Synchronet v3.20d-Win32 (install) has been released (Mar-2025).

You can donate to the Synchronet project using PayPal.

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
faq:tcpip [2020/04/17 20:20] – [Bind] Add a sub-section heading for rebind digital manfaq:tcpip [2025/01/29 23:12] (current) – [SSH Session Key] Added some common logged ssh errors nelgin
Line 48: Line 48:
 |WS             |1123   |       |WebSocket Service - to support the [[http://ftelnet.ca|fTelnet web browser-based terminal]] | |WS             |1123   |       |WebSocket Service - to support the [[http://ftelnet.ca|fTelnet web browser-based terminal]] |
 |WSS            |11235  |       |WebSocket Secure Service - to support the [[http://ftelnet.ca|fTelnet web browser-based terminal]] over TLS | |WSS            |11235  |       |WebSocket Secure Service - to support the [[http://ftelnet.ca|fTelnet web browser-based terminal]] over TLS |
 +
 +Additionally, a default Synchronet installation includes *disabled* servers and services on the following ports:
 +
 +^Protocol ^TCP ^UDP ^Comments^
 +|QOTD         |17 |17     |Allows remote querying of BBS's auto-message (e.g. via ''qotdservice.js'')|
 +|IMAP           |143    |-      |Allows remote download of user's email (similar to POP3, via ''imapservice.js'')|
 +|IMAPS          |993    |-      |Allows secure remote download of user's email (similar to POP3/TLS)|
 +|BINKP          |24554  |-      |Allows exchange of FidoNet files (e.g. mail bundles and packets, via ''binkit.js'')|
 +|BINKPS         |24553  |-      |Allows secure exchange of FidoNet files|
 +|NNTPS         |563 |- |Allows BBS users to securely read and post messages using standard news readers/clients|
 +|Hotline        |5500   |-      |Allows interaction with Hotline client|
 +|Hotline-TRANS  |5501   |-      |""|
 +
 +
  
 Enabling connectivity to Synchronet through your firewall is no different than enabling connectivity to any other TCP/IP server. Follow your firewall documentation for forwarding or opening ports for TCP/IP servers located "behind" the firewall. Your firewall may have the option of placing the entire BBS computer in a "DMZ" (opening all its ports to the public Internet), but doing so is not normally recommended.  Enabling connectivity to Synchronet through your firewall is no different than enabling connectivity to any other TCP/IP server. Follow your firewall documentation for forwarding or opening ports for TCP/IP servers located "behind" the firewall. Your firewall may have the option of placing the entire BBS computer in a "DMZ" (opening all its ports to the public Internet), but doing so is not normally recommended. 
Line 174: Line 188:
 In general, you need to check your Synchronet Mail Server window/log output for details about why Internet e-mail delivery attempts may be failing.  In general, you need to check your Synchronet Mail Server window/log output for details about why Internet e-mail delivery attempts may be failing. 
  
 +==== GMail ====
 +:?: **Question:**\\
 +Why can't I send Internet e-mail from my BBS to GMail.com?
 +
 +Example:
 +  cvs.synchro.net reporting delivery failure of message
 +  from Someone to annyone@gmail.com
 +  
 +  Reason:
 +  gmail-smtp-in.l.google.com replied with:
 +  "550 5.7.26  https://support.google.com/mail/answer/81126#authentication
 +  d9443c01a7336-21a919d2ef1si90834815ad.334 - gsmtp"
 +  instead of the expected reply:
 +  "250 ..."        
 +
 +:!: **Answer:**\\
 +GMail.com requires mail severs have a valid **SPF** DNS record to send email to their servers. This requirement from Google is an anti-spoofing/SPAM measurement and nothing to do specifically with the Synchronet Mail Server. [[https://support.google.com/a/answer/33786?sjid=18257063204175362891-NC|Here are helpful instructions from Google on how to set up an SPF record your domain]].
 +
 +An SPF record is a specially formatted DNS **TXT** (text) record. You can check if your domain has an SPF record by querying the DNS for TXT records for your domain using common network tools provided with your OS such as ''host'', ''dig'', and ''nslookup''.
 +
 +  $ host -t txt vert.synchro.net
 +  vert.synchro.net descriptive text "v=spf1 mx a -all"
 +
 +If you are [[howto:relay_smtp|relaying your outbound Internet mail through Vertrauen]], then it is Vertrauen's mail servers that you need to reference in your domain's SPF record (not your own):
 +  mail.synchro.net
 +
 +If you are relaying your outbound Internet mail through Vertrauen **and** [[howto:vert_mx|using Vertrauen as your inbound Internet Mail Exchange (MX)]], then setting your domain's SPF record to just the following will suffice:
 +  v=spf1 mx a -all
 +  
 +If you are using the Synchronet dynamic DNS service to have/update a ''//yourbbs//.synchro.net'' hostname, then see [[module:dyndns#SPF]] for details on how to create the appropriate SPF record.
 ===== Receive Mail ===== ===== Receive Mail =====
  
Line 185: Line 229:
 You should also see evidence of the successful SMTP connection to the server in your Synchronet Mail Server window/log output. If you do not, then it's likely that your firewall or Internet Service Provider is blocking incoming connections to TCP port 25. Before concluding this is the case, verify that the remote Telnet client can connect to other SMTP servers first (e.g. ''vert.synchro.net'', TCP port 25). If it cannot, then this remote client probably has restrictions on which (if any) connections he can make to TCP port 25. Try using a different, less restricted, remote Internet connection for your test.  You should also see evidence of the successful SMTP connection to the server in your Synchronet Mail Server window/log output. If you do not, then it's likely that your firewall or Internet Service Provider is blocking incoming connections to TCP port 25. Before concluding this is the case, verify that the remote Telnet client can connect to other SMTP servers first (e.g. ''vert.synchro.net'', TCP port 25). If it cannot, then this remote client probably has restrictions on which (if any) connections he can make to TCP port 25. Try using a different, less restricted, remote Internet connection for your test. 
  
-If your firewall or Internet Service Provider is blocking incoming connections to TCP port 25 (many consumer-class ISPs do), then you won't be able to receive Internet e-mail on your BBS. Fixing your firewall configuration is rather simple, but changing ISPs is often not. One possible work-around is having a mail proxy (3rd party server) receive the e-mail for you and forward it to a non-standard, non-filtered/blocked SMTP port. Many Dynamic DNS services offer this service [[http://www.dyndns.com/services/mailhop/relay.html|for a fee]]. Or a fellow sysop may be able and willing to perform this service for you as a favor. +If your firewall or Internet Service Provider is blocking incoming connections to TCP port 25 (many consumer-class ISPs do), then you won't be able to receive Internet e-mail on your BBS. Fixing your firewall configuration is rather simple, but changing ISPs is often not. One possible work-around is having a mail proxy (3rd party server) receive the e-mail for you and forward it to a non-standard, non-filtered/blocked SMTP port. Many Dynamic DNS services offer this Mail Exchange (MX) service [[http://www.dyndns.com/services/mailhop/relay.html|for a fee]]. [[howto:vert_mx|Or a fellow sysop may be able and willing to perform this service for you as a favor]]. 
  
 ===== FTP Connect ===== ===== FTP Connect =====
Line 276: Line 320:
   sbbs: term 0001 Will retry in 15 seconds (1 of 2)   sbbs: term 0001 Will retry in 15 seconds (1 of 2)
  
-... this is most likely because a TCP session is stuck in a ''TCP TIMEWAIT'' state (you can use ''[[man>netstat]]'' to verify this). The session will eventually time-out and close properly on its own, allowing the port to be re-bound at that time. To work-around this problem, you can either increase the ''BindRetryCount'' and/or ''BindRetryDelay'' values in your ''[[dir:ctrl]]/[[config:sbbs.ini]]'' file, or you can add the following line to the root section of your ''[[dir:ctrl]]/[[config:sockopts.ini]]'' file: +... this is most likely because a TCP session is stuck in a TCP "TIME WAIT" or "CLOSE WAIT" state (you can use ''[[man>netstat]]'' to verify this). The session will eventually time-out and close properly on its own, allowing the port to be re-bound at that time. To work-around this problem, you can either increase the ''BindRetryCount'' and/or ''BindRetryDelay'' values in your ''[[dir:ctrl]]/[[config:sbbs.ini]]'' file, or you can add the following line to the root section of your ''[[dir:ctrl]]/[[config:sockopts.ini]]'' file: 
   REUSEADDR=1    REUSEADDR=1 
  
Line 396: Line 440:
  
 These files (''cryptlib.key'' and ''ssl.cert'') are encrypted with the Synchronet //system password//, so if the system password is changed then these files must also be regenerated. The files are automatically recreated by //sbbs// upon startup if they do not already exist. These files (''cryptlib.key'' and ''ssl.cert'') are encrypted with the Synchronet //system password//, so if the system password is changed then these files must also be regenerated. The files are automatically recreated by //sbbs// upon startup if they do not already exist.
 +
 +===== SSH Errors =====
 +:?: **Question:**\\
 +Should I be concerned about ssh errors in my log files?
 +
 +:!: **Answer**\\
 +A number of ssh errors are generated mainly due to clients disconnecting or not actually using a valid ssh client, such as port scanners or bots. Some of these errors are
 +
 +  'Internal consistency check failed' (-16) setting session active
 +  
 +  'ENOTCONN: Socket is not connected' (-42) setting session active
 +  
 +  'Error reading client's SSH identifier string: ETIMEDOUT: Function timed out before completion' (-41) setting session active
 +  
 +  No data was read because the remote system closed the connection (recv() == 0)' (-41) setting session active
 +  
 +  'Need resource to proceed' (-50) setting session active
 +  
 +
 ===== See Also ===== ===== See Also =====
   * [[:server:|Servers]]   * [[:server:|Servers]]

Trace: