[00:02] rbasak: i think you forgot to commit your tests/changelogs/test_distribution file. Can you do so and push it to master? === Hirppa is now known as Guest81339 === Valfor is now known as Guest45971 === X-Rob is now known as Guest84163 === giraffe is now known as Guest83487 === Guest84163 is now known as X-Rob [00:27] anybody around that happens to be into voip/asterisk? I'm trying to figure out what to do with the asterisk 11 install we have [04:31] good morning === Guest69923 is now known as lordievader [05:30] Good morning [06:14] nacc: sorry! Done. [06:23] hey guys, do yu know of any webmail apckage that is updated by apt that can be added?, i have used squirrelmail until it was unsupported and Rainloop isn't handled by any repo so I am looking for a better solution. === lifeless_ is now known as lifeless === G_ is now known as G === edwinksl- is now known as edwinksl [11:52] anybody set up galera arbitrator 3 on an ubuntu node? === Guest81339 is now known as Hirppa [14:00] is there a clever one-liner to dump yaml to json? [14:08] ok, this seems to work -> ruby -rjson -ryaml -e 'puts YAML.load($stdin.read).to_json' [14:08] with pipes [14:31] Ubuntu server sure likes to push out updates to its kernel [14:43] rbasak: hi, ping [14:43] rbasak: http://pastebin.ubuntu.com/25319275/ these 3 entries in d/changelog are related [14:44] rbasak: would you prefer to see 3 individual commits, or one? [14:44] devster31: also python -c 'import sys, yaml, json; json.dump(yaml.load(sys.stdin), sys.stdout, indent=4)' < file.yaml > file.json [14:44] you surely can find more via search engines [14:44] doesn't that require pyyaml or something? [14:44] yep [14:45] was installed for me already [15:00] nacc: are you in yet? What's your opinion wrt my question above? [15:01] ahasenack: I can tell you what I prefer and usually do in these cases if you want? [15:01] sure, I just asked them first because they are the uploaders [15:01] * cpaelzer feels neglected [15:02] ahasenack: I'd make one commit each - but with slight adaptions to the commit message to get better changelogs [15:02] heh, imagine how I feel with MPs up for more than a month :) [15:03] On the first one I make a level 1 entry in this case the use of ldap-auth-config AND in the same commit a level 2 entry what this commit changes in particular [15:03] Following commits have only level 2 entries as long as they belong to the same thing [15:03] on auto generated changelog that auto-groups them which I like to carry the "they belong together" meaning [15:04] I thought I reviewed all that made sense to review from me [15:04] you did [15:04] all others had other reviewers for a reason [15:04] I saw your two new merges in the queue but since I started late ... [15:05] also I plan to add a few on my own today/tmrw as time permits [15:10] ahasenack: reading [15:11] ahasenack: it feels like they should be rewritten if they are related (tbh). I don't think it matters much if they are one commit or three, though. [15:11] ahasenack: what matters is each commit accurately describes teh changes in it [15:11] ok [15:11] ahasenack: given that we don't want to accidentally cherry-pick only one of the three, though, it seems reasonable to make them one? [15:11] it does [15:12] you can't really just drop one of the 3, for example [15:14] ahasenack: yep [15:17] I am trying to setup ssh connection between my Linux OS and virtual server but during 'ssh-copy-id username@remotehost' I am getting error. Please somebody help. [15:22] pankaj, help us help you. [15:23] nacc: this one was sponsored already, what do we do with it from an MP perspective? https://code.launchpad.net/~ahasenack/ubuntu/+source/samba/+git/samba/+merge/326073 [15:24] ahasenack: i don't recall, i'll leave it for now until we decide what to do with them [15:24] ok [15:24] ahasenack: any open MPs for ubuntu-advantage-tools you need me to look at? I'm starting with the doc [15:24] so only 4 to review :) [15:24] dpb1: no open mp [15:25] dpb1: we just need to make a release in github, tag, if we are happy with it as is [15:25] ahasenack: can I install onto xenial from that ppa? [15:25] dpb1: yes [15:25] (and get tip, I mean) [15:25] ok [15:25] I'll do that [15:25] dpb1: ack had two changes since that build: manpage, and another I forgot [15:26] manpage just had a new section about exit status [15:26] oh, it's not a recipe? I'm shocked [15:26] can recipes build from github? [15:26] we might have to mirror [15:26] I really don't care [15:26] I'll just build the package here [15:26] n/w [15:26] just giving you a hard time [15:27] ahasenack: and, no landscape yet, right? [15:27] right [15:29] ahasenack: lint failures! [15:29] shocked [15:29] again [15:29] what did you run? [15:29] dpkg-buildpackage -uc -us [15:29] but, more cheaper... make lint [15:29] ah, I blame ack for that. shellcheck in ubuntu is older than in debian [15:29] and github installs the debian one [15:30] which is fixed regarding those failures [15:30] should I be on artful for this testing? [15:30] won't help you regarding shellcheck [15:30] or it's out of date there too [15:30] ok [15:30] but are these run at package build time? Hm [15:31] :/ [15:31] yes [15:31] then we have to drop that [15:32] I can quickly fix I think [15:32] sec [15:33] ackk: we need to drop shellcheck, it needs to work in plain ubuntu regardless of what we do to make it work in travis [15:34] ah, he is away today [15:34] ahasenack: I'm putting up a branch, it's fine [15:35] cpaelzer: should i just open a new bug for this pflash/apparmor issue? [15:36] cpaelzer: or maybe discuss via e-mail somewhere? just trying to cleanly separate the issue from the migration one [15:36] dannf: yes they are separate issues for sure [15:36] dannf: and the one hitting the image files on all arches is fixed [15:36] cpaelzer: cool - yeah, just didn't know if you minded a bug for an issue that's not actually in ubunt yet :) [15:36] dannf: so a new one would be great [15:37] dannf: I fixed the other one (images) already even it is not a bug yet [15:37] dannf: for qemu 2.10 prep [15:37] dannf: so yeah please, just need dmesg and the xml [15:37] ad I need to drive virt-aa-helper manually from there and see what rules it creates for the flash files [15:39] cpaelzer: will do [15:39] dannf: I'm also on the minor one with the s390x packaging - cleaning that up [15:40] dannf: yet I think with a different fix than what you suggested [15:40] IMHO there is no reason to have s390 being the only different one [15:40] so I'd more likely adapt the d/control in a way to match the other architectures [15:40] hmmm [15:40] cpaelzer: i was assuming it was the only different one because it didn't have full emulation - e.g. requires hardware acceleration - but i'm not sure about that [15:41] * xnox wonders if there is stuff that I did, that made s390x look odd. It should be just like x86_64. [15:41] * xnox and e.g. should not be in "ports" bucket [15:41] well ther eis a partial tcg which can be used [15:41] so why not [15:41] xnox: yeah it was you :-P [15:41] ahasenack: https://github.com/CanonicalLtd/ubuntu-advantage-script/pull/39 [15:41] but long enough ago that it doesn't matter [15:42] and that is my mindset as well, it should be just like x86, arm, ppc, ... [15:42] oO it seems gcc7 also makes qemu compiles unhappy [15:42] cpaelzer, as long as you do not drop qemu-system-s390x i'm fine =) [15:42] I'd be the last one to do that [16:01] qemu2.10 is good with ggc-7 so overall all fine for artful [16:01] wow ggc new compiler, gcc of course [17:06] can anybody confirm that ubuntu-server is and will be using timesyncd? [17:07] it seems that this changed from 14.04 to 16.04, however the same seems to not be true for 16.04 desktop [17:07] I'm seeing ntpd running on a fresh install of desktop [17:07] also I can't see where the default is set and can't tell what timesyncd is actually using [17:08] the conf file has the fallback commented out, ntp.ubuntu.com , which if I had to guess I'd imagine is what is used, but I'd like to confirm that [17:11] yeah, confirmed with tcpdump, it's calling out to alphyn.canonical.com.ntp , guess maybe a patch to set that as deafult in the code [17:12] dpb1: ping [17:14] hey teward [17:15] dpb1: got your inquiry on the email of the meeting logs - sorry I was in a server room away from my phone [17:15] i just got the ping for it - my email parser read it and poked. I'll be available, to my knowledge today, for the meeting next week if there's a need for me to be backup [17:15] if something comes up I'll let you all know. [17:15] teward: no worries at all, just wanted to give you a heads up you are getting close [17:16] yep, I checked that myself :) [17:16] heh [17:16] cool [17:16] thanks for getting back [17:16] yep === Tohuw is now known as Guest68958 [17:46] is there an alternative to proxmox on ubuntu-server(by that I mean is supported by ubuntu)? [17:48] Vladimirski: to do the same thing/everything that proxmox does? what I mean is, it could be easier if you were interest in only particular features [17:49] for example if you were just doing qemu and weren't interested in a web interface you could use libvirt with virsh/virtmanager [17:49] or if you were interested in containers with lxd and new lxc command line [17:49] drab: Well I need a virtual environment where I can host different operative systems [17:49] ok, does it have to have a nice to use web interface? [17:50] well it would be nice to have one [17:53] drab: I was thinking of using KVM, maybe there's a webgui for it [17:54] drab: Actually oVirt maybe is my solution? [17:54] if you want a bwe based solution the best I know is Ovirt [17:54] yeah, was typing just that [17:54] if you're xen oriented, there's xenserver [17:55] for kvm, if you have a desktop, libvirt + virtmanager is actually really neat [17:55] but I guess it's not as aware of a cluster of libvirt instances and so forth [17:55] it depends how "cloud" you're trying to go [17:55] thanks [17:55] gotta think about it [17:55] if you just want to run a bunch of virtual machines on one or two servers, then imho libvirt + virtmanager is probably the easiest [17:56] it should be to complicated in configuration sense.. [17:56] alright [17:56] if you're trying to do something more advanced, then probably ovirt is a better choice if you don't want to run proxmox (which afaik is one of the best solutions out there) [17:56] but you have to use their own debian isos, which is one of the reason I ddin't go with it [17:57] Vladimirski: fwiw, I don't know what you're doing, but if you have limited capacity containers may be a better choice than full virtualization [17:58] I've pretty much migrated all my instances from kvm to lxd minus a few where kernel space stuff matters or I need further isolation at that level [17:58] kvm/libvirt works well alone, but it's not very straight-forward to setup in a multinode setup [17:58] most notable example, nfs-kernel-server [17:58] yeah [17:59] hence the suggestion for ovirt in that case, more similar to proxmox, but also more work to setup and maintain ime as complexity is higher [17:59] libvirt + virtmanager is *really* straightforward [18:00] https://help.ubuntu.com/lts/serverguide/NTP.html [18:00] stuff on this page seems not true... specifically the interaction between timesyncd and ntp [18:00] anybody familiar with the two? [18:00] except for multinode, perhaps, where you'll need corosync and friends, which can be a bit of a hassle [18:00] "If NTP is installed and replaces the activity of timedatectl the line "NTP synchronized" is set to yes." [18:00] that is, haven't used it or some time, so it might be easier now [18:01] but that doesn't seem to be the case. I removed ntp and timedatectl still says NTP synchronized is true [18:01] ie nothing seems to change [18:01] drab: just wait a while and time will drift [18:01] and I can't really remove it as it's not its own package (timesyncd I mean) [18:01] ntp setup is the easy part [18:02] yeah it's all done, but the interaction between the two is very opaque [18:02] I don't see where timesync checks for ntp etc [18:02] or where you'd "deconfigure" timesyncd [18:02] so I have no confidence that this is working correctly and timesycnd is backing out leaving ntp to do the job [18:03] simply installing and configuring ntpd with a local-ish ntp server should do the job down to a very small fraction of a second between the hosts [18:04] yeah, that's not what I'm concerned about, what looks dubious is the interaction with systemd-timesyncd [18:06] again look at the official doc I linked, it says something very specific about the interaction of the two [18:06] and that doesn't hold true in my experiment [18:07] hi [18:07] if I want to checkout a specific stuff from git but its not branch but tree [18:08] https://github.com/opencart/opencart/tree/2.3.0.2 [18:08] how do I clone that? [18:08] :D [18:09] it's not a "tree", that's just the web view in github [18:09] there is a tag for 2.3.0.2 release, that's what you clone [18:10] hehehe: https://git-scm.com/docs/git-clone#git-clone--bltnamegt [18:11] as the man page says you can specify a tag with the branch command [18:15] cool [18:17] cpaelzer: around still? [18:17] (not urgent) [18:19] solved it [18:20] ahasenack: here [18:20] next idea - some app where it simulates icecream :) you have to lick a screen at high speed to eat it lol [18:20] cpaelzer: checking that extra patch in cifs-utils, doing some archeology [18:20] cpaelzer: I think it's not needed, because [18:20] cpaelzer: a) http://pastebin.ubuntu.com/25320452/ 6.2 release notes mentions that that binary is now searched using $PATH (I'm trying to find a diff) [18:21] thats exactly why I asked, because I often find archeology turns out to be inertesting :-) [18:21] cpaelzer: b) this is the patch: http://pastebin.ubuntu.com/25320448/ [18:21] c) http://pastebin.ubuntu.com/25320445/ is the code without the patch [18:21] it seems our check is reduntant, although it would avoid some unecessary calls [18:21] hrm, that is not the 'canonical' way to check if systemd is running [18:21] but also make it less robust if the binary ever moves to another location [18:21] nacc: yes so :)) [18:21] checking for /var/run/systemd is, iirc [18:21] the switch to using popen is from 2013 [18:22] (in cifs-utils) [18:22] I searched lp for closed bugs but only found one asking to update cifs-utils [18:22] will try a more thorough d/changelog search now [18:22] ahasenack: well there could be the case of systemd having the paths above and considers it is_systemd_running [18:23] ahasenack: but lacks the binary [18:23] ahasenack: yeah, i'd file an upstream bug that those checks are sort of wrong [18:23] ahasenack: I thik that is what the check was meant for [18:23] well, nothing is checking that it's running, not even our patch [18:23] semantically, they clearly are trying to :) [18:23] which is a sub-optimal upstream [18:23] but they are using the wrong semantics [18:24] i believe the /var/run/systemd check is what pitti or xnox told me to use [18:24] ahasenack: well if the popen fails they will end as if the check would have been wrong [18:24] so yeah [18:24] (for puppet upstream) [18:24] dropping our delta would make it even better [18:24] as it would work if the path changes [18:24] nacc, but do forget that /var/run exists. [18:24] nacc, only ever use /run/systemd/system check; as /run/systemd exists on systems with pid 1 upstart, and logind running. [18:24] xnox: :) is there a "new" path to check for systemd running? /run/systemd then, i guess you mean? [18:25] xnox: ah yes, thanks! [18:25] /run/systemd alone is not sufficient. [18:25] right [18:25] sorry, misremembered [18:25] and here we have an examples how checks like these get to life [18:25] we are all humans and software changes [18:25] ahasenack: TL;DR we can make this a sync - right? [18:25] so i don't think it makes sense to keep this delta [18:26] and i think it makes sene to file a bug upstream and say fix your check [18:26] at one point it was /run/systemd, but then pitti fixed it in all the software and upstream to be be more specific. [18:26] with a suggested patch [18:26] since we already discussed the other one away [18:26] cpaelzer: possibly, I'd just like to test that is asks for the password correctly [18:26] drab: thanks, do you know about a good libvirt + virtmanager setup guide? [18:26] cpaelzer: is debian using systemd? [18:26] nacc, what's the code? because i thought pitti did fix all the things to migrate to the fuller check. [18:26] ahasenack: yes, but you can switch init systemd if you want to do so badly [18:27] -d [18:27] xnox: cifs-utils [18:27] ahasenack: you checked upstream too? [18:27] looking at http://pastebin.ubuntu.com/25320448/ it seems wrong [18:27] nacc: fetching their git repo now [18:27] ahasenack: ack thanks [18:27] systemd-ask-password is optional, and systemd cgroup exists on upstart+cgmanager+logind and thus without systemd pid1 [18:27] nacc: upstream is http://pastebin.ubuntu.com/25320445/ [18:28] xnox: yeah the cgroup check makes little sense [18:28] yeah the comment in 5 is wrong. [18:28] if any of that fails, it will fallback to getpass() [18:28] drab: btw, is it possible to connect to the virtmanager via the net, instead of having it locally? [18:28] ahasenack: ah! it's to know just whether it should use systemd-ask-password? [18:28] ahasenack: shite code [18:28] Vladimirski: yes [18:28] Vladimirski: Connect via ssh. [18:28] nacc: yes, that is probably a better alternative for fstab entries during boot [18:28] Vladimirski: I don't know of a tutorial off the cuff, I just google all the time. and yes, you can connect over ssh, which is how I sued it [18:29] nacc: I've seen it working, btw [18:29] drab: Did you take all its money? [18:29] ahasenack: xnox upstream git still is that way as well, not just in debian [18:29] Vladimirski: you install virtmanager on your dekstop and libvirt on the server where you do the virtualization [18:29] it's just like that dmcrypt prompt, it shows up nicely in ubuntu's splash screen [18:29] drab: conncet via ssh to see the gui? [18:29] mason: ? [18:29] ahasenack: sure, i mean it "does work", but it works by chance, i think [18:29] oh I see [18:29] drab: ALright, thank you :) [18:29] nacc: maybe it would fail on trusty :) [18:29] nacc, ahasenack: https://github.com/systemd/systemd/blob/master/src/libsystemd/sd-daemon/sd-daemon.c#L628 -> sd_booted is the function to use if one is ok linking libysstemd; or one should mimick the check that /run/systemd/system folder exists. [18:29] Vladimirski: Glad drab could help you out with that. [18:29] ahasenack: the semantic they want is "if i am on systemd and systemd-ask-password exists (and is executable?)), use it [18:29] nacc: ahasenack: but a bug and suggestive patch to upstream and making the package atm a sync should be a good way (as actions for now) - right? [18:29] nacc, ahasenack: feel free to bash upstream with https://github.com/systemd/systemd/blob/master/src/libsystemd/sd-daemon/sd-daemon.c#L628 [18:29] cpaelzer: +1 [18:30] nacc: yes [18:30] ahasenack: their variable name is confusing :) [18:30] ahasenack: at a minimum [18:30] mason: sorry, I saw your answer as well. Thanks :) [18:30] afk, bbl [18:30] :P [18:30] mason: didn't mean to leave you out..:( [18:30] Vladimirski: FWIW, you can either ssh to root (just be very careful) or ssh to a user in the right group, so you have some options. [18:31] Either way, consider using limiters on what the account can do via ssh connection. [18:31] cpaelzer: ok, so let me try the debian code without our patch, make sure it can mount cifs filesystems during boot [18:31] and if yes, i'll comment on the mp, we abandon it, and you sync? [18:31] ahasenack: yes lets do it that way [18:31] ahasenack: requestsync if so [18:31] and/or the MP (but requestsync will file a bug) [18:31] nacc: what's that? [18:32] ahasenack: yet another tool :) [18:32] Vladimirski: A quick search turns up: https://serverfault.com/questions/407497/how-do-i-configure-sshd-to-permit-a-single-command-without-giving-full-login-ac [18:32] another magical script from ubuntu-dev-scripts? :0 [18:32] :) [18:32] ahasenack: a tool to open a bug to request a sync [18:32] which we'd want in this case, to track down the logic of syncing it (why the delta can be dropped) [18:32] (IMO) [18:32] for documentation at least [18:32] Ah, there it is. man authorized_keys and search for command= [18:32] as it's not entirely obvious to drop a quilt patch [18:33] nacc: +1 on explaining on a please sync bug [18:33] ok, I'll do that, coment on the reasoning in the bug, [18:33] but to admit I never used the tool but opened the bug the "classic" way [18:33] which there are 3-5 :-) [18:33] mason: I tend to you private keys when using ssh which seems much more secure [18:33] to use* [18:33] and maybe file an upstream bug to improve the systemd detection, I have to read more carefully what xnox said above [18:33] perfect ahasenack [18:33] Vladimirski: If you look at that command section, that works with private keys and provides a bit more protection. [18:33] ahasenack: yeah, i think that can be a card in our board to do after FF [18:34] mason: that's great [18:34] cpaelzer: nacc xnox ok, thanks for the feedback [18:34] ahasenack: yw [18:34] Vladimirski: FWIW, I was using Xen for years, and only in the last year or two am I using libvirt and friends, and I have to say, I quite like it. Very flexible and convenient, and I love virt-manager. [18:34] mason: thanks again mason :) [18:35] ahasenack: yw++ [18:38] dannf: did I miss the new extra bug on the pflash lock byte issue - or just no time yet to file? [18:38] dannf: not that I'd expect to work on it today - just don't want to miss it [18:39] ahasenack: feel free to drop me a mail with the sync bug eventually [18:39] ahasenack: in case non picks up today I will tmrw then [18:40] I'll add it to the mp if that's ok [18:40] yeah fine for me [18:40] cool [18:40] I wasn't sure which of our portfolio of options you'd take :-) [19:34] cpaelzer: you haven't, i'll file it now [19:35] quick question :) reinstalling php app here, on same box, folders permisson 750 files 640 owner is root:www-data, should work but something is a miss - using nginx [19:35] gives 403 :)) [19:35] xnox: looking at https://github.com/systemd/systemd/blob/master/src/libsystemd/sd-daemon/sd-daemon.c#L628 finally [19:35] I sense I might of omited something I have done before [19:35] xnox: we could use that to decide if systemd is being used, it's my understanding [19:35] and then for this particular use case we would add another check to see if systemd-ask-password is available (since you said it was optional), and only then call it [19:36] these two conditions: systemd being used, systemd-ask-password installed [19:36] righT? [19:36] ahasenack, in essence drop the cgroups check, use the check that /run/systemd/system folder exists. [19:36] right [19:37] (because e.g. upstart, cgmanager, cgroups-lite, all face a systemd cgroup for logind integration) [19:37] use that for the "is systemd being used?" check instead of what was in that pastebin [19:37] in fact in no one would be wrong no one could of been right :) [19:37] ack. [19:37] *if [19:37] xnox: ok, thx. I'll file an issue with upstream [19:37] tah. [19:38] mh, looks like a lot of people dropped from irc [19:38] yes [19:38] they been punished for idling :) by god of action [19:38] *have been [19:42] hopefully there's no god of poor questions punishing ppl asking for help without doing research first [19:44] :)) [19:52] cpaelzer: LP: #1710960 [19:52] Launchpad bug 1710960 in libvirt (Ubuntu) "QEMU 2.10 may require AppArmor updates for pflash devices" [Undecided,New] https://launchpad.net/bugs/1710960 [20:14] is this place only for ubuntu-server issues or can you help with other more wtfamidoingarghitsbroke linux server-ish kind of things? specifically mail, stupidly behind NAT which I'd like to correct. [20:14] oh, and hi :) [20:15] we try to be helpful such as we can.. [20:16] ah ok, thanks :) my question is kind of, what's normal. ok, I'll try again. if you have a gateway machine but you don't want to serve mail from the gateway, it appears NAT'ing the SMTP loses a lot of email kind of info that services like postfix need for mail spam blocking (ip mainly) [20:17] so, do you setup two mail servers? one on each hop? postfix them both? simple sendmail on the gateway with postfix downstream? none of the above? [20:17] Package 'php7.0-fpm' has conffile prompt and needs to be upgraded manually [20:17] what can it mean? [20:18] hehehe, I googled it for you :) https://askubuntu.com/questions/921162/how-can-i-automate-a-conffile-prompt-in-unattended-upgrades [20:19] ty [20:19] so automated updates can rewrite default php config? [20:19] going to apply that fix [20:20] I'll setup mail submission on the submission port but turns out I quickly became an open relay and upstream (google) got a little grumpy [20:20] eliam: DNAT'ing a port from your public gateway to your private SMTP listener shouldn't remove anything useful for Postifx to ID spam [20:21] sdeziel: I don't see the problem with NAT, but in any case, a DMZ with routing would remove the need for NAT'ing if that's a problem [20:21] eeer, eliam [20:22] So, postfix sees all inbound mail as coming from 'within the network' due to the source ip being the NAT firewall box [20:22] eliam: you need to basically add a subnet on the gw, put postfix on that subnet and route [20:22] eliam: if postfix sees only the firewall's IP that probably means you have a SNAT/MASQUERADE rule that is wrong [20:23] that shouldn't be the case, the gw should only do DNAT, not both SNAT and DNAT [20:23] yeah, what sdeziel said [20:25] https://pastebin.com/pZpN4Zy0 [20:25] eliam: iptables -t nat -nvL POSTROUTING [20:25] or better yet, iptables-save [20:28] if you want but there appears to be *a lot* of repeats! [20:28] http://paste.ubuntu.com/25321152/ [20:29] eliam: you shouldn't mix conntrack and state. conntrack replaced the older/obsoleted state module [20:30] eliam: yes, you have quite a few dup [20:30] ok, I'll look at that. So, I guess it's DNAT and postfix turned me into a relay (as the whole internal subnet was 'allowed') [20:31] "-A POSTROUTING -o eth0 -j MASQUERADE" => could be the faulty one. Can you give the output of "ip ro g 192.168.1.70" [20:32] eliam: yes, if you authorized relying from 10.0.0.0/8 and you wrongly masquerade to an IP in that range when reaching the SMTP box, then yeah, open relay [20:33] ip ro ... http://paste.ubuntu.com/25321194/ [20:34] eliam: so yeah, that confirms the issue. You want to make that "-o eth0 MASQUERADE" rule a tad more specific [20:35] eliam: maybe replace it by "-A POSTROUTING -o eth0 -s 192.168.0.0/16 -j MASQUERADE" [20:36] eliam: your LOGDROP chain doesn't log, it just DROP ;) [20:37] it's an IMightLogThatSometime chain :) I turn logging on if I'm interested but the logs get *filled* otherwise so I remove it [20:38] ah [20:39] so basically I'm a bit confused about iptables then and need to read a little. external traffic can't see the mail server, hence the DNAT. If I limit to internal traffic, mail won't reach the mail server, will it? [20:40] eliam: your DNAT and FORWARD rules are OK [20:41] eliam: the problem is that when your firewall/gateway passes the SMTP traffic over to 192.168.1.70, it goes out eth0 and you have a rule that says: [20:42] when traffic goes out of fw's eth0, make the source 192.168.1.2 [20:42] oh dear :( [20:42] I didn't mean that! [20:42] most probably not :) [20:43] maybe the masquerade is not needed at all then? The 'gateway' per se is actually just for inbound DMZ traffic and isn't really the network gateway (which is the router). [20:43] replace "-A POSTROUTING -o eth0 -j MASQUERADE" by "-A POSTROUTING -o eth0 -s 192.168.0.0/16 -j MASQUERADE" and you won't be doing the undesired source rewrite [20:44] ah, then I think I know why you added that MASQUERADE rule ;) [20:44]