I'm using Mailcow,
I can send email but it goes to spam folder in Gmail,
check header it says "DKIM fail".
spf and DMARC are passed.
I just copied dkim record from mailcow UI and pasted it into domain's DNS.
this is the DNS setings
DKIM._DOMAINKEY TXT 3600 v=DKIM1;k=rsa;t=s;s=email;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtltohTp1WvnqRlFkGbaG9Urchi6jnvAQTBRxiehh6ZcslrBdU9KfXVMFDckasKyeHP0tVZSTTWRAiroiTWfKLk7trq3DBsy+Wc8EAz6yMEVLwyCJhh1wtgC/khHjdxzrvQrxbbJIYnz79bKTMUp4/Cr6BJ7eRBnjxWuwJtDmbuGZaxLl5biPvgbUmXqQWGvncSIUrytmLvd2XzLETXDBueIezB0vjZxfFH65znYOs4J+y6hd+EryWjGlM1Gy4Y8uwaKJhVCwdrOGCQjRYeZW3OA1NDCyYxlkPi5mSK/WGIVZBwTdAKwrV5NP2HyNZ5HCZIC8VzcSKAJ3VYHeTsaesQIDAQAB
this is the header
DKIM FAILED
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=jpyy.ml; s=dkim;
t=1671204384; h=from:subject:date:message-id:to:mime-version:content-type;
bh=RenstW80cSPLXw/2g0G4x1MNFKyZVMXFRE1oZh7R63c=;
b=FKL9WJIT6f2xgTQnGPgg6i2SaXyjbWtxTFnQAwcfceqPWKYtzrPJkebLmj8ZHDXGv3+7J5
+XiRjtQOqF5q0KHhNy06fmx1j66n6Z//zTpWhVdVAqjwTeelqfPu2tewt8tZgpvN5Bqpvm
9+jBJ0iw0Hd+IS/H6uy7TgRPVQzqJ9+bZW99SxDt5QJxTOxW1wsbmEv/4V8P47vARyQCd0
adPenQewmS8f0BoJwS30pnwVjiHO3ZSe/huBSrlsvWbjjM6b5E+cIfUckBX5dNtiylmcNx
YACE9Q/QYd/SmvyZnAxFDAFUkCeuKLMxFGKeBBxN6iecyThjVMajspgp1N6z4w==
Signed-by: mail#jjyy.ml
Expected-Body-Hash: RenstW80cSPLXw/2g0G4x1MNFKyZVMXFRE1oZh7R63c=
Public-Key: v=DKIM1;k=rsa;t=s;s=email;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArZGc4NCdvFe5WSXASt7bcsI0E5XrO97yaokMB65cLOi6RDfS4+N9Jt3MlFMKCEJTAa/BT6fHEDJpEOngI9U3Oz8SiTLvzFLz/quguLGZhNYVL1N7yHrMBEP4xsmD1zeoxF573ioIBHeil/27RCQitvco1xUAC5houoA0V3PuayS411Qmgqiinr93gBiaRvKnpGs82pbkQa9N5QDHwDzyTszMemSbEbC4CfBFu7SOlf8ziSVfS/F1VTY/rBa30uSQ8YDz4NbaecykbU4W/QwdHDA9kljUKrCbhA7nOds+l1l+fLl+mtgpu/dAMR9RJ4arNvRmAPv8IojV35Kdg+MH/wIDAQAB;
DKIM-Result: fail (bad signature)
I've been struggling with this for 2 days.
any help would be appreciated thank you.
Related
I'm trying to get PingAccess set up as a proxy (let's call the PA host
pagateway) for a couple of applications that share a Web Session. I want all access to come via the PA pagateway and use HTTPS, but the back end systems are not HTTPS.
I have two sites defined, app1:8080 and app2:8080. Both are set to "secure" = no and "use target host header" = yes.
I have listeners defined on ports 5000 and 5001 that are both set to "secure" = yes.
The first problem I found is that when I access either app in this way (e.g. going to https://pagateway:5000), after successfully authenticating with PingFederate I end up getting redirected to the actual underlying host name (e.g. http://app1:8080), meaning any subsequent interactions with the app are not via PingAccess. For users outside the network they wouldn't even be able to do that because the app1 host wouldn't even be visible or accessible.
I thought maybe I needed to turn off "Use target host header" to false but Chrome prompts me to download a file that contains NAK, ETX, ETX, NUL, STX, STX codes, and in the PA logs I get an SSL error:
2015-11-20 11:13:33,718 DEBUG [6a5KYac2dnnY0ZpIl-3GNA] com.pingidentity.pa.core.transport.http.HttpServerHandler:180 - IOException reading sourceSocket
javax.net.ssl.SSLException: Unrecognized SSL message, plaintext connection?
at sun.security.ssl.InputRecord.handleUnknownRecord(InputRecord.java:710)
...
I'm unsure exactly which part of the process the SSL error is coming from (between browser and pagateway, or pagateway and app1). I'm guessing maybe app1 is having trouble with the unexpected host header...
In another variation I turned off SSL on the PA listener (I also had to change the PingAccess call-back URL in the PingFederate client settings to be http). But when I accessed it via http://pagateway:5000 I got a generic PingFederate error message in the browser and a different error in the PA logs:
2015-11-20 11:37:25,764 DEBUG [DBxHnFjViCgLYgYb-IrfqQ] com.pingidentity.pa.core.interceptor.flow.InterceptorFlowController:148 - Invoking request handler: Scheme Validation for Request to [pagateway:5000] [/]
2015-11-20 11:37:25,764 DEBUG [DBxHnFjViCgLYgYb-IrfqQ] com.pingidentity.pa.core.interceptor.flow.InterceptorFlowController:200 - Exception caught. Invoking abort handlers
com.pingidentity.pa.sdk.policy.AccessException: Invalid request protocol.
at com.pingidentity.pa.core.interceptor.SchemeValidationInterceptor.handleRequest(SchemeValidationInterceptor.java:61)
Does anyone have any idea what I'm doing wrong? I'm kind of surprised about the redirection to the actual server name, to be honest, but after that I'm stumped about where to go from here.
Any help would be appreciated.
Have you contacted our support on this? It's sounding like something that will need to be dug into a bit deeper - but some high level suggestions I can make:
Take a look at a browser trace to determine when the redirect is happening to the backend site. Usually this is because there's a Location header in a redirect from the backend web server that (by nature) is an absolute URL but pointing to it instead of the externally facing hostname.
A common solution to this is setting Target Host Header to False - so it will receive the request unmodified from the browser, and the backend server should know to represent itself as that (if it behaves nicely behind a proxy).
If the backend server can't do that (which it sounds like it can't) - you should look at assigning rewriting rules to that application. More details on them are available here: https://support.pingidentity.com/s/document-item?bundleId=pingaccess-52&topicId=reference%2Fui%2Fpa_c_Rewrite_Rules_Overview.html. The "Rewrite Response Header Rule" in particular will rewrite Location headers in HTTP redirects.
FYI - The "Invalid request protocol." error you're seeing at bottom of your description could be due to a "Require HTTPS" flag on your defined Application.
Do you have the same issue if you add a trailing slash at the end (https://pagateway:5000/webapp/)? Your application server will rewrite the URL based on what it thinks is the true host. This is to get around some security related issues around directory listing.
Which application server are you using? All app servers are unique, but I'll provide instructions on how to resolve this with Tomcat.
Add a global rule that forces the application server to use the external facing host name. Here is a sample Groovy script:
def header = exc?.request?.header;
header?.setHost("pf.pingdemo.com:443");
anything();
In Tomcat's server.xml, add scheme="https" to the connection:
<Connector port="8080" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="443" scheme="https" />
Cheers,
Tam
I am trying to setup the certificate verification in opensips along with the blink sip client. I followed the tutorial:
https://github.com/antonraharja/book-opensips-101/blob/master/content/3.2.%20SIP%20TLS%20Secure%20Calling.mediawiki
My config look like so:
[opensips.cfg]
disable_tls = no
listen = tls:my_ip:5061
tls_verify_server= 0
tls_verify_client = 1
tls_require_client_certificate = 1
#tls_method = TLSv1
tls_method = SSLv23
tls_certificate = "/usr/local/etc/opensips/tls/server/server-cert.pem"
tls_private_key = "/usr/local/etc/opensips/tls/server/server-privkey.pem"
tls_ca_list = "/usr/local/etc/opensips/tls/server/server-calist.pem"
So i generated the rootCA and the server certificate. Then i took the server-calist.pem added the server-privkey.pem in there (otherwise blink sip client won't load it) and set it in client. I also set the server-calist.pem as a certificate authority in the blink. But when i try to login to my server i get:
Feb 4 21:02:42 user /usr/local/sbin/opensips[28065]: DBG:core:tcp_read_req: Using the global ( per process ) buff
Feb 4 21:02:42 user /usr/local/sbin/opensips[28065]: DBG:core:tls_update_fd: New fd is 17
Feb 4 21:02:42 user /usr/local/sbin/opensips[28065]: ERROR:core:tls_accept: New TLS connection from 130.85.9.114:48253 failed to accept: rejected by client
So i assume that the client doesn't accept the server certificate for some reason, although i have the "Verify server" checkbox turned off in my blink sip client! I think i have the wrong certificate authority file.
./user/user-cert.pem
./user/user-cert_req.pem
./user/user-privkey.pem
./user/user-calist.pem <- this 4 are for using opensips as a client i think
./rootCA/certs/01.pem
./rootCA/private/cakey.pem
./rootCA/cacert.pem
./server/server-privkey.pem
./server/server-calist.pem
./server/server-cert.pem
./server/server-cert_req.pem
./calist.pem
Can anybody help, did i do something wrong i the config or did i use the wrong certificate chain? What certificate exactly should be used by the client as a client cert, and ca authority cert?
Allright, i'm still not sure if it is working or not, because the authorization behaviour became weird, but after it's hanging for 5-6 minutes i get the success authorization, so this is a solution:
Generate rootCA:
opensipsctl tls rootCA
then edit server.conf file in your tls opensips folder and set the commonName = xxx.xxx.xxx.xxx where xxx.xxx.xxx.xxx is your server ip address. Other variables can be edited in any way. Generate the certificates signed by CA
opensipsctl tls userCERT server
This will produce 4 files. Download the server-calist.pem, server-cert.pem, server-privkey.pem. Open the server-privkey.pem, copy it's content and paste in the file server-cert.pem, before the actual certificate. If you are using blink, the produced server-cert.pem goes in the preferences->account->advanced. And server-calist.pem goes into the preferences->advanced. After that restart blink and after 5-6 minutes your account is gonna be logged in. But i'v observed a weird behaviour, if you run another copy of blink and try to log into the other existing account after your logged from the first one with the certificates, you can log in from other account without providing the certificates. So i don't know, but i think it's working.
P.S. I asked about the certificates in the opensips mailing list, but i guess they found my question too lame, so i didn't get the response. If you have the same problem and got better results or an answer from opensips support let me know please.
I'm having an error with gmail gem while trying to send a mail, this is working fine on local, and was working fine on heroku, but now im moving this app to a VPS server. This is the error:
e = g.compose do
to 'test#gmail.com'
subject 'testasea'
body 'test'
end
=> #<Mail::Message:25450040, Multipart: false, Headers: <From: .......>
e.deliver!
=> OpenSSL::SSL::SSLError: hostname does not match the server certificate
I've added this into an initializer file, without any luck:
ActionMailer::Base.smtp_settings = {
:enable_starttls_auto => true,
:openssl_verify_mode => 'none' # I've tested with 0 and false,
}
I tried to monkey path the class
OpenSSL::SSL::SSLSocket.class_eval do
def post_connection_check(hostname)
return true
end
end
with no luck, when I do that i receive a 535 Incorrect authentication data, however I know data is ok because i can do
g.inbox.count :read
And it returns me the right number.
I would like to know:
the incorrect certificate is the one my server (smtp client) is sending? or the one that is received by gmail smtp server?
why it works in local?
Why if i monkey path the class I received an authentication error?
Is there any workaround? i dont care if is not safe, is just a tenting application,.
This is only a guess, but if you are in a WHM VPS there is a function that restricts outgoing SMTP connections, you can find it in Tweak Settings.
Restrict outgoing SMTP to root, exim, and mailman (FKA SMTP Tweak)
It redirects all SMTP connections, If this is enabled you will receive your server self-signed ssl certificate, and if you bypass it using the monkey patch or setting configuration to dont check ssl certificate you will probably found an authentication error as you are in fact connecting to the LOCAL SMTP server.
Just disable it and test again.
I'm currently working on an AS/2 implementation (my first BizTalk project) and I'm facing an issue with certificates. I've checked numerous websites, blogs, MSDN and until now, I don't get it working.
Here's the scenario:
From a specific partner, I need to receive an AS/2 encrypted message.
Here's how I test this:
- I have my local computer and a server which both run BizTalk 2013.
- I have generated 1 certificate (DES3 2048 bits) by using OpenSSL.
The certificates are installed as follows:
Sending machine: Local Computer\Other People (My CER file).
Sending machine: Local Computer\Trusted Root Certification Authorities (My CER file) - To make the certificate trusted.
Receiving machine: Current User\Personal Store (My PFX file) - NOTE: Current user is the user under which the In-Process host instance of BizTalk is running.
Receiving machine: Current User\Personal Store (My PFX file) - to make the certificate trusted. - NOTE: Current user is the user under which the In-Process host instance of BizTalk is running.
In IIS, the application pool running the BTSHttpReceive.dll is running under the ApplicationPoolIdentity.
And finally, here's the BizTalk configuration:
(Sending parter):
Send port -> Certificate: Receiving parner certificate (CER).
Pary agreement (Sending partner -> Receing partner) -> Validation: "Message should be encrypted is selected" and the encryption algorithm is set to DES3.
(Receiving partner):
Host (BizTalkServerApplication) -> Certificates: My certificate (PFX).
Party agreement (Sendingp partner -> Receing partner) -> Validation: "Message should be encrypted is selected" and encryption algorithm is set to DES3.
When I try to send a message from the sending computer to the receiving computer (just a text file with one line) the receiving computer generates two errors in BizTalk Event Viewer:
Error message 1:
The AS2 Decoder encountered an exception during processing. Details of the message and exception are as follows: AS2-From:"AS2-xxx" AS2-To:"AS2-xxx" MessageID:"" MessageType: "unknown" Exception:"An error occurred when decrypting an AS2 message."
Error message 2:
A message received by adapter "HTTP" on receive location "xxx" with URI "/BTSHttpReceive.dll" is suspended.
Error details: An output message of the component "Microsoft.BizTalk.EdiInt.PipelineComponents" in receive pipeline "Microsoft.BizTalk.EdiInt.DefaultPipelines.AS2Receive, Microsoft.BizTalk.Edi.EdiIntPipelines, Version=3.0.1.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" is suspended due to the following error:
An error occurred when decrypting an AS2 message..
The sequence number of the suspended message is 2.
MessageId: {BFE72958-E968-4FF6-B7DA-EB31340D81F6}
InstanceID: {B2B08761-4403-44AE-A788-D487F94CC270}
Here's what I have checked already:
Serial numbers or the certificate as I've seen that this might cause an issue:
Sending computer certificate serial number: 00 8a 42 09 ee af c2 29 b1
Receiving computer certificate serial number: 00 8a 42 09 ee af c2 29 b1
I hope someone can point me in the right direction because I'm searching for days on this issue.
Kind regards,
Thanks for your response but I must say that I've managed to find the issue. It seems that the decrypting certificate should be registeren as the BizTalk Isolated Host process user account.
Anyway, that solved my issue.
I have implemented SSO through mod_auth_kerb in our apache-active directory environment and it works just as expected. However the following knowledge is bugging me :
I requested a Kerberos protected page from two client machines, one user belonged to the Kerberos-setup domain and the other user belonged to some other domain.
I then compared the HTTP packets on the two machines. On both the machines, after the request for the Kerberos protected page is sent, the server responds with the following HTTP packet :
HTTP/1.1 401 Authorization Required
Date: Wed, 05 Sep 2012 14:25:20 GMT
Server: Apache WWW-Authenticate: Negotiate
WWW-Authenticate: Basic realm="Kerberos Login"
Content-Length: 60
Connection: close
Content-Type: text/html; charset=iso-8859-1
However, after the above response from the server the client machine's browser belonging to the Kerberos-setup domain responds with a WWW-Authenticate : Negotiate 'token', whereas the other client browser(user belonging to some other domain) does not respond at all.
Now my understanding is, that the client belonging to the other domain should have also responded with its own TGT+Session key token, which the active directory should have rejected. But why this client does not respond at all to the server's WWW-Authenticate : Negotiate challenge is beyond my logic.
What is even more confusing is that the server's HTTP response(given above), does not contain any information about the domain it is linked to.
So on what basis is the client browser belonging to the correct domain decide that it has to respond to the server's WWW-Authenticate : Negotiate challenge, and on what basis does the client belonging to some other domain decide not to respond to the same ?
Note : Both the client machines have Windows 7 and active directory is a Windows 2008 server.
I am trying to understand mod_auth_kerb's implementation of SSO, and this particular knowledge is key to that.
The module has the option KrbMethodK5Passwd turned on. It sends a Basic header to collect you Kerberos credentials. This is pointless for a non-domain client. Disable this option.
There is a hierarchy of strengths of auth mechanisms, the browser is obliged to choose the best. This is: Negotiate, Digest, NTLM, Basic.