PASSWORD ROOT DONT WORK !!!

Submitted by scraffe on Wed, 07/17/2013 - 03:46

I try to connect to the server but apparently the password is no longer valid and I can not even log in anymore SSH? Is there a way to recover the password or change it? I think it must be a pirate! thank you for your help, I have a lot of site on ... Regards Stephane PS : I managed to change the password, but I still had a concern for me connect from firefox, I managed through Chrome?

Status: 
Active

Comments

Submitted by andreychek on Wed, 07/17/2013 - 08:05

Howdy -- I'm glad you were able to access your system using Chrome.

How did you change your password, was that done through Virtualmin?

Both Chrome and Firefox should work fine with Virtualmin.

What problems are you seeing exactly when accessing Virtualmin with Firefox?

Submitted by scraffe on Sat, 07/20/2013 - 12:43

goodnight, Following connection to this problem, I have not had any problems apparently. By cons, today, my clients complain about not having a message, so I'm going to Virtualmin and apparently everything is ok except that the messages are not coming! I do not know or look and I wonder if I would not have been hacked the last time when I changed the password from my machine pro rescue mode and changing the SSH chroot after having ... And you Can you please look, if I see myself forced to change server to be on! Thank you for your help

Submitted by andreychek on Sat, 07/20/2013 - 12:49

Hmm, can you clarify your question? I'm not sure I understand what you're asking...

Are you saying that email messages aren't coming through?

If so, the first place to look would be to review your email logs, in /var/log/mail.log.

Those would contain error messages regarding email delivery.

Submitted by scraffe on Sat, 07/20/2013 - 12:55

Ok here is the log I found an error and I do not understand!

Jul 20 19:42:41 ns385239 postfix/qmgr[7341]: 42A14695EC: from=<esdinffr@ns385239.ovh.net>, size=3736, nrcpt=1 (queue active)
Jul 20 19:42:41 ns385239 postfix/smtp[20131]: C88D865076: host gateway-f2.isp.att.net[207.115.11.16] refused to talk to me: 521-46.105.125.210 blocked by ldap:ou=rblmx,dc=att,dc=net 521 Error - Blocked for abuse. Contact abuse_rbl@abuse-att.net.
Jul 20 19:42:41 ns385239 postfix/smtp[20132]: B22EC6506A: host gateway-f2.isp.att.net[207.115.11.16] refused to talk to me: 521-46.105.125.210 blocked by ldap:ou=rblmx,dc=att,dc=net 521 Error - Blocked for abuse. Contact abuse_rbl@abuse-att.net.
Jul 20 19:42:41 ns385239 postfix/smtp[20131]: C88D865076: to=<vip_recruiter@bellsouth.net>, relay=gateway-f1.isp.att.net[204.127.217.16]:25, delay=286068, delays=286067/0.01/0.67/0, dsn=4.0.0, status=deferred (host gateway-f1.isp.att.net[204.127.217.16] refused to talk to me: 521-46.105.125.210 blocked by ldap:ou=rblmx,dc=att,dc=net 521 Error - Blocked for abuse. Contact abuse_rbl@abuse-att.net.)
Jul 20 19:42:41 ns385239 postfix/smtp[20132]: B22EC6506A: to=<vip_pouponny45@bellsouth.net>, relay=gateway-f1.isp.att.net[204.127.217.16]:25, delay=286068, delays=286067/0.01/0.67/0, dsn=4.0.0, status=deferred (host gateway-f1.isp.att.net[204.127.217.16] refused to talk to me: 521-46.105.125.210 blocked by ldap:ou=rblmx,dc=att,dc=net 521 Error - Blocked for abuse. Contact abuse_rbl@abuse-att.net.)
Jul 20 19:42:53 ns385239 postfix/tlsmgr[20139]: fatal: open database /var/lib/postfix/smtpd_scache.db: Invalid argument
Jul 20 19:42:54 ns385239 postfix/master[7330]: warning: process /usr/lib/postfix/tlsmgr pid 20139 exit status 1
Jul 20 19:42:54 ns385239 postfix/master[7330]: warning: /usr/lib/postfix/tlsmgr: bad command startup -- throttling
Jul 20 19:43:16 ns385239 postfix/smtp[20133]: 42A14695EC: to=<bolliger@alltel.net>, relay=none, delay=284065, delays=284030/0.01/35/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=alltel.net type=MX: Host not found, try again)
Jul 20 19:43:54 ns385239 postfix/tlsmgr[20197]: fatal: open database /var/lib/postfix/smtpd_scache.db: Invalid argument
Jul 20 19:43:55 ns385239 postfix/master[7330]: warning: process /usr/lib/postfix/tlsmgr pid 20197 exit status 1
Jul 20 19:43:55 ns385239 postfix/master[7330]: warning: /usr/lib/postfix/tlsmgr: bad command startup -- throttling
Jul 20 19:44:18 ns385239 dovecot: imap-login: Login: user=<info.clefser2>, method=PLAIN, rip=88.177.64.194, lip=46.105.125.210
Jul 20 19:44:18 ns385239 dovecot: imap-login: Login: user=<info.clefserv>, method=PLAIN, rip=88.177.64.194, lip=46.105.125.210
Jul 20 19:44:51 ns385239 dovecot: IMAP(info.clefser2): Disconnected: Logged out bytes=235/1093
Jul 20 19:44:51 ns385239 dovecot: IMAP(info.clefserv): Disconnected: Logged out bytes=452/4701
Jul 20 19:44:55 ns385239 postfix/tlsmgr[20349]: fatal: open database /var/lib/postfix/smtpd_scache.db: Invalid argument
Jul 20 19:44:56 ns385239 postfix/master[7330]: warning: process /usr/lib/postfix/tlsmgr pid 20349 exit status 1
Jul 20 19:44:56 ns385239 postfix/master[7330]: warning: /usr/lib/postfix/tlsmgr: bad command startup -- throttling
Jul 20 19:45:56 ns385239 postfix/tlsmgr[20818]: fatal: open database /var/lib/postfix/smtpd_scache.db: Invalid argument
Jul 20 19:45:57 ns385239 postfix/master[7330]: warning: process /usr/lib/postfix/tlsmgr pid 20818 exit status 1
Jul 20 19:45:57 ns385239 postfix/master[7330]: warning: /usr/lib/postfix/tlsmgr: bad command startup -- throttling
Jul 20 19:46:57 ns385239 postfix/tlsmgr[20875]: fatal: open database /var/lib/postfix/smtpd_scache.db: Invalid argument
Jul 20 19:46:58 ns385239 postfix/master[7330]: warning: process /usr/lib/postfix/tlsmgr pid 20875 exit status 1
Jul 20 19:46:58 ns385239 postfix/master[7330]: warning: /usr/lib/postfix/tlsmgr: bad command startup -- throttling
Jul 20 19:47:41 ns385239 postfix/qmgr[7341]: A1740611A6: from=<esdinffr@ns385239.ovh.net>, size=3720, nrcpt=1 (queue active)
Jul 20 19:47:41 ns385239 postfix/qmgr[7341]: F14D36504C: from=<esdinffr@ns385239.ovh.net>, size=3726, nrcpt=1 (queue active)
Jul 20 19:47:41 ns385239 postfix/qmgr[7341]: 393FF695EF: from=<esdinffr@ns385239.ovh.net>, size=3724, nrcpt=1 (queue active)
Jul 20 19:47:41 ns385239 postfix/qmgr[7341]: C5065646C2: from=<esdinffr@ns385239.ovh.net>, size=3728, nrcpt=1 (queue active)
Jul 20 19:47:41 ns385239 postfix/qmgr[7341]: 1791F6506E: from=<esdinffr@ns385239.ovh.net>, size=3713, nrcpt=1 (queue active)
Jul 20 19:47:41 ns385239 postfix/qmgr[7341]: 1C72D69618: from=<esdinffr@ns385239.ovh.net>, size=3737, nrcpt=1 (queue active)
Jul 20 19:47:41 ns385239 postfix/smtp[20930]: connect to comspeed.net[176.74.176.167]:25: Connection refused
Jul 20 19:47:41 ns385239 postfix/smtp[20930]: 393FF695EF: to=<williebarb@comspeed.net>, relay=none, delay=281765, delays=281765/0.01/0.15/0, dsn=4.4.1, status=deferred (connect to comspeed.net[176.74.176.167]:25: Connection refused)
Jul 20 19:47:41 ns385239 postfix/smtp[20932]: 1791F6506E: host gateway-f2.isp.att.net[207.115.11.16] refused to talk to me: 521-46.105.125.210 blocked by ldap:ou=rblmx,dc=att,dc=net 521 Error - Blocked for abuse. Contact abuse_rbl@abuse-att.net.
Jul 20 19:47:41 ns385239 postfix/smtp[20933]: 1C72D69618: host gateway-f2.isp.att.net[207.115.11.16] refused to talk to me: 521-46.105.125.210 blocked by ldap:ou=rblmx,dc=att,dc=net 521 Error - Blocked for abuse. Contact abuse_rbl@abuse-att.net.
Jul 20 19:47:41 ns385239 postfix/smtp[20933]: 1C72D69618: to=<williebatch@bellsouth.net>, relay=gateway-f1.isp.att.net[204.127.217.16]:25, delay=281765, delays=281764/0.03/0.67/0, dsn=4.0.0, status=deferred (host gateway-f1.isp.att.net[204.127.217.16] refused to talk to me: 521-46.105.125.210 blocked by ldap:ou=rblmx,dc=att,dc=net 521 Error - Blocked for abuse. Contact abuse_rbl@abuse-att.net.)
Jul 20 19:47:41 ns385239 postfix/smtp[20932]: 1791F6506E: to=<vje101951@bellsouth.net>, relay=gateway-f1.isp.att.net[204.127.217.16]:25, delay=286095, delays=286094/0.02/0.67/0, dsn=4.0.0, status=deferred (host gateway-f1.isp.att.net[204.127.217.16] refused to talk to me: 521-46.105.125.210 blocked by ldap:ou=rblmx,dc=att,dc=net 521 Error - Blocked for abuse. Contact abuse_rbl@abuse-att.net.)
Jul 20 19:47:43 ns385239 postfix/smtp[20931]: C5065646C2: to=<vjdxsxtvxa@piousness.com>, relay=none, delay=286097, delays=286094/0.02/2.4/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=piousness.com type=MX: Host not found, try again)
Jul 20 19:47:43 ns385239 postfix/smtp[20929]: F14D36504C: to=<vjdzcs@adroitness.com>, relay=none, delay=286097, delays=286094/0.01/2.5/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=adroitness.com type=MX: Host not found, try again)
Jul 20 19:47:58 ns385239 postfix/tlsmgr[20940]: fatal: open database /var/lib/postfix/smtpd_scache.db: Invalid argument
Jul 20 19:47:59 ns385239 postfix/master[7330]: warning: process /usr/lib/postfix/tlsmgr pid 20940 exit status 1
Jul 20 19:47:59 ns385239 postfix/master[7330]: warning: /usr/lib/postfix/tlsmgr: bad command startup -- throttling
Jul 20 19:48:11 ns385239 postfix/smtp[20928]: connect to yahh.com[141.8.224.25]:25: Connection timed out
Jul 20 19:48:11 ns385239 postfix/smtp[20928]: A1740611A6: to=<blturner15@yahh.com>, relay=none, delay=285987, delays=285957/0.01/30/0, dsn=4.4.1, status=deferred (connect to yahh.com[141.8.224.25]:25: Connection timed out)
Jul 20 19:48:59 ns385239 postfix/tlsmgr[20996]: fatal: open database /var/lib/postfix/smtpd_scache.db: Invalid argument
Jul 20 19:49:00 ns385239 postfix/master[7330]: warning: process /usr/lib/postfix/tlsmgr pid 20996 exit status 1
Jul 20 19:49:00 ns385239 postfix/master[7330]: warning: /usr/lib/postfix/tlsmgr: bad command startup -- throttling
Jul 20 19:50:00 ns385239 postfix/tlsmgr[21162]: fatal: open database /var/lib/postfix/smtpd_scache.db: Invalid argument
Jul 20 19:50:01 ns385239 postfix/master[7330]: warning: process /usr/lib/postfix/tlsmgr pid 21162 exit status 1
Jul 20 19:50:01 ns385239 postfix/master[7330]: warning: /usr/lib/postfix/tlsmgr: bad command startup -- throttling

Submitted by andreychek on Sat, 07/20/2013 - 13:44

Hmm, while I haven't run into that issue before, Googling the errors you're seeing, it sounds like the Postfix cache file may be corrupt.

Here's what I would try -- log into your server over SSH as root, and run the following commands:

/etc/init.d/postfix stop
mv /var/lib/postfix/smtp_scache.db /tmp
mv /var/lib/postfix/smtpd_scache.db /tmp
/etc/init.d/postfix start

After doing that, are you able to send email again?

Submitted by scraffe on Sat, 07/20/2013 - 15:51

Apparently an error in the log but I do not like this message ... do you think it is possible that an attacker has entered the system, and it is preferable that I change server? Excuse the google translation...

Jul 20 22:39:56 ns385239 postfix/smtpd[17818]: disconnect from serveur.se-faire-des-amis.net[94.23.215.9]
Jul 20 22:41:32 ns385239 dovecot: IMAP(info.clefser2): Connection closed: Connection reset by peer bytes=235/1072
Jul 20 22:41:32 ns385239 dovecot: IMAP(info.clefserv): Connection closed: Connection reset by peer bytes=283/1357
Jul 20 22:42:41 ns385239 postfix/qmgr[8816]: 50BE06504B: from=<esdinffr@ns385239.ovh.net>, size=3743, nrcpt=1 (queue active)
Jul 20 22:42:41 ns385239 postfix/qmgr[8816]: 9DD4C695DA: from=<esdinffr@ns385239.ovh.net>, size=3722, nrcpt=1 (queue active)
Jul 20 22:42:41 ns385239 postfix/qmgr[8816]: 64DB4695FD: from=<esdinffr@ns385239.ovh.net>, size=3731, nrcpt=1 (queue active)
Jul 20 22:42:41 ns385239 postfix/smtp[18486]: 50BE06504B: host gateway-f1.isp.att.net[204.127.217.16] refused to talk to me: 521-46.105.125.210 blocked by ldap:ou=rblmx,dc=att,dc=net 521 Error - Blocked for abuse. Contact abuse_rbl@abuse-att.net.
Jul 20 22:42:41 ns385239 postfix/smtp[18487]: 9DD4C695DA: host gateway-f2.isp.att.net[207.115.11.16] refused to talk to me: 521-46.105.125.210 blocked by ldap:ou=rblmx,dc=att,dc=net 521 Error - Blocked for abuse. Contact abuse_rbl@abuse-att.net.
Jul 20 22:42:41 ns385239 postfix/smtp[18488]: 64DB4695FD: host gateway-f1.isp.att.net[204.127.217.16] refused to talk to me: 521-46.105.125.210 blocked by ldap:ou=rblmx,dc=att,dc=net 521 Error - Blocked for abuse. Contact abuse_rbl@abuse-att.net.
Jul 20 22:42:41 ns385239 postfix/smtp[18486]: 50BE06504B: to=<bl_hodges@bellsouth.net>, relay=gateway-f2.isp.att.net[207.115.11.16]:25, delay=298494, delays=298493/0.01/0.67/0, dsn=4.0.0, status=deferred (host gateway-f2.isp.att.net[207.115.11.16] refused to talk to me: 521-46.105.125.210 blocked by ldap:ou=rblmx,dc=att,dc=net 521 Error - Blocked for abuse. Contact abuse_rbl@abuse-att.net.)
Jul 20 22:42:41 ns385239 postfix/smtp[18487]: 9DD4C695DA: to=<boryv@bellsouth.net>, relay=gateway-f1.isp.att.net[204.127.217.16]:25, delay=294289, delays=294289/0/0.67/0, dsn=4.0.0, status=deferred (host gateway-f1.isp.att.net[204.127.217.16] refused to talk to me: 521-46.105.125.210 blocked by ldap:ou=rblmx,dc=att,dc=net 521 Error - Blocked for abuse. Contact abuse_rbl@abuse-att.net.)
Jul 20 22:42:42 ns385239 postfix/smtp[18488]: 64DB4695FD: to=<wayo@bellsouth.net>, relay=gateway-f2.isp.att.net[207.115.11.16]:25, delay=294429, delays=294429/0.01/0.67/0, dsn=4.0.0, status=deferred (host gateway-f2.isp.att.net[207.115.11.16] refused to talk to me: 521-46.105.125.210 blocked by ldap:ou=rblmx,dc=att,dc=net 521 Error - Blocked for abuse. Contact abuse_rbl@abuse-att.net.)
Jul 20 22:43:16 ns385239 postfix/anvil[17527]: statistics: max connection rate 1/60s for (smtp:193.252.22.214) at Jul 20 22:35:25
Jul 20 22:43:16 ns385239 postfix/anvil[17527]: statistics: max connection count 1 for (smtp:193.252.22.214) at Jul 20 22:35:25
Jul 20 22:43:16 ns385239 postfix/anvil[17527]: statistics: max cache size 1 at Jul 20 22:35:25
Jul 20 22:44:11 ns385239 dovecot: imap-login: Login: user=<info.clefserv>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured
Jul 20 22:44:11 ns385239 dovecot: IMAP(info.clefserv): Connection closed bytes=1804/15229
Jul 20 22:44:14 ns385239 dovecot: imap-login: Login: user=<info.clefserv>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured
Jul 20 22:44:14 ns385239 dovecot: imap-login: Login: user=<info.clefserv>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured
Jul 20 22:44:14 ns385239 dovecot: IMAP(info.clefserv): Connection closed bytes=1804/15229
Jul 20 22:44:14 ns385239 dovecot: IMAP(info.clefserv): Connection closed bytes=649/4829

Submitted by andreychek on Sat, 07/20/2013 - 16:15

It's difficult to know why a mail server would reject your emails... it's usually necessary to contact the owner of the mail server for further information.

However, you could try checking to see if your IP address is listed on any RBL's... one way of doing that is to enter your IP address here:

http://www.anti-abuse.org/multi-rbl-check/

Also, what output do you receive if you run this command -- this will show how many emails are in your mail queue:

mailq | tail -1

Submitted by scraffe on Sat, 07/20/2013 - 17:08

204 Kbites in 53 requests but when I pass in Virtualmin server / Postfix Mail Server / MailQueue it gives me this message: /usr/bin/postqueue -p failed : sh: /usr/bin/postqueue: No such file or directory ??

Submitted by andreychek on Sat, 07/20/2013 - 17:22

The number of messages in your mail queue looks normal.

The error you're getting suggests that Webmin is looking in the wrong place for the postqueue program; that can be corrected by going into Webmin -> Servers -> Postfix -> Module Config -> System Configuration, and there, make sure that "Full path to Postfix queue management command (`postqueue')" contains the correct path to your "postqueue" program.

I suspect that would be "/usr/sbin/postqueue" on Ubuntu.

Submitted by scraffe on Sat, 07/20/2013 - 17:51

yes is contains : /usr/sbin/postqueue ??

Submitted by andreychek on Sat, 07/20/2013 - 18:10

Hmm, the error you shared above showed that it was looking for "/usr/bin/postqueue", which would be incorrect... are you sure that it has "/usr/sbin/postqueue", and not "/usr/bin/postqueue"?

Submitted by andreychek on Sat, 07/20/2013 - 19:53

Hmm, it'd be helpful to see the values for the other fields on that page.

Could you take a screenshot of the screen Webmin -> Servers -> Postfix -> Module Config -> System Configuration, and attach that screenshot to this request? Thanks!

Submitted by scraffe on Sat, 07/20/2013 - 20:23

i dont An HTTP error 0 occurred. /comment-upload/js

Submitted by andreychek on Sun, 07/21/2013 - 07:47

Thanks for your email!

It looks like the "Mail queue display command" field is incorrect, it points to a file that doesn't exist.

Try setting that to the following:

/usr/sbin/postqueue -p

And then see if that resolves the problem.