparameters “{CertThumbprint}” –accepttos –emailaddress webmaster@floatingcloud.io –pemfilespath c:\certs –validation route53 –route53accesskeyid mykey –route53secretaccesskey private –verbose

As you can see , it gets scheduled in task scheduler

Hits: 214

Take control of your email domains and allow others to do the work Postfix Admin UI

In the add domain admin you need to allow each domain to be controlled. For security purposes admin privileges are limited. So you need to select like in the picture, when adding the admin.

The following instructions are for the Complete Linux Email Server with Webmail in the AWS Cloud. You can also install ARM64 / Graviton Complete Linux Email Server with Webmail . This include Postfixadmin for easily adding users, as well as HTTPS SSL Certificates. You can easily launch them.

When adding an extra domain I suggest that the new MX record point mx record that is the first one that you used to create the server, as the ssl certificate is created for that domain. Let me know if you want me to explain this.

The second domain only becomes visible when you add it to the list of domains that the admin can see. This is because you can have several admins with divided responsibilities.

So go into the admin UI that you alluded to before.

launch the Complete Linux Email Server with Webmail in the AWS Cloud. You can also install ARM64 / Graviton Complete Linux Email Server with Webmail . This include Postfixadmin for easily adding users, as well as HTTPS SSL Certificates.

Now that you missed that you do not need to delete the admin user. Just select admin list. Then edit

In the edit window you will see the list of domain names. Select them, make sure active is still selected. The choose save changes.

Now you’ll see the domain name in the window screen that you sent me,

Hits: 454

Setup an Alias in Postfix Admin UI in Floating cloud Postfix server

It’s really simple even if you don’t want an alias.

Log into the  admin area as user even if the user has admin rights, press “Users click here to login to the user section.”

When logging in you get a menu to forward or change password, obviously users can change the password here.

IN the Forwarding box add the address it needs to be sent to , make the appropriate Choices. Press save, THEN TEST it please.

Hits: 285

Powershell Command

Here is the Powershellcommand to open the ports needed by HmailServer on Windows Server 2019 and others.  Open the Powershell as Administrator.

New-NetFirewallRule -DisplayName "Mail Ports HMS" -Direction inbound -Profile Any -Action Allow -LocalPort 25,110,143,587 -Protocol TCP

You will see the rule in the Firewall UI under inbound rules.

Hits: 4600

In Windows there are always multiple ways to install stuff like CGI

I will follow the installation steps of the PHP 8 Non Thread Safe version on a Windows Server 2019 Standard Evaluation (Desktop Experience) operating system what needs IIS and CGI to be installed. Install first the IIS (Internet Information Services) by opening Server Manager where we have Manage, Tools, View and Help menus. At Manage we click on Add Roles and Features and for IIS installation on Server Roles select Web Server (IIS), then Add Features and Next after selecting. At Role Services, expand Application Development and select CGI (Common Gateway Interface). We still have a final Next and then Install.

Php is built with C++ and needs the visual studio runtime installed.

You can get started with an Email Cloud Server that is wonderful combination of MS Windows Server  and Open Source Software. It is available through AWS Marketplace as Hmailserver on Windows Server with Roundcube Webmail so that you can check email anywhere and from any device.

Now Download and install Microsoft Visual C++ Redistributable Package by going to the latest supported Visual C++ downloads and download the latest version of the Microsoft Visual C++ 2015-2019 Redistributable (x64) – 14.22.278.21 (x64: vc_redist.x64.exe) and install it;

Download the latest php non thread safe 64 from  https://windows.php.net/download/ , extract it to a dir like c:\php8

In server manager choose

web Server (IIS)

I had installed the web server first without Adding CGI feature, thaen I couldn’t find the option to add the feature to IIS. After a day off my brains worked better, You need to press the little arrow in the add server roles for Web Server IIS, then Web Server, then application Development, under there , is CGI

Now finally, I I have the CGI option and FastCGI in the Add Handler mappings in the IIS Manager.

TO add php as fastcgi add a new handler and fill it out.

Request path: *.php

Module: FastCGIModule

Executable: C:\php8\php-cgi.exe

Name: PHP with FastCGI

Now edit the fast cgi settings from the service manager, they miraculously should have appeared.

Click on the fastci php-cgi.exe that you previously added, now add

The Edit FastCGI Application was opened and at FastCGI Properties under General\Environment Variables (Collection) click on the three dots … next to the work “Collection”

Now Add these values as follows:

Under Members click Add and for the Name Properties we change Name: PHP_MAX_REQUESTS and VALUE: 5000 then click OK to save the changes;
OK to exit from Edit FastCGI Application and come back to the FastCGI Settings and we can close Internet Information Services (ISS) Manager;

Now open a Powershell Window as Admin

To restart IIS open the Comand Prompt or PowerShell and type iisreset

C:\Users\Administrator>iisreset

Now go into the php dir and check if php is working on your server as a language. Run the following:

PS C:\php8> .\php.exe -info

You should see a ton of settings instead of an error.

You should also verify that PHP works with IIS. Create the following file, but delete when your finished as giving server information can invite attackers, if they see that your old version of php is vulnerable.

create a file called info.php and insert into it the following

the C:\inetpub\wwwroot directory and create info.php

Just this line of code in the file:

<?php phpinfo(); ?>

after you save it open http://localhost/info.php

The next project will be to do this totally in a script from ansible.

Hits: 99

Install Maria DB on Windows

Maria DB started as a fork from MySql, when MySQL was aquired by Oracle. Fears that Oracle would throttle Mysql have not happened and Oracle continues to develop MySql. However it is very UN-fun to login to Oracle and sign their incredibly long “I agree” before downloading.

Download MariaDB Products & Tools | MariaDB

Next to OS select MS Windows (64-bit)

CLick on the downloaded icon to start the installation.

click , next, next, until you get to the Password, supply a Password, I click the button that sets the charachter set as UTF8, this gives you support for foreign language charachters.

Click next then accept the defaults. However, if you plan to use this server on as a DB server you should make the buffer much larger, so that you can use the free memory.

Now complete the installation.

To start using your DB click the MySql Client. When prompted for the password give the root password that you assigned earlier.

You can start developing your DB. You should add a user with remote access, as we did not allow remote root access. If your importing a full DB with the root Mysql DB, this will also import your old users.

Create a User in MariaDB

Creating a user that has access from anywhere, I am using the username floating, but you can use whatever you like, the word float is the password, so change that

CREATE USER 'floating'@'%' IDENTIFIED BY 'float';

The following gives users full root admin privleges:

GRANT ALL PRIVILEGES ON * . * TO 'floating'@'%';

If you don’t want the user, create it with only localhost access

CREATE USER 'newuser'@'localhost' IDENTIFIED BY 'password';

GRANT ALL PRIVILEGES ON * . * TO 'floating'@'localhost';

Hits: 155

Confusion About Postfix Logs

There is a lot of confusion around how to read and manage Postfix logs, these can include Dovecot or other Mail Transfer Apps.

You should be using the Automated Docker Compose installation of Postfix, Roundcube Webmail, Dovecot and Certbot that makes https certificates

Simplest Way to view Postfix Logs

To see the logs, after you login via ssh or AWS SSM enter one of the following:

docker logs postfix
docker logs roundcube
docker logs dovecot
docker logs certbot
docker logs nginx

These logs are limited to 50 GB each, so it wont fill your disk with Postfix logs.

Only Certbot keeps some logs outside of docker, these are in opt/postfix-containerized/docker-volumes/var/logs

Hits: 1894

Postfix Hardening for Security and Privacy

Harden Your Postfix Email Server

Postfix Hardening Guide for Security and Privacy – Linux Audit for GDPR, HIPAA , ITAR . Don’t use gmail Gsuite, get your own corporate server.

Start Hardening postfix by installing a new Postfix Email Server with Webmail, Https Cert, Easy User Admin following this you will have a simple to use and hardened Postfix Email Server. Simple to use always best for Cyber Security, since complicated stuff has more friction allowing hackers to get in.

It Seems that presently so many need to have their emails in Postfix Hardend and secured. Did you know that according to GDPR you need to be able to delete every email interaction with EU folks?

The flip side of this is that health professionals need a permanent record of every interaction that is not editable or deletable.

We work with you to keep your Corporate emails up to regs.

Hits: 1248

sometimes you  cannot use SES, But the users still want their messages delivered. so here is some info. I hope that it is helpful.

hmail-servernamecheap

shareedit

edited Apr 12 at 17:43

asked Apr 12 at 14:56

Kayot

12310

I can’t see a TXT record for dkim._domainkey.linnabary.us. How does the signature of a test email look? Does it contain the correct domain (d=linnabary.us) and selector (s=dkim)? Also, don’t use online tools to generate secret keys! Use openssl or similar to generate them on your machine. The site you link to sends you a public/private key pair in the response of a POST request. Even if they say they don’t save it, there is no way to check wheather they really don’t, so that key should be seen as compromised already when you get it. – mataApr 12 at 15:33

Source: hmail server – DKIM hmailserver and NameCheap Setup – Stack Overflow

Hits: 527

BE SURE!!! to back up your ec2 as an image  from in the AWS Web UI console.

The Best way to have a completely secure Postfix server tnat can use ses, is to install our simple to install EC2 including Roundcube WebMail. Check it out AWS Marketplace: Mail Server on Linux Postfix using MySQL for tons of users (amazon.com)

create useless sasl file for those who want AWS SES · Issue #4 · montgomery-auber/postfix-containerized (github.com)

https://docs.aws.amazon.com/ses/latest/DeveloperGuide/smtp-credentials.html?icmpid=docs_ses_console

sudo postconf -e “relayhost = [email-smtp.us-west-2.amazonaws.com]:587” \
“smtp_sasl_auth_enable = yes” \
“smtp_sasl_security_options = noanonymous” \
“smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd” \
“smtp_use_tls = yes” \
“smtp_tls_security_level = encrypt” \
“smtp_tls_note_starttls_offer = yes”

Lines got connect using postconf

In a text editor, open the file /etc/postfix/sasl_passwd. If the file doesn’t already exist, create it.

Add the following line to /etc/postfix/sasl_passwd:

[email-smtp.us-west-2.amazonaws.com]:587 SMTPUSERNAME:SMTPPASSWORD

At a command prompt, type the following command to create a hashmap database file containing your SMTP credentials:

sudo postmap hash:/etc/postfix/sasl_passwd

email-smtp.us-east-2.amazonaws.com

SMTP Username:
LongNAME
SMTP Password:
CONFUSINGPassword

Add the following line to /etc/postfix/sasl_passwd:

email-smtp.us-west-2.amazonaws.com:587 LONGSECRET

The postconf command was combining the last line of the previous main.cf with one of the lines in the command below. This is because the main.cf did not have a line ending at the end of the file.

docker exec -it postfix postconf -e “relayhost = email-smtp.us-east-2.amazonaws.com:587” \
“smtp_sasl_auth_enable = yes” \
“smtp_sasl_security_options = noanonymous” \
“smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd” \
“smtp_use_tls = yes” \
“smtp_tls_security_level = encrypt” \
“smtp_tls_note_starttls_offer = yes” ### THis line got smushed by postconf

The smushed line looked like this

smtpd_tls_auth_only = yessmtp_tls_note_starttls_offer = yes

the first half of the line is not part of the postconf command

Ask permission

You need to request from AWS to allow you to send emails via SES. They apporve you as long as it’s clear that you wont send spam.

Quota details – Sending quota | AWS Service Quotas (amazon.com)

It is best to use SES to send emails, however the server is setup to send emails too.

In order to send email via SES you need to get permission as well as to add the addresses and domains.

See:

Integrating Amazon SES with Postfix – Amazon Simple Email Service

when running postconf the last line without line ending gets combined with one of the lines in the postconf command
“`

docker exec -it postfix postconf -e \
“relayhost = email-smtp.us-east-1.amazonaws.com:587” \
“smtp_sasl_auth_enable = yes” \
“smtp_sasl_security_options = noanonymous” \
“smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd” \
“smtp_use_tls = yes” \
“smtp_tls_security_level = encrypt” \
“smtp_tls_note_starttls_offer = yes”

“`

the above would end up looking like

`
smtpd_tls_auth_only = yes
inet_protocols = ipv4smtp_tls_note_starttls_offer = yes
smtp_tls_security_level = encrypt
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
relayhost = email-smtp.us-east-1.amazonaws.com:587
smtp_sasl_auth_enable = yes
`
The line starting with inet_protocols got combined

See – Add line ending to the end of /etc/postfix/main.cf · Issue #3 · montgomery-auber/postfix-containerized (github.com)

The line starting with inet_protocols got combined

The solution was to add the last line to the postconf command , then it worked.

```

docker exec -it postfix postconf -e \
"inet_protocols = ipv4"  \
 "relayhost = email-smtp.us-east-1.amazonaws.com:587" \
"smtp_sasl_auth_enable = yes" \
"smtp_sasl_security_options = noanonymous" \
"smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd" \
"smtp_use_tls = yes" \
"smtp_tls_security_level = encrypt" \
"smtp_tls_note_starttls_offer = yes" 

Instructions to add aws ses support to postfix, based on:
http://www.postfix.org/SASL_README.html

To make this possible, Postfix supports per-sender SASL passwords and per-sender relay hosts. In the example below, the Postfix SMTP client will search the SASL password file by sender address before it searches that same file by destination. Likewise, the Postfix trivial-rewrite(8) daemon will search the per-sender relayhost file, and use the default relayhost setting only as a final resort.

/etc/postfix/main.cf:
    smtp_sender_dependent_authentication = yes
    sender_dependent_relayhost_maps = hash:/etc/postfix/sender_relay
    smtp_sasl_auth_enable = yes
    smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
    relayhost = [mail.isp.example]
    # Alternative form:
    # relayhost = [mail.isp.example]:submission

/etc/postfix/sasl_passwd:
    # Per-sender authentication; see also /etc/postfix/sender_relay.
    user1@example.com               username1:password1
    user2@example.net               username2:password2
    # Login information for the default relayhost.
    [mail.isp.example]              username:password
    # Alternative form:
    # [mail.isp.example]:submission username:password

/etc/postfix/sender_relay:
    # Per-sender provider; see also /etc/postfix/sasl_passwd.
    user1@example.com               [mail.example.com]:submission
    user2@example.net               [mail.example.net]

http://www.postfix.org/postconf.5.html
https://docs.aws.amazon.com/ses/latest/DeveloperGuide/postfix.html

Hits: 281

Postfix Hardening Guide for Security and Privacy

Postfix Security and Privacy

Postfix is one of the most used components on a server that needs to receive or send emails. With all its options available, it is easy to have a weak configuration. This security guide looks into Postfix hardening, to increase the defenses against spam, abuse, and leaking sensitive data.

start installing a Cyber Hardened postfix without hassles. Quickly Install  Postfix, Dovecot, Postgres, Letsencrypt certificate and Roundcube, launch the Complete Email Server with Webmail in the AWS Cloud.

Enable SASL authentication.

# Enable SASL authentication
smtp_sasl_auth_enable = yes
# Disallow any methods that do allow anonymous authentication
smtp_sasl_security_options = noanonymous
# Define the sasl_passwd file location
smtp_sasl_password_maps = hash:/etc/postfix/sasl/sasl_passwd

The Best way to have a completely secure Postfix server is to install our simple to install EC2 including Roundcube WebMail. Check it out AWS Marketplace: Mail Server on Linux Postfix using MySQL for tons of users (amazon.com)

Now we will edit the /etc/postfix/sasl/sasl_passwd file.

[mail.example.org]:587 username:password

This file can be parsed by postmap to created an optimized version, which is used as the database for lookups.

postmap /etc/postfix/sasl/sasl_passwd

The last part is configuring encryption. To enable this, we have to configure this separately.

# Enable STARTTLS encryption
smtp_use_tls = yes
# Location of CA certificates
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt

Now restart Postfix, and send a test email.

echo “test” | mail -s “test” me@example.org

Related and useful commands

• postqueue -f (flush mail queue and retry delivering all emails)

Cryptography, encryption, and privacy

Enable TLS logging

To see the details from TLS, increase the level of Postfix logging. Set smtp_tls_loglevel (outgoing) or  smtpd_tls_loglevel (incoming) to the value one (1).

postconf -e smtp_tls_loglevel=1

Testing keys

With OpenSSL you can easily test your SMTP configuration and related ciphers. One of the areas to test is the strength of the initial connection handshake. This is typically done with the Diffie–Hellman (DH) algorithm, that exchanges the cryptographic keys.

echo | openssl s_client -starttls smtp -connect localhost:25 -cipher "EDH" 2>/dev/null | grep -i -e "Server .* key"

Note: you need at least version 1.02 of OpenSSL, otherwise not all details are displayed. Use openssl version to double check that you are on a recent version.

This command should give you two lines of output. The first line is the temporary key and should be at least 1024 bits when using DH, to prevent the Logjam attack.

Server Temp Key: DH, 2048 bits

The second line is the public key size. This will typically be a 2048 bit key (or higher) on modern systems.

Server public key is 2048 bit

Hits: 2969

Register a domain with Route 53

Many people get stuck setting up an EC2 Instance as a  mail server. Did you send a test message to your new instance and never receive the email ? To set up a mail server you first need the MX record to be properly setup in Route 53 or in Your DNS. Some of our Floating Cloud Clients  get stuck setting up there Mail Servers. The best way to start is to first purchase your domain from AWS Route 53, that way it is easiest to set up.  I like to purchase domains from AWS because the price doesn’t change from the second year on.  Many domain registrars  charge you only a couple of dollars to register a domain for a year, but then will charge you up the wazoooo for the following years.

It’s very simple to install an email server with Postfix, Dovecot, Postgres and Roundcube Webmail. Here are the instructions to configure Postfix Email Server

These instructions assume that you purchased the domain from Route 53. To purchase a domain from AWS via Route 53 go to: https://console.aws.amazon.com/route53/home#DomainRegistration:

After Registering your domain Route 53 sets up a “hosted zone” for you this includes an SOA – Start of Authority Record and NS record that tells the universe what servers know your real IP addresses. I failed a job interview not know what an SOA was, so be sure to remember it!

Elastic IP Address

Once you have registered your domain you can use your Elastic IP address for the A record for the DNS. Do not use an assigned IP address when you launch and EC2!!! This changes when you shutdown then re-launch the instance. See https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html

To get an Elastic IP Address for your EC2 Instance open your EC2 console Panel. In the left column go all the way down until you see Elastic IP addresses, select that. It is under Networks and Security. Then click on the blue button at the top “Allocate New Address”, then Allocate in the next screen. Then you will receive an Elastic IP Address.

Now you need to assign the IP Address to the EC2 Instance that you previously launched.  You should label your EC2 instances, then when it is easy to remember which instance is which in these kind of configurations. You can click on your new IP address that will appear or select it from the list of Elastic IPs that has now started.

Right Click on your IP Address from with the list of IPs and select “Associate Address”

Select from the list of instances your Instance that needs the IP Address, then click the blue “Associate” button

Setup the Route 53 DNS

Now you can setup the DNS with your instance.

Copy your Elastic IP Address number from list of Elastic IPs

Now go into Route 53 from the services drop down menu at the top of your Console Panel. It is under Networking & Content Deliver in the lower left, but might move.

Then click on Hosted Zones, since you purchased your domain from AWS they set this up automatically.

Now Select your domain name from within the list of hosted zones. For our demonstration purpose we will set up a domain called test.floatingcloud.io, so that we can eventually receive email to username@test.floatingcloud.io . There are many ways to set up DNS and MX records but we are keeping it simple.

Select create Record Set. In the right window next to “Name” write your subdomain name if you have one or leave it blank for Top Level. Next to value paste your Elastic IP address.

Now you have set up an A record.  You can connect to it via SSH or RDP, if it has a working webserver, your domain will now work.

Now we need to point out MX record the server. the MX record tell the internet where to send mail. You can have an A record with an entirely different domain name receive mail on behalf of different domain. For instance you can have an A record for mail.yourdomain.com and point the MX record for the Top Level Domain yourdomain.com and recevie email to user user@yourdomain.com . But we are keeping it simple here, using the same sub-domain name for both A and MX records.

So again select “Create Record Set” at the top of the window. In the drop down menu in the same right window select MX Record.

Now in the Value window put the number 10 before the domain name, then a space followed by your domain name of the above A record. Next to name type in your subdomain, if you are using one or leave it blank if it is top level. The number represents priority, if you later setup and backup mail server, you give this a higher number for it to be used only if the first one is down.

You should now have it all set up. You should now try to send email to an existing user at your mailserver.

Hits: 964

Using AWS Session Manager you can connect to your instances via Web Console instead of SSH. This is similar to what was always offered by Azure and Google Cloud.

Then Select Session Manager

If you see that its greyed out, you need to still configure it.

So instead go to ssm manager  Quick Start 

Now select get started on the left side, If you dont see get started  in correct home region, it’s because you have set it up before.

Select Create

Select Host Management , then next

Select Like in the following image, or suit your own needs, this keeps instances safe, Towards the bottom I selected Add required IAM policies, as well as “current account” for targets choose regions, I like to select all, and leave all instances selected., then click create. It might take a few minutes.

Selecting just the region you need now is much quicker than selecting all.

At the end of this you will now have an IAM role named AmazonSSMRoleForInstanceQuickSetup

Now when you select connect to Session Manager the Connect Button should now be Orange

Select Connect

Now you can run stuff, If using Amazon Linux , you will even have sudo access.

Hits: 148

I am installing my easy to install floating cloud email server in AWS Marketplace: 

I am in the Final test stages. I have implimented only a small amoiunt of spam protection, however this is enough to block the biggest spammer in the multiverse. The blocked ip address is owned my google and used to send email: nslookup 209.85.222.182
182.222.85.209.in-addr.arpa name = mail-qk1-f182.google.com.

I have installed this on AWS EC2 and requested that AWS lift smtp restrictions. I also use AWS SES. Neither is llisted by sorbs.

Hits: 496

HATE Gmail?

Update Nov 4, 2021

This opensource project now works. You can easily install it.

To start installing, launch the Complete Email Server with Webmail in the AWS Cloud.

Everyone hates Gmail and some put up with hotmail. A personal email server is best to have. We have helped people to install a great email server on Windows, but linux was too complicated for ordinary folks.

We stopped installing the Windows Hmail Server, since Windows Vulnerabilities  have been frightening and we couldn’t keep up with the patching.

https://github.com/montgomery-auber/postfix-containerized/

postfix, postfixadmin and pgsql working together in a container. It can receive as well as send email.

In order for it to work you need to have dns and mx records point towards it.

Here is my blog directing you how to setup AWS Route 53 with A and MX DNS records.
https://floatingcloud.io/setup-mx-record-in-route-53-with-a-domain-that-you-registered-with-aws/

Postfix Containerized Version 1 has only only MBOX, it does not have POP3 or Imap support, You can add users in postfixadmin.

run docker-compose up -d

IN Postfix admin first go to http://YOURDOMAIN/setup.php

The secret password is topsecret99

after creating an admin user login with it at http://YOURDOMAIN/login.php

Here you can manage domains and users.

The mail received  is in the linux path ./var/mail/domains/YOURDOMAIN

You can see about Postfix admin at http://postfixadmin.sf.net  

and https://github.com/postfixadmin/postfixadmin

Hits: 870

I would like to containerize my sites, especially this FloatingCloud.io site.

Here are some links that I will use for guidance, wish me luck.

• https://blog.kontena.io/running-your-wordpress-site-in-containers/ – This uses Docker build instead of the official image from Docker Hub
• http://roycornelissen.com/walking-the-talk/
• https://stephenafamo.com/blog/moving-wordpress-docker-container/ – Uses NginX reverse proxy
• https://www.sitepoint.com/how-to-use-the-official-docker-wordpress-image/
• https://stackoverflow.com/questions/45714456/how-to-migrate-docker-volume-between-hosts
• https://docs.docker.com/storage/volumes/#backup-a-container
• https://medium.com/@pybrarian/mysql-databases-that-dont-retain-data-293bc2ed7f02
• https://hub.docker.com/_/wordpress/
• https://www.wpexplorer.com/migrating-wordpress-website/ – uses initdb.d

• create an instance with docker and docker-compose
• copy over the database export with “mysqldump –u[user name] –p[password] [database name] > [dump file] “and a tarZ of the wp-content files
• create dirs to store the wp-content, this will be a docker mounted volume
• create initdb.d dir to be mounted as a volume, put the sql export in there. mysql reads and runs that if it’s DB dir is empty
• edit the docker-compose.yaml file below, you might want to delete the table_prefix if you use the default wp_
• run “docker-compose up” after it work re-run with “docker-compose up -d”
• It takes a while to work, after you get can’t connect to DB errors, the db does magically come up
• account www or apache should be created on the server and ownership of the files should go  to it, indeed perhaps create this user in docker group too without root access, for security. I used Ubuntu 19 which comes with user www-data so I just changed the owner to that for www-content, then I was able to update the plugins.

version: '2'

services:
  db:
     image: mysql:5.7
     restart: always
     ports:
      - "3306:3306"
     environment:
       MYSQL_ROOT_PASSWORD: wordpress
       MYSQL_DATABASE: wordpress
       MYSQL_USER: wordpress
       MYSQL_PASSWORD: wordpress
     volumes:
        - ./database/data:/var/lib/mysql
        - ./database/initdb.d:/docker-entrypoint-initdb.d
  website:
     image: wordpress:latest
     working_dir: /var/www/html
     depends_on:
        - db
     ports:
        - "80:80"
     volumes:
        - "/home/steve/wp-content/:/var/www/html/wp-content/"
     restart: always
     environment:
       - WORDPRESS_DB_HOST=db:3306
       - WORDPRESS_DB_PASSWORD=wordpress
       - WP_DEBUG=true
       - WP_DEBUG_LOG=true
       - WP_DEBUG_DISPLAY=true
       - WORDPRESS_TABLE_PREFIX=linuxguru_

Hits: 836

ComputeOvsDpdkParameters:
    KernelArgs: "default_hugepagesz=1GB hugepagesz=1G hugepages=120 intel_iommu=on iommu=pt"
    OvsPmdCoreList: "17,53,35,71"
    OvsDpdkCoreList: "0,36,18,54"
    ##  OvsDpdkMemoryChannels  should be 4 (default), refer to Hardware Manual or run  dmidecode -t memory
    OvsDpdkMemoryChannels: "4"
    ##  OvsDpdkSocketMemory: "1024,1024" is the recommended setting without dpdk nic
    OvsDpdkSocketMemory: "1024,4096"
    TunedProfileName: "cpu-partitioning"
    NovaReservedHostMemory: 4096
    OvsEnableDpdk: true
    ## IsolCpusList A set of CPU cores isolated from the host processes. except for dpdk. Match the list of cores in OvsPmdCoreList and NovaVcpuPinSet.
    IsolCpusList: "1-17,19-35,36-53,55-70"
    ## NovaVcpuPinSet Sets cores for CPU pinning. not pmd ??? Exclude all cores from the OvsPmdCoreList and the OvsDpdkCoreList.
    NovaVcpuPinSet: ['1-16,19-34,37-52,55-70,']

Hits: 2036

Perfect MongoDB upgrade instructions from 3.4 to 3.6

Run these instructions on each Windows Server with MongoDB 3.4

First Backup each server with an image. In case something breaks an image can be launched like the original. Snapshots are very hard to recover an OS from, so be sure to do an Image. Do this in the AWS EC2 panel, right click on each instance and select  Image then create image.

Run Windows update – from search next to start type windows update, then click to check for updates. Reboot, at the end. Windows Update can take over an hour.

Open a PowerShell window. The default installation of MongoDB on Windows Server 2016 is local without a password. BTW – in 3.6 you can only connect remotely with a password. IN the PowerShell window type “mongo”

At the MongoDB prompt type

db.adminCommand( { setFeatureCompatibilityVersion: “3.4” } )

Close the Powershell Window

Open the Browser and download the installation file for MongoDB 3.6. This is the official mongodb website download.

https://fastdl.mongodb.org/win32/mongodb-win32-x86_64-2008plus-ssl-3.6.13-signed.msi

Before installing 3.6 stop and disable the mongod service which runs 3.4. Type the word “services” into the Windows search, next to “Start”. Scroll down to Mongodb and stop it, right click and open properties, then set it to disabled. It might show an error when you stop, but don’t worry about it, just make sure that it’s stopped.

Now install by running the downloaded file.

Run the MSI installation file that you downloaded, Not the previous version that is also in the Downloads dir. mongodb-win32-x86_64-2008plus-ssl-3.6.13-signed.msi

Select Complete Installation.

Be sure to UNCHECK the option for Compass. It’s small and easy to miss.

After the installation is successful add the new installation as a service. Run a CMD prompt as administrator. In the search next to “Start” type “cmd” but don’t just press enter. Right click on the

icon and select “run as administrator”. It doesn’t work in PowerShell, even as administrator.

Paste the following into the cmd window, by right clicking.

sc.exe create MongoDB36 binPath= “\”C:\Program Files\MongoDB\Server\3.6\bin\mongod.exe\” –service –config=\”C:\Program Files\MongoDB\Server\3.4\mongod.cfg\”” DisplayName= “MongoDB36” start= “auto”

It should say that it was successful

Now go back into the services. Refresh the list if you don’t see Mongodb36. Right click on MongoDB36 and select start. It should also start without issues.

The MongoDB server is now updated. All APIs, etc. will be calling 3.6

You still need to switch the MongoDB Client run 3.6. All that needs to be done now is to change the PATH so that it runs the 3.6 executble

From start search “System Environment Variables”. Click the environment variables button and edit both administrator and system variable, just change 3.4 to 3.6 in the mongodb path, just switch the 4 for a 6

Open a POwershell windows, Run the Mongo Command and see that you now have 3.6

now try

db.adminCommand( { setFeatureCompatibilityVersion: “3.6” } )

Congratulations, Now you can benefit from the new features of MongoDB 3.6

To see the working version enter at the mongo prompt:

db.adminCommand( { getParameter: 1, featureCompatibilityVersion: 1 } )

It will now show that it is version 3.6

Reboot, and check that all is fine.

Here are some links that I used for my research.

https://ginesys.atlassian.net/wiki/spaces/PUB/pages/1900549/How+To+Set+the+PATH+variable+in+environment+variable+in+Windows

http://dochub.mongodb.org/core/3.6-upgrade-fcv

https://docs.mongodb.com/manual/release-notes/3.6-upgrade-standalone/a

https://stackoverflow.com/questions/42398139/how-to-upgrade-mongodb-on-windows-server

https://docs.mongodb.com/manual/tutorial/insert-documents/

https://docs.mongodb.com/manual/tutorial/upgrade-revision/

https://docs.mongodb.com/manual/tutorial/install-mongodb-on-windows/

https://www.mongodb.com/download-center/community?jmp=docs

https://docs.mongodb.com/v3.6/tutorial/install-mongodb-on-windows/

https://appuals.com/how-to-fix-error-1067-the-process-terminated-unexpectedly/

https://stackoverflow.com/questions/51095435/create-the-mongodb-windows-service-command-does-nothing

Hits: 1981

CoreOS Container Linux is more secure and compact than others.  I installed docker-compose with the following script from https://gist.github.com/sourcec0de/5cf7d36a5f696c2ffc68

#!/bin/bash

mkdir -p /opt/bin
LATEST_URL=`curl -Ls -o /dev/null -w %{url_effective} https://github.com/docker/compose/releases/latest`
COMPOSE_VERSION=${LATEST_URL##*/}
DOWNLOAD_URL=https://github.com/docker/compose/releases/download/${COMPOSE_VERSION}/docker-compose-`uname -s`-`uname -m`

curl -L ${DOWNLOAD_URL} -o /opt/bin/docker-compose
chmod +x /opt/bin/docker-compose

Hits: 560

db.removeUser()

Hits: 502

https://blog.zerosector.io/2018/04/04/mailcow/amp/

https://mailcow.email