efa-project.org

if everything is configured well, it should works.
what is your question ?

Hi We have this configured on a production and it does works fine. i dont know which FW are you using but it smart to configure a relay in case one of the EFA is down the emails keeps working. | FW | --> | new mail relay | --> | eFa | --> | Mail Server| Configure the Mail Server to hand out the emai...

Make sure you do have the below on the mailscanner config file.

Hi,
Do you have port 80/443 nat to your EFA ?

Hi Shawin,
i've noticed this last day too on one of our EFA. so i beleive it some kind of DDos or brute force.
i am working with Paul in order to configure fail2ban in order to provide some security.
lately we have a IDS in front of the EFA which keeps the logs clean.
EFA is working fine now

The first question is: can you see from your apache access logs, or error log or any log something that you could define as a brute force attack? If yes, then we can make a fail2ban rule to block the attempts. If not, then fail2ban won't help. If you can show me some examples errors, I can help you...

I can translate, Arabic, Frans, Dutch

Welcome here

possibly. did you configure the exchange transport to send mail to efa as the smarthost for exchange, or is the exchange server sending the mails out directly, bypassing exchange? Hi Paul, yes exchange is configured to send emails out using the efa as it smarthost. We do have one "send connect...

Hi Guys, We have configured EFA as next EFA is smarthost of the exchange. EFA WAN IP is 1.1.1.1 DNS name is EFA@Domain.com Exchange WAN IP is 1.1.1.2 DNS name is mail@domain.com We have configured the EFA to hand out / recieve the emails with spammy help on the IRC. When we send our emails the arriv...

Sure. Assuming that there is a recognizable pattern in some log files, you can configure Fail2Ban to watch for it and block appropriately. The first question to ask yourself, is how do you know you are being brute forced? (i.e. does that show up in the log files in a recognizable pattern). Once you...

pdwalker wrote: ↑18 Apr 2018 12:04 Whoops. I missed this earlier.

jamerson, did you ever resolve your problem?

Thank you paul,
yes its been running for couple of weeks now with the 443 open to the internet.
waiting for the v4 hopefully it will support fail2ban on the smtp and https.

Hi Paul,
Our EFA has a https over the internet so the users on the go can release their emails.
so the https://efa.domain.com is open on the internet i want to include the fail2ban to block the brute force ip over the internet.
is this possible to configure with fail2ban ?

Hi guys, i know this a old post. i just want to share i just configured this on the latest version of the EFA 4/16/2018 ) EFA-3.0.2.6. of today and it does works. i want to configure the log /etc/fail2ban/jail.conf Can we config the fail2ban to block the https too when they try to access the EFA ove...

Thank you ,
we have configured and its up and running.
big thank you for the link.

Hi PDwalker,
thank you for your answer.
i would love to know how to configure the fail2ban on the EFA?
i just looked on the forum but can't seem to find something.

thank you

Hi Guys, Today i have found those logs on the EFA. those logs keeps showing up. Mar 27 02:39:31 filter postfix/smtpd[26541]: connect from unknown[91.234.99.215] Mar 27 02:39:31 filter postfix/smtpd[26541]: warning: unknown[91.234.99.215]: SASL LOGIN authentication failed: authentication failure Mar ...

We have the same configuration up and running
on the your Exchange you need to configure it to send using smarthost, the smarthost is going to be your EFA IP/FQDN.
note: please make sure your Exchange IP is on the EFA whitelist configured.

the EFA is build to block spam,
if it detect spams means it well configured and you should be happy that it does detect spam

pdwalker wrote: ↑09 Mar 2018 16:26 Can you give me the spam report for that blocked message?

I've provided you the screenshot and report you asked for.
do you mean something else ?

As I do not understand your setup, just want to point out that I see IPv6 EX02.domain.comlan ([::1]) and IPv4 EX02.domain.comlan (192.168.4.5). mixed for the same host. Received: from EX02.domain.comlan (192.168.4.5) by EX02.domain.comlan (192.168.4.5) with Microsoft SMTP Server (version=TLS1_2, ci...

Hi Paul,
i see the email is blocked as showed on the screenshot.
when the internal user send a email its get blocked as the below screenshot

Hi Paul, i am back with my complain the internal users are still getting blocked when they send out emails. not always but most of them time. i've attached a screenshot Received: from filter.domain.com (mail.domain.com [192.168.4.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bi...

Thank you Paul for the explain. the users on the go( off office), sometimes they need to allow some blocked emails,if they open the EFA message to deliever a blocked email. if the https/http not open on the internet it won't works. i completely agree with you about exposing the EFA to the internet i...

Paul thank you for your help,
i've got this fixed with Spammy help.
Thank you so much guys for the support.