Resolved Email issues after migrating to Onyx Virtual Cloud

[pould]

Hi folks,

Yesterday I migrated a virtual server running Plesk 12.5 to a virtual cloud server running Onyx.

Everything has transferred over correctly (I've checked mail box sizes etc), I have repointed all the DNS records to the new IP address, but for almost 24 hours now I can't access my mail server. I've tried flipping through the different IMAP and SMTP servers to see if a "reinstall" sorts the issue but to no avail.

As far as I can tell, when you look at the hosted domain(s) they are pointing in the right place (peter-ould.net at the new IP of 77.68.13.126) but mail doesn't seem to want to talk.

Any ideas what to look at?

Thanks in advance for your help.

 

[UFHH01]

Hi pould,

first test - result:

peter-ould.net.    A    14400    77.68.13.126

but the reverse check of the IP "77.68.13.126" resolves to nowhere:

Nameserver rns.ui-dns.biz. reports: No such host 126.13.68.77.in-addr.arpa.

Second test - result:

looking up MX hosts on domain "peter-ould.net"
mx.peter-ould.net (preference:10)
mx.peter-ould.net (preference:20)

Trying TLS on mx.peter-ould.net[77.68.13.126] (10):
Cannot connect to server (reason: Connection timed out)

Trying TLS on mx.peter-ould.net[77.68.13.126] (20):
Cannot connect to server (reason: Connection timed out)

Third test - result: => http://viewdns.info/portscan/?host=peter-ould.net => only port 22, 80, 443 seem to be opened and reachable. Pls. consider to have a look at:

Which Ports Need To Be Opened for all Plesk Services to Work with a Firewall? ( KB - article 391 )​

In addition, pls. consider to investigate issues with the help of log - files, instead of "guessing":

but mail doesn't seem to want to talk.

... and pls. post the results of the service status from the depending services ( postfix/qmail - dovecot/imap-courrier )

Plesk for Linux services logs and configuration files ( KB - article: 111 283 )​

Pls. note as well, the massive issues with the IP/domain here: => http://mxtoolbox.com/domain/peter-ould.net/

 

[pould]

Thanks for getting back to me.

Assume I know very little and you need to explain things simply to me. What is the first thing that you want me to do to try to help you understand what is going on?

 

[pould]

So for example, you're pointing me to a KB article about which ports need to be open, but you're not giving me any advice on how to fix the problem. It might be obvious to you but it's not to me.

 

[pould]

And again, you write "but the reverse check of the IP "77.68.13.126" resolves to nowhere" but you don't give me any advice how to fix this.

 

[UFHH01]

Hi pould,

What is the first thing that you want me to do to try to help you understand what is going on?

Consider to follow resolutions in KB - articles and try to start reading some documentations. We can guide you with investigations to your root cause(s), but we don't administrate your server for you.

So for example, you're pointing me to a KB article about which ports need to be open, but you're not giving me any advice on how to fix the problem. It might be obvious to you but it's not to me.

Sorry, pould, but is there a reason, why you don't have a look at official Plesk documentations in the first place, instead of expecting "step-by-step - tutorials", to administrate your server? I really don't want to offend you, but when I saw that you registered 2008 for the Plesk forum, it was obvious not to have to point to the official documents. But o.k. ... here you go:

=> The Plesk Firewall (Linux) ( Plesk Onyx ( 17.0 ) - online documentation - Administrator's Guide )​

And again, you write "but the reverse check of the IP "77.68.13.126" resolves to nowhere" but you don't give me any advice how to fix this.

Pls. contact your ISP or server hosting provider ( => Fasthosts Internet Limited, United Kingdom, England, Gloucester ), to ask them how to reverse a rented/static IP. Unfortunately, there is no "one-rule-for-all" - solution, which makes it very difficult to guess, how you are able to reverse your rented/static IP from your ISP or your server hosting provider.

 

[pould]

The blacklisting of the domain for email will affect trying to use SMTP via my server, but this is not an issue at the moment for me since I use Google SMTP. I had no idea the issue was so bad and I will look at what I can do moving forward. The Virtual Cloud host is 1and1 and I will contact them about setting up reverse DNS.

So we're left with the ports issue. Well, I have the Firewall extension loaded and everything set to open (and Apache mod-security turned off) trying to solve this issue. Are you suggesting that I should explicitly open up ports on top of this?

You asked for a copy of the Courier log. Below are the last lines.

---------


Nov 29 15:13:06 localhost spamd[11513]: spamd: connection from localhost.localdomain [127.0.0.1]:52122 to port 783, fd 5
Nov 29 15:13:06 localhost spamd[11512]: prefork: child states: II
Nov 29 15:13:07 localhost dovecot: pop3-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, TLS, session=<ftuMBnJCQKx/AAAB>
Nov 29 15:13:07 localhost dovecot: pop3-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<JvaMBnJC0Jp/AAAB>
Nov 29 15:13:07 localhost dovecot: imap-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, TLS, session=<vvSNBnJClNF/AAAB>
Nov 29 15:13:07 localhost dovecot: imap-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<dg2OBnJC7sd/AAAB>
Nov 29 15:18:09 localhost spamd[11513]: spamd: connection from localhost.localdomain [127.0.0.1]:52306 to port 783, fd 5
Nov 29 15:18:09 localhost spamd[11512]: prefork: child states: II
Nov 29 15:18:10 localhost dovecot: pop3-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, TLS, session=<BI2hGHJC+Kx/AAAB>
Nov 29 15:18:10 localhost dovecot: pop3-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<DKahGHJCiJt/AAAB>
Nov 29 15:18:10 localhost dovecot: imap-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, TLS, session=<NqKiGHJCTNJ/AAAB>
Nov 29 15:18:10 localhost dovecot: imap-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<SbyiGHJCpsh/AAAB>
Nov 29 15:23:12 localhost spamd[11513]: spamd: connection from localhost.localdomain [127.0.0.1]:52466 to port 783, fd 5
Nov 29 15:23:12 localhost spamd[11512]: prefork: child states: II
Nov 29 15:23:13 localhost dovecot: pop3-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, TLS, session=<q42sKnJCmK1/AAAB>
Nov 29 15:23:13 localhost dovecot: pop3-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<mKmsKnJCKJx/AAAB>
Nov 29 15:23:13 localhost dovecot: imap-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, TLS, session=<76atKnJC7NJ/AAAB>
Nov 29 15:23:13 localhost dovecot: imap-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<tL+tKnJCRsl/AAAB>
Nov 29 15:28:15 localhost spamd[11513]: spamd: connection from localhost.localdomain [127.0.0.1]:52708 to port 783, fd 5
Nov 29 15:28:15 localhost spamd[11512]: prefork: child states: II
Nov 29 15:28:15 localhost dovecot: pop3-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, TLS, session=<T0S3PHJCiq5/AAAB>
Nov 29 15:28:15 localhost dovecot: pop3-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<mF63PHJCGp1/AAAB>
Nov 29 15:28:15 localhost dovecot: imap-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, TLS, session=<k124PHJC3tN/AAAB>
Nov 29 15:28:15 localhost dovecot: imap-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<y3W4PHJCOMp/AAAB>
Nov 29 15:33:18 localhost spamd[11513]: spamd: connection from localhost.localdomain [127.0.0.1]:52930 to port 783, fd 5
Nov 29 15:33:18 localhost spamd[11512]: prefork: child states: II
Nov 29 15:33:18 localhost dovecot: pop3-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, TLS, session=<owrCTnJCaK9/AAAB>
Nov 29 15:33:18 localhost dovecot: pop3-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<LCXCTnJC+J1/AAAB>
Nov 29 15:33:18 localhost dovecot: imap-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, TLS, session=<9h/DTnJCvNR/AAAB>
Nov 29 15:33:18 localhost dovecot: imap-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<CTjDTnJCFst/AAAB>
Nov 29 15:38:20 localhost spamd[11513]: spamd: connection from localhost.localdomain [127.0.0.1]:53306 to port 783, fd 5
Nov 29 15:38:20 localhost spamd[11512]: prefork: child states: II
Nov 29 15:38:21 localhost dovecot: pop3-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, TLS, session=<jdzMYHJC4LB/AAAB>
Nov 29 15:38:21 localhost dovecot: pop3-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<xPXMYHJCcJ9/AAAB>
Nov 29 15:38:21 localhost dovecot: imap-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, TLS, session=<3PHNYHJCNNZ/AAAB>
Nov 29 15:38:21 localhost dovecot: imap-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<dwrOYHJCjsx/AAAB>

 

[UFHH01]

Hi pould,

Well, I have the Firewall extension loaded and everything set to open

Pls. post the output of "iptables -L" and pls. be aware, that some operating systems or installation - images install a ( separate ) firewall by default, which might close all incoming/outgoing traffic by default. Due to the fact, that port 22, 80, 443 are opened and reachable during my tests for you, while other ports are closed, lead to the fact, that "someone" configured that.

For your provided log:
Could you at least try to send an eMail ( from an existing external account ) to an existing eMail - account on your server and as well try to send and eMail from an existing eMail - account on your server to an external eMail - account, so that your log - file might contain some entries with these tests? As you can see, there is no send/receive - action in your provided log.

 

[pould]

1&1 have helped me with the firewall issue. Thanks for your assistance.