New Server IP => Recipient address rejected: Access denied

Discussion in 'Installation/Configuration' started by KaiserGimmel, Jun 21, 2010.

  1. KaiserGimmel

    KaiserGimmel New Member

    [Solved]New Server IP => Recipient address rejected: Access denied

    Hi guys,

    all my emails are bounced -.-
    My hoster changed my server ip to a new one, i tried to adapt it in the configs but i cant get it to work.

    I changed the mynetworks in master.cnf and in amavis/50-user the inet_acl (im on debian lenny with ispconfig 3) but it still doesnt work! :(

    Here is the important part from the logs:
    Code:
    Jun 21 08:06:01 torchwood postfix/smtpd[12716]: connect from localhost.localdomain[127.0.0.1]
    Jun 21 08:06:01 torchwood postfix/smtpd[12716]: NOQUEUE: reject: RCPT from localhost.localdomain[127.0.0.1]: 554 5.7.1 <x@mail.com>: Recipient address rejected: Access denied; from=<x2@mail.com> to=<x@mail.com> proto=ESMTP helo=<localhost>
    Jun 21 08:06:01 torchwood amavis[5536]: (05536-01) Negative SMTP resp. to DATA: 554 5.5.1 Error: no valid recipients
    Jun 21 08:06:01 torchwood amavis[5536]: (05536-01) (!)FWD via SMTP: <x2@mail.com> -> <x@mail.com>,BODY=7BIT 554 5.7.1 Failed, id=05536-01, from MTA([127.0.0.1]:10025): 554 5.7.1 <x@mail.com>: Recipient address rejected: Access denied
    Jun 21 08:06:01 torchwood postfix/smtpd[12716]: NOQUEUE: reject: RCPT from localhost.localdomain[127.0.0.1]: 554 5.7.1 <x2@mail.com>: Recipient address rejected: Access denied; from=<> to=<x2@mail.com> proto=ESMTP helo=<localhost>
    Jun 21 08:06:01 torchwood amavis[5536]: (05536-01) Negative SMTP resp. to DATA: 554 5.5.1 Error: no valid recipients
    Jun 21 08:06:01 torchwood amavis[5536]: (05536-01) (!)SEND via SMTP: <> -> <x2@mail.com>,ENVID=AM..20100621T080601Z@torchwood.servername.com 554 5.7.1 Failed, id=05536-01, from MTA([127.0.0.1]:10025): 554 5.7.1 <x2@mail.com>: Recipient address rejected: Access denied
    Jun 21 08:06:01 torchwood amavis[5536]: (05536-01) (!)NOTICE: UNABLE TO SEND DSN to <2x@mail.com>: 554 5.7.1 Failed, id=05536-01, from MTA([127.0.0.1]:10025): 554 5.7.1 <x2@mail.com>: Recipient address rejected: Access denied
    Jun 21 08:06:01 torchwood amavis[5536]: (05536-01) Blocked MTA-BLOCKED, [209.85.211.198] [209.85.211.198] <x2@mail.com> -> <x@mail.com>, Message-ID: <AANLkTikxF_h8pgXGD53NFUd-Ru7dN9gFNuK5skJu85B3@mail.gmail.com>, mail_id: GvtW7m-b1F-u, Hits: -0.099, size: 6713, 14909 ms
    Jun 21 08:06:01 torchwood imapd-ssl: Connection, ip=[::ffff:88.217.1.134]
    Jun 21 08:06:02 torchwood imapd-ssl: Connection, ip=[::ffff:88.217.1.134]
    Jun 21 08:06:02 torchwood postfix/smtp[11857]: 6BA781CA4133: to=<x@mail.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=23, delays=8.5/0.01/0.01/15, dsn=5.7.1, status=bounced (host 127.0.0.1[127.0.0.1] said: 554 5.7.1 Failed, id=05536-01, from MTA([127.0.0.1]:10025): 554 5.7.1 <x@mail.com>: Recipient address rejected: Access denied (in reply to end of DATA command))
    Jun 21 08:06:02 torchwood postfix/cleanup[11591]: 8ECAE1CA4606: message-id=<20100621080602.8ECAE1CA4606@torchwood.servname.com>
    Jun 21 08:06:02 torchwood imapd-ssl: Connection, ip=[::ffff:88.217.1.134]
    Jun 21 08:06:02 torchwood postfix/bounce[12739]: 6BA781CA4133: sender non-delivery notification: 8ECAE1CA4606
    Jun 21 08:06:02 torchwood postfix/qmgr[4340]: 8ECAE1CA4606: from=<>, size=8891, nrcpt=1 (queue active)
    Jun 21 08:06:02 torchwood postfix/qmgr[4340]: 6BA781CA4133: removed
    
    Code:
    cat /etc/postfix/master.cf
    #
    # Postfix master process configuration file.  For details on the format
    # of the file, see the master(5) manual page (command: "man 5 master").
    #
    # Do not forget to execute "postfix reload" after editing this file.
    #
    # ==========================================================================
    # service type  private unpriv  chroot  wakeup  maxproc command + args
    #               (yes)   (yes)   (yes)   (never) (100)
    # ==========================================================================
    smtp      inet  n       -       -       -       -       smtpd
    #submission inet n       -       -       -       -       smtpd
    #  -o smtpd_tls_security_level=encrypt
    #  -o smtpd_sasl_auth_enable=yes
    #  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
    #  -o milter_macro_daemon_name=ORIGINATING
    #smtps     inet  n       -       -       -       -       smtpd
    #  -o smtpd_tls_wrappermode=yes
    #  -o smtpd_sasl_auth_enable=yes
    #  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
    #  -o milter_macro_daemon_name=ORIGINATING
    #628      inet  n       -       -       -       -       qmqpd
    pickup    fifo  n       -       -       60      1       pickup
    cleanup   unix  n       -       -       -       0       cleanup
    qmgr      fifo  n       -       n       300     1       qmgr
    #qmgr     fifo  n       -       -       300     1       oqmgr
    tlsmgr    unix  -       -       -       1000?   1       tlsmgr
    rewrite   unix  -       -       -       -       -       trivial-rewrite
    bounce    unix  -       -       -       -       0       bounce
    defer     unix  -       -       -       -       0       bounce
    trace     unix  -       -       -       -       0       bounce
    verify    unix  -       -       -       -       1       verify
    flush     unix  n       -       -       1000?   0       flush
    proxymap  unix  -       -       n       -       -       proxymap
    proxywrite unix -       -       n       -       1       proxymap
    smtp      unix  -       -       -       -       -       smtp
    # When relaying mail as backup MX, disable fallback_relay to avoid MX loops
    relay     unix  -       -       -       -       -       smtp
    	-o smtp_fallback_relay=
    #       -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
    showq     unix  n       -       -       -       -       showq
    error     unix  -       -       -       -       -       error
    retry     unix  -       -       -       -       -       error
    discard   unix  -       -       -       -       -       discard
    local     unix  -       n       n       -       -       local
    virtual   unix  -       n       n       -       -       virtual
    lmtp      unix  -       -       -       -       -       lmtp
    anvil     unix  -       -       -       -       1       anvil
    scache    unix  -       -       -       -       1       scache
    #
    # ====================================================================
    # Interfaces to non-Postfix software. Be sure to examine the manual
    # pages of the non-Postfix software to find out what options it wants.
    #
    # Many of the following services use the Postfix pipe(8) delivery
    # agent.  See the pipe(8) man page for information about ${recipient}
    # and other message envelope options.
    # ====================================================================
    #
    # maildrop. See the Postfix MAILDROP_README file for details.
    # Also specify in main.cf: maildrop_destination_recipient_limit=1
    #
    maildrop  unix  -       n       n       -       -       pipe
      flags=DRhu user=vmail argv=/usr/bin/maildrop -d vmail ${extension} ${recipient} ${user} ${nexthop} ${sender}
    #
    # See the Postfix UUCP_README file for configuration details.
    #
    uucp      unix  -       n       n       -       -       pipe
      flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
    #
    # Other external delivery methods.
    #
    ifmail    unix  -       n       n       -       -       pipe
      flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
    bsmtp     unix  -       n       n       -       -       pipe
      flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
    scalemail-backend unix	-	n	n	-	2	pipe
      flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
    mailman   unix  -       n       n       -       -       pipe
      flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
      ${nexthop} ${user}
    
    
    amavis unix - - - - 2 smtp
            -o smtp_data_done_timeout=1200
            -o smtp_send_xforward_command=yes
    
    127.0.0.1:10025 inet n - - - - smtpd
            -o content_filter=
            -o local_recipient_maps=
            -o relay_recipient_maps=
            -o smtpd_restriction_classes=
            -o smtpd_client_restrictions=
            -o smtpd_helo_restrictions=
            -o smtpd_sender_restrictions=
            -o smtpd_recipient_restrictions=permit_mynetworks,reject
            -o mynetworks=127.0.0.0/8
    	-o mynetworks=xxx.xxx.xxx.xxx   (<-- changed this one to the new one)
            -o strict_rfc821_envelopes=yes
            -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
            -o smtpd_bind_address=127.0.0.1
    
    Code:
    cat /etc/postfix/main.cf
    # See /usr/share/postfix/main.cf.dist for a commented, more complete version
    
    
    # Debian specific:  Specifying a file name will cause the first
    # line of that file to be used as the name.  The Debian default
    # is /etc/mailname.
    #myorigin = /etc/mailname
    
    smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
    biff = no
    
    # appending .domain is the MUA's job.
    append_dot_mydomain = no
    
    # Uncomment the next line to generate "delayed mail" warnings
    #delay_warning_time = 4h
    
    readme_directory = /usr/share/doc/postfix
    
    # TLS parameters
    smtpd_tls_cert_file = /etc/postfix/smtpd.cert
    smtpd_tls_key_file = /etc/postfix/smtpd.key
    smtpd_tls_CAfile = /etc/postfix/cacert.cert
    smtpd_use_tls = yes
    smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
    smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
    
    # See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
    # information on enabling SSL in the smtp client.
    
    myhostname = torchwood.servername.com
    alias_maps = hash:/etc/aliases
    alias_database = hash:/etc/aliases
    myorigin = /etc/mailname
    mydestination = torchwood.servername.com, localhost, localhost.localdomain
    relayhost = 
    mynetworks = 127.0.0.0/8, xxx.xxx.xxx.xxx/32 (changed this one, too)
    mailbox_size_limit = 0
    recipient_delimiter = +
    inet_interfaces = all
    html_directory = /usr/share/doc/postfix/html
    virtual_alias_domains = 
    virtual_alias_maps = proxy:mysql:/etc/postfix/mysql-virtual_forwardings.cf, mysql:/etc/postfix/mysql-virtual_email2email.cf
    virtual_mailbox_domains = proxy:mysql:/etc/postfix/mysql-virtual_domains.cf
    virtual_mailbox_maps = proxy:mysql:/etc/postfix/mysql-virtual_mailboxes.cf
    virtual_mailbox_base = /var/vmail
    virtual_uid_maps = static:5000
    virtual_gid_maps = static:5000
    smtpd_sasl_auth_enable = yes
    broken_sasl_auth_clients = yes
    smtpd_sasl_authenticated_header = yes
    smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, check_recipient_access mysql:/etc/postfix/mysql-virtual_recipient.cf, reject_unauth_destination
    smtpd_tls_security_level = may
    transport_maps = proxy:mysql:/etc/postfix/mysql-virtual_transports.cf
    relay_domains = mysql:/etc/postfix/mysql-virtual_relaydomains.cf
    virtual_create_maildirsize = yes
    virtual_maildir_extended = yes
    virtual_mailbox_limit_maps = proxy:mysql:/etc/postfix/mysql-virtual_mailbox_limit_maps.cf
    virtual_mailbox_limit_override = yes
    virtual_maildir_limit_message = "The user you are trying to reach is over quota."
    virtual_overquota_bounce = yes
    proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $virtual_mailbox_limit_maps
    smtpd_sender_restrictions = check_sender_access mysql:/etc/postfix/mysql-virtual_sender.cf
    smtpd_client_restrictions = check_client_access mysql:/etc/postfix/mysql-virtual_client.cf
    maildrop_destination_concurrency_limit = 1
    maildrop_destination_recipient_limit = 1
    virtual_transport = maildrop
    header_checks = regexp:/etc/postfix/header_checks
    mime_header_checks = regexp:/etc/postfix/mime_header_checks
    nested_header_checks = regexp:/etc/postfix/nested_header_checks
    body_checks = regexp:/etc/postfix/body_checks
    content_filter = amavis:[127.0.0.1]:10024
    receive_override_options = no_address_mappings
    message_size_limit = 0
    relay_recipient_maps = mysql:/etc/postfix/mysql-virtual_relayrecipientmaps.cf
    
    DNS for my domain is updated and propagated.

    Apparently today is my birthday - no birthday emails as it seems :/
    Any help would be much appreciated!
    Thanks
    Max
     
    Last edited: Jun 22, 2010
  2. till

    till Super Moderator Staff Member ISPConfig Developer

    There are no changes nescessary in the mail setup when the IP changes. You have to change just the webserver settings.

    Not sure why you have this lin:

    -o mynetworks=xxx.xxx.xxx.xxx (<-- changed this one to the new one)

    as it is not from ISPConfig and may not be there as this line prevents amavisd to work correctly. The correct amavisd Configuration is:

    Code:
    127.0.0.1:10025 inet n - - - - smtpd
            -o content_filter=
            -o local_recipient_maps=
            -o relay_recipient_maps=
            -o smtpd_restriction_classes=
            -o smtpd_client_restrictions=
            -o smtpd_helo_restrictions=
            -o smtpd_sender_restrictions=
            -o smtpd_recipient_restrictions=permit_mynetworks,reject
            -o mynetworks=127.0.0.0/8
            -o strict_rfc821_envelopes=yes
            -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
            -o smtpd_bind_address=127.0.0.1
     
  3. KaiserGimmel

    KaiserGimmel New Member

    too bad - doesnt work.

    I removed the line - still doesnt work. I even ran the update.php again - same result. If i comment out the content_filter line in main.cf postfix at least accept emails and dont reject them...

    Something is really messed up...

    Whats the best way to "revert" everything and start blank without reinstalling? I guess its harder to fight the wrong line than to set it up again, right?

    I dont wanna reinstall because the mercurial repository is kinda big...

    Cheers and thank you for your help and time
    Max
     
  4. till

    till Super Moderator Staff Member ISPConfig Developer

    Then your problem might be the amavis 50-user file. Which line(s) have you changed there?
     
  5. KaiserGimmel

    KaiserGimmel New Member

    i added those two after strict;

    use strict;
    @inet_acl = qw( 127.0.0.1 [::1] 109.230.xxx.xxx [::1] );
    $inet_socket_bind = undef;
     
    Last edited: Jun 21, 2010
  6. till

    till Super Moderator Staff Member ISPConfig Developer

    Please remove both lines and restart amavisd.
     
  7. KaiserGimmel

    KaiserGimmel New Member

    yay - no more bounces!

    ... but:
    ... and i still cant receive them with thunderbird. But there is no timeout in thunderbird - they just dont arrive ... :/ Nothing special in the logs if i connect just:

     
  8. till

    till Super Moderator Staff Member ISPConfig Developer

    Restart clamd and amavisd.
     
  9. KaiserGimmel

    KaiserGimmel New Member

    did both - but:

    Starting ClamAV daemon: clamd ERROR: Failed to change socket ownership to group 20
    failed!

    I'm wondering if it worked before but i cant image how a new ip changed clamd. :?

    Virus filtering is not that important (its just me and i usually dont open attachments) - do you think its related to the courier-imap problem i mentioned in the mail above (cant receive any email) ?

    Cheers & so long
    Max
     
  10. KaiserGimmel

    KaiserGimmel New Member

    Solved

    Thanks for the help, very appreciated! - somehow the port from courier changed from 993 to 143 - after adapting everything works fine now (except the clamd thing above, but thats low prio).
     

Share This Page