New Server IP => Recipient address rejected: Access denied

[KaiserGimmel]

Hi guys,

all my emails are bounced -.-
My hoster changed my server ip to a new one, i tried to adapt it in the configs but i cant get it to work.

I changed the mynetworks in master.cnf and in amavis/50-user the inet_acl (im on debian lenny with ispconfig 3) but it still doesnt work!

Here is the important part from the logs:

Jun 21 08:06:01 torchwood postfix/smtpd[12716]: connect from localhost.localdomain[127.0.0.1]
Jun 21 08:06:01 torchwood postfix/smtpd[12716]: NOQUEUE: reject: RCPT from localhost.localdomain[127.0.0.1]: 554 5.7.1 <x@mail.com>: Recipient address rejected: Access denied; from=<x2@mail.com> to=<x@mail.com> proto=ESMTP helo=<localhost>
Jun 21 08:06:01 torchwood amavis[5536]: (05536-01) Negative SMTP resp. to DATA: 554 5.5.1 Error: no valid recipients
Jun 21 08:06:01 torchwood amavis[5536]: (05536-01) (!)FWD via SMTP: <x2@mail.com> -> <x@mail.com>,BODY=7BIT 554 5.7.1 Failed, id=05536-01, from MTA([127.0.0.1]:10025): 554 5.7.1 <x@mail.com>: Recipient address rejected: Access denied
Jun 21 08:06:01 torchwood postfix/smtpd[12716]: NOQUEUE: reject: RCPT from localhost.localdomain[127.0.0.1]: 554 5.7.1 <x2@mail.com>: Recipient address rejected: Access denied; from=<> to=<x2@mail.com> proto=ESMTP helo=<localhost>
Jun 21 08:06:01 torchwood amavis[5536]: (05536-01) Negative SMTP resp. to DATA: 554 5.5.1 Error: no valid recipients
Jun 21 08:06:01 torchwood amavis[5536]: (05536-01) (!)SEND via SMTP: <> -> <x2@mail.com>,ENVID=AM..20100621T080601Z@torchwood.servername.com 554 5.7.1 Failed, id=05536-01, from MTA([127.0.0.1]:10025): 554 5.7.1 <x2@mail.com>: Recipient address rejected: Access denied
Jun 21 08:06:01 torchwood amavis[5536]: (05536-01) (!)NOTICE: UNABLE TO SEND DSN to <2x@mail.com>: 554 5.7.1 Failed, id=05536-01, from MTA([127.0.0.1]:10025): 554 5.7.1 <x2@mail.com>: Recipient address rejected: Access denied
Jun 21 08:06:01 torchwood amavis[5536]: (05536-01) Blocked MTA-BLOCKED, [209.85.211.198] [209.85.211.198] <x2@mail.com> -> <x@mail.com>, Message-ID: <AANLkTikxF_h8pgXGD53NFUd-Ru7dN9gFNuK5skJu85B3@mail.gmail.com>, mail_id: GvtW7m-b1F-u, Hits: -0.099, size: 6713, 14909 ms
Jun 21 08:06:01 torchwood imapd-ssl: Connection, ip=[::ffff:88.217.1.134]
Jun 21 08:06:02 torchwood imapd-ssl: Connection, ip=[::ffff:88.217.1.134]
Jun 21 08:06:02 torchwood postfix/smtp[11857]: 6BA781CA4133: to=<x@mail.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=23, delays=8.5/0.01/0.01/15, dsn=5.7.1, status=bounced (host 127.0.0.1[127.0.0.1] said: 554 5.7.1 Failed, id=05536-01, from MTA([127.0.0.1]:10025): 554 5.7.1 <x@mail.com>: Recipient address rejected: Access denied (in reply to end of DATA command))
Jun 21 08:06:02 torchwood postfix/cleanup[11591]: 8ECAE1CA4606: message-id=<20100621080602.8ECAE1CA4606@torchwood.servname.com>
Jun 21 08:06:02 torchwood imapd-ssl: Connection, ip=[::ffff:88.217.1.134]
Jun 21 08:06:02 torchwood postfix/bounce[12739]: 6BA781CA4133: sender non-delivery notification: 8ECAE1CA4606
Jun 21 08:06:02 torchwood postfix/qmgr[4340]: 8ECAE1CA4606: from=<>, size=8891, nrcpt=1 (queue active)
Jun 21 08:06:02 torchwood postfix/qmgr[4340]: 6BA781CA4133: removed

cat /etc/postfix/master.cf
#
# Postfix master process configuration file.  For details on the format
# of the file, see the master(5) manual page (command: "man 5 master").
#
# Do not forget to execute "postfix reload" after editing this file.
#
# ==========================================================================
# service type  private unpriv  chroot  wakeup  maxproc command + args
#               (yes)   (yes)   (yes)   (never) (100)
# ==========================================================================
smtp      inet  n       -       -       -       -       smtpd
#submission inet n       -       -       -       -       smtpd
#  -o smtpd_tls_security_level=encrypt
#  -o smtpd_sasl_auth_enable=yes
#  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
#  -o milter_macro_daemon_name=ORIGINATING
#smtps     inet  n       -       -       -       -       smtpd
#  -o smtpd_tls_wrappermode=yes
#  -o smtpd_sasl_auth_enable=yes
#  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
#  -o milter_macro_daemon_name=ORIGINATING
#628      inet  n       -       -       -       -       qmqpd
pickup    fifo  n       -       -       60      1       pickup
cleanup   unix  n       -       -       -       0       cleanup
qmgr      fifo  n       -       n       300     1       qmgr
#qmgr     fifo  n       -       -       300     1       oqmgr
tlsmgr    unix  -       -       -       1000?   1       tlsmgr
rewrite   unix  -       -       -       -       -       trivial-rewrite
bounce    unix  -       -       -       -       0       bounce
defer     unix  -       -       -       -       0       bounce
trace     unix  -       -       -       -       0       bounce
verify    unix  -       -       -       -       1       verify
flush     unix  n       -       -       1000?   0       flush
proxymap  unix  -       -       n       -       -       proxymap
proxywrite unix -       -       n       -       1       proxymap
smtp      unix  -       -       -       -       -       smtp
# When relaying mail as backup MX, disable fallback_relay to avoid MX loops
relay     unix  -       -       -       -       -       smtp
	-o smtp_fallback_relay=
#       -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
showq     unix  n       -       -       -       -       showq
error     unix  -       -       -       -       -       error
retry     unix  -       -       -       -       -       error
discard   unix  -       -       -       -       -       discard
local     unix  -       n       n       -       -       local
virtual   unix  -       n       n       -       -       virtual
lmtp      unix  -       -       -       -       -       lmtp
anvil     unix  -       -       -       -       1       anvil
scache    unix  -       -       -       -       1       scache
#
# ====================================================================
# Interfaces to non-Postfix software. Be sure to examine the manual
# pages of the non-Postfix software to find out what options it wants.
#
# Many of the following services use the Postfix pipe(8) delivery
# agent.  See the pipe(8) man page for information about ${recipient}
# and other message envelope options.
# ====================================================================
#
# maildrop. See the Postfix MAILDROP_README file for details.
# Also specify in main.cf: maildrop_destination_recipient_limit=1
#
maildrop  unix  -       n       n       -       -       pipe
  flags=DRhu user=vmail argv=/usr/bin/maildrop -d vmail ${extension} ${recipient} ${user} ${nexthop} ${sender}
#
# See the Postfix UUCP_README file for configuration details.
#
uucp      unix  -       n       n       -       -       pipe
  flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
#
# Other external delivery methods.
#
ifmail    unix  -       n       n       -       -       pipe
  flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp     unix  -       n       n       -       -       pipe
  flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
scalemail-backend unix	-	n	n	-	2	pipe
  flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
mailman   unix  -       n       n       -       -       pipe
  flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
  ${nexthop} ${user}


amavis unix - - - - 2 smtp
        -o smtp_data_done_timeout=1200
        -o smtp_send_xforward_command=yes

127.0.0.1:10025 inet n - - - - smtpd
        -o content_filter=
        -o local_recipient_maps=
        -o relay_recipient_maps=
        -o smtpd_restriction_classes=
        -o smtpd_client_restrictions=
        -o smtpd_helo_restrictions=
        -o smtpd_sender_restrictions=
        -o smtpd_recipient_restrictions=permit_mynetworks,reject
        -o mynetworks=127.0.0.0/8
	-o mynetworks=xxx.xxx.xxx.xxx   (<-- changed this one to the new one)
        -o strict_rfc821_envelopes=yes
        -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
        -o smtpd_bind_address=127.0.0.1

cat /etc/postfix/main.cf
# See /usr/share/postfix/main.cf.dist for a commented, more complete version


# Debian specific:  Specifying a file name will cause the first
# line of that file to be used as the name.  The Debian default
# is /etc/mailname.
#myorigin = /etc/mailname

smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

readme_directory = /usr/share/doc/postfix

# TLS parameters
smtpd_tls_cert_file = /etc/postfix/smtpd.cert
smtpd_tls_key_file = /etc/postfix/smtpd.key
smtpd_tls_CAfile = /etc/postfix/cacert.cert
smtpd_use_tls = yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.

myhostname = torchwood.servername.com
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = torchwood.servername.com, localhost, localhost.localdomain
relayhost = 
mynetworks = 127.0.0.0/8, xxx.xxx.xxx.xxx/32 (changed this one, too)
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
html_directory = /usr/share/doc/postfix/html
virtual_alias_domains = 
virtual_alias_maps = proxy:mysql:/etc/postfix/mysql-virtual_forwardings.cf, mysql:/etc/postfix/mysql-virtual_email2email.cf
virtual_mailbox_domains = proxy:mysql:/etc/postfix/mysql-virtual_domains.cf
virtual_mailbox_maps = proxy:mysql:/etc/postfix/mysql-virtual_mailboxes.cf
virtual_mailbox_base = /var/vmail
virtual_uid_maps = static:5000
virtual_gid_maps = static:5000
smtpd_sasl_auth_enable = yes
broken_sasl_auth_clients = yes
smtpd_sasl_authenticated_header = yes
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, check_recipient_access mysql:/etc/postfix/mysql-virtual_recipient.cf, reject_unauth_destination
smtpd_tls_security_level = may
transport_maps = proxy:mysql:/etc/postfix/mysql-virtual_transports.cf
relay_domains = mysql:/etc/postfix/mysql-virtual_relaydomains.cf
virtual_create_maildirsize = yes
virtual_maildir_extended = yes
virtual_mailbox_limit_maps = proxy:mysql:/etc/postfix/mysql-virtual_mailbox_limit_maps.cf
virtual_mailbox_limit_override = yes
virtual_maildir_limit_message = "The user you are trying to reach is over quota."
virtual_overquota_bounce = yes
proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $virtual_mailbox_limit_maps
smtpd_sender_restrictions = check_sender_access mysql:/etc/postfix/mysql-virtual_sender.cf
smtpd_client_restrictions = check_client_access mysql:/etc/postfix/mysql-virtual_client.cf
maildrop_destination_concurrency_limit = 1
maildrop_destination_recipient_limit = 1
virtual_transport = maildrop
header_checks = regexp:/etc/postfix/header_checks
mime_header_checks = regexp:/etc/postfix/mime_header_checks
nested_header_checks = regexp:/etc/postfix/nested_header_checks
body_checks = regexp:/etc/postfix/body_checks
content_filter = amavis:[127.0.0.1]:10024
receive_override_options = no_address_mappings
message_size_limit = 0
relay_recipient_maps = mysql:/etc/postfix/mysql-virtual_relayrecipientmaps.cf

DNS for my domain is updated and propagated.

Apparently today is my birthday - no birthday emails as it seems :/
Any help would be much appreciated!
Thanks
Max

[till]

There are no changes nescessary in the mail setup when the IP changes. You have to change just the webserver settings.

Not sure why you have this lin:

-o mynetworks=xxx.xxx.xxx.xxx (<-- changed this one to the new one)

as it is not from ISPConfig and may not be there as this line prevents amavisd to work correctly. The correct amavisd Configuration is:

127.0.0.1:10025 inet n - - - - smtpd
        -o content_filter=
        -o local_recipient_maps=
        -o relay_recipient_maps=
        -o smtpd_restriction_classes=
        -o smtpd_client_restrictions=
        -o smtpd_helo_restrictions=
        -o smtpd_sender_restrictions=
        -o smtpd_recipient_restrictions=permit_mynetworks,reject
        -o mynetworks=127.0.0.0/8
        -o strict_rfc821_envelopes=yes
        -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
        -o smtpd_bind_address=127.0.0.1

[KaiserGimmel]

too bad - doesnt work.

I removed the line - still doesnt work. I even ran the update.php again - same result. If i comment out the content_filter line in main.cf postfix at least accept emails and dont reject them...

Something is really messed up...

Whats the best way to "revert" everything and start blank without reinstalling? I guess its harder to fight the wrong line than to set it up again, right?

I dont wanna reinstall because the mercurial repository is kinda big...

Cheers and thank you for your help and time
Max

[till]

Then your problem might be the amavis 50-user file. Which line(s) have you changed there?

[KaiserGimmel]

i added those two after strict;

use strict;
@inet_acl = qw( 127.0.0.1 [::1] 109.230.xxx.xxx [::1] );
$inet_socket_bind = undef;

[till]

Please remove both lines and restart amavisd.

[KaiserGimmel]

yay - no more bounces!

... but:

ClamAV-clamd av-scanner FAILED: run_av error: Too many retries to talk to /var/run/clamav/clamd.ctl (Can't connect to UNIX socket /var/run/clamav/clamd.ctl: Keine Berechtigung) at (eval 105) line 373.\n

... and i still cant receive them with thunderbird. But there is no timeout in thunderbird - they just dont arrive ... :/ Nothing special in the logs if i connect just:

...
Jun 21 15:17:09 torchwood imapd: Connection, ip=[::ffff:88.217.1.134]
Jun 21 15:17:09 torchwood imapd: Connection, ip=[::ffff:88.217.1.134]
Jun 21 15:17:46 torchwood imapd-ssl: Connection, ip=[::ffff:88.217.1.134]
Jun 21 15:17:47 torchwood imapd-ssl: Connection, ip=[::ffff:88.217.1.134]
Jun 21 15:17:49 torchwood imapd-ssl: Connection, ip=[::ffff:88.217.1.134]
Jun 21 15:17:50 torchwood imapd-ssl: Connection, ip=[::ffff:88.217.1.134]
Jun 21 15:17:51 torchwood imapd-ssl: Connection, ip=[::ffff:88.217.1.134]
Jun 21 15:17:52 torchwood imapd-ssl: Connection, ip=[::ffff:88.217.1.134]
Jun 21 15:17:54 torchwood imapd-ssl: Connection, ip=[::ffff:88.217.1.134]
...

[till]

Restart clamd and amavisd.

[KaiserGimmel]

did both - but:

Starting ClamAV daemon: clamd ERROR: Failed to change socket ownership to group 20
failed!

I'm wondering if it worked before but i cant image how a new ip changed clamd. :?

Virus filtering is not that important (its just me and i usually dont open attachments) - do you think its related to the courier-imap problem i mentioned in the mail above (cant receive any email) ?

Cheers & so long
Max

[KaiserGimmel]

Thanks for the help, very appreciated! - somehow the port from courier changed from 993 to 143 - after adapting everything works fine now (except the clamd thing above, but thats low prio).