eFa 5 Installation error - [eFa] - Error initializing system! Please try again...

[jlau]

I was installing eFa 5 on a brand new CentOS 9 Stream minimal install and ran into an issue during initial setup.
The script would fail at this point:

Code: Select all

[eFa] - Configuring hostname and domainname
[eFa] - Setting IP settings
[eFa] - Setting DNS
[eFa] - Generating SSH Host keys
Generating public/private rsa key pair.
Your identification has been saved in /etc/ssh/ssh_host_rsa_key
Your public key has been saved in /etc/ssh/ssh_host_rsa_key.pub
The key fingerprint is:
SHA256:[REMOVED FOR SECURITY]
The key's randomart image is:
[REMOVED FOR SECURITY]
unknown key type dsa
[eFa] - Error initializing system!  Please try again...

The problem: "unknown key type dsa"
DSA has been removed from recent versions of OpenSSH due to security vulnerabilities.

The solution:
Edit the script /usr/sbin/eFa-Commit and comment out the lines handling the generation of the DSA key:

Code: Select all

if [[ $genhostkeys -eq 1 ]]; then
[ $verbose -eq 1 ] && echo -e "$green[eFa]$clean - Generating SSH Host keys"
rm -f /etc/ssh/ssh_host_rsa_key
[ $? -ne 0 ] && exit 1
rm -f /etc/ssh/ssh_host_dsa_key
[ $? -ne 0 ] && exit 1
rm -f /etc/ssh/ssh_host_ecdsa_key
[ $? -ne 0 ] && exit 1
rm -f /etc/ssh/ssh_host_ed25519_key
[ $? -ne 0 ] && exit 1
ssh-keygen -f /etc/ssh/ssh_host_rsa_key -N '' -t rsa
[ $? -ne 0 ] && exit 1
#ssh-keygen -f /etc/ssh/ssh_host_dsa_key -N '' -t dsa
#[ $? -ne 0 ] && exit 1
ssh-keygen -f /etc/ssh/ssh_host_ecdsa_key -N '' -t ecdsa
[ $? -ne 0 ] && exit 1
ssh-keygen -f /etc/ssh/ssh_host_ed25519_key -N '' -t ed25519
[ $? -ne 0 ] && exit 1

[barbours]

EFA-project is going off into the sunset. Please come join us on OpenEFA - https://openefa.com forum: forum.openefa.com. We are developing a modern, more dynamic, smarter EFA. We are continuing support of the efa-project efa so please post your solution there.

Look forward to seeing you.

sb

[djshaunvt]

Thanks to the poster for this solution.. I have been struggling for days with this error...

Worked like a charm !!!!

I install the new EFA but it detects alot of legitimate emails as spam for some reason

Also when realeasing the emails it says released but the emails never arrive on the exchnage server.. Normal emails are delivered fine.

I like the look of the old one better though i must say... Keep that in mind but glad something new is on the horizon..

Needs a bit of work I think to incorpore the more user friendly view of the older versions such as efa 4 and 5

[barbours]

Thank you for the feedback! I want to address your concerns directly - both the false positive issue and the technical problem with email releases not arriving. Let me break this down:

--------------------------------------------------------------------------------
ISSUE 1: Legitimate Emails Detected as Spam
--------------------------------------------------------------------------------

This is actually EXPECTED behavior in the first few weeks of deployment, and I want to explain why (and how to fix it).

THE SHORT ANSWER:
OpenEFA uses adaptive learning instead of fixed rules. Out of the box, it doesn't know YOUR organization's communication patterns yet. The first 2-4 weeks are a "learning period" where the system builds intelligence about your senders, vendors, and communication style.

LEGACY EFA vs. OPENEFA - THE KEY DIFFERENCE:

Legacy EFA (versions 4 & 5):
• Rules-based system (fixed patterns and keywords)
• Same rules for everyone
• Worked "out of the box" but never got smarter
• Required manual rule tuning to catch new threats
• No understanding of relationships or context
• Struggled with sophisticated attacks (CEO fraud, targeted phishing)

OpenEFA:
• Adaptive learning system (NLP, behavioral analysis, relationship tracking)
• Learns YOUR specific organization's patterns
• Initial learning period (2-4 weeks of higher false positives)
• Automatically adapts to new threats
• Understands sender relationships and communication context
• Excellent at catching sophisticated attacks (BEC, impersonation, targeted phishing)

THE TRADEOFF:
• Week 1-2: More false positives (10-20% of quarantine may be legitimate)
• Week 3-4: Rapid improvement (false positives drop to 5-10%)
• Month 2+: Superior performance (1-3% false positives, better threat detection than rules)

WHAT'S HAPPENING BEHIND THE SCENES:
OpenEFA is learning:
✓ Who are your regular senders? (building sender-recipient relationships)
✓ What does legitimate business email look like for YOUR org?
✓ What's your communication vocabulary and style?
✓ Which vendors/partners do you work with?
✓ What's normal timing and frequency of communication?

HOW TO OPTIMIZE RESULTS:

1. USE THE FEEDBACK SYSTEM (Most Important!)
• When you see a legitimate email in quarantine, mark it as "Not Spam"
• This teaches the system: "This sender is legitimate for this recipient"
• Builds relationship scores organically
• After 3-4 legitimate emails from the same sender, system learns

2. AVOID EXCESSIVE WHITELISTING
• Whitelisting bypasses the learning system entirely
• It's a short-term fix but prevents long-term improvement
• Better: Use feedback on individual emails to teach the system

When to whitelist:
✓ Critical senders (payroll, banking) during first 2 weeks only (temporary)
✓ As a last resort for persistent issues

Why we recommend feedback instead:
✓ System learns the relationship (more secure)
✓ Behavioral analysis still works (catches compromised accounts)
✓ Vocabulary learning improves
✓ No manual maintenance required

3. FIRST MONTH ACTION PLAN:
Week 1: Review quarantine 2x daily, mark false positives
Week 2: Review quarantine 1x daily, continue feedback
Week 3-4: Review every other day, see dramatic improvement
Month 2+: Occasional reviews, trust the system

EXPECTED TIMELINE:
• Days 1-7: Active learning, expect moderate false positives
• Days 8-21: Rapid improvement, false positives dropping
• Days 22-60: System maturing, excellent performance
• Day 60+: Peak performance, minimal false positives, superior threat detection

THE PAYOFF:
Once the system learns your organization (30-60 days):
• Better security than rules-based systems (catches CEO fraud, compromised vendors, targeted attacks)
• Lower false positives than you had with legacy EFA
• Zero manual rule maintenance
• Continuous adaptation to new threats

Think of it like training a security analyst vs. giving a guard a checklist. The analyst needs time to learn your organization, but becomes far more effective.

--------------------------------------------------------------------------------
ISSUE 2: Released Emails Not Arriving at Exchange Server FIXED IN v1.5.4
--------------------------------------------------------------------------------

You mentioned: "when releasing the emails it says released but the emails never arrive on the exchange server.. Normal emails are delivered fine."

GOOD NEWS: This quarantine release bug has been fixed in OpenEFA Installer v1.5.4!

The issue was related to email reinjection into Postfix after release from quarantine. Earlier versions had a problem where released emails were marked as "released" in the database but weren't properly reinjected into the mail queue for delivery.

WHAT WAS FIXED IN v1.5.4:
Quarantine release mechanism overhauled
Proper Postfix reinjection for released emails
Email header preservation during release
Delivery confirmation and logging
Prevention of re-filtering released emails (content_filter loop fix)

HOW TO CHECK YOUR VERSION:

```bash
cat /opt/spacyserver/VERSION
```

Or check the installer version:
```bash
cat /opt/openefa-installer/VERSION
```

If you see version 1.5.3 or earlier, you need to upgrade.

UPGRADING TO v1.5.4:

Option 1: If you have the installer:
```bash
cd /opt/openefa-installer
git pull origin main
# Review CHANGES_v1.5.4.md for upgrade notes
sudo ./install.sh --upgrade
```

Option 2: Manual update (if no installer):
```bash
# Backup current installation first
sudo cp /opt/spacyserver/web/quarantine_routes.py /opt/spacyserver/web/quarantine_routes.py.backup

# Download updated quarantine release module
# Contact support@openefa.org for upgrade package

# Restart services
sudo systemctl restart spacyweb
sudo systemctl restart postfix
```

AFTER UPGRADING TO v1.5.4:

Test the quarantine release:
1. Find a test email in quarantine
2. Click "Release"
3. Check /var/log/mail.log for delivery:
```bash
sudo tail -f /var/log/mail.log | grep -i "released\|delivered"
```
4. Confirm email arrives at Exchange server

The email should now:
Be released from quarantine
Reinject into Postfix queue
Deliver to Exchange server
Appear in recipient's inbox

IF YOU'RE STILL EXPERIENCING ISSUES ON v1.5.4:

This would be unexpected. If quarantine release still fails after upgrading, please provide:

1. Confirm version: `cat /opt/spacyserver/VERSION`
2. Mail logs after release attempt:
```bash
sudo tail -100 /var/log/mail.log | grep -i "released"
```
3. Check mail queue:
```bash
sudo mailq
```
4. SpacyWeb logs:
```bash
sudo tail -100 /opt/spacyserver/logs/spacyweb.log
```
5. Postfix status:
```bash
sudo systemctl status postfix
```

We'll diagnose and patch any remaining issues immediately.

TEMPORARY WORKAROUND (If you can't upgrade immediately):

Until you upgrade to v1.5.4, you can manually forward emails from quarantine:
• View the email in quarantine detail page
• Copy the email content
• Forward manually to the intended recipient

But upgrading to v1.5.4 is the proper fix.

--------------------------------------------------------------------------------
ISSUE 3: UI/UX - Preference for Legacy EFA Look & Feel
--------------------------------------------------------------------------------

You mentioned: "I like the look of the old one better" and "more user friendly view of the older versions such as efa 4 and 5"

We hear you! The UI feedback is valuable.

WHAT WE'VE IMPROVED IN OPENEFA:
✓ Real-time spam score breakdown (see exactly why an email was scored)
✓ Detailed entity extraction (people, organizations, money, dates highlighted)
✓ Advanced threat detection visualization (BEC alerts, brand impersonation flags)
✓ Relationship scoring display (see sender trust scores)
✓ Modern responsive design (works on mobile)

WHAT LEGACY EFA DID WELL:
• Simpler, cleaner interface for basic tasks
• Faster load times (fewer features = lighter pages)
• Familiar workflow (muscle memory for long-time users)

YOUR FEEDBACK HELPS:

Specifically, what aspects of the old UI did you prefer?
• Layout/organization?
• Speed/performance?
• Simplicity (fewer options)?
• Specific features or workflows?

We're actively developing OpenEFA and can incorporate UI improvements based on real user feedback.

POSSIBLE UI ENHANCEMENTS WE'RE CONSIDERING:
• "Classic View" mode (simplified interface option)
• Faster page loads (optimize JavaScript/CSS)
• Customizable dashboard layouts
• Keyboard shortcuts for power users
• Dark mode (many users request this)

Please share specific pain points - this helps us prioritize development.

--------------------------------------------------------------------------------
RECOMMENDED NEXT STEPS
--------------------------------------------------------------------------------

FOR YOU:

Immediate (Today):
1. UPGRADE TO v1.5.4 (fixes email release bug)
2. Test quarantine release functionality
3. Verify emails now arrive at Exchange server

This Week:
4. Commit to 2 weeks of active feedback (mark false positives as "Not Spam")
5. Give the learning system a chance to adapt to your organization
6. Track improvement - you should see false positives drop by 50% in Week 2

This Month:
7. Continue occasional feedback
8. Watch the system improve
9. Provide UI/UX feedback (what specifically would improve your workflow?)

FOR US:

Completed:
Fixed email release bug (v1.5.4)
Improved Postfix reinjection mechanism
Enhanced quarantine delivery logging

Ongoing:
Gather UI/UX feedback from community
Consider "classic view" option for users who prefer simpler interface
Optimize page load performance
Improve onboarding documentation for new users

--------------------------------------------------------------------------------
SETTING PROPER EXPECTATIONS
--------------------------------------------------------------------------------

OPENEFA IS DIFFERENT FROM LEGACY EFA:

What's Better:
Adaptive learning (gets smarter over time)
BEC/CEO fraud detection (legacy EFA couldn't do this)
Behavioral analysis (detects compromised vendors)
Relationship awareness (understands your communication patterns)
Multi-tenant ready (for MSPs managing multiple clients)
Modern NLP (understands context, not just keywords)
No manual rule maintenance
Quarantine release now works correctly (v1.5.4+)

What Requires Adjustment:
Initial learning period (2-4 weeks of higher false positives)
Different workflow (feedback-based vs. rule-based)
New UI (more features = steeper learning curve)
Need to trust the learning process (resist over-using whitelists)

What's Fixed:
Released emails not being delivered (FIXED in v1.5.4)

HONEST ASSESSMENT:

OpenEFA is a major architectural upgrade with significant benefits. The quarantine release bug you encountered was present in earlier versions but has been resolved in v1.5.4.

Legacy EFA was mature, stable, and familiar - but it had reached its limits. It couldn't adapt to modern threats like:
• CEO fraud (business email compromise)
• Sophisticated phishing (context-aware attacks)
• Compromised vendor accounts (behavioral anomalies)
• Targeted spear-phishing (relationship-based attacks)

OpenEFA can catch these threats BECAUSE of the learning system, but that learning requires an initial investment of your time providing feedback.

THE QUESTION IS:
Are you willing to invest 2-4 weeks of active feedback to get a system that's significantly better at protecting your organization long-term?

If yes, upgrade to v1.5.4 and we're here to help you through the learning period.

If the UI is a blocker, let us know what specifically bothers you - we can prioritize UI improvements based on real feedback.

--------------------------------------------------------------------------------
VERSION 1.5.4 RELEASE NOTES (Relevant Fixes)
--------------------------------------------------------------------------------

OPENEFA INSTALLER v1.5.4 - Quarantine Release Fix

Bug Fixes:
Fixed quarantine release emails not being delivered
Improved Postfix reinjection mechanism after release
Enhanced email header preservation during release
Added delivery confirmation logging
Prevented content_filter re-filtering of released emails

Improvements:
Better error handling in quarantine release process
Release status tracking in database
Improved logging for troubleshooting
Web interface feedback on release success/failure

Installation:
• Fresh installs: Includes all fixes automatically
• Upgrades: Follow upgrade procedure above
• Changelog: See /opt/openefa-installer/CHANGES_v1.5.4.md

--------------------------------------------------------------------------------
WE'RE LISTENING
--------------------------------------------------------------------------------

Your feedback about:
• False positives → Expected during learning, we'll help you optimize
• Email release bug → FIXED in v1.5.4 - please upgrade!
• UI preferences → Valuable input for development priorities

This is a community-driven project. Your real-world experience helps us improve OpenEFA for everyone.

Please:
1. Upgrade to v1.5.4 to fix the quarantine release issue
2. Give the learning system 2-4 weeks with active feedback
3. Tell us specifically what UI elements you miss from legacy EFA
4. Report any other bugs or issues you encounter

We want OpenEFA to be BETTER than legacy EFA in every way - including user experience. But we need your feedback to get there.

Thank you for being an early adopter and helping us improve!

--------------------------------------------------------------------------------

Best regards,
The OpenEFA Development Team

P.S. - For anyone interested in the deep technical details of our learning philosophy (why we chose adaptive learning over rules), we've documented it here:
/opt/spacyserver/docs/03-core-concepts/learning-philosophy.md

It explains the "system-wide vocabulary + per-domain relationships" model and why this architecture provides better security while maintaining privacy.

================================================================================
ADDITIONAL RESOURCES
================================================================================

DOCUMENTATION:
• Learning Philosophy: /opt/spacyserver/docs/03-core-concepts/learning-philosophy.md
• How It Works: /opt/spacyserver/docs/03-core-concepts/how-it-works.md
• Troubleshooting: /opt/spacyserver/docs/11-troubleshooting/false-positives.md
• Version History: /opt/openefa-installer/CHANGES_v1.5.4.md

SUPPORT:
• Forum: Post here with questions
• Email: support@openefa.org
• GitHub Issues: Report bugs (if using GitHub version)

QUICK DIAGNOSTICS:
• Check OpenEFA version: `cat /opt/spacyserver/VERSION`
• Check installer version: `cat /opt/openefa-installer/VERSION`
• View mail logs: `sudo tail -100 /var/log/mail.log`
• Check Postfix status: `sudo systemctl status postfix`
• View quarantine: Login to web interface at https://your-server/quarantine

UPGRADE TO v1.5.4:
• Pull latest installer: `cd /opt/openefa-installer && git pull`
• Review changelog: `cat /opt/openefa-installer/CHANGES_v1.5.4.md`
• Run upgrade: `sudo ./install.sh --upgrade`

================================================================================

[djshaunvt]

Thank you very much firstly for the in depth reply.

The info provided is really detailed and much appreciated.

All my questions around the technical difficulties with released emails not being deliverde to the on-site Exchange server were answered.

It looks like it might have been the bug that was addressed in the latest version. I will have to revisit the new version again (Had to uninstall and reinstall the older EFA 5 as couldnt afford emails not being delivered)

With regards to the look and feel i prefered the simplistic look of the older version over the never version. The older version in my opinion is much easier to see at a glance all email recieved for that specific time frame in a simple easy view.

The newer view was a bit over whelming on the eye.

In the older version if I want to find out more info with regards to a specific email I could just open up that specific email.

The nice feature I saw on th newer one was the ability to select a couple of emails and release all at once. I thought that was a nice touch that was missing from the older versions.

Thanks once again for thr hard work and Ill definetly be revisting the newer version in the near future.