Spam filter cuts off all mail

Question

Level 1

16 points

Spam filter cuts off all mail

Hi,

Well, I finally went live with our new ML server, and while it seems like everything is working OK, I'm seeing a lot of strange things in the logs. I'll ask about some of those in another thread.

Anyway, the real time zen spamhaus seems to be working fine.

But if I turn on the spam filter, it doesn't let ANY mail through, even on the lowest setting.

Can anybody help here? Thanks!

LOG: domain and emails altered.

Spam filter ON (mail gets through):

Oct 9 10:48:25 gpress.com postfix/postscreen[5042]: CONNECT from [192.168.1.100]:55143 to [173.164.166.18]:25

Oct 9 10:48:25 gpress.com postfix/postscreen[5042]: PASS OLD [192.168.1.100]:55143

Oct 9 10:48:25 gpress.com postfix/smtpd[5044]: connect from unknown[192.168.1.100]

Oct 9 10:48:25 gpress.com postfix/smtpd[5044]: sacl_check: mbr_user_name_to_uuid(scottr99@comcast.net) failed: No such file or directory

Oct 9 10:48:25 gpress.com postfix/smtpd[5044]: sacl_check: mbr_user_name_to_uuid(@comcast.net) failed: No such file or directory

Oct 9 10:48:25 gpress.com postfix/smtpd[5044]: D72F820F806: client=unknown[192.168.1.100], sasl_method=CRAM-MD5, sasl_username=scott

Oct 9 10:48:25 gpress.com postfix/cleanup[5057]: D72F820F806: message-id=<CE7AE4F5.85737%scott@gpress.com>

Oct 9 10:48:25 gpress.com postfix/qmgr[5058]: D72F820F806: from=<scott@gpress.com>, size=1168, nrcpt=1 (queue active)

Oct 9 10:48:25 gpress.com postfix/smtp[5059]: connect to 127.0.0.1[127.0.0.1]:10024: Connection refused

Oct 9 10:48:25 gpress.com postfix/smtp[5059]: D72F820F806: to=<scottr99@comcast.net>, relay=none, delay=0.09, delays=0.08/0.01/0/0, dsn=4.4.1, status=deferred (connect to 127.0.0.1[127.0.0.1]:10024: Connection refused)

Oct 9 10:48:28 gpress.com postfix/smtpd[5044]: disconnect from unknown[192.168.1.100]

Spam filter OFF (no mail):

Oct 9 10:52:57 gpress.com postfix/postscreen[5113]: CONNECT from [192.168.1.100]:55152 to [173.164.166.18]:25

Oct 9 10:52:57 gpress.com postfix/postscreen[5113]: PASS OLD [192.168.1.100]:55152

Oct 9 10:52:57 gpress.com postfix/smtpd[5157]: connect from unknown[192.168.1.100]

Oct 9 10:52:57 gpress.com postfix/smtpd[5157]: sacl_check: mbr_user_name_to_uuid(scottr99@comcast.net) failed: No such file or directory

Oct 9 10:52:57 gpress.com postfix/smtpd[5157]: sacl_check: mbr_user_name_to_uuid(@comcast.net) failed: No such file or directory

Oct 9 10:52:57 gpress.com postfix/smtpd[5157]: BBB5120F8AD: client=unknown[192.168.1.100], sasl_method=CRAM-MD5, sasl_username=scott

Oct 9 10:52:57 gpress.com postfix/cleanup[5121]: sacl_check: mbr_user_name_to_uuid(scottr99@comcast.net) failed: No such file or directory

Oct 9 10:52:57 gpress.com postfix/cleanup[5121]: sacl_check: mbr_user_name_to_uuid(@comcast.net) failed: No such file or directory

Oct 9 10:52:57 gpress.com postfix/cleanup[5121]: BBB5120F8AD: message-id=<CE7AE609.85738%scott@gpress.com>

Oct 9 10:52:57 gpress.com postfix/qmgr[5122]: BBB5120F8AD: from=<scott@gpress.com>, size=1168, nrcpt=1 (queue active)

Oct 9 10:52:57 gpress.com postfix/smtp[5255]: connect to mx1.comcast.net[2001:558:fe14:70::22]:25: No route to host

Oct 9 10:52:58 gpress.com postfix/smtp[5255]: BBB5120F8AD: to=<scottr99@comcast.net>, relay=mx2.comcast.net[76.96.40.147]:25, delay=1.2, delays=0.05/0.01/0.49/0.65, dsn=2.0.0, status=sent (250 2.0.0 b5sy1m0010Q8fjh0B5syx1 mail accepted for delivery)

Oct 9 10:52:58 gpress.com postfix/qmgr[5122]: BBB5120F8AD: removed

Oct 9 10:53:00 gpress.com postfix/smtpd[5157]: disconnect from unknown[192.168.1.100]

Mac mini, OS X Server

Posted on Oct 9, 2013 11:24 AM

Reply

Answer 1

Linc Davis

Level 10

209,535 points

Oct 9, 2013 7:32 PM in response to scottl31

You're more likely to find something of interest in /var/log/amavis.log. See also:

OS X Server (Mountain Lion): May be unable to receive mail after migrating

Reply

Answer 2

scottl31 Author

Level 1

16 points

Oct 9, 2013 7:46 PM in response to Linc Davis

I didn't migrate or go from a time machine bacck up. this was a new machine with everything already installed.

Also, I did find that amavis.log in that location.

any other tips?

Thanks,

Scott

Reply

Answer 3

scottl31 Author

Level 1

16 points

Oct 9, 2013 8:04 PM in response to scottl31

oops, meant to say I didn't see the amavis.log in that location.

Reply

Answer 4

Linc Davis

Level 10

209,535 points

Oct 9, 2013 10:06 PM in response to scottl31

Correction: /Library/Logs/Mail/amavis.log

Reply

Answer 5

scottl31 Author

Level 1

16 points

Oct 10, 2013 6:36 AM in response to Linc Davis

Hi Linc,

Do you have an idea what I need to look for? All the logs in there are for the last 2 days when the filter was only turned on momentarily to test it.

There's lots of interesting stuff in there, like this :

(!!)TROUBLE in pre_loop_hook: SECURITY PROBLEM, ABORTING at /Applications/Server.app/Contents/ServerRoot/usr/bin/amavisd line 11420.

And this:

(!!)FATAL: Directory of a config file "/Library/Server/Mail/Config/amavisd/amavisd.conf" is writable (confirmed), UID 83, EUID 83, EGID 83 83 12 61 403 405

Reply

Answer 6

Linc Davis

Level 10

209,535 points

Oct 10, 2013 9:01 AM in response to scottl31

(!!)FATAL: Directory of a config file "/Library/Server/Mail/Config/amavisd/amavisd.conf" is writable

$ ls -del /L*/S*/M*/C*/a*
drwxr-xr-x  3 root  wheel  102 Oct  9 22:04 /Library/Server/Mail/Config/amavisd

Reply

Answer 7

scottl31 Author

Level 1

16 points

Oct 10, 2013 9:28 AM in response to Linc Davis

Hi Linc,

Do I execute this in terminal all at once, or two separate lines to fix the whole problem?

Or is there other possible things that need attaention?

Thanks so much for your help and patience.

Scott

Reply

Answer 8

Linc Davis

Level 10

209,535 points

Oct 10, 2013 10:26 AM in response to scottl31

The first line (after the dollar sign) is a shell command. The second line is the output. Compare what you get.

Reply

Answer 9

scottl31 Author

Level 1

16 points

Oct 10, 2013 12:41 PM in response to Linc Davis

Linc,

Here's what I got, can you tell anything from this?

ls -del /L*/S*/M*/C*/a*

drwxrwxrwx 3 root wheel 102 Oct 9 20:31 /Library/Server/Mail/Config/amavisd

Reply

Answer 10

Linc Davis

Level 10

209,535 points

Oct 10, 2013 2:28 PM in response to scottl31

sudo chmod 755 /L*/S*/M*/C*/a*

That fixes one, but it wouldn't be surprising if you had a lot of other wrong permissions.

Reply

Answer 11

scottl31 Author

Level 1

16 points

Oct 10, 2013 3:02 PM in response to Linc Davis

That worked, I checked it again with your previous command.

Is there a way to fix them all at once, or is it a guessing game?

Thanks!

Reply

Answer 12

Linc Davis

Level 10

209,535 points

Oct 10, 2013 5:22 PM in response to scottl31

If it's working now, don't mess with it.

Reply

Answer 13

scottl31 Author

Level 1

16 points

Oct 10, 2013 6:12 PM in response to Linc Davis

What I meant by that was, your command worked to make the change that you were shoiwing me. I'll test to see if it fixed the problem.

Reply

Answer 14

scottl31 Author

Level 1

16 points

Oct 10, 2013 7:20 PM in response to Linc Davis

Hey Linc,

It looks like it IS working. I guess that did it.

Mail gets through now, but I'll tell everybody to pay special attention to make sure they get everything they expect. I have it set for cautious.

Thanks so much for your help with this fix!

One other thing on the subject. Now that it's on, is there a way to define what happens to the mail that gets snagged like we could in SL, or does it just get rejected? I can just hear my boss now complaining that it caught some special email he was expecting, with no way to find it.

Thanks again for all your help,

Scott

Reply

Answer 15

Linc Davis

Level 10

209,535 points

Oct 10, 2013 8:11 PM in response to scottl31

I don't know where the messages go. I don't use filtering. You'd have to find the documentation.

Reply