email problem, one client only

[chancer]

I have a client who wants their email diverting to an existing email address. I already have a few clients set up doing that and it works perfectly. Neither I nor any clients apart from that one are having email problems just now, and I can't find what may be causing the problem.

I have tried adding one of my email addresses to the list of forwarding addresses, then sent an email to the client's address from one of my private email addresses - it bounces with Relay access denied in the bounce message.

So far as I can see, the email setup in ISPConfig is exactly the same as for all the other clients. Why would relay access be denied? Where do I look for a cure?

The logs are not telling me anything is untoward, just the usual lengthy list of E. Europeans probing for a spam relay.

Many thanks.

[madmucho]

Please can you describe situation at example?
As i see you want Forward mail addres to another address, is destination forward address hosted on same server?

PS : I try solve similiar problem today at one client, but not forwarding, only delivering and problem was in standart dns entery, was deleted :-)

[chancer]

Hi, madmucho, no the destination address is on another server, although my own address that I added to forward to is on the same server.

I have checked the DNS settings and they are correct. The web site is working and the MX records are set correctly according to dig.

[madmucho]

And any errors in ispconfig log, mail log ?

Take a look inside you domain folder
/var/www/problemdomain/.forward
is there mailaddresses to which users from domain want forward to?

[chancer]

Yes. But

a) It's my address, which is th eone on the same server

b) The one the client wants mail forwarded to is missing

Also, I now understand a message I get from the server every 12 hours saying certain clients have overused their mail quotas - these all have email response addresses or forms on their sites.

This particular client has a radio campaign pointing people to their web site and they are losing a fortune. Would someone help me, urgently, please?

TIA,

Sorry, nearly forgot - spent hours poring over the logs, but couldn't find anything which told me what's happening. To be honest, I'm not even sure where to look or what I should be looking for.

[till]

Please check the mail log file for errors. The mail log is in the directory /var/log/ and can be named maillog, mail.log or just mail

[chancer]

I have mail.err mail.log mail.info and mail.warn - there are no entries in mail.err, mail.warn tells me clamav is out of date, as do the other two, reproduced below, mail.log then mail.info:

Feb 4 09:08:34 sww2 freshclam[25166]: Received signal: wake up
Feb 4 09:08:34 sww2 freshclam[25166]: ClamAV update process started at Mon Feb 4 09:08:34 2008
Feb 4 09:08:34 sww2 freshclam[25166]: SECURITY WARNING: NO SUPPORT FOR DIGITAL SIGNATURES
Feb 4 09:08:34 sww2 freshclam[25166]: See the FAQ at http://www.clamav.net/support/faq for an explanation.
Feb 4 09:08:34 sww2 freshclam[25166]: Your ClamAV installation is OUTDATED!
Feb 4 09:08:34 sww2 freshclam[25166]: Local version: 0.91.2 Recommended version: 0.92
Feb 4 09:08:34 sww2 freshclam[25166]: DON'T PANIC! Read http://www.clamav.net/support/faq
Feb 4 09:08:34 sww2 freshclam[25166]: main.inc is up to date (version: 45, sigs: 169676, f-level: 21, builder: sven)
Feb 4 09:08:34 sww2 freshclam[25166]: daily.inc is up to date (version: 5678, sigs: 33988, f-level: 21, builder: ccordes)
Feb 4 09:08:34 sww2 freshclam[25166]: --------------------------------------

Feb 4 09:08:34 sww2 freshclam[25166]: Received signal: wake up
Feb 4 09:08:34 sww2 freshclam[25166]: ClamAV update process started at Mon Feb 4 09:08:34 2008
Feb 4 09:08:34 sww2 freshclam[25166]: SECURITY WARNING: NO SUPPORT FOR DIGITAL SIGNATURES
Feb 4 09:08:34 sww2 freshclam[25166]: See the FAQ at http://www.clamav.net/support/faq for an explanation.
Feb 4 09:08:34 sww2 freshclam[25166]: Your ClamAV installation is OUTDATED!
Feb 4 09:08:34 sww2 freshclam[25166]: Local version: 0.91.2 Recommended version: 0.92
Feb 4 09:08:34 sww2 freshclam[25166]: DON'T PANIC! Read http://www.clamav.net/support/faq
Feb 4 09:08:34 sww2 freshclam[25166]: main.inc is up to date (version: 45, sigs: 169676, f-level: 21, builder: sven)
Feb 4 09:08:34 sww2 freshclam[25166]: daily.inc is up to date (version: 5678, sigs: 33988, f-level: 21, builder: ccordes)
Feb 4 09:08:34 sww2 freshclam[25166]: --------------------------------------

Not much help, I'm afraid.

[chancer]

Update: The logs have been repeating those messages and making no other entries since Friday, when I downloaded the zipped log files and then deleted the zips which were there.

I don't understand why that has happened. I keep meaning to change the cron job so the zips will be emailed to me anyway.

[chancer]

So, can anyone tell me how to get the logs recording normally again, so I can try some test emails and see what the logs say?

[madmucho]

Normal logs about emails can be found usualy
/var/log/mail/info
There are whole mailserver comunication.
When i debug email mesages i using hardcore telnet :-)
telnet mailserver 25
and simulate connection like this
http://www.yuki-onna.co.uk/email/smtp.html

you can check log and see what is there.

[chancer]

Thanks, madmucho, but I have shown what the logs are producing. Those messages are repeated over and over, although I have several live, working email accounts on my server. The logs I can find are not recording any of that activity.

I am running Debian Etch and there is no directory called mail, only the files I mentioned above and the gz zip files produced from them every 24 hours, like mail.info.1.gz mail.log.1.gz and so forth.

I can produce emails using telnet, the form on the web site or email clients but if the logs do not record anything, how do I diagnose what is going wrong?

This client has tried setting up the email account on his email client and I can send him emails normally, and he can send emails to me. He does not receive emails from the web form. So far as I can make out, and I have had a more experienced php developer check, too, the form is properly structured to email its inputs to that address. Would it help if I copied the form here? It's not a short one, though.

[chancer]

Would someone ***please*** tell me how to get these logs functioning again?

[chancer]

The logs have started logging again, so I filled in the form to see where it goes and got this from the mail.info log:

Feb 5 09:01:36 sww postfix/pickup[3855]: 6D93E219FB: uid=33 from=<www-data>
Feb 5 09:01:36 sww postfix/cleanup[8386]: 6D93E219FB: message-id=<20080205090136.6D93E219FB@mydomain.co.uk>
Feb 5 09:01:36 sww postfix/qmgr[22838]: 6D93E219FB: from=<www-data@sww.stopwatchweb.co.uk>, size=571, nrcpt=1 (queue active)
Feb 5 09:01:36 sww postfix/smtp[8388]: 6D93E219FB: to=<formresponse@plainmortgageadvice.co.uk>, relay=none, delay=0.3, delays=0.2/0.05/0.05/0, dsn=5.4.6, status=bounced (mail for plainmortgageadvice.co.uk loops back to myself)
Feb 5 09:01:36 sww postfix/cleanup[8386]: C5532219FC: message-id=<20080205090136.C5532219FC@stopwatchweb.co.uk>
Feb 5 09:01:36 sww postfix/qmgr[22838]: C5532219FC: from=<>, size=2421, nrcpt=1 (queue active)
Feb 5 09:01:36 sww postfix/bounce[8390]: 6D93E219FB: sender non-delivery notification: C5532219FC
Feb 5 09:01:36 sww postfix/qmgr[22838]: 6D93E219FB: removed
Feb 5 09:01:36 sww postfix/local[8391]: warning: maildir access problem for UID/GID=33/33: create maildir file /var/www/Maildir/tmp/1202202096.P8391.sww.vm.bytemark.co.uk: Permission denied
Feb 5 09:01:36 sww postfix/local[8391]: warning: perhaps you need to create the maildirs in advance
Feb 5 09:01:36 sww postfix/local[8391]: C5532219FC: to=<www-data@sww.stopwatchweb.co.uk>, relay=local, delay=0.16, delays=0.06/0.05/0/0.05, dsn=5.2.0, status=bounced (maildir delivery failed: create maildir file /var/www/Maildir/tmp/1202202096.P8391.sww.vm.bytemark.co.uk: Permission denied)
Feb 5 09:01:36 sww postfix/qmgr[22838]: C5532219FC: removed

I understand what permsission denied means, but I don't know how to do anything about it. Any suggestions, please?

[till]

Please add the line:

plainmortgageadvice.co.uk

at the end of the file /etc/postfix/local-host-names and restart postfix.

[chancer]

The line was missing, so I added it and restarted Postfix. Filled in the form and the user has still received nothing.

We have tried this using an email address not on the server, so we know the form works and sends email normally.

We have tried sending emails using the user account but just with email clients, not from the web site. That works, too.

It is definitely a problem sending mail from a web site on the server, whether to the user's email client or to a forwarding address.

[chancer]

Did some further spade work - the alias is in virtusertable to @www.plainmortgageadvice.co.uk but not without the www. - added it and tried again. Log reports cahnged slightly, looking for a user = alias, rather than user with alias - how the **** does an alias log in!!!!

Feb 5 13:08:18 sww postfix/cleanup[32644]: 2CE9D21943: message-id=<20080205130818.2CE9D21943@stopwatchweb.co.uk>
Feb 5 13:08:18 sww postfix/qmgr[32620]: 2CE9D21943: from=<www-data@sww.stopwatchweb.co.uk>, size=579, nrcpt=1 (queue active)
Feb 5 13:08:18 sww postfix/local[32646]: 2CE9D21943: to=<formresponse@plainmortgageadvice.co.uk>, relay=local, delay=0.7, delays=0.43/0.1/0/0.17, dsn=5.1.1, status=bounced (unknown user: "formresponse")
Feb 5 13:08:18 sww postfix/cleanup[32644]: AFFC62194B: message-id=<20080205130818.AFFC62194B@stopwatchweb.co.uk>
Feb 5 13:08:18 sww postfix/qmgr[32620]: AFFC62194B: from=<>, size=2365, nrcpt=1 (queue active)
Feb 5 13:08:18 sww postfix/local[32646]: warning: maildir access problem for UID/GID=33/33: create maildir file /var/www/Maildir/tmp/1202216898.P32646.sww.vm.bytemark.co.uk: Permission denied
Feb 5 13:08:18 sww postfix/local[32646]: warning: perhaps you need to create the maildirs in advance
Feb 5 13:08:18 sww postfix/bounce[32648]: 2CE9D21943: sender non-delivery notification: AFFC62194B
Feb 5 13:08:18 sww postfix/qmgr[32620]: 2CE9D21943: removed
Feb 5 13:08:18 sww postfix/local[32646]: AFFC62194B: to=<www-data@sww.stopwatchweb.co.uk>, relay=local, delay=0.16, delays=0.09/0/0/0.07, dsn=5.2.0, status=bounced (maildir delivery failed: create maildir file /var/www/Maildir/tmp/1202216898.P32646.sww.vm.bytemark.co.uk: Permission denied)
Feb 5 13:08:18 sww postfix/qmgr[32620]: AFFC62194B: removed

Can anyone understand this behaviour? Some progress, anyway: at least the domain and alias is now each in its correct right place. Still no email from thesite, though, which is the purpose of the exercise.

[madmucho]

Uf....as i looking to last post dont know, im not much experienced user if i look at that.

But, if you have not in virtualusertable prefix_user@domain.tld i thing you have not specified default dns for your domain, i solvd similiar problem some day past. Try look at this two images if you have correct dns
http://cms2.meteoguru.cz/1.jpg
http://cms2.meteoguru.cz/2.jpg
And if you have correctly set prefixes....

[chancer]

I don't think that's it, madmucho. ISPConfig is geared to work with Bind9 whereas my servers are on Tinydns. So I set DNS to the servers by hand. So long as ISPConfig can then find where to send and listen, it doesn't seem to mind.

Also, every other aspect of mail works. If the MX record settings were wrong on the DNS servers, email would not work at all.

I suspect some kind of authentication or permissions problem here, but I am no expert, either.

[falko]

What's in /etc/postfix/main.cf, /etc/postfix/local-host-names, and /etc/postfix/virtusertable?

[chancer]

In /etc/postfix/main.cf 57 lines of code. I've copied some here, let me know if you are wanting to see anything specific:
smtpd_use_tls = yes
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
relayhost =
mailbox_command =
home_mailbox = Maildir/

virtual_maps = hash:/etc/postfix/virtusertable

mydestination = /etc/postfix/local-host-names


I've added plainmortgageadvice.co.uk below the line in /etc/postfix/local-host-names and formresponse@plainmortgageadvice.co.uk below the line in /etc/postfix/virtusertable, restarting Postfix each time.

/etc/aliases has:
# See man 5 aliases for format
postmaster: root

[till]

Please do not add addresses manually in the virtusertable. Remove the lines you added manually and create the email address in ISPConfig instead. Also make sure that the website www.plainmortgageadvice.co.uk has a co-domain plainmortgageadvice.co.uk with empty host field.

[chancer]

We are getting there. Thanks, Till. My system uses Tinydns, ISPConfig uses Bind. So whilst I have been setting up the DNS records correctly by hand and ISPConfig has been finding where to get and send stuff from and to, the subdomains had not been set up in ISPConfig. madmucho, you were correct after all.

So, now for that user, I am getting messages to www-data. I want them to go to the user, not to me or the system. How do I make that happen, please?

[chancer]

I have set up the subdomain. I have checked in /etc/postfix/local-host-names and in /etc/postfix/virtusertable and the subdomain and alias have been added correctly.

Can anybody here tell me why mail for that subdomain is now going to www-data and not to that subdomain? Is it a simple matter of waiting for DNS to propagate? Do I need to restart ISPConfig? Is there something else I must do?

I restarted Postfix immediately upon adding the subdomain in ISPConfig.

[falko]

What's in your mail log when you send a mail to that subdomain?

[chancer]

Last attempt produced in mail.log:
Feb 6 11:24:16 sww postfix/pickup[29369]: 6E7D9219C6: uid=33 from=<www-data>
Feb 6 11:24:16 sww postfix/cleanup[32590]: 6E7D9219C6: message-id=<20080206112416.6E7D9219C6@stopwatchweb.co.uk>
Feb 6 11:24:16 sww postfix/qmgr[15243]: 6E7D9219C6: from=<www-data@sww.stopwatchweb.co.uk>, size=562, nrcpt=1 (queue active)
Feb 6 11:24:16 sww postfix/cleanup[32590]: AEAB321983: message-id=<20080206112416.6E7D9219C6@stopwatchweb.co.uk>
Feb 6 11:24:16 sww postfix/local[32592]: 6E7D9219C6: to=<web26_chrisg@sww.stopwatchweb.co.uk>, orig_to=<formresponse@plainmortgageadvice.co.uk>, relay=local, delay=0.47, delays=0.31/0.1/0/0.07, dsn=2.0.0, status=sent (forwarded as AEAB321983)
Feb 6 11:24:16 sww postfix/qmgr[15243]: 6E7D9219C6: removed
Feb 6 11:24:16 sww postfix/qmgr[15243]: AEAB321983: from=<www-data@sww.stopwatchweb.co.uk>, size=711, nrcpt=1 (queue active)

[chancer]

Is this sufficient information? Is there anything else I can do to help you help me?

[till]

is the domain:

sww.stopwatchweb.co.uk

listed in /etc/postfix/local-host-names ?

[chancer]

Yes, it is, but below the line. Put there some months ago by a developer in solving an earlier problem.

I don't know if this helps, but sww.stopwatchweb.co.uk is not specifically named as a sub-domain in the name servers. As I mentioned earlier, it is the Tinydns system. The entry for palinmortgageadvice.co.uk has:
@plainmortgageadvice.co.uk::www.stopwatchweb.co.uk :10 and for stopwatchweb.co.uk:
@stopwatchweb.co.uk::sww.stopwatchweb.co.uk:10

I don't understand this, but thought it may possibly have some relevance.

Apologies for taking so long to reply. I looked on the site this afternoon several times, but this is the first time the post has appeared although your post has a time of 10.32 on it. My browser must be cacheing horribly.

[chancer]

Just been looking through other domains set up in ISPConfig on that server. Most have www.domainname.tld in the Basis screen and domainname.tld in the Co-Domains screen. But plainmortgageadvice.co.uk has both in the Co-Domains - www. was already there when I made the suggested addition.

Is this a cause for concern?

[falko]

Remove the www from the Co-Domains.
So the problem now is that mails for formresponse@plainmortgageadvice.co.uk are going to web26_chrisg@sww.stopwatchweb.co.uk when they shouldn't?
Is web26_chrisg@sww.stopwatchweb.co.uk a Catch-All account?

[chancer]

Mails for formresponse@plainmortgageadvice.co.uk should be going to formresponse@plainmortgageadvice.co.uk and they are not, that is correct.

The full header says it is coming from www-data@sww.stopwatchweb.co.uk to formresponse@plainmortgageadvice.co.uk but instead they are being delivered to mike@sww.stopwatchweb.co.uk. The header says it is being delivered to web26_chrisg@sww.stopwatchweb.co.uk.

I have removed the www sub-domain and filled in the form again. It has come to me again. Should I restrat Postfix, ISPConfig, or just leave it for a short while and try again?

web26_chrisg@sww.stopwatchweb.co.uk should not be an account at all. I have certainly not deliberately set it up as a catch-all account.

[falko]

What's in /etc/postfix/virtusertable and /etc/aliases?

[chancer]

The entries for this domain in /etc/virtusertable are: formresponse@www.plainmortgageadvice.co.uk web26_chrisg
web26_chrisg@www.plainmortgageadvice.co.uk web26_chrisg
formresponse@plainmortgageadvice.co.uk web26_chrisg
web26_chrisg@plainmortgageadvice.co.uk web26_chrisg Did you want to see the whole table?

As posted earlier, the only entry in /etc/aliases is: # See man 5 aliases for format
postmaster: root

[falko]

What's the output of grep web26_chrisg /etc/passwd?

[chancer]

Output of grep web26_chrisg /etc/passwd:
web26_chrisg:x:10041:10026:Chris Glen:/var/www/web26:/dev/null
Here is a recent log output fromanother test filling in of the form (@localhost added to suername during tests): Feb 12 20:30:38 sww postfix/cleanup[6452]: A1F9F21A5A: message-id=<20080212203038.6106321A60@stopwatchweb.co.uk>
Feb 12 20:30:38 sww postfix/qmgr[5852]: A1F9F21A5A: from=<www-data@sww.stopwatchweb.co.uk>, size=826, nrcpt=1 (queue active)
Feb 12 20:30:38 sww postfix/local[6454]: 6106321A60: to=<web26_chrisg@localhost>, orig_to=<formresponse@plainmortgageadvice.co.uk>, relay=local, delay=0.49, delays=0.32/0.04/0/0.13, dsn=2.0.0, status=sent (forwarded as A1F9F21A5A)
Feb 12 20:30:49 sww postfix/local[6455]: A1F9F21A5A: to=<mike@sww.stopwatchweb.co.uk>, orig_to=<formresponse@plainmortgageadvice.co.uk>, relay=local, delay=10, delays=0.05/0.04/0/10, dsn=2.0.0, status=sent (delivered to command: /usr/bin/procmail -f-)
Feb 12 20:30:49 sww postfix/qmgr[5852]: A1F9F21A5A: removed which appears to suggest the mail is being sent. is it likely there is a procmailrc directive preventing the mail going to the correct address? There is no /etc/procmailrc fileon my system. Should I create one and put in (which?) directives?

I now have another client reporting the same problem. As with the first, before adjustments, mail is disappearing rather than coming to me as email server administrator.

[chancer]

Each user has two mailboxes. One is in /var/mail and the other is in /var/www/web##/user/web##_uname.

I resolved the problems by pointing the users at the correct mailboxes.