mail errors

Submitted by cddrummergo on Sat, 01/17/2015 - 18:49

Hi Andrew.

So After tail -f maillog I was seeing some weird spam being sent off of the server, I went and deleted all of the mail for this user and all of the users with mail.

Still not sure if this is a cert problem or another type, and I'm going to recreate those email boxes and try again.

I am getting some strange SMTP connections so Im going to diag that.

Right now, I have another domain that will not receive any port 25. Gmail bounces with port 25 socket error

The recipient server did not accept our requests to connect. Learn more at http://support.google.com/mail/bin/answer.py?answer=7720 [(1) mail.domain.info. [169.24.67.19]:25: socket error] [(5) mail.domain.info. [169.24.67.19]:25: socket error] [(10) mail.domain.info. [169.24.67.19]:25: socket error]

the domains below are receiving and sending mail on port 25, but if I wanted to

netstat -an | grep :25 tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN tcp 0 0 169.24.67.17:25 0.0.0.0:* LISTEN tcp 0 0 169.24.67.18:25 0.0.0.0:* LISTEN tcp 0 0 169.24.67.14:6008 60.183.108.21:2576 ESTA

add port 25 to another ip (the failing one, .19), would that be in the network adaptor settings of this domain ip?

Thanks, Charles

Status: 
Closed (fixed)

Comments

Submitted by JamieCameron on Sat, 01/17/2015 - 18:53

So are these errors you see when sending email, or when one of your domains receives email?

Submitted by cddrummergo on Sat, 01/17/2015 - 19:06

I have one that will recieve and one that wont, port 25 is open for the other domains but refuses to work for one.

Im not sure if its reverse dns or what and I noticed that the grep has port 25 for other domains and they work.

Charles

Submitted by andreychek on Sat, 01/17/2015 - 19:21

It looks like you have an open request regarding this issue in the Forums here:

https://www.virtualmin.com/node/35884

The Forums are the best place to receive support for Virtualmin GPL, and we'll follow up with you there shortly.

Thanks!

Submitted by cddrummergo on Sat, 01/17/2015 - 19:37

your right sorry about that.

I think i have been hacked. All was working a few weeks back.

Now 1 domain wont recieve

1 user on another domain will not work

and Im getting lots of these. and not much is making sense.

Jan 17 17:23:06 sv1 postfix/qmgr[2794]: 635822F80DC0: removed Jan 17 17:23:14 sv1 postfix/smtpd[8830]: connect from p5099771d.dip0.t-ipconnect.de[80.153.119.29] Jan 17 17:23:14 sv1 postfix/smtpd[9116]: connect from host177-103-static.44-88-b.business.telecomitalia.it[88.44.103.177] Jan 17 17:23:17 sv1 postfix/smtpd[8830]: warning: p5099771d.dip0.t-ipconnect.de[80.153.119.29]: SASL LOGIN authentication failed: authentication failure Jan 17 17:23:17 sv1 postfix/smtpd[9116]: warning: host177-103-static.44-88-b.business.telecomitalia.it[88.44.103.177]: SASL LOGIN authentication failed: authentication failure Jan 17 17:23:20 sv1 postfix/smtpd[8830]: warning: p5099771d.dip0.t-ipconnect.de[80.153.119.29]: SASL LOGIN authentication failed: authentication failure Jan 17 17:23:20 sv1 postfix/smtpd[8830]: too many errors after AUTH from p5099771d.dip0.t-ipconnect.de[80.153.119.29] Jan 17 17:23:20 sv1 postfix/smtpd[8830]: disconnect from p5099771d.dip0.t-ipconnect.de[80.153.119.29] Jan 17 17:23:20 sv1 postfix/smtpd[9116]: warning: host177-103-static.44-88-b.business.telecomitalia.it[88.44.103.177]: SASL LOGIN authentication failed: authentication failure Jan 17 17:23:20 sv1 postfix/smtpd[9116]: too many errors after AUTH from host177-103-static.44-88-b.business.telecomitalia.it[88.44.103.177] Jan 17 17:23:20 sv1 postfix/smtpd[9116]: disconnect from host177-103-static.44-88-b.business.telecomitalia.it[88.44.103.177] Jan 17 17:23:34 sv1 postfix/pickup[2793]: B0F5C2F80DC0: uid=506 from= Jan 17 17:23:34 sv1 postfix/cleanup[9018]: B0F5C2F80DC0: message-id=0a3a00eed25c135fed4bc969ef0ef7be@www.unclejimmysjalopys.com Jan 17 17:23:35 sv1 dkim-filter[2669]: B0F5C2F80DC0: no signature data Jan 17 17:23:35 sv1 postfix/qmgr[2794]: B0F5C2F80DC0: from=UncleJimmysJalopys@sv1.pchelpdock.com, size=2235, nrcpt=1 (queue active) Jan 17 17:23:36 sv1 postfix/smtp[9173]: B0F5C2F80DC0: to=james.snelling7@gmail.com, relay=gmail-smtp-in.l.google.com[74.125.20.27]:25, delay=1.8, delays=0.57/0.03/0.23/1, dsn=2.0.0, status=sent (250 2.0.0 OK 1421544216 x4si10813705pdh.43 - gsmtp)

Submitted by JamieCameron on Sun, 01/18/2015 - 16:45

So, receiving email for a domain and a user not being able to send email could have quite different causes.

What is the domain that couldn't receive email? And what entries for it appear in your log file?