Odd email behavor

General Discussion of atomic repo and development projects.

Ask for help here with anything else not covered by other forums.
Galactic Zero
Forum Regular
Forum Regular
Posts: 471
Joined: Mon Dec 06, 2004 10:43 pm

Odd email behavor

Unread post by Galactic Zero »

After updating PSA to 9.3 and reinstalling clamd spamsassin and qmail scanner I started to get blank emails to postmaster, no subject, no two line etc... Here is the header info:

Code: Select all

DomainKey-Status: bad format
Received: (qmail 368 invoked by uid 10067); 5 Apr 2010 10:07:33 -0500
Received: from  by gz.galacticzero.net (envelope-from <postmaster@gz.galacticzero.net>, uid 2021) with qmail-scanner-2.08st 
 (clamdscan: 0.95.3/10701. spamassassin: 3.2.5. perlscan: 2.08st.  
 Clear:RC:1(127.0.0.1):. 
 Processed in 0.356629 secs); 05 Apr 2010 15:07:33 -0000
Delivered-To: postmaster@gz.galacticzero.net
I deleted the postmaster account and am still getting this stuff every couple of minutes sometimes even 2 or 3 in the same minute. Any suggestions?
Franklyn Halamka
Still learning my way around Linux Security.
http://www.galacticzero.net
Kalimari
Forum Regular
Forum Regular
Posts: 526
Joined: Wed Jan 02, 2008 3:21 pm
Location: United Kingdom

Re: Odd email behavor

Unread post by Kalimari »

Take a look at /usr/local/psa/var/log/maillog for matching entries, there should be more info as to the cause.
Galactic Zero
Forum Regular
Forum Regular
Posts: 471
Joined: Mon Dec 06, 2004 10:43 pm

Re: Odd email behavor

Unread post by Galactic Zero »

Here is some of the tail of the maillog. The dir /var/qmail/alias is empty..

Code: Select all

Apr  6 10:43:11 gz qmail-local-handlers[10616]: from=postmaster@gz.galacticzero.net
Apr  6 10:43:11 gz qmail-local-handlers[10616]: to=postmaster@gz.galacticzero.net
Apr  6 10:43:11 gz qmail-local-handlers[10616]: mailbox: /var/qmail/alias
Apr  6 10:43:11 gz qmail-local-handlers[10616]: hook_dir = '/usr/local/psa/handlers/before-local'
Apr  6 10:43:11 gz qmail-local-handlers[10616]: recipient[3] = 'postmaster@gz.galacticzero.net'
Apr  6 10:43:11 gz qmail-local-handlers[10616]: handlers dir = '/usr/local/psa/handlers/before-local/recipient/postmaster@gz.galacticzero.net'
Apr  6 10:43:11 gz qmail-local-handlers[10616]: call_handlers: call executable = '/usr/local/psa/handlers/info/10-dd52-domainkeys-CKisRJ/executable'
Apr  6 10:43:11 gz qmail-local-handlers[10645]: call_handlers: PASS during call '/usr/local/psa/handlers/info/10-dd52-domainkeys-CKisRJ/executable' handler
Apr  6 10:43:11 gz qmail-local-handlers[10616]: handlers_stderr: Error occured during execv(): Permission denied.

Apr  6 10:43:11 gz qmail-local-handlers[10653]: Handlers Filter before-local for qmail started ...
Apr  6 10:43:11 gz qmail-local-handlers[10653]: from=postmaster@gz.galacticzero.net
Apr  6 10:43:11 gz qmail-local-handlers[10653]: to=franklyn@galacticzero.net
Apr  6 10:43:11 gz qmail-local-handlers[10653]: mailbox: /var/qmail/mailnames/galacticzero.net/franklyn
Apr  6 10:43:11 gz qmail-local-handlers[10653]: hook_dir = '/usr/local/psa/handlers/before-local'
Apr  6 10:43:11 gz qmail-local-handlers[10653]: recipient[3] = 'franklyn@galacticzero.net'
Apr  6 10:43:11 gz qmail-local-handlers[10653]: handlers dir = '/usr/local/psa/handlers/before-local/recipient/franklyn@galacticzero.net'
Apr  6 10:43:11 gz qmail-local-handlers[10653]: call_handlers: call executable = '/usr/local/psa/handlers/info/10-dd52-domainkeys-CKisRJ/executable'
Apr  6 10:43:11 gz qmail-local-handlers[10653]: handlers_stderr: PASS
Apr  6 10:43:11 gz qmail-local-handlers[10653]: call_handlers: PASS during call '/usr/local/psa/handlers/info/10-dd52-domainkeys-CKisRJ/executable' handler
Apr  6 10:43:11 gz qmail-local-handlers[10638]: Handlers Filter before-local for qmail started ...
Apr  6 10:43:11 gz qmail-local-handlers[10638]: from=postmaster@gz.galacticzero.net
Apr  6 10:43:11 gz qmail-local-handlers[10638]: to=postmaster@gz.galacticzero.net
Apr  6 10:43:11 gz qmail-local-handlers[10638]: mailbox: /var/qmail/alias
Apr  6 10:43:11 gz qmail-local-handlers[10638]: hook_dir = '/usr/local/psa/handlers/before-local'
Apr  6 10:43:11 gz qmail-local-handlers[10638]: recipient[3] = 'postmaster@gz.galacticzero.net'
Apr  6 10:43:11 gz qmail-local-handlers[10638]: handlers dir = '/usr/local/psa/handlers/before-local/recipient/postmaster@gz.galacticzero.net'
Apr  6 10:43:11 gz qmail-local-handlers[10638]: call_handlers: call executable = '/usr/local/psa/handlers/info/10-dd52-domainkeys-CKisRJ/executable'
Apr  6 10:43:11 gz qmail-local-handlers[10657]: call_handlers: PASS during call '/usr/local/psa/handlers/info/10-dd52-domainkeys-CKisRJ/executable' handler
Apr  6 10:43:11 gz qmail-local-handlers[10638]: handlers_stderr: Error occured during execv(): Permission denied.
Franklyn Halamka
Still learning my way around Linux Security.
http://www.galacticzero.net
BruceLee
Forum Regular
Forum Regular
Posts: 879
Joined: Sat Mar 28, 2009 6:58 pm
Location: Germany

Re: Odd email behavor

Unread post by BruceLee »

did you try the solutions posted here:
http://forum.parallels.com/showthread.php?t=97651
Kalimari
Forum Regular
Forum Regular
Posts: 526
Joined: Wed Jan 02, 2008 3:21 pm
Location: United Kingdom

Re: Odd email behavor

Unread post by Kalimari »

This is the solution which eventually fixed it for 9.3: http://forum.parallels.com/showpost.php ... stcount=51

Uninstalled qmail-scanner, patched the system with the relevant update in this bundle: http://download1.sw-soft.com/Plesk/Hotf ... te.tar.bz2, reinstalled qmail-scanner and all fine since.

Is you update with qmail-scanner in place, bruen suggested
breun wrote:If you're using qmail-scanner make sure you replace /var/qmail/bin/qmail-queue.orig with the patched version (and match that file's ownership and permissions) instead of /var/qmail/bin/qmail-queue.
Back up original qmail-queue (retain/note ownership and permissions) & qmail-scanner config first

Good luck
Galactic Zero
Forum Regular
Forum Regular
Posts: 471
Joined: Mon Dec 06, 2004 10:43 pm

Re: Odd email behavor

Unread post by Galactic Zero »

Ok, uninstalled qmail-scanner, patched qmail-queue and reinstalled scanner.
Still getting blank emails however it appears to have slowed down atm. Mails sent inter domain are taking a long time to come in and It shows I sent the mail at 12:52am and received it at 12:34am...

Here is the header of that email:

Code: Select all

DomainKey-Status: no signature
Received: (qmail 3701 invoked by uid 10067); 8 Apr 2010 00:34:12 -0500
Received: from tx-67-232-100-218.dhcp.embarqhsd.net by gz.galacticzero.net (envelope-from <franklyn@galacticzero.net>, uid 2020) with qmail-scanner-2.08st 
 (clamdscan: 0.95.3/10716. spamassassin: 3.2.5. perlscan: 2.08st.  
 Clear:RC:1(67.232.100.218):. 
 Processed in 0.15289 secs); 08 Apr 2010 05:34:12 -0000
Received: from tx-67-232-100-218.dhcp.embarqhsd.net (HELO GalacticBase) (67.232.100.218)
  by gz.galacticzero.net with SMTP; 8 Apr 2010 00:34:12 -0500
From: "Franklyn Halamka" <franklyn@galacticzero.net>
To: "'Franklyn Halamka'" <franklyn@galacticzero.net>
Cc: <galacticzero@gmail.com>
Subject: 4th test of in and out mail.
Date: Thu, 8 Apr 2010 00:52:20 -0500
Message-ID: <505601cad6df$a95fcf40$fc1f6dc0$@net>
MIME-Version: 1.0
Content-Type: multipart/mixed;
	boundary="----=_NextPart_000_5057_01CAD6B5.C089C740"
X-Mailer: Microsoft Office Outlook 12.0
Thread-Index: AcrW36cVGREzUsYSRhGMnT2mTXgTNA==
Content-Language: en-us
X-MS-TNEF-Correlator: 000000004BB43872B1DF8F428CC9272BD0BB80E9C45CA200

Any clues?

And on a side note, which is better? postfix or qmail? Now that ART has a scanner for postfix is it better to change?
Franklyn Halamka
Still learning my way around Linux Security.
http://www.galacticzero.net
Kalimari
Forum Regular
Forum Regular
Posts: 526
Joined: Wed Jan 02, 2008 3:21 pm
Location: United Kingdom

Re: Odd email behavor

Unread post by Kalimari »

Decided to switch over to Postfix after similar issues. However, Plesk->Postfix has its own problems with some message w/attachments undeliverable and endlessly looping, never got to the bottom of it. So late one evening, thought I'd give the Qmail patch another go... and it worked! Now, I suspect the switch to postfix then back, patching qmail, then installing qmail-scanner did something different, I originally patched over an existing qmail-scanner install, hence my suggestion. Unfortunately, didn't write notes of the exact process, so cannot provide step-by-step guide, but followed notes on Atomic and Parallels forums. As far as I remember all I did was to ensure the existing qmail-queue binary was backed up (cp with -p flag to retain permissions/ownership) and made sure the patched qmail-queue used the same before qmail-scanner was installed and let it run for a while to be sure (added zen.spamhaus to Plesk's blacklisting to keep spam to a minimum while I checked the system and sent test messages). Then added qs to the mix via yum in the usual way.

As to blank messages still bouncing about, did you clear the qmail queue before patching?

Code: Select all

/usr/local/psa/admin/sbin/mailmng --stop-smtpd
ps -ef | grep qmail-queue
kill -ALRM `pidof qmail-queue`
Check permissions/ownership (these are mine):

Code: Select all

ls -lah /var/qmail/bin/qmail-queue*
-r-xr-sr-x 1 mhandlers-user popuser 6.5K Mar 26 01:58 /var/qmail/bin/qmail-queue
-rwsr-xr-x 1 qmailq         qmail    71K Mar 26 01:33 /var/qmail/bin/qmail-queue.bak
-r-s--x--x 1 qmailq         qmail    21K Dec 30 00:07 /var/qmail/bin/qmail-queue.moved
-rwsr-xr-x 1 qmailq         qmail   175K Mar 26 01:51 /var/qmail/bin/qmail-queue.orig
-rwsr-xr-x 1 qmailq         qmail   175K Mar 26 01:51 /var/qmail/bin/qmail-queue.orig.bak
-r-xr-sr-x 1 mhandlers-user popuser 175K Jan 21 08:25 /var/qmail/bin/qmail-queue.update

stat /var/qmail/bin/qmail-queue
  File: `/var/qmail/bin/qmail-queue'
  Size: 6653      	Blocks: 16         IO Block: 4096   regular file
Device: 803h/2051d	Inode: 34178619    Links: 1
Access: (2555/-r-xr-sr-x)  Uid: (   30/mhandlers-user)   Gid: (   31/ popuser)
Access: 2010-04-08 07:12:40.000000000 +0100
Modify: 2010-03-26 01:58:56.000000000 +0000
Change: 2010-03-26 01:58:56.000000000 +0000
Hope that helps...

Not sure why you have a date/time discrepancy and slow delivery, maybe unrelated?
Galactic Zero
Forum Regular
Forum Regular
Posts: 471
Joined: Mon Dec 06, 2004 10:43 pm

Re: Odd email behavor

Unread post by Galactic Zero »

Another symptom I have is this. When I restart qmail it fails to start if clamd is running. Stop clamd then start qmail and restart clamd works. Not sure why qmail is failing with clamd running.

Any ideas?

Kalimari, I have the same permission as you, the only thing I didn't do was clear the queue. From 12:30 to 7:20 I have 320 blamk emails, all sent to postmaster and that alias / mail account is non-existant.

One thing I did was remove qmail-scanner clamd and spamassassin the I did UvH Force psa-qmail and then backed up the orig. queue and copied the patched file and set the correct permissions / ownership, restarted qmail and reinstalled qs / clamd / and spamassassin.
Franklyn Halamka
Still learning my way around Linux Security.
http://www.galacticzero.net
Galactic Zero
Forum Regular
Forum Regular
Posts: 471
Joined: Mon Dec 06, 2004 10:43 pm

Re: Odd email behavor

Unread post by Galactic Zero »

Sent test mail to internal and external email addies...
To external mail sent time is 7:47am recv. Time is 8:13am...
To internal mail sent time is 7:48am recv. Time is 7:30am

Ok, something is definitely off here..
SPECS:
PSA 9.3.0 with patched qmail-queue and current versions of clamd/spamassassin/qmail-scanner.

If I had any hair I'd be pulling it about now...
Franklyn Halamka
Still learning my way around Linux Security.
http://www.galacticzero.net
scott
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 8355
Joined: Wed Dec 31, 1969 8:00 pm
Location: earth
Contact:

Re: Odd email behavor

Unread post by scott »

huh, so if clamd is running you cant restart qmail at all? Does it just hang, or does it exit immediately with an error?
Galactic Zero
Forum Regular
Forum Regular
Posts: 471
Joined: Mon Dec 06, 2004 10:43 pm

Re: Odd email behavor

Unread post by Galactic Zero »

Which log would show errors? Here is what happens:

[root@gz ~]# service qmail restart
Stopping : Starting qmail: [FAILED]
[root@gz ~]# ps aux |grep clamd
root 20835 0.0 0.0 3924 660 pts/0 R+ 09:04 0:00 grep clamd
qscand 28714 75.2 8.2 222636 170088 ? Ssl 07:20 77:37 clamd
[root@gz ~]# service clamd stop
Stopping Clam AntiVirus Daemon: [ OK ]
[root@gz ~]# service qmail start
Starting qmail: [ OK ]
[root@gz ~]# service clamd start
Starting Clam AntiVirus Daemon: LibClamAV Warning: ***********************************************************
LibClamAV Warning: *** This version of the ClamAV engine is outdated. ***
LibClamAV Warning: *** DON'T PANIC! Read http://www.clamav.net/support/faq ***
LibClamAV Warning: ***********************************************************
[ OK ]
Franklyn Halamka
Still learning my way around Linux Security.
http://www.galacticzero.net
Kalimari
Forum Regular
Forum Regular
Posts: 526
Joined: Wed Jan 02, 2008 3:21 pm
Location: United Kingdom

Re: Odd email behavor

Unread post by Kalimari »

Galactic Zero, what you are experiencing is exactly what made me shift over to Postfix (other than the time issue, cannot see how that is related? but cannot rule it out).

here's a thought... maybe (just maybe) it is worth switching MTA to postfix (clear queue first), follow the guide here: http://www.atomicorp.com/forum/viewtopi ... 3&start=15 - it retains all accounts/mailboxes etc - then switch back to qmail, I looked through my .bash_history for the commands used:

Code: Select all

cd ~
wget http://download1.sw-soft.com/Plesk/Hotfix/PleskUnix/9.3.0/32111/update.tar.bz2
tar jxvf update.tar.bz2
/usr/local/psa/admin/sbin/mailmng --stop-smtpd
postfix -f
/usr/local/psa/admin/sbin/autoinstaller --select-release-current --install-component qmail
cp -p /var/qmail/bin/qmail-queue /var/qmail/bin/qmail-queue.bak
cp ~/update/dist-rpm-RedHat-el5-x86_64/qmail-queue /var/qmail/bin/qmail-queue (ensure you pick the version specific to your system)
chown mhandlers-user.popuser /var/qmail/bin/qmail-queue
chmod 2555 /var/qmail/bin/qmail-queue
yum install qmail-scanner
vi /etc/qmail-scanner.ini
qmail-scanner-reconfigure
/etc/init.d/xinetd restart
Hope it helps...
Galactic Zero
Forum Regular
Forum Regular
Posts: 471
Joined: Mon Dec 06, 2004 10:43 pm

Re: Odd email behavor

Unread post by Galactic Zero »

Trying the switch to postfix from qmail and back and during the install of postfix I get this:

Main components list for Parallels Plesk Panel
===============================================================================

2 of 44 components selected

Please select the components of Parallels Plesk Panel you want to install:

1. * Base packages of Plesk
2. [=] Plesk Updater
3. [=] PHP5 support
4. [=] PostgreSQL server support
5. [=] Application vault packages
6. [ ] Plesk Professional Web Site Editor
7. [=] Plesk API [former Plesk Agent]
8. [=] Plesk migration manager
9. [ ] SiteBuilder publishing support for Plesk
10. [ ] SiteBuilder module migration suite
11. [=] ColdFusion support for Plesk
12. [=] MIVA Empresa support
13. [=] Plesk billing
14. [.] <+> Plesk hosting features // 4 of 5 components selected

Different mailservers
15. (=) Qmail mailserver
16. (*) Postfix mailserver

17. [.] <+> Additional Plesk modules // 4 of 5 components selected
18. [ ] <+> Game servers // 0 of 3 components selected
19. [.] <+> Addition mail services // 1 of 4 components selected
20. [.] <+> Server backup solutions // 1 of 2 components selected
21. [.] <+> Additional language packs // 1 of 9 components selected
22. [=] <+> Plesk webmails support // 2 of 2 components selected

N) Next page; P) Go back; Q) Cancel installing;
A) Select all; D) Deselect all;
Enter number to toggle the component or to overview the group;
Type a number or a character of desired action [N]: n
Retrieving information about the installed packages...
Downloading the file PSA_9.3.0/update-rpm-CentOS-5-i386/update-9.3.0-cos5-i386.hdr.gz: 10%..20%..30%..40%..50%..60%..70%..80%..90%..100% done.
Downloading the file PSA_9.3.0/dist-rpm-CentOS-5-i386/build-9.3.0-cos5-i386.hdr.gz: 10%..20%..30%..40%..50%..60%..70%..80%..90%..100% done.
Downloading the file PSA_9.3.0/thirdparty-rpm-CentOS-5-i386/thirdparty-9.3.0-cos5-i386.hdr.gz: 11%..20%..31%..40%..52%..61%..70%..82%..91%..100% done.
Determining the packages that need to be installed.
ERROR: Unable to install the "psa-mail-pc-driver-1.0.0-cos5.build93091230.07.i586" package.
Not all packages were installed.
Please, contact product technical support.


Any clues on how to fix?
Thanks
Franklyn Halamka
Still learning my way around Linux Security.
http://www.galacticzero.net
Galactic Zero
Forum Regular
Forum Regular
Posts: 471
Joined: Mon Dec 06, 2004 10:43 pm

Re: Odd email behavor

Unread post by Galactic Zero »

OK!!! Finally got this fixed. After my above post I decided to use the CP to update plesk. Well, it showed that there were base packages available for update so... I click on it and clicked install.

3 Patches were installed:
nstalling patches...
Downloading the file PSA_9.3.0/microupdates/MU1/dist-rpm-CentOS-5-i386/qmail-queue:
Downloading the file PSA_9.3.0/microupdates/MU1/dist-rpm-CentOS-5-i386/qmail-remote:
Downloading the file PSA_9.3.0/microupdates/MU2/dist-rpm-CentOS-5-i386/sw-cp-serverd:

As a side note I'd uninstalled qmail-scanner before attempting to switch to postfix.. Anyway after the update completed I installed qmail-scanner, restarted clamd and spamassassin, reconfigured the qmail-scanner.ini restarted smtpd (stopped it before the attempted install of postfix.) and then ran reconfigure.

Tested email, sent out and back in the blink of an eye. Seems the blank email issue has gone away. The issue of qmail failing to restart if clamd was running is also fixed.

So, all in all, a very good Friday Night.... Thanks all for you help.
Franklyn Halamka
Still learning my way around Linux Security.
http://www.galacticzero.net
Kalimari
Forum Regular
Forum Regular
Posts: 526
Joined: Wed Jan 02, 2008 3:21 pm
Location: United Kingdom

Re: Odd email behavor

Unread post by Kalimari »

Great news. Glad it is all working for you.
Post Reply