Sync Hestia new mail domain to Proxmox Mail Gateway as Relay Domain

Posted on 25/07/2024 by Martino

After you successfully imported all Hestia mail domains into your Proxmox Mail Gateway, you might want to sync Hestia to PMG when you add OR delete a mail domain in Hestia as an allowed Relay Domain mail destination on your Proxmox Mail Gateway. Here’s the how-to!

Make sure your Hestia server can establish a trusted SSH connection to the PMG server, using private keys. You can find plenty of guides on how to do so.

On the Hestia server, create the hooks folder and the add domain script:

mkdir /usr/local/hestia/data/hooks/
cd /usr/local/hestia/data/hooks/

vi v-add-mail-domain-after

Enter:

#!/bin/bash
ssh pmg pmgsh create /config/domains --domain "$2" --comment "$1_`date "+%Y-%m-%d"`"

Save and exit vi. This will connect to your PMG server and create the mail domain with the username and creation date in the comment.

Create the delete domain script:

vi v-delete-mail-domain-after

Enter:

#!/bin/bash
ssh pmg pmgsh delete /config/domains/$1

Save and exit vi. This will execute the command and delete the mail domain on the PMG server.

Make the scripts executable:

chmod +x *

Now you need to modify the v-add-mail-domain and v-delete-mail-domain Hestia scripts to execute the hooks.

vi /usr/local/hestia/bin/v-add-mail-domain-after

At the end of the file, before the exit entry, add this:

# Adding new domain to Proxmox Proxy List
/usr/local/hestia/data/hooks/v-add-mail-domain-after $user $domain
$BIN/v-log-action "$user" "Info" "Mail" "Mail relay entry on Proxmox added (Domain: $domain)."

Save and exit vi. This will execute the previously created hook and adds an entry into the user’s log file.

Now for the v-delete-mail-domain command:

vi /usr/local/hestia/bin/v-delete-mail-domain-after

At the end of the file, before the exit entry, add this:

# Delete mail domain from Proxmox Proxy list
sh /usr/local/hestia/data/hooks/v-delete-mail-domain-after $domain
$BIN/v-log-action "$user" "Info" "Mail" "Mail relay entry on Proxmox deleted (Domain: $domain)."

Save and exit vi.

That’s it! Now add your new mail domain and it’ll show up on your Proxmox Mail Gateway. Or delete it 🙂

Tweet Post to Delicious Post to Facebook

Export Hestia mail domains into the Relay Domains in Proxmox Mail Gateway 8

Posted on 02/02/2024 by Martino

See my blogpost about using PMG with Hestia. This is a quick and dirty script to get all Hestia mail domain names for all Hestia users into the Mail Proxy Relay Domains list.

First, on Hestia, export all configured mail domains for all user:

for user in $(v-list-users | awk '{print $1}')
do 
 v-list-mail-domains $user | awk '{print $1}' | grep -v -e 'USER' -e 'DOMAIN' -e '------' -e 'Error:' >> relay_domains.txt
done

Get the relay_domains.txt file to your Proxmox master or node server and run the import:

while IFS= read -r domain 
do
 pmgsh create /config/domains --domain $domain
 echo "Added relay domain: $domain" 
done < relay_domains.txt

Done.

Now you can continue with setting up the mail domains settings as described here.

Tweet Post to Delicious Post to Facebook

HestiaCP / Hestia – Batch change mail domain settings for use with Proxmox Mail Gateway

Posted on 02/02/2024 by Martino

So I have a very cool (and quite full) Hestia server but I do not like the anti-spam capabilities and I wanted to have a reliable incoming and outgoing mail cluster before it. I therefor installed Proxmox Mail Gateway 8 on three nodes to do the filtering. But I have over 20 users and more than 100 mail domains to change.

SO! Batch-mode on.

What I wanted is to disable anti-spam, antivirus and reject spam settings. And also enable the smart relay to use the PMG cluster for outgoing mail.

After importing all mail domain names into Proxmox as ‘relay domains’ (trusted domains for which Proxmox can accept emails), I wrote this script to get all configured mail domains for a Hestia user and change the settings.

Just save it as mailchange.sh, do a chmod +x mailchange.sh and run it with a username:

./mailchange.sh hestia.username

The script:

#!/bin/bash
clear

# Change this to your PMG cluster host and the relay port 
relayhost="relay.domain.com"
relayport="26"

RED="\033[31m"
GREEN="\033[32m"
NORMAL="\033[0;39m"

if [ -z "$1" ]; then
  printf "$RED"
  echo "Error: The first argument must be a valid username."
  printf "$NORMAL"
  exit 1
else
  user="$1"
fi

# Getting all domains for username
v-list-mail-domains $1 | awk '{print $1}' | grep -v -e 'DOMAIN' -e '------' -e 'Error:' > $1_domains.txt

# Showing current mail domain settings
echo ""
printf "$GREEN"
echo Current mail domains and settings
echo ""
printf "$NORMAL"
v-list-mail-domains $1

# You can still get out of here!
echo ""
printf "$RED"
read -p "Ready to change the settings? (yes/no) " yn
case $yn in
yes ) printf "$GREEN";
echo OK, we will proceed;;
no ) echo exiting...;
  printf "$NORMAL";
exit;;
* ) echo invalid response;
exit 1;;
esac

printf "$NORMAL"
while IFS= read -r domain
do
    echo ""
    v-delete-mail-domain-antispam $1 $domain >/dev/null
    v-delete-mail-domain-antivirus $1 $domain >/dev/null
    v-delete-mail-domain-reject $1 $domain >/dev/null
    v-delete-mail-domain-smtp-relay $1 $domain >/dev/null
    v-add-mail-domain-smtp-relay $1 $domain $relayhost "" "" $relayport >/dev/null
    printf "$GREEN"
    echo "Removed settings and added smart relay for domain $domain"
    printf "$NORMAL"
done < $1_domains.txt

echo ""
printf "$GREEN"
echo New mail domains and settings
echo ""
printf "$NORMAL"
v-list-mail-domains $1

Before:

After:

Done!

Tweet Post to Delicious Post to Facebook

Microsoft Teams – Cannot chat with external users

Posted on 23/01/2024 by Martino

So Microsoft changed things again. This time, it seems you can have a Teams meeting with external users but can’t chat with them, if their account is not company-managed. Here’s the work around for that, in Powershell. Please authenticate with your Tennant as usual and:

Install:
Get-Module -ListAvailable -Name MicrosoftTeams
Install-Module MicrosoftTeams
Connect-MicrosoftTeams

Set:
Set-CSTenantFederationConfiguration -AllowTeamsConsumer:$true

Check:
Get-CSTenantFederationConfiguration

Tweet Post to Delicious Post to Facebook

Microsoft 365 – Disable MFA on admin account using PowerShell when locked out

Posted on 04/08/2023 by Martino

The phone-number associated with the admin account was no longer available so the client couldn’t access the admin portal of Microsoft 365 as the following message popped-up:

“More information required – Your organisation needs more information to keep your account secure”

And there was NO way to get passed that. Total lock-out. So, fire up PowerShell on a Windows machine (PS on a Mac does not work with MSOnline) and copy/paste the following lines to disable MFA and get asked to enter a new phone number! Please change the admin email and password to yours.

Set-ExecutionPolicy RemoteSigned
Install-Module PowershellGet -Force
Install-Module -Name ExchangeOnlineManagement
Import-Module ExchangeOnlineManagement

$secpasswd = ConvertTo-SecureString -String 'SuperSecretPassword' -AsPlainText -Force
$o365cred = New-Object System.Management.Automation.PSCredential ("adminemail@address.com", $secpasswd)
Connect-ExchangeOnline -Credential $o365cred -ShowBanner:$false

Install-Module MSOnline
Import-Module MSOnline
Connect-MsolService -Credential $o365cred

Get-MsolUser -UserPrincipalName adminemail@address.com | Set-MsolUser -StrongAuthenticationMethods @()

Tweet Post to Delicious Post to Facebook

Synology DS1511+ fan error: how to disable warning

Posted on 08/11/2017 by Martino

My old Synology DS1511+ has a failed fan. It gave warnings in the form of beeps and in the logs, which it is supposed to do.

To be honest, I found someone who already had done what I wanted, so I just modified it slightly to work for DS1511+.

What we are going to do:

Enable SSH and connect to our Synology box.
Locate any files named â€œfanâ€ something.
Use the Editor VI to create a Shell Script to disable theÂ â€œcheck_fanâ€ function after each reboot.
Info: basic VI commands and Vi commands on Synology wiki. We are only going to use the [ESC] key, and the command â€œ:wq!â€ to exit and save from vi.

Steps to make this Work:

First turn on SSH in Control Panel |Terminal
Connect to your Synology box using a program like Putty where username is â€œrootâ€ and password is the same you use for â€œadminâ€œ.
Locate the file we need to modify in order to disable the fan check.
Note: if you cant find the file, navigate to sys dir first using cd /sys/
```
find -name "*fan*"

Results in:
./module/pineview_synobios/parameters/check_fan
```

Create a Shell script by navigating to the location containing the scripts. Creating a new script file and modify the permissions for the file (do this with sudo):

cd /usr/syno/etc.defaults/rc.sysv/
viÂ S99zz_fan_check_disable.sh
echo 0 > /sys/module/pineview_synobios/parameters/check_fan
[ESC]
:x [Enter]
chmod +x S99zz_fan_check_disable.sh

Thatâ€™s it. Reboot your NAS and now you donâ€™t have to modify the file after each reboot.

Tweet Post to Delicious Post to Facebook

Hetzner – Proxmox / ESX – Sophos / pfSense additional IP network config – working & solved

Posted on 18/03/2015 by Martino

Got a root server at Hetzner with 1 extra public IP address (next to the one provided). Wanted to install Debian and Proxmox on it so I can have a cheap Virtual Machine host. You can also install VMware ESX but then you need to ask them to attach a KVM-over-IP unit and didn’t want to bother.

Networking was a bit of a pain but I got it all configured:

– Proxmox is using the first public IP address so you can manage it externally.
– The second public IP address is needed to assign it to Sophos UTM / pfSense or any firewall of your choice.

This firewall will then NAT incoming traffic to your internal VM’s. In this example,Â 188.45.45.87 is the MAIN public IP address andÂ 188.45.45.81 is the ADDITIONAL one.

Proxmox network config:Â

# network interface settings
auto lo
iface lo inet loopback

iface eth0 inet manual

iface eth0 inet6 static
 address 2b01:4g8:140:14d7::2
 netmask 64
 gateway fe80::1

auto vmbr0 ## Public IP address for Proxmox
iface vmbr0 inet static
 address 188.45.45.87
 netmask 255.255.255.192
 gateway 188.45.45.65
 bridge_ports eth0
 bridge_stp off
 bridge_fd 0

auto vmbr1 ## Interface for internal LAN networking
iface vmbr1 inet static
 address 192.168.0.254
 netmask 255.255.255.0
 gateway 192.168.0.1
 bridge_ports none
 bridge_stp off
 bridge_fd 0

Check if you can reach your Proxmox server on your public IP address. Now, get an additional IP address using Hetzner’s Robot control panel. Once assigned, make sure you request a separate MAC address for the new IP address !!! In this example, 188.45.45.81 has a separate MAC address of 00:50:xx:00:xx:EE

In Proxmox, create a new VM and assign 2 network cards. One will be used for the LAN (vmbr1) and the other one for the WAN (vmbr0). Â The MAC address of the WAN address needs to match the MAC address you’ve requested previously using Hetzner’s Robot ! Â Â Â To configure your Sophos or pfSense firewall, you’ll need to create a SSH tunnel to the internal IP address of the firewall, as it won’t yet have the additional public IP address configured and probably need to finish the configuration using SSH or a browser. So, use this command (please adjust for your IP settings):

sudo ssh -L 4444:192.168.0.1:4444 root@188.45.45.87

In your browser, navigate to https://localhost:4444/ and finish configuring your firewall. Important: your WAN IP address is the additional IP address. Gateway and netmask are the same as the MAIN IP address.

Enable a DHCP server on your LAN and that’s it! Now you can install your VM’s and get an internal private IP address (as long as you assign vmbr01 in Proxmox to the VM) and use your firewall to NAT outside traffic to the inside.

Tweet Post to Delicious Post to Facebook

Synology Cloud Station and the pesky TailCharacterConflict error

Posted on 18/03/2015 by Martino

At my (previous) company we’re using Synology Cloud Station with 20 users and lots of files. One user was complaining that the folder names were renamed with this nice addition:

Company Name B.V._PC_Name_UserName_Jan-27-145750-2015_TailCharacterConflict

Everything I tried didn’t help: renaming the folder, deleting it from the server, resyncing, everything. Google wasn’t a big help either. The folder kept being renamed with this very irritatingÂ TailCharacterConflict.

Until I saw the pattern.

You CAN’T let you folder name end with a trailing PERIOD. In this case, the folder name was Company Name B.V.

Changing the folder name to Company Name BVÂ (with the periods) solved the problem. Insane, but true!

Tweet Post to Delicious Post to Facebook

Postfix smtp relay on OS X Yosemite 10.10

Posted on 28/11/2014 by Neil

I’m lazy, and for email testing this is great. Who doesn’t need an email relay at some point?Â As there was no off the shelf solution, here it is for Yosemite.

Define the relay host:
sudo vim /etc/postfix/main.cf
Add section after the existing ‘relayhost’ example:
relayhost = [smtp.gmail.com]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_use_tls = yes
smtp_sasl_mechanism_filter = plain

Add your account for the relay to use.
sudo vim /etc/postfix/sasl_passwd
add:
[smtp.gmail.com]:587 name@somedomain.org:password

Make sure it starts at boot. If you don’t want this, skip this!
sudo vi /System/Library/LaunchDaemons/org.postfix.master.plist
after:
</dict>
add this:
<key>RunAtLoad</key>
<true/>

Finally:
sudo chmod 600 /etc/postfix/sasl_passwd
sudo postmap /etc/postfix/sasl_passwd

Then stop postfix:
sudo launchctl stop org.postfix.master
And start it again (so it reads the config changes):
sudo launchctl start org.postfix.master
sudo postfix start

Check it’s listening:
netstat -an | grep LISTEN | grep 25
It should output something like this:
tcp6 0 0 ::1.25 *.* LISTEN
tcp4 0 0 127.0.0.1.25 *.* LISTEN

You can test it like so:
df -kH | mail -s “contents” your@yourdomain.com

Disclaimer:
1) You can screw your postfix if you don’t pay attention. Be carefull.
2) gmail was used as an example. I’m not endorsed, sponsored or whatever.

This is based on:
Using MacOSX Lion command line mail with Gmail as SMTP
Mac OS X 10.10 Yosemite Postfix SASL authentication failed

Tweet Post to Delicious Post to Facebook

Martino Campodoro

Lost in Translation

Sync Hestia new mail domain to Proxmox Mail Gateway as Relay Domain

Export Hestia mail domains into the Relay Domains in Proxmox Mail Gateway 8

HestiaCP / Hestia – Batch change mail domain settings for use with Proxmox Mail Gateway

Microsoft Teams – Cannot chat with external users

Microsoft 365 – Disable MFA on admin account using PowerShell when locked out

Synology DS1511+ fan error: how to disable warning

What we are going to do:

Steps to make this Work:

Hetzner – Proxmox / ESX – Sophos / pfSense additional IP network config – working & solved

Synology Cloud Station and the pesky TailCharacterConflict error

Postfix smtp relay on OS X Yosemite 10.10