VM Pro secondary email server

14 posts / 0 new
Last post
#1 Mon, 06/29/2009 - 11:20
dbrewer

VM Pro secondary email server

My company (RJR Solutions) just upgraded to virtualmin Pro. They asked me to set up VM GPL on a different server to act as a secondary MX server. I followed the directions here: http://www.virtualmin.com/documentation/email/hold-and-forward

I logged into the secondary server, and did not see anything created in /var/mail

I performed the following test:

telnet xxx.xxx.xxx.xxx 25

Trying xxx.xxx.xxx.xxx...

Connected to xxx.xxx.xxx.xxx.

Escape character is '^]'.

220 mailrelay.com ESMTP Postfix (Ubuntu)

HELO example.com

250 mailrelay.com

MAIL FROM: user@example.com

250 2.1.0 Ok

RCPT TO: user@example.com

554 5.7.1 user@example.com: Relay access denied

How do I know that the backup mail relay is working? It appears that it is not.

Mon, 06/29/2009 - 14:37
Joe
Joe's picture

Nothing should ever appear in /var/mail. That's the old mbox mail spool location.

On the forward and hold server, the mail would be held in the Postfix queue until it could be delivered.

The fact that you get a relay access denied means that it's not working. We'll need to see the maillog to know more about why. And I think there's also one option in main.cf that is adjusted on the backup mail server...relay_domains, I think. So, make sure that's being updated. The log and that directive will tell us more about where to look for trouble.

--

Check out the forum guidelines!

Mon, 06/29/2009 - 14:57
dbrewer

From mail.log:

Jun 29 11:28:03 rjrmailrelay1 postfix/smtpd[6163]: NOQUEUE: reject: RCPT from sendingserver.net[xxx.xxx.xxx.xxx]: 554 5.
7.1 <user@example.com>: Relay access denied; from=<user@example.com> to=<user@example.com> proto=SMTP helo=<example
.com>

I could not find relay_domains in main.cf. I found:

relayhost =

and it is empty. The variable is not assigned a value.

Mon, 06/29/2009 - 15:06 (Reply to #3)
Joe
Joe's picture

relayhost is not related, and should be disabled in the vast majority of cases. You can/should ignore it.

So, the backup MX stuff isn't working in Virtualmin.

Did you remember to check the 'Add all existing mail domains to secondary MX servers?' box? Not doing so would lead to the secondary not knowing about any of your existing domains. You'd need to disable the secondary and re-enable it to trigger this again.

--

Check out the forum guidelines!

Mon, 06/29/2009 - 17:33
ronald
ronald's picture

and you want this in the config file: smtpd_recipient_restrictions = permit_mynetworks permit_sasl_authenticated reject_unauth_destination permit_mx_backup

Tue, 06/30/2009 - 13:24
dbrewer

I disabled the secondary server in the webmin console, and re-added it using the really wide button that says "Save, and add existing domains to new secondaries". I remember hitting this button the first time after I had hit the small one that says "Save", and nothing happened. This time the output told me that it was copying the domains over to the secondary server. The HELO test worked fine this time. Thanks Joe.

About Ronald's comment, is this still necessary? which config file? the primary or the secondary?

Tue, 06/30/2009 - 16:52
ronald
ronald's picture

Yeah that should be necessary on the secondary server so it knows it is allowed to act as a secondary server.

main.cf of secondary postfix is where you add it.

Wed, 07/01/2009 - 08:23
dbrewer

I enabled the secondary server last night by pointing the secondary mx record to the server. HELP!!! I had to switch the pointer back to the primary. The secondary server is generating backscatter like crazy. I need to disable bounce notification on the secondary server, or address it to a drop-dead catch-all, and drop bounced messages from the mail queue (I think.)

I added permit_mx_backup to the config file on the secondary server, as per above. But I can't reenable the server till I deal with the backscatter. Any ideas?

Wed, 07/01/2009 - 10:42
ronald
ronald's picture

i used to get a lot of spam on my secondary mailserver, ... until I installed postgrey. This may be an option for you too.

There may be settings you have to check on in the webmin's module for postfix, mainly SMTP Client Options and SMTP Client Restrictions

For the company, you may be interested in Transparent SMTP proxies, see the Wiki: http://en.wikipedia.org/wiki/Transparent_SMTP_proxy

Wed, 07/01/2009 - 12:23
dbrewer

A proxy would open a connection to the destination MTA. Great for some things, but our secondary MX server is only needed when the primary is down, which is the destination MTA. I agree that greylisting on the secondary server will reduce the backscatter, but what is really needed is to keep the primary and secondary MX in sync somehow, using relay_recipient_maps. Then the email would be immediately rejected. Perhaps there is a documented procedure that I can follow? Perhaps a script that copies /etc/postfix/virtual.db from the primary to the secondary whenever email addresses are changed on the primary?

Wed, 07/01/2009 - 14:40 (Reply to #10)
Joe
Joe's picture

Somehow, I thought this had been implemented a couple of versions back in Virtualmin, though the docs don't cover it. I'll have to poke around a bit.

--

Check out the forum guidelines!

Mon, 07/13/2009 - 08:06
dbrewer

It took very few lines of code to end the backscatter problem on a relay MX server running Virtualmin GPL for a primary MX server using Virtualmin Pro. My fix seems to be working fine. For Joe and/or Jaime to review (make sure I didn't compromise anything):

All of this was done to the relay server, not the primary!!!

First: install expect on relay server: On a debian system, just 'apt-get install expect' Next: Add to /etc/postfix/main.cf of relay server: relay_recipient_maps = hash:/etc/postfix/relay_recipients

From a script I called 'importMap.sh' (using your own login info):

#!/usr/bin/expect -f
spawn scp "admin@domain.tld:/etc/postfix/virtual" /etc/postfix/relay_recipients
expect {
-re ".\*es.\*o.\*" {
exp_send "yes\n"
exp_continue
}
-re ".\*sword.\*" {
exp_send "PASSWORD\n"
}
}
interact

From a script I called 'loadEmailMap.sh':

#!/bin/sh
/usr/sbin/postmap /etc/postfix/relay_recipients

From /etc/crontab:

\*/10 * * * *  root /path-to-program/importMap.sh; /path-to-program/loadEmailMap.sh
Sun, 11/22/2009 - 21:35 (Reply to #12)
Dark Light

Thanks, that gave me a great idea, simply use the 'Cluster copy files' on the master server to copy the /etc/postfix/virtual file across to your child webmin server, then select the option to run this script after the copy completes:


#!/bin/bash
sed -e 's/\t.*/\tOK/g' -e '/#.*/d' /tmp/virtual | grep -v '^@' | grep '.*@.*' > /etc/postfix/relay_recipients

sed -e 's/\t.*//g' -e '/#.*/d' -e '/@/d' /tmp/virtual > /etc/postfix/relay_domains

rm -f /tmp/virtual

postmap hash:/etc/postfix/relay_domains
postmap hash:/etc/postfix/relay_recipients

Simples.

Sun, 01/03/2010 - 19:16
beat

We have similar config, and our secondary mailservers are now also listed on backsquater, because they accept mail for any user on the secondary domains, then send back mail that use doesn't exist, and it would be really good to have this properly solved in such a virtualmin config, that when email users get modified on main mail server, that this gets reflected and taken in account on secondary mail servers too.

Any hint ?

Topic locked