Problems with amavis: Blocked MTA-BLOCKED

Discussion in 'ISPConfig 3 Priority Support' started by vistree, Jul 27, 2021.

  1. vistree

    vistree Member HowtoForge Supporter

    Yesterday I did an ispconfig update from ISPConfig 3.1.15p3 to the current stable ISPConfig version 3.2.5.
    I have a multiserver installation - mail on one and all other services on the main server.
    I did the update on the mail server first - then on the main server (correct order??).
    No errors, but no mails were delivered after the update was completed. Neither were external mails delivered to local mailboxes, nor were internal mails delivered to external recipients.
    After some analysis, I found out that amavis is causing the problem (I did NOT update amavis, but did a "reconfigure services" when updating).
    Mailserver is Debian 8, main server is Debian 9!

    External TO Internal:
    Jul 26 13:09:42 mail amavis[7566]: (07566-15) (!)connect to 127.0.0.1:* failed, attempt #1: Can't connect to socket 127.0.0.1:* using module IO::Socket::IP: Connection refused
    Jul 26 13:09:42 mail amavis[7566]: (07566-15) (!)tBI_1wk2LurH FWD from <[email protected]> -> <[email protected]>, 451 4.5.0 From MTA() during fwd-connect (All attempts (1) failed connecting to smtp:127.0.0.1:*): id=07566-15
    Jul 26 13:09:42 mail amavis[7566]: (07566-15) Blocked MTA-BLOCKED {TempFailedInternal}, LOCAL [127.0.0.1] [46.91.196.52] <[email protected]> -> <[email protected]>, Message-ID: <[email protected]p-webde-bap17>, mail_id: tBI_1wk2LurH, Hits: -1.374, size: 2543, dkim_sd=dbaedf251592:web.de, 214 ms
    Jul 26 13:09:42 mail postfix/lmtp[8077]: CD968A2722: to=<[email protected]>, relay=127.0.0.1[127.0.0.1]:10024, delay=1280, delays=1257/3.4/20/0.21, dsn=4.5.0, status=deferred (host 127.0.0.1[127.0.0.1] said: 451 4.5.0 id=07566-15 - Temporary MTA failure on relaying, From MTA() during fwd-connect (All attempts (1) failed connecting to smtp:127.0.0.1:*): id=07566-15 (in reply to end of DATA command))


    Internal TO External:
    Jul 26 12:43:19 mail amavis[4666]: (04666-02) (!)connect to 127.0.0.1:* failed, attempt #1: Can't connect to socket 127.0.0.1:* using module IO::Socket::IP: Connection refused
    Jul 26 12:43:19 mail amavis[4666]: (04666-02) (!)E0chsoK-1Y4N FWD from <[email protected]> -> <[email protected]>, 451 4.5.0 From MTA() during fwd-connect (All attempts (1) failed connecting to smtp:127.0.0.1:*): id=04666-02
    Jul 26 12:43:19 mail amavis[4666]: (04666-02) Blocked MTA-BLOCKED {TempFailedOutbound}, ORIGINATING LOCAL [127.0.0.1] [146.88.36.113] <[email protected]> -> <[email protected]>, Message-ID: <[email protected]>, mail_id: E0chsoK-1Y4N, Hits: -2.9, size: 722, 191 ms
    Jul 26 12:43:19 mail postfix/lmtp[4687]: 19147A20D4: to=<[email protected]>, relay=127.0.0.1[127.0.0.1]:10026, delay=958, delays=957/0.05/0.48/0.19, dsn=4.5.0, status=deferred (host 127.0.0.1[127.0.0.1] said: 451 4.5.0 id=04666-02 - Temporary MTA failure on relaying, From MTA() during fwd-connect (All attempts (1) failed connecting to smtp:127.0.0.1:*): id=04666-02 (in reply to end of DATA command))

    For now I disabled Amavis by doing the following changes in /etc/postfix/main.cf
    FROM:
    smtpd_sender_restrictions = check_sender_access regexp:/etc/postfix/tag_as_originating.re , permit_mynetworks, permit_sasl_authenticated, check_sender_access mysql:/etc/postfix/mysql-virtual_sender.cf, check_sender_access regexp:/etc/postfix/tag_as_foreign.re
    TO:
    smtpd_sender_restrictions = permit_mynetworks, permit_sasl_authenticated, check_sender_access mysql:/etc/postfix/mysql-virtual_sender.cf

    And commenting out:
    #content_filter = amavis:[127.0.0.1]:10024
    #receive_override_options = no_address_mappings

    The issue seems to be related to https://www.howtoforge.com/community/threads/no-mails-are-being-received-or-sent.86957/ but I am not sure. Can you help?
     
    Last edited: Jul 28, 2021
  2. Jesse Norell

    Jesse Norell ISPConfig Developer Staff Member ISPConfig Developer

    I would update the master first, but having done it this way, once you do update the master you might run the installer on your slave another time and answer Yes to updating permissions in the master database. (I think there were db schema changes related to at least php versions and web/db backups, so it may not matter on your configuration, but just to be safe...).
    That sounds like the downstream smtp instances (ports 10025 and 10027) are not open, what does your /etc/postifx/master.cf look like? You might also run the diagnostic script in the "read before posting" thread, or at least post output of "netstat -tnau" - what ports is postfix listening on?

    FWIW, debian 8 is not supported on 3.2, I don't know what you should expect from that system offhand.
     
  3. vistree

    vistree Member HowtoForge Supporter

    Thanx Jesse for your feedback and your help!! I rerun the update on the slave-mail-server - just to be sure ;-)
    Regarding the amavis problem: I am wondering what's going wrong, as I did just an update ...
    Output of master.cf:
    #########################
    #
    # Postfix master process configuration file. For details on the format
    # of the file, see the master(5) manual page (command: "man 5 master" or
    # on-line: http://www.postfix.org/master.5.html).
    #
    # Do not forget to execute "postfix reload" after editing this file.
    #
    # ==========================================================================
    # service type private unpriv chroot wakeup maxproc command + args
    # (yes) (yes) (yes) (never) (100)
    # ==========================================================================
    smtp inet n - - - - smtpd
    submission inet n - - - - smtpd
    -o syslog_name=postfix/submission
    -o smtpd_tls_security_level=encrypt
    -o smtpd_sasl_auth_enable=yes
    -o smtpd_client_restrictions=permit_sasl_authenticated,reject
    # -o smtpd_reject_unlisted_recipient=no
    # -o smtpd_client_restrictions=$mua_client_restrictions
    # -o smtpd_helo_restrictions=$mua_helo_restrictions
    # -o smtpd_sender_restrictions=$mua_sender_restrictions
    # -o smtpd_recipient_restrictions=
    # -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
    # -o milter_macro_daemon_name=ORIGINATING
    smtps inet n - - - - smtpd
    -o syslog_name=postfix/smtps
    -o smtpd_tls_wrappermode=yes
    -o smtpd_sasl_auth_enable=yes
    -o smtpd_client_restrictions=permit_sasl_authenticated,reject

    ##smtp inet n - - - - smtpd
    #smtp inet n - - - 1 postscreen
    #smtpd pass - - - - - smtpd
    #dnsblog unix - - - - 0 dnsblog
    #tlsproxy unix - - - - 0 tlsproxy
    #submission inet n - - - - smtpd
    # Falls clients sich nicht verbinden koennen: -o smtpd_tls_dh1024_param_file=${config_directory}/dh1024.pem
    # -o syslog_name=postfix/submission
    # -o smtpd_tls_security_level=encrypt
    # -o smtpd_sasl_auth_enable=yes
    # -o smtpd_client_restrictions=permit_sasl_authenticated,reject
    # -o smtpd_reject_unlisted_recipient=no
    # -o smtpd_client_restrictions=$mua_client_restrictions
    # -o smtpd_helo_restrictions=$mua_helo_restrictions
    # -o smtpd_sender_restrictions=$mua_sender_restrictions
    # -o smtpd_recipient_restrictions=
    # -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
    # -o milter_macro_daemon_name=ORIGINATING
    #smtps inet n - - - - smtpd
    # -o syslog_name=postfix/smtps
    # -o smtpd_tls_wrappermode=yes
    # -o smtpd_sasl_auth_enable=yes
    # -o smtpd_client_restrictions=permit_sasl_authenticated,reject
    # -o smtpd_reject_unlisted_recipient=no
    # -o smtpd_client_restrictions=$mua_client_restrictions
    # -o smtpd_helo_restrictions=$mua_helo_restrictions
    # -o smtpd_sender_restrictions=$mua_sender_restrictions
    # -o smtpd_recipient_restrictions=
    # -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
    # -o milter_macro_daemon_name=ORIGINATING
    #628 inet n - - - - qmqpd
    pickup unix n - - 60 1 pickup
    cleanup unix n - - - 0 cleanup
    qmgr unix n - n 300 1 qmgr
    #qmgr unix n - n 300 1 oqmgr
    tlsmgr unix - - - 1000? 1 tlsmgr
    rewrite unix - - - - - trivial-rewrite
    bounce unix - - - - 0 bounce
    defer unix - - - - 0 bounce
    trace unix - - - - 0 bounce
    verify unix - - - - 1 verify
    flush unix n - - 1000? 0 flush
    proxymap unix - - n - - proxymap
    proxywrite unix - - n - 1 proxymap
    smtp unix - - - - - smtp
    relay unix - - - - - smtp
    # -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
    showq unix n - - - - showq
    error unix - - - - - error
    retry unix - - - - - error
    discard unix - - - - - discard
    local unix - n n - - local
    virtual unix - n n - - virtual
    lmtp unix - - - - - lmtp
    anvil unix - - - - 1 anvil
    scache unix - - - - 1 scache
    #
    # ====================================================================
    # Interfaces to non-Postfix software. Be sure to examine the manual
    # pages of the non-Postfix software to find out what options it wants.
    #
    # Many of the following services use the Postfix pipe(8) delivery
    # agent. See the pipe(8) man page for information about ${recipient}
    # and other message envelope options.
    # ====================================================================
    #
    # maildrop. See the Postfix MAILDROP_README file for details.
    # Also specify in main.cf: maildrop_destination_recipient_limit=1
    #
    maildrop unix - n n - - pipe
    flags=DRhu user=vmail [email protected] argv=/usr/bin/maildrop -d vmail ${extension} ${recipient} ${user} ${nexthop} ${sender}
    #
    # ====================================================================
    #
    # Recent Cyrus versions can use the existing "lmtp" master.cf entry.
    #
    # Specify in cyrus.conf:
    # lmtp cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
    #
    # Specify in main.cf one or more of the following:
    # mailbox_transport = lmtp:inet:localhost
    # virtual_transport = lmtp:inet:localhost
    #
    # ====================================================================
    #
    # Cyrus 2.1.5 (Amos Gouaux)
    # Also specify in main.cf: cyrus_destination_recipient_limit=1
    #
    #cyrus unix - n n - - pipe
    # user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
    #
    # ====================================================================
    # Old example of delivery via Cyrus.
    #
    #old-cyrus unix - n n - - pipe
    # flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
    #
    # ====================================================================
    #
    # See the Postfix UUCP_README file for configuration details.
    #
    uucp unix - n n - - pipe
    flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
    #
    # Other external delivery methods.
    #
    ifmail unix - n n - - pipe
    flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
    bsmtp unix - n n - - pipe
    flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
    scalemail-backend unix - n n - 2 pipe
    flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
    mailman unix - n n - - pipe
    flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
    ${nexthop} ${user}

    dovecot unix - n n - - pipe
    flags=DRhu user=vmail:vmail argv=/usr/lib/dovecot/deliver -f ${sender} -d ${user}@${nexthop}
    ###########################

    And output of netstat -tnau:
    Aktive Internetverbindungen (Server und stehende Verbindungen)
    Proto Recv-Q Send-Q Local Address Foreign Address State
    tcp 0 0 127.0.0.1:10026 0.0.0.0:* LISTEN
    tcp 0 0 0.0.0.0:14922 0.0.0.0:* LISTEN
    tcp 0 0 0.0.0.0:587 0.0.0.0:* LISTEN
    tcp 0 0 127.0.0.1:9100 0.0.0.0:* LISTEN
    tcp 0 0 0.0.0.0:110 0.0.0.0:* LISTEN
    tcp 0 0 127.0.0.1:783 0.0.0.0:* LISTEN
    tcp 0 0 0.0.0.0:143 0.0.0.0:* LISTEN
    tcp 0 0 127.0.0.1:9104 0.0.0.0:* LISTEN
    tcp 0 0 0.0.0.0:465 0.0.0.0:* LISTEN
    tcp 0 0 127.0.0.1:9105 0.0.0.0:* LISTEN
    tcp 0 0 188.68.32.28:53 0.0.0.0:* LISTEN
    tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN
    tcp 0 0 0.0.0.0:25 0.0.0.0:* LISTEN
    tcp 0 0 188.68.32.28:25 150.188.85.225:49420 SYN_RECV
    tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN
    tcp 0 0 0.0.0.0:993 0.0.0.0:* LISTEN
    tcp 0 0 0.0.0.0:995 0.0.0.0:* LISTEN
    tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN
    tcp 0 0 127.0.0.1:10024 0.0.0.0:* LISTEN
    tcp 0 216 188.68.32.28:14922 46.91.196.52:57437 VERBUNDEN
    tcp 0 0 127.0.0.1:51398 127.0.0.1:3306 VERBUNDEN
    tcp 0 0 127.0.0.1:51418 127.0.0.1:3306 VERBUNDEN
    tcp 0 0 127.0.0.1:51284 127.0.0.1:3306 VERBUNDEN
    tcp 0 0 188.68.32.28:993 46.223.162.217:19502 VERBUNDEN
    tcp 0 0 188.68.32.28:143 46.88.227.223:54935 VERBUNDEN
    tcp 0 0 127.0.0.1:51419 127.0.0.1:3306 VERBUNDEN
    tcp 0 0 188.68.32.28:25 150.188.85.225:49320 TIME_WAIT
    tcp 0 0 127.0.0.1:51413 127.0.0.1:3306 TIME_WAIT
    tcp 0 0 127.0.0.1:51424 127.0.0.1:3306 VERBUNDEN
    tcp 0 0 127.0.0.1:51415 127.0.0.1:3306 VERBUNDEN
    tcp 0 0 188.68.32.28:25 150.188.85.225:49323 TIME_WAIT
    tcp 0 0 188.68.32.28:993 46.223.162.217:19435 VERBUNDEN
    tcp 0 0 127.0.0.1:51414 127.0.0.1:3306 VERBUNDEN
    tcp 0 0 127.0.0.1:51425 127.0.0.1:3306 VERBUNDEN
    tcp 0 0 188.68.32.28:995 109.40.3.160:25350 VERBUNDEN
    tcp 0 0 127.0.0.1:51427 127.0.0.1:3306 VERBUNDEN
    tcp 0 0 188.68.32.28:995 109.40.3.160:27428 VERBUNDEN
    tcp 0 0 188.68.32.28:993 46.223.162.217:19407 VERBUNDEN
    tcp 0 330 188.68.32.28:993 77.9.124.20:52558 FIN_WAIT1
    tcp 0 0 188.68.32.28:993 46.223.162.217:19553 VERBUNDEN
    tcp 0 0 127.0.0.1:51426 127.0.0.1:3306 VERBUNDEN
    tcp 0 0 188.68.32.28:465 5.188.206.238:56073 VERBUNDEN
    tcp 0 0 188.68.32.28:993 46.223.162.217:19548 VERBUNDEN
    tcp 0 0 127.0.0.1:51283 127.0.0.1:3306 VERBUNDEN
    tcp 0 0 127.0.0.1:51422 127.0.0.1:3306 VERBUNDEN
    tcp 0 0 127.0.0.1:51421 127.0.0.1:3306 VERBUNDEN
    tcp 0 0 188.68.32.28:143 37.120.190.158:44578 TIME_WAIT
    tcp 0 0 127.0.0.1:51420 127.0.0.1:3306 VERBUNDEN
    tcp 0 0 188.68.32.28:143 37.120.190.158:44580 TIME_WAIT
    tcp 0 0 188.68.32.28:25 150.188.85.225:49335 TIME_WAIT
    tcp 0 0 127.0.0.1:51401 127.0.0.1:3306 TIME_WAIT
    tcp 0 0 188.68.32.28:25 37.0.8.138:43578 TIME_WAIT
    tcp 0 0 188.68.32.28:25 150.188.85.225:49376 TIME_WAIT
    tcp 0 0 188.68.32.28:25 150.188.85.225:49368 TIME_WAIT
    tcp 0 0 127.0.0.1:51417 127.0.0.1:3306 VERBUNDEN
    tcp 0 0 127.0.0.1:51423 127.0.0.1:3306 VERBUNDEN
    tcp 0 0 188.68.32.28:993 46.223.162.217:19528 VERBUNDEN
    tcp 0 0 188.68.32.28:995 46.223.162.217:19561 VERBUNDEN
    tcp 0 0 188.68.32.28:25 150.188.85.225:49365 TIME_WAIT
    tcp 0 0 188.68.32.28:49334 37.120.190.158:3306 TIME_WAIT
    tcp 0 0 188.68.32.28:25 37.0.8.138:36124 TIME_WAIT
    tcp 0 0 188.68.32.28:49332 37.120.190.158:3306 TIME_WAIT
    tcp 0 0 127.0.0.1:51416 127.0.0.1:3306 VERBUNDEN
    tcp 0 0 188.68.32.28:49333 37.120.190.158:3306 TIME_WAIT
    tcp6 0 0 :::1993 :::* LISTEN
    tcp6 0 0 ::1:10026 :::* LISTEN
    tcp6 0 0 :::3306 :::* LISTEN
    tcp6 0 0 :::14922 :::* LISTEN
    tcp6 0 0 :::587 :::* LISTEN
    tcp6 0 0 :::1995 :::* LISTEN
    tcp6 0 0 :::236 :::* LISTEN
    tcp6 0 0 :::237 :::* LISTEN
    tcp6 0 0 :::110 :::* LISTEN
    tcp6 0 0 ::1:783 :::* LISTEN
    tcp6 0 0 :::143 :::* LISTEN
    tcp6 0 0 :::465 :::* LISTEN
    tcp6 0 0 :::2003 :::* LISTEN
    tcp6 0 0 :::53 :::* LISTEN
    tcp6 0 0 :::1110 :::* LISTEN
    tcp6 0 0 :::1143 :::* LISTEN
    tcp6 0 0 :::25 :::* LISTEN
    tcp6 0 0 ::1:953 :::* LISTEN
    tcp6 0 0 :::993 :::* LISTEN
    tcp6 0 0 :::995 :::* LISTEN
    tcp6 0 0 :::389 :::* LISTEN
    tcp6 0 0 ::1:10024 :::* LISTEN
    tcp6 0 0 127.0.0.1:3306 127.0.0.1:51416 VERBUNDEN
    tcp6 0 0 127.0.0.1:3306 127.0.0.1:51424 VERBUNDEN
    tcp6 0 0 188.68.32.28:237 37.120.190.158:58036 VERBUNDEN
    tcp6 0 0 127.0.0.1:3306 127.0.0.1:51415 VERBUNDEN
    tcp6 0 0 127.0.0.1:3306 127.0.0.1:51418 VERBUNDEN
    tcp6 0 0 127.0.0.1:3306 127.0.0.1:51425 VERBUNDEN
    tcp6 0 0 188.68.32.28:237 37.120.190.158:56954 VERBUNDEN
    tcp6 0 0 127.0.0.1:3306 127.0.0.1:51284 VERBUNDEN
    tcp6 0 0 127.0.0.1:3306 127.0.0.1:51427 VERBUNDEN
    tcp6 0 0 127.0.0.1:3306 127.0.0.1:51417 VERBUNDEN
    tcp6 0 0 127.0.0.1:3306 127.0.0.1:51398 VERBUNDEN
    tcp6 0 0 127.0.0.1:3306 127.0.0.1:51283 VERBUNDEN
    tcp6 0 0 188.68.32.28:237 37.120.190.158:57750 VERBUNDEN
    tcp6 0 0 127.0.0.1:3306 127.0.0.1:51426 VERBUNDEN
    tcp6 0 0 127.0.0.1:3306 127.0.0.1:51420 VERBUNDEN
    tcp6 0 0 188.68.32.28:237 134.3.103.55:64889 VERBUNDEN
    tcp6 0 0 188.68.32.28:237 134.3.103.55:65035 FIN_WAIT2
    tcp6 0 0 127.0.0.1:3306 127.0.0.1:51423 VERBUNDEN
    tcp6 0 0 127.0.0.1:3306 127.0.0.1:51414 VERBUNDEN
    tcp6 0 0 127.0.0.1:3306 127.0.0.1:51421 VERBUNDEN
    tcp6 0 0 188.68.32.28:237 37.120.190.158:57538 VERBUNDEN
    tcp6 0 0 127.0.0.1:3306 127.0.0.1:51419 VERBUNDEN
    tcp6 0 0 188.68.32.28:237 37.120.190.158:56860 VERBUNDEN
    tcp6 0 0 127.0.0.1:3306 127.0.0.1:51422 VERBUNDEN
    udp 0 0 188.68.32.28:53 0.0.0.0:*
    udp 0 0 127.0.0.1:53 0.0.0.0:*
    udp 0 0 188.68.32.28:123 0.0.0.0:*
    udp 0 0 127.0.0.1:123 0.0.0.0:*
    udp 0 0 0.0.0.0:123 0.0.0.0:*
    udp6 0 0 :::53 :::*
    udp6 0 0 fe80::e4e3:11ff:feb:123 :::*
    udp6 0 0 ::1:123 :::*
    udp6 0 0 :::123 :::*
     
  4. vistree

    vistree Member HowtoForge Supporter

    I have updated the protocol in my first post as some lines were cut off + added the debug script output from mail-slave-server.
     

    Attached Files:

    Last edited: Jul 28, 2021
  5. Jesse Norell

    Jesse Norell ISPConfig Developer Staff Member ISPConfig Developer

    Your master.cf does not have entries for 10025 and 10027. You could try changing the content filter from amavis to rspamd (in server config), then back - maybe it'll get fixed up. Short of that we could try troubleshooting why that happens, but you really might start with a quick upgrade to supported OS version (possibly debian 8 isn't recognized/handled?).
     
  6. vistree

    vistree Member HowtoForge Supporter

    Thanx - I will try this fix tomorrow ;-)
     
  7. vistree

    vistree Member HowtoForge Supporter

    Hi, it seems that master.cf and main.cf have not been updated correctly on my machine (or I missed a step). But after rerunning update_ispconfig.sh --force I got new versions of the files which included also the rules for 10025 and 10027.
    Thanx Jesse for your support!!
     
    till likes this.

Share This Page