Problems with Ubuntu 20.04 LTS and the mailserver

Discussion in 'ISPConfig 3 Priority Support' started by Martin007, Oct 9, 2020.

  1. Martin007

    Martin007 New Member HowtoForge Supporter

    Hello,

    I've Upgraded to Ubuntu 20.04 and to the latest nightly-build from ispconfig for full support of Ubuntu 20.04, but I can't get the SSL and nonSSL imap and smtp to work.
    I get emails to my email accounts. Roundcube webmail is showing the new emails, but when I send a email to an external address, it opens a new tab with the url "http://server-host:8081/squirrelmai...oading1602255622553&_lang=undefined&_framed=1" and it's showing "Sending message..." in the buttom for minutes. Some times the email is sended and received by my external email address.
    I use Thunderbird with the latest beta version with SSL/TSL option and imap+smtp. None logins are working with it (tested all ports with ssl and without - password normal).

    The logs don't show any big problems:
    Code:
    Oct  9 17:04:32 c02 postfix/smtpd[9359]: warning: unknown[45.142.120.83]: SASL LOGIN authentication failed: Connection lost to authentication server
    Oct  9 17:04:32 c02 dovecot: auth: Warning: auth client 0 disconnected with 1 pending requests: Connection reset by peer
    Oct  9 17:04:32 c02 dovecot: auth: Warning: auth client 0 disconnected with 1 pending requests: Connection reset by peer
    Oct  9 17:04:32 c02 postfix/smtpd[9359]: disconnect from unknown[45.142.120.83] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
    Oct  9 17:04:32 c02 postfix/smtpd[9482]: warning: unknown[45.142.120.83]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
    Oct  9 17:04:32 c02 postfix/smtpd[9482]: disconnect from unknown[45.142.120.83] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
    Oct  9 17:04:33 c02 postfix/smtpd[9483]: warning: unknown[45.142.120.83]: SASL LOGIN authentication failed: Connection lost to authentication server
    Oct  9 17:04:33 c02 postfix/smtpd[9455]: warning: unknown[212.70.149.83]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
    Oct  9 17:04:33 c02 postfix/smtpd[9454]: warning: unknown[212.70.149.52]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
    Oct  9 17:04:33 c02 postfix/smtpd[9465]: connect from unknown[45.142.120.83]
    Oct  9 17:04:34 c02 postfix/smtpd[9483]: disconnect from unknown[45.142.120.83] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
    Oct  9 17:04:34 c02 postfix/smtpd[9454]: disconnect from unknown[212.70.149.52] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
    Oct  9 17:04:34 c02 postfix/smtpd[9455]: disconnect from unknown[212.70.149.83] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
    Oct  9 17:04:34 c02 postfix/smtpd[9435]: warning: unknown[212.70.149.5]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
    Oct  9 17:04:34 c02 dovecot: auth: Warning: auth client 0 disconnected with 1 pending requests: Connection reset by peer
    Oct  9 17:04:35 c02 postfix/smtpd[9574]: warning: unknown[45.142.120.83]: SASL LOGIN authentication failed: Connection lost to authentication server
    Oct  9 17:04:35 c02 postfix/smtpd[9574]: disconnect from unknown[45.142.120.83] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
    Oct  9 17:04:35 c02 postfix/smtpd[9435]: disconnect from unknown[212.70.149.5] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
    Oct  9 17:04:36 c02 postfix/smtpd[9359]: connect from unknown[45.142.120.83]
    Oct  9 17:04:36 c02 dovecot: auth: Warning: auth client 0 disconnected with 1 pending requests: Connection reset by peer
    Oct  9 17:04:38 c02 postfix/smtpd[9482]: connect from unknown[45.142.120.83]
    Oct  9 17:04:38 c02 postfix/smtpd[8335]: warning: unknown[212.70.149.20]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
    Oct  9 17:04:38 c02 postfix/smtpd[8335]: disconnect from unknown[212.70.149.20] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
    Oct  9 17:04:39 c02 dovecot: auth: Warning: auth client 0 disconnected with 1 pending requests: Connection reset by peer
    Oct  9 17:04:39 c02 postfix/smtpd[10199]: warning: unknown[45.142.120.83]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
    Oct  9 17:04:39 c02 postfix/smtpd[10199]: disconnect from unknown[45.142.120.83] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
    Oct  9 17:04:40 c02 postfix/smtpd[9360]: warning: unknown[45.142.120.83]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
    Oct  9 17:04:40 c02 postfix/smtpd[9360]: disconnect from unknown[45.142.120.83] ehlo=1 auth=0/1 rset=1 quit=1 commands=3/4
    Oct  9 17:04:40 c02 postfix/smtpd[9483]: connect from unknown[45.142.120.83]
    
    I've upgraded ispconfig with the update.php script and I used the SSL-Cert howto from "https://www.howtoforge.com/communit...l-port-8080-with-lets-encrypt-free-ssl.75554/".
     
  2. Jesse Norell

    Jesse Norell ISPConfig Developer Staff Member ISPConfig Developer

    Ie. you are actually using roundcube but the "send" button in roundcube opens a url with 'squirrelmail' in it? Is squirrelmail also installed? I wonder if it adds a redirect for some path that matches roundcube's request; try `grep -R squirrelmail /etc/apache2 /etc/nginx` and if that shows nothing, check what packages are installed, and purge anything related to squirrelmail.
     
    Martin007 likes this.
  3. Jesse Norell

    Jesse Norell ISPConfig Developer Staff Member ISPConfig Developer

    On the off chance you were playing with squirrelmail at some point, your browser might have a redirect cached as well, so clearing your browser cache wouldn't hurt, too.
     
    Martin007 likes this.
  4. Martin007

    Martin007 New Member HowtoForge Supporter

    Code:
    /etc/nginx/sites-enabled/000-apps.vhost:        location /squirrelmail {
    /etc/nginx/sites-enabled/000-apps.vhost:               location ~ ^/squirrelmail/(.+\.php)$ {
    /etc/nginx/sites-enabled/000-apps.vhost:               location ~* ^/squirrelmail/(.+\.(jpg|jpeg|gif|css|png|js|ico|html|xml|txt))$ {
    /etc/nginx/sites-enabled/000-apps.vhost:               rewrite ^/* /squirrelmail last;
    /etc/nginx/sites-enabled/000-ispconfig.vhost:#        location /squirrelmail {
    /etc/nginx/sites-enabled/000-ispconfig.vhost:#               location ~ ^/squirrelmail/(.+\.php)$ {
    /etc/nginx/sites-enabled/000-ispconfig.vhost:#               location ~* ^/squirrelmail/(.+\.(jpg|jpeg|gif|css|png|js|ico|html|xml|txt))$ {
    /etc/nginx/sites-enabled/000-ispconfig.vhost:#               rewrite ^/* /squirrelmail last;
    /etc/nginx/sites-available/ispconfig.vhost:#        location /squirrelmail {
    /etc/nginx/sites-available/ispconfig.vhost:#               location ~ ^/squirrelmail/(.+\.php)$ {
    /etc/nginx/sites-available/ispconfig.vhost:#               location ~* ^/squirrelmail/(.+\.(jpg|jpeg|gif|css|png|js|ico|html|xml|txt))$ {
    /etc/nginx/sites-available/ispconfig.vhost:#               rewrite ^/* /squirrelmail last;
    /etc/nginx/sites-available/apps.vhost:        location /squirrelmail {
    /etc/nginx/sites-available/apps.vhost:               location ~ ^/squirrelmail/(.+\.php)$ {
    /etc/nginx/sites-available/apps.vhost:               location ~* ^/squirrelmail/(.+\.(jpg|jpeg|gif|css|png|js|ico|html|xml|txt))$ {
    /etc/nginx/sites-available/apps.vhost:               rewrite ^/* /squirrelmail last;
    
    And what is with the bigger email problem?
     
  5. till

    till Super Moderator Staff Member ISPConfig Developer

    Please have a look at the Ubuntu 20.04 perfect server guide and compare the packages that get installed there with your current setup. Go through the mail-related chapters and run all install commands to ensure all required packages are there. Besides that, you might want to check the /etc/dovecot/dovecot.conf file and the postfix /etc/postfix/main.cf file if they contain settings for the SSL config and if the paths used there point to the correct SSL cert.
     
  6. till

    till Super Moderator Staff Member ISPConfig Developer

    Regarding squirrelmail, the nginx setups use squirrelmail as a kind of alias for roundcube, this normally works fine, maybe the update broke something.
     
  7. till

    till Super Moderator Staff Member ISPConfig Developer

    And you might want to check if you have any custom templates in /usr/local/ispconfig/server/conf-custom/ for dovecot or postfix.
     
  8. Martin007

    Martin007 New Member HowtoForge Supporter

    I don't have any templates.

    I don't know, but nginx uses the squirrelmail as the directory for roundcube. I don't know how to fix it.

    I've checked the guide already earlier today. It's all done and working, but the mail server don't works. The configs look fine:

    Code:
    /etc/dovecot/dovecot.conf
    
    listen = *,[::]
    protocols = imap pop3 lmtp
    auth_mechanisms = plain login
    disable_plaintext_auth = no
    log_timestamp = "%Y-%m-%d %H:%M:%S "
    mail_privileged_group = vmail
    postmaster_address = [email protected]
    ssl_cert = </etc/postfix/smtpd.cert
    ssl_key = </etc/postfix/smtpd.key
    ssl_dh = </etc/dovecot/dh.pem
    ssl_min_protocol = TLSv1.2
    ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
    ssl_prefer_server_ciphers = no
    mail_max_userip_connections = 100
    mail_plugins = $mail_plugins quota
    passdb {
      args = /etc/dovecot/dovecot-sql.conf
      driver = sql
    }
    userdb {
      driver = prefetch
    }
    userdb {
      args = /etc/dovecot/dovecot-sql.conf
      driver = sql
    }
    plugin {
      quota = dict:user::file:/var/vmail/%d/%n/.quotausage
    
      # no longer needed, as 'sieve' is in userdb extra fields:
      sieve=/var/vmail/%d/%n/.sieve
    
      sieve_before=/var/vmail/%d/%n/.ispconfig-before.sieve
      sieve_after=/var/vmail/%d/%n/.ispconfig.sieve
      sieve_max_script_size = 2M
      sieve_max_actions = 100
      sieve_max_redirects = 25
    }
    service auth {
      unix_listener /var/spool/postfix/private/auth {
        group = postfix
        mode = 0660
        user = postfix
      }
      unix_listener auth-userdb {
        group = vmail
        mode = 0600
        user = vmail
      }
      user = root
    }
    service lmtp {
      unix_listener /var/spool/postfix/private/dovecot-lmtp {
       group = postfix
       mode = 0600
       user = postfix
      }
    }
    lmtp_rcpt_check_quota = yes
    service imap-login {
      client_limit = 1000
      process_limit = 512
    }
    protocol imap {
      mail_plugins = quota imap_quota
      auth_verbose = yes
    }
    protocol pop3 {
      pop3_uidl_format = %08Xu%08Xv
      mail_plugins = quota
      auth_verbose = yes
    }
    protocol lda {
    postmaster_address = [email protected]
      mail_plugins = sieve quota
    }
    protocol lmtp {
    postmaster_address = [email protected]
      mail_plugins = quota sieve
    }
    
    
    service stats {
        unix_listener stats-reader {
            user = vmail
            group = vmail
            mode = 0660
        }
    #2.3+
        unix_listener stats-writer {
            user = vmail
            group = vmail
            mode = 0660
        }
    }
    
    service quota-status {
      executable = quota-status -p postfix
      unix_listener /var/spool/postfix/private/quota-status {
        group = postfix
        mode = 0660
        user = postfix
      }
      client_limit = 1
    }
    plugin {
      quota_status_success = DUNNO
      quota_status_nouser = DUNNO
      quota_status_overquota = "552 5.2.2 Mailbox is full"
    }
    Code:
    # See /usr/share/postfix/main.cf.dist for a commented, more complete version
    
    
    # Debian specific:  Specifying a file name will cause the first
    # line of that file to be used as the name.  The Debian default
    # is /etc/mailname.
    #myorigin = /etc/mailname
    
    smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
    biff = no
    
    # appending .domain is the MUA's job.
    append_dot_mydomain = no
    
    # Uncomment the next line to generate "delayed mail" warnings
    #delay_warning_time = 4h
    
    readme_directory = /usr/share/doc/postfix
    
    # See http://www.postfix.org/COMPATIBILITY_README.html -- default to 2 on
    # fresh installs.
    compatibility_level = 2
    
    # TLS parameters
    smtpd_tls_cert_file = /etc/postfix/smtpd.cert
    smtpd_tls_key_file = /etc/postfix/smtpd.key
    smtpd_use_tls = yes
    smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
    smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
    
    # See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
    # information on enabling SSL in the smtp client.
    
    smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
    myhostname = c02.server.com
    alias_maps = hash:/etc/aliases, hash:/var/lib/mailman/data/aliases
    alias_database = hash:/etc/aliases, hash:/var/lib/mailman/data/aliases
    myorigin = /etc/mailname
    mydestination = c02.server.com, localhost, localhost.localdomain
    relayhost =
    mynetworks = 127.0.0.0/8 [::1]/128
    mailbox_size_limit = 0
    recipient_delimiter = +
    inet_interfaces = all
    inet_protocols = all
    html_directory = /usr/share/doc/postfix/html
    virtual_alias_domains = proxy:mysql:/etc/postfix/mysql-virtual_alias_domains.cf
    virtual_alias_maps = hash:/var/lib/mailman/data/virtual-mailman, proxy:mysql:/etc/postfix/mysql-virtual_forwardings.cf, proxy:mysql:/etc/postfix/mysql-virtual_alias_maps.cf, proxy:mysql:/etc/postfix/mysql-virtual_email2email.cf
    virtual_mailbox_domains = proxy:mysql:/etc/postfix/mysql-virtual_domains.cf
    virtual_mailbox_maps = proxy:mysql:/etc/postfix/mysql-virtual_mailboxes.cf
    virtual_mailbox_base = /var/vmail
    virtual_uid_maps = proxy:mysql:/etc/postfix/mysql-virtual_uids.cf
    virtual_gid_maps = proxy:mysql:/etc/postfix/mysql-virtual_gids.cf
    sender_bcc_maps = proxy:mysql:/etc/postfix/mysql-virtual_outgoing_bcc.cf
    smtpd_sasl_auth_enable = yes
    broken_sasl_auth_clients = yes
    smtpd_sasl_authenticated_header = yes
    smtpd_restriction_classes = greylisting
    greylisting = check_policy_service inet:127.0.0.1:10023
    smtpd_recipient_restrictions = permit_mynetworks, reject_unknown_recipient_domain, reject_unlisted_recipient, permit_sasl_authenticated, reject_non_fqdn_recipient, reject_unauth_destination, check_recipient_access proxy:mysql:/etc/postfix/mysql-virtual_recipient.cf, check_recipient_access mysql:/etc/postfix/mysql-virtual_policy_greylist.cf, check_policy_service unix:private/quota-status
    smtpd_tls_security_level = may
    transport_maps = hash:/var/lib/mailman/data/transport-mailman, proxy:mysql:/etc/postfix/mysql-virtual_transports.cf
    relay_domains = proxy:mysql:/etc/postfix/mysql-virtual_relaydomains.cf
    relay_recipient_maps = proxy:mysql:/etc/postfix/mysql-virtual_relayrecipientmaps.cf
    smtpd_sender_login_maps = proxy:mysql:/etc/postfix/mysql-virtual_sender_login_maps.cf
    proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $sender_bcc_maps $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $smtpd_sender_login_maps $virtual_uid_maps $virtual_gid_maps $smtpd_client_restrictions $smtpd_sender_restrictions $smtpd_recipient_restrictions
    smtpd_helo_required = yes
    smtpd_helo_restrictions = reject_invalid_helo_hostname, permit_mynetworks, check_helo_access regexp:/etc/postfix/helo_access, permit_sasl_authenticated, reject_non_fqdn_helo_hostname, check_helo_access regexp:/etc/postfix/blacklist_helo, permit
    smtpd_sender_restrictions = check_sender_access regexp:/etc/postfix/tag_as_originating.re, permit_mynetworks,  permit_sasl_authenticated, reject_non_fqdn_sender, check_sender_access regexp:/etc/postfix/tag_as_foreign.re, check_sender_access proxy:mysql:/etc/postfix/mysql-virtual_sender.cf
    smtpd_client_restrictions = check_client_access proxy:mysql:/etc/postfix/mysql-virtual_client.cf, permit_inet_interfaces, permit_mynetworks, reject_rbl_client zen.spamhaus.org, reject_rbl_client ix.dnsbl.manitu.net, reject_rbl_client b.barracudecentral.org, reject_rbl_client bl.spamcop.net, permit_sasl_authenticated, reject_unauth_pipelining, permit
    smtpd_client_message_rate_limit = 100
    maildrop_destination_concurrency_limit = 1
    maildrop_destination_recipient_limit = 1
    virtual_transport = lmtp:unix:private/dovecot-lmtp
    header_checks = regexp:/etc/postfix/header_checks
    mime_header_checks = regexp:/etc/postfix/mime_header_checks
    nested_header_checks = regexp:/etc/postfix/nested_header_checks
    body_checks = regexp:/etc/postfix/body_checks
    owner_request_special = no
    smtp_tls_security_level = dane
    smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
    smtpd_tls_protocols = !SSLv2,!SSLv3
    smtp_tls_protocols = !SSLv2,!SSLv3
    smtpd_tls_exclude_ciphers = RC4, aNULL
    smtp_tls_exclude_ciphers = RC4, aNULL
    dovecot_destination_recipient_limit = 1
    smtpd_sasl_type = dovecot
    smtpd_sasl_path = private/auth
    content_filter = lmtp:[127.0.0.1]:10024
    receive_override_options = no_address_mappings
    message_size_limit = 0
    smtpd_etrn_restrictions = permit_mynetworks, reject
    smtpd_data_restrictions = permit_mynetworks, reject_unauth_pipelining, reject_multi_recipient_bounce, permit
    smtpd_tls_mandatory_ciphers = medium
    tls_medium_cipherlist = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
    tls_preempt_cipherlist = no
    address_verify_negative_refresh_time = 60s
    enable_original_recipient = no
    smtpd_forbidden_commands = CONNECT,GET,POST,USER,PASS
    address_verify_sender_ttl = 15686s
    smtp_dns_support_level = dnssec
    

    Hope you can help me. Do you want to have a look at the server?
     
  9. Martin007

    Martin007 New Member HowtoForge Supporter

    Please delete.
     
  10. till

    till Super Moderator Staff Member ISPConfig Developer

    That's ok, nothing that needs to be fixed. It's just a folder name. The issue is probably related to your SSL problems.

    The mail config looks fine so far. It might be that using the let#s encryot tutorial (which is for ISPConfig 3.1) together with ISPConfig 3.2 beta, which has it's own mechanism for LE SSL certs for the mail system, messed something up.

    Please restart postfix and dovecot and then post the messages that appear in the mail.log file. In addition, please post the content of the postfix master.cf file.

    And post the result of:

    ls -la /etc/postfix/smtpd.cert
    ls -la /usr/local/ispconfig/interface/ssl/
     

Share This Page