3.2beta2 issues mail server

Discussion in 'Developers' Forum' started by NueX, Sep 23, 2020.

  1. NueX

    NueX New Member

    Hi all,
    I was too keen on pulling 3.2beta2 and do now regret it. I updated from a Debian 10 perfect server setup on ISPConfig 3.1.15p3. It screwed up my (personal) mail server setup:

    - Incoming mails get bounced with "Relay access denied"
    - Local to-myself-mails (from [email protected] to [email protected]) through "Recipient address rejected: User unknown in virtual mailbox table" during sending

    This still persists with 3.2dev20200923. Reconfigured everything and the diff of the postfix/main.cf to the working version on 3.1.15p3 does not show any significant differences.
    Any idea? Thanks a lot!

    /etc/postfix/main.cf:
    Code:
    # See /usr/share/postfix/main.cf.dist for a commented, more complete version
    
    
    # Debian specific:  Specifying a file name will cause the first
    # line of that file to be used as the name.  The Debian default
    # is /etc/mailname.
    #myorigin = /etc/mailname
    
    smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
    biff = no
    
    # appending .domain is the MUA's job.
    append_dot_mydomain = no
    
    # Uncomment the next line to generate "delayed mail" warnings
    #delay_warning_time = 4h
    
    readme_directory = /usr/share/doc/postfix
    
    # TLS parameters
    smtpd_tls_key_file = /etc/postfix/smtpd.key
    smtpd_tls_cert_file = /etc/postfix/smtpd.cert
    
    smtpd_use_tls = yes
    smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
    smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
    
    # See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
    # information on enabling SSL in the smtp client.
    
    smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
    myhostname = mail.mydomain.com
    alias_maps = hash:/etc/aliases, hash:/var/lib/mailman/data/aliases
    alias_database = hash:/etc/aliases, hash:/var/lib/mailman/data/aliases
    myorigin = /etc/mailname
    mydestination = nx.mydomain.com, localhost, localhost.localdomain
    relayhost = 
    mynetworks = 127.0.0.0/8 [::1]/128
    mailbox_size_limit = 10737418240
    recipient_delimiter = +
    inet_interfaces = all
    html_directory = /usr/share/doc/postfix/html
    inet_protocols = all
    virtual_alias_domains = 
    virtual_alias_maps = hash:/var/lib/mailman/data/virtual-mailman, proxy:mysql:/etc/postfix/mysql-virtual_forwardings.cf, proxy:mysql:/etc/postfix/mysql-virtual_email2email.cf
    virtual_mailbox_domains = proxy:mysql:/etc/postfix/mysql-virtual_domains.cf
    virtual_mailbox_maps = proxy:mysql:/etc/postfix/mysql-virtual_mailboxes.cf
    virtual_mailbox_base = /var/vmail
    virtual_uid_maps = mysql:/etc/postfix/mysql-virtual_uids.cf
    virtual_gid_maps = mysql:/etc/postfix/mysql-virtual_gids.cf
    smtpd_sasl_auth_enable = yes
    broken_sasl_auth_clients = yes
    smtpd_sasl_authenticated_header = yes
    smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, reject_rbl_client cbl.abuseat.org, reject_rbl_client b.barracudacentral.org, reject_rbl_client zen.spamhaus.org, reject_rbl_client mail.bl.blocklist.de, reject_rbl_client dnsbl.inps.de, reject_rbl_client ix.dnsbl.manitu.net, reject_rbl_client dul.dnsbl.sorbs.net, check_recipient_access mysql:/etc/postfix/mysql-virtual_recipient.cf, check_recipient_access mysql:/etc/postfix/mysql-virtual_policy_greylist.cf, check_policy_service unix:private/policy-spf
    smtpd_tls_security_level = may
    transport_maps = hash:/var/lib/mailman/data/transport-mailman, proxy:mysql:/etc/postfix/mysql-virtual_transports.cf
    relay_domains = mysql:/etc/postfix/mysql-virtual_relaydomains.cf
    relay_recipient_maps = mysql:/etc/postfix/mysql-virtual_relayrecipientmaps.cf
    proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $sender_bcc_maps $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $smtpd_sender_login_maps
    smtpd_sender_restrictions = permit_mynetworks, permit_sasl_authenticated, check_sender_access mysql:/etc/postfix/mysql-virtual_sender.cf
    smtpd_client_restrictions = check_client_access mysql:/etc/postfix/mysql-virtual_client.cf
    smtpd_client_message_rate_limit = 100
    maildrop_destination_concurrency_limit = 1
    maildrop_destination_recipient_limit = 1
    virtual_transport = lmtp:unix:private/dovecot-lmtp
    header_checks = regexp:/etc/postfix/header_checks
    mime_header_checks = regexp:/etc/postfix/mime_header_checks
    nested_header_checks = regexp:/etc/postfix/nested_header_checks
    body_checks = regexp:/etc/postfix/body_checks
    owner_request_special = no
    smtp_tls_security_level = may
    smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
    smtpd_tls_protocols = !SSLv2,!SSLv3
    smtp_tls_protocols = !SSLv2,!SSLv3
    dovecot_destination_recipient_limit = 1
    smtpd_sasl_type = dovecot
    smtpd_sasl_path = private/auth
    message_size_limit = 104857600
    sender_bcc_maps = proxy:mysql:/etc/postfix/mysql-virtual_outgoing_bcc.cf
    smtpd_restriction_classes = greylisting
    greylisting = check_policy_service inet:127.0.0.1:10023
    smtpd_sender_login_maps = proxy:mysql:/etc/postfix/mysql-virtual_sender_login_maps.cf
    smtpd_helo_required = yes
    #smtpd_helo_restrictions = permit_sasl_authenticated, permit_mynetworks, check_helo_access regexp:/etc/postfix/helo_access, reject_invalid_hostname, reject_non_fqdn_hostname, check_helo_access regexp:/etc/postfix/blacklist_helo
    smtpd_helo_restrictions = permit_sasl_authenticated, permit_mynetworks, check_helo_access regexp:/etc/postfix/helo_access, reject_invalid_hostname, reject_non_fqdn_hostname, reject_invalid_helo_hostname, reject_unknown_helo_hostname, check_helo_access regexp:/etc/postfix/blacklist_helo
    smtpd_tls_exclude_ciphers = RC4, aNULL
    smtp_tls_exclude_ciphers = RC4, aNULL
    strict_rfc821_envelopes = yes
    smtpd_data_restrictions = reject_unauth_pipelining
    smtpd_delay_reject = yes
    policy-spf_time_limit = 3600s
    compatibility_level = 2
    non_smtpd_milters = inet:localhost:11332
    address_verify_sender_ttl = 15686s
    enable_original_recipient = no
    smtpd_milters = inet:localhost:11332
    milter_protocol = 6
    milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen}
    milter_default_action = accept
    
     
  2. Jesse Norell

    Jesse Norell ISPConfig Developer Staff Member ISPConfig Developer

    Hello @NueX,

    Sorry you're having problems there, but we should be able to get things back up shortly. I updated a production system last night and ran into one issue of bad sql updates on tables, so that I ended up missing at least one column - that is almost certainly my fault, as I have run a few past 3.1dev versions there, as well as tested some features as I developed them. But it sure doesn't hurt to check your table definitions, or re-run the sql commands in install/sql/incremental/upd_0089.sql and upd_0090.sql (that's what fixed me).

    Do you have any templates in /usr/local/ispconfig/server/conf-custom/ ? If so, and you didn't update them, that could well be your problem.

    Can you post some mail.log output beyond just the 'relay access denied' error, there may be some other clues in there. Meanwhile I'll browse your above config.
     
  3. Jesse Norell

    Jesse Norell ISPConfig Developer Staff Member ISPConfig Developer

    You have numerous postfix settings that aren't current, I'd guess this is your problem. Or postconf failed to run on your system for some reason...
     
  4. NueX

    NueX New Member

    Hi Jesse,
    Indeed! I forgot about the old templates, but now renamed them to *.bak to check:

    /usr/local/ispconfig/server/conf-custom/install/debian6_dovecot2.conf.master.bak
    /usr/local/ispconfig/server/conf-custom/install/debian_postfix.conf.master.bak

    After rerunning the installer, mails from the outside now make it to the inbox. The local to-myself test still fails:
    Code:
    Sep 23 22:29:08 nx postfix/submission/smtpd[18289]: NOQUEUE: reject: RCPT from unknown[179.42.29.86]: 550 5.1.1 <[email protected]>: Recipient address rejected: User unknown in virtual mailbox table; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<mycomputer.lan>
    
     
  5. NueX

    NueX New Member

    Tested further: only some mailboxes are now reachable from the outside, the one from the local test also fails from external:
    Code:
    Sep 23 22:32:49 nx postfix/smtpd[19154]: NOQUEUE: reject: RCPT from mail-gateway-shared03.cyon.net[94.126.200.53]: 550 5.1.1 <[email protected]>: Recipient address rejected: User unknown in virtual mailbox table; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<mail-gateway-shared03.cyon.net>
     
  6. Jesse Norell

    Jesse Norell ISPConfig Developer Staff Member ISPConfig Developer

    Do you have any other templates, in particular ones for mysql-virtual* files? You should check every single template you have with this update.
     
  7. NueX

    NueX New Member

    Only a single one for apache which should not interfere?
    Code:
    # find /usr/local/ispconfig/server/conf-custom/ -name "*"
    /usr/local/ispconfig/server/conf-custom/
    /usr/local/ispconfig/server/conf-custom/mail
    /usr/local/ispconfig/server/conf-custom/mail/empty.dir
    /usr/local/ispconfig/server/conf-custom/apache_apps.vhost.master
    /usr/local/ispconfig/server/conf-custom/index
    /usr/local/ispconfig/server/conf-custom/index/empty.dir
    /usr/local/ispconfig/server/conf-custom/empty.dir
    /usr/local/ispconfig/server/conf-custom/error
    /usr/local/ispconfig/server/conf-custom/error/empty.dir
    /usr/local/ispconfig/server/conf-custom/install
    /usr/local/ispconfig/server/conf-custom/install/debian6_dovecot2.conf.master.bak
    /usr/local/ispconfig/server/conf-custom/install/empty.dir
    /usr/local/ispconfig/server/conf-custom/install/debian_postfix.conf.master.bak
     
  8. Jesse Norell

    Jesse Norell ISPConfig Developer Staff Member ISPConfig Developer

    Also check for dovecot template (you must have lmtp enabled).
     
  9. Jesse Norell

    Jesse Norell ISPConfig Developer Staff Member ISPConfig Developer

    Ok, what do you have for main.cf now? And what is in /etc/postfix/mysql-virtual_recipient.cf (remove your password).
     
  10. till

    till Super Moderator Staff Member ISPConfig Developer

    No, but you'll probably have to update/adjust that as well before you create or update a website in ISPConfig.
     
  11. NueX

    NueX New Member

    /etc/postfix/main.cf:
    Code:
    # See /usr/share/postfix/main.cf.dist for a commented, more complete version
    
    
    # Debian specific:  Specifying a file name will cause the first
    # line of that file to be used as the name.  The Debian default
    # is /etc/mailname.
    #myorigin = /etc/mailname
    
    smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
    biff = no
    
    # appending .domain is the MUA's job.
    append_dot_mydomain = no
    
    # Uncomment the next line to generate "delayed mail" warnings
    #delay_warning_time = 4h
    
    readme_directory = /usr/share/doc/postfix
    
    # TLS parameters
    smtpd_tls_key_file = /etc/postfix/smtpd.key
    smtpd_tls_cert_file = /etc/postfix/smtpd.cert
    
    smtpd_use_tls = yes
    smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
    smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
    
    # See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
    # information on enabling SSL in the smtp client.
    
    smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
    myhostname = mail.mydomain.com
    alias_maps = hash:/etc/aliases, hash:/var/lib/mailman/data/aliases
    alias_database = hash:/etc/aliases, hash:/var/lib/mailman/data/aliases
    myorigin = /etc/mailname
    mydestination = nx.mydomain.com, localhost, localhost.localdomain
    relayhost =
    mynetworks = 127.0.0.0/8 [::1]/128
    mailbox_size_limit = 10737418240
    recipient_delimiter = +
    inet_interfaces = all
    html_directory = /usr/share/doc/postfix/html
    inet_protocols = all
    virtual_alias_domains = proxy:mysql:/etc/postfix/mysql-virtual_alias_domains.cf
    virtual_alias_maps = hash:/var/lib/mailman/data/virtual-mailman, proxy:mysql:/etc/postfix/mysql-virtual_forwardings.cf, proxy:mysql:/etc/postfix/mysql-virtual_alias_maps.cf, proxy:mysql:/etc/postfix/mysql-virtual_email2email.cf
    virtual_mailbox_domains = proxy:mysql:/etc/postfix/mysql-virtual_domains.cf
    virtual_mailbox_maps = proxy:mysql:/etc/postfix/mysql-virtual_mailboxes.cf
    virtual_mailbox_base = /var/vmail
    virtual_uid_maps = proxy:mysql:/etc/postfix/mysql-virtual_uids.cf
    virtual_gid_maps = proxy:mysql:/etc/postfix/mysql-virtual_gids.cf
    smtpd_sasl_auth_enable = yes
    broken_sasl_auth_clients = yes
    smtpd_sasl_authenticated_header = yes
    smtpd_recipient_restrictions = permit_mynetworks, reject_unknown_recipient_domain, check_recipient_access proxy:mysql:/etc/postfix/mysql-verify_recipients.cf, permit_sasl_authenticated, reject_non_fqdn_recipient, reject_unauth_destination, check_recipient_access proxy:mysql:/etc/postfix/mysql-virtual_recipient.cf, check_recipient_access mysql:/etc/postfix/mysql-virtual_policy_greylist.cf, check_policy_service unix:private/quota-status
    smtpd_tls_security_level = may
    transport_maps = hash:/var/lib/mailman/data/transport-mailman, proxy:mysql:/etc/postfix/mysql-virtual_transports.cf
    relay_domains = proxy:mysql:/etc/postfix/mysql-virtual_relaydomains.cf
    relay_recipient_maps = proxy:mysql:/etc/postfix/mysql-virtual_relayrecipientmaps.cf
    proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $sender_bcc_maps $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $smtpd_sender_login_maps $virtual_uid_maps $virtual_gid_maps $smtpd_client_restrictions $smtpd_sender_restrictions $smtpd_recipient_restrictions
    smtpd_sender_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_sender, check_sender_access proxy:mysql:/etc/postfix/mysql-virtual_sender.cf
    smtpd_client_restrictions = check_client_access proxy:mysql:/etc/postfix/mysql-virtual_client.cf, permit_inet_interfaces, permit_mynetworks, reject_rbl_client cbl.abuseat.org, reject_rbl_client b.barracudacentral.org, reject_rbl_client zen.spamhaus.org, reject_rbl_client mail.bl.blocklist.de, reject_rbl_client dnsbl.inps.de, reject_rbl_client ix.dnsbl.manitu.net, reject_rbl_client dul.dnsbl.sorbs.net, permit_sasl_authenticated, reject_unauth_pipelining , permit
    smtpd_client_message_rate_limit = 100
    maildrop_destination_concurrency_limit = 1
    maildrop_destination_recipient_limit = 1
    virtual_transport = lmtp:unix:private/dovecot-lmtp
    header_checks = regexp:/etc/postfix/header_checks
    mime_header_checks = regexp:/etc/postfix/mime_header_checks
    nested_header_checks = regexp:/etc/postfix/nested_header_checks
    body_checks = regexp:/etc/postfix/body_checks
    owner_request_special = no
    smtp_tls_security_level = may
    smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
    smtpd_tls_protocols = !SSLv2,!SSLv3, !TLSv1, !TLSv1.1
    smtp_tls_protocols = !SSLv2,!SSLv3, !TLSv1, !TLSv1.1
    dovecot_destination_recipient_limit = 1
    smtpd_sasl_type = dovecot
    smtpd_sasl_path = private/auth
    message_size_limit = 104857600
    sender_bcc_maps = proxy:mysql:/etc/postfix/mysql-virtual_outgoing_bcc.cf
    smtpd_restriction_classes = greylisting
    greylisting = check_policy_service inet:127.0.0.1:10023
    smtpd_sender_login_maps = proxy:mysql:/etc/postfix/mysql-virtual_sender_login_maps.cf
    smtpd_helo_required = yes
    #smtpd_helo_restrictions = permit_sasl_authenticated, permit_mynetworks, check_helo_access regexp:/etc/postfix/helo_access, reject_invalid_hostname, reject_non_fqdn_hostname, check_helo_access regexp:/etc/postfix/blacklist_helo
    smtpd_helo_restrictions = reject_invalid_helo_hostname, permit_mynetworks, check_helo_access regexp:/etc/postfix/helo_access, permit_sasl_authenticated, reject_non_fqdn_helo_hostname, check_helo_access regexp:/etc/postfix/blacklist_helo, ,reject_unknown_helo_hostname, permit
    smtpd_tls_exclude_ciphers = RC4, aNULL
    smtp_tls_exclude_ciphers = RC4, aNULL
    strict_rfc821_envelopes = yes
    smtpd_data_restrictions = permit_mynetworks, reject_unauth_pipelining, reject_multi_recipient_bounce, permit
    smtpd_delay_reject = yes
    policy-spf_time_limit = 3600s
    compatibility_level = 2
    non_smtpd_milters = inet:localhost:11332
    address_verify_sender_ttl = 15686s
    enable_original_recipient = no
    smtpd_milters = inet:localhost:11332
    milter_protocol = 6
    milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen}
    milter_default_action = accept
    smtpd_etrn_restrictions = permit_mynetworks, reject
    smtpd_tls_mandatory_ciphers = medium
    tls_medium_cipherlist = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
    tls_preempt_cipherlist = no
    /etc/postfix/mysql-virtual_recipient.cf
    Code:
    user = ispconfig
    password = xxxxxxx
    dbname = dbispconfig
    hosts = 127.0.0.1
    query = select access from mail_access where source = '%s' and type = 'recipient' and active = 'y' and server_id = 1
     
  12. NueX

    NueX New Member

    Sure, thanks!
     
  13. NueX

    NueX New Member

    The query returns 0 rows:
    Code:
    MariaDB [dbispconfig]> select access from mail_access where type = 'recipient' and active = 'y' and server_id = 1;
    Empty set (0.000 sec)
     
  14. Jesse Norell

    Jesse Norell ISPConfig Developer Staff Member ISPConfig Developer

    Ok, without reading too detailed, that definitely looks better. Any mail.log errors? Eg. the issue I had with a missing table column showed up as:
    Code:
    postfix/proxymap[21258]: warning: mysql:/etc/postfix/mysql-virtual_email2email.cf: query failed: Unknown column 'forward_in_lda' in 'where clause'
     
  15. NueX

    NueX New Member

    No such errors:
    Code:
    grep mysql /var/log/mail.log
    [empty]
    
     
  16. Jesse Norell

    Jesse Norell ISPConfig Developer Staff Member ISPConfig Developer

    So "[email protected]" is setup as a mailbox or ??

    What do you get for these commands?:

    Code:
    postmap -q [email protected] mysql:/etc/postfix/mysql-virtual_alias_maps.cf
    postmap -q [email protected] mysql:/etc/postfix/mysql-virtual_email2email.cf
    postmap -q [email protected] mysql:/etc/postfix/mysql-virtual_forwardings.cf
    postmap -q [email protected] mysql:/etc/postfix/mysql-virtual_mailboxes.cf
    postmap -q [email protected] mysql:/etc/postfix/mysql-virtual_outgoing_bcc.cf
    postmap -q [email protected] mysql:/etc/postfix/mysql-virtual_relayrecipientmaps.cf
    postmap -q [email protected] mysql:/etc/postfix/mysql-virtual_sender.cf
    postmap -q [email protected] mysql:/etc/postfix/mysql-virtual_sender_login_maps.cf
    
     
  17. NueX

    NueX New Member

    Did some more investigations. My setup is as follows:
    mydomain.com with mailbox [email protected]
    domain2.com as Domain Alias for mydomain.com
    Now, mails to [email protected] from external get to the inbox, mails to [email protected] get bounced "Recipient address rejected: User unknown in virtual mailbox table"
     
  18. NueX

    NueX New Member

  19. Jesse Norell

    Jesse Norell ISPConfig Developer Staff Member ISPConfig Developer

    Go ahead and get all the postmap output from above, but the virtual_mailboxes output will be most interesting. I still suspect an sql table issue, what do you have for table definitions of mail_domain, mail_user and mail_forwarding?
     
  20. Jesse Norell

    Jesse Norell ISPConfig Developer Staff Member ISPConfig Developer

    What is in your /etc/postfix/mysql-virtual_mailboxes.cf ?

    And if you run the query manually, what does it return (just change '%s' in the query to '[email protected]')?
     

Share This Page