Postfix and 9.5.1: Sending not possible / delayed when Greylisting switched on

[openairhoster2]

Sorry, I found postfix-queue myself. It is in
dist-deb-Debian-5.0-x86_64/opt/maildrivers/psa-mail-pc-driver_1.0.0-debian5.0.build92091210.11_amd64.deb
(and then unpack dist-deb-Debian-5.0-x86_64/opt/maildrivers# l psa-mail-pc-driver_1.0.0-debian5.0.build92091210.11_amd64.deb with dpkg -x , and then in /subdir usr/lib/plesk-9.0

 

[karesmakro]

This helps only for greylisting problem!
You can find this file in

<dist_folder>/dist-deb-folder/opt/maildrivers/psa-mail-pc-driver_<dist>.deb/CONTENTS/usr/lib/plesk-9.0/

Please make a backup of your existing postfix-queue file!
after you replaced the file, you should run following commands:

chown mhandlers-user:popuser /usr/lib/plesk-9.0/postfix-queue
chmod 550 /usr/lib/plesk-9.0/postfix-queue

 

[openairhoster2]

OK, switching to postfix-queue from 9.2.3 as proposed by karesmakro helped my greylisting problem, too.
I hardly dare to say this, because I don't know what old problems 9.2.3 postfix-queue will give me back, and there is even less incentive for Parallels now to do something about the bug in 9.5.1. Well, since they couldn't care less anyway, it doesn't make a difference ;-)

 

[MeikR]

Hi @ll,

I have the same problem (sending not possible, internal greylisting procedure for pop users) after installing the hotfix postfix-queue.
Oly the queue file write error was gone, but I got the more worst error now.

The server is: Debian Lenny 64bit with 9.3 Plesk.

After replacing the fixed 9.5.1 postfix-queue with the 9.3 postfix-queue, sending mails is ok, but I have again the old queue file write errors.

@karesmakro & openairhoster2:

The path of the queue file depends on your system. Check out the link:
http://kb.odin.com/en/5794

@Igor: I am looking forward for a new hotfix postfix-queue file, that prevents the queue file write errors and which let the users send mail without greylisting procedure in pop accounts. Please update this thread directly if a solution is found.

EDIT:
I also tried the 9.2.3 queue file. Until now, everything works fine (on the surface)... No que file write errors and mails can be send) Hopefully we got not other problems with this.

EDIT: 04.05.2010:
I have still some queue file write errors, but much much less.

 

[BoiseComputer]

Greylisting

To fix my error with the greylisting I went with another program to do my greylisting. One benefit of my workaround is that I can have an auto-whitelist to the greylist. If I receive 10 e-mails from a person in 30 days that are successful it whitelists that server so they don't have delay.

 

[MeikR]

Hi,

after 3 days of watching the behavior of the postfix-queue file 9.2.3 I have still queue file errors. Every few minutes I get a mail with these error, because the sending server try again and again... So this is not a solution for me and I hope that there will be soon a fixed postfix-queue 9.5.1 which has no internal "sending error" if greylisting is turned on.

@IgorG: This "bug" has nothing to do with error messages or debug infos from us. The devolepers must know what to do, because this behavior is no real bug, it is a error in implement the greylisting features. In all versions before it was right, so why this part cannot be coded back to 9.3 where it was ok? Only the queue file bug has to be removed, or do they found the bug "queue write error" in the part of greylisting behavior?

@BoiseComputer:
What 3rd party greylisting do you use? Is there a good documentation in integrate this in plesk?

Can the error of "sending not possible" be avoid, if greylisting is turned off? And how to switch off greylisting systemwide?

 

[BoiseComputer]

Postgrey for Postfix

Disable built in Plesk greylisting:

/usr/local/psa/bin/grey_listing --update-server -status off

Install Postgrey Package:
Debian based:

apt-get install postgrey

Redhat based:

yum install postgrey

Change Postgrey configuration:

nano /etc/rc.d/init.d/postgrey

change:
OPTIONS="--unix=$SOCKET"
to:

OPTIONS="--unix=$SOCKET --inet=127.0.0.1:60000 --delay=29"

or

OPTIONS="--unix=$SOCKET --inet=127.0.0.1:60000 --delay=29 --max-age=20 --auto-whitelist-clients=10"

The auto-whitelist will remove the delay for clients that have sent 10 successful e-mails in the last 20 days.

service postgrey restart

netstat -lpn | grep 60000

Open Postfix configuration file:

nano /etc/postfix/main.cf

Add "policy_time_limit = 3600" to end of configuration file.

policy_time_limit = 3600

Add "check_policy_service inet:127.0.0.1:60000" to configuration:

"check_policy_service inet:127.0.0.1:60000" should be added to smtpd_recipient_restrictions line.

Line should resemble

smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, check_policy_service inet:127.0.0.1:60000, reject_unauth_destination

Restart Postfix

service postfix restart

Check your logfiles for errors:

tail -f /usr/local/psa/var/log/maillog

 

[karesmakro]

@BoiseComputer nice howto!
But you should also set

policy_time_limit = 3600

in main.cf, because default 1000 seconds are to short for greylisting.
in master.cf there should be disabled the proxy_filter:127.0.0.1:10025, to prevent double greylisting

smtp    inet    n       -       -       -       -       smtpd -o smtpd_proxy_filter=

But I would prefer Policyd v2 http://www.policyd.org/tiki-index.php?page=homepage
because there is a really better handling of e.g. whitelisted ip-addresses, create exceptions for domains or mail addresses ....

 

[BoiseComputer]

I will change that setting. As far as double greylisting I already disabled grey listing server wide. I will add the command to disable Plesk greylisting and your code to my steps. Thank you for the feedback.

 

[xaex]

update to 9.5.2..???

 

[BoiseComputer]

Change Log

Doesn't seem to mention any of our problems.

Parallels Plesk Panel 9.5.2
[-] Migrating Java applications fails bug is fixed.
[-] In some cases after upgrade, the old version of Horde remains registered in Plesk when actually Horde was successfully upgraded bug is fixed.
[-] Impossible to change mail account password from Horde webmail interface bug is fixed.
[-] After upgrade, Horde stops accepting short usernames (without the "@doman" part) bug is fixed.
[-] After upgrade, Horde Kronolith calendar works with errors and fails to create events bug is fixed.
[-] After upgrade, mobile browsers return the Not Found error when trying to access Horde webmail bug is fixed.
[-] Browser returns error when trying to access an Address Book on Horde webmail after upgrade bug is fixed.
[-] When migrating to CentOS 5 under Parallels Virtuozzo Containers, Migration Manager returns "internal server error" upon migration of some mail accounts, while the accounts seem to be migrated properly bug is fixed.
[-] Migration Manager reports that dump validation failed due to invalid value of the "enabled" attribute of mail redirects for some mail accounts where mail redirection is set up but disabled bug is fixed.
[-] When upgrading from Plesk versions earlier than 8.6, serial number of DNS zone was set to "0" bug is fixed.
[-] After migration from Plesk versions earlier than 8.6, site applications are not shown in the Panel if the APS package release on target host differs from that on the source while the app version is the same bug is fixed.
[-] After upgrade, installation of site applications fails on domains where files/folders permissions were set to wrong values bug is fixed.

 

[openairhoster2]

I'd give it a try, but I don't see where I can download 9.5.2 ??
Igor, can you comment on whether this bug has been fixed in 9.5.2?

 

[agarzon]

I have the same problem.

SMTP: Postfix
SPF: Enable
DomainKeys: Enable
Greylisting: Enable

Webmail: atmail (fixed because atmail default of plesk is a **** and still with out fix smtphost in Config.php)

Error when try to send:

Message rejected by SMTP server. Check message content and attachments\nServer Responded: SMTP Server rejected email. Returned:451 mail server temporary failed

Solution:

Change Horde? no thanks... always fails.
Return to Qmail
Disable SPF
Disable Greylist
Domainkeys is the only thing that does not hurt ... but does not work anyway

Wow, now work like a charm !... because PLESK ALWAYS RELEASE BAD UPDATES ! (I use Plesk since 6 years ago, and never... never... never I made a upgrade without problems.

 

[openairhoster2]

Hello? Any update on this thread? The problem has been around for more than one month now.

 

[JarekG]

I faced with this problem this morning. Temporarily I disabled greylisting on port 587 and kept it on port 25.

Any updates parallels team ? Please ?

 

[openairhoster2]

Damned! Would you care to answer?

Plesk: Why aren't you answering? What is this?

 

[IgorG]

http://kb.odin.com/en/8608

 

[JarekG]

In my opinion...

Permissions on existing file:
-rwxr-sr-x 1 root postdrop 177032 Aug 14 2008 /usr/sbin/postqueue

From your FAQ 2555 gives:
-r-xr-xr-x 1 root postdrop 152763 Jun 21 05:00 postfix-queue

Correct permissions should be 3755:
-rwxr-sr-x 1 root postdrop 152763 Jun 21 05:00 postfix-queue

Regards,
Jarek

 

[JarekG]

The other thing is.. I have got a strange feeling that it doesn't work for me at all... I'm still getting the same error after applying this patch.

 

[JarekG]

OK. I think postfix-queue file from the hotfix should be copied to:

/usr/lib/plesk-9.0/postfix-queue

Not as in your knowledge base as:

/usr/sbin/postqueue

This seems to solve the problem but I still cannot believe it took me few hours to sort this out where Parallels is remaining silent.

Very poor service. Nothing else I could say.

P.S. New post in thread notification seems to stopped working.