postfix email problem / 10027: Connection timed out

[bigfrog]

Hi, I use Plesk 10.1.1 on ubuntu 10.04.2 LTS 64Bit,
a strato dedicated server.

We have an email problem, emails from forms of the websites
on the servers don't go out, AND redirection does not work.

"Normal" mail from real-person accounts leave and come in fine,
but redirection does not work.

As I see my Plesk works with postfix 2.7.0-1
postqueue -p
[...]
-- 3383 Kbytes in 136 Requests.

The oldest entry in the queue is 3 days old, but I don't have a clue
what happened 3 days ago. We had the server working fine before.
rkhunter and ckrootkit proved the system to be OK.
Today I made the update from 10.0.1 to 10.1.1 because of this
email problem, but the update did not cure.

postqueue -f shows no effect neither service postfix restart

in the logs (/var/log/mail.info) I find the related messages:
...
May 1 21:20:35 h1884374 postfix/error[28212]: 979642BEA473: to=<[email protected]>, relay=none, delay=78662, delays=78640/22/0/0.42, dsn=4.4.1, status=deferred (delivery temporarily suspended: connect to 127.0.0.1[127.0.0.1]:10027: Connection timed out)
May 1 21:21:51 h1884374 postfix/error[28215]: 4A2CE170823B: to=<[email protected]>, relay=none, delay=0.06, delays=0.05/0/0/0, dsn=4.4.1, status=deferred (delivery temporarily suspended: connect to 127.0.0.1[127.0.0.1]:10027: Connection timed out)
May 1 21:21:51 h1884374 postfix/error[28241]: 4FDDD170823C: to=<[email protected]>, relay=none, delay=0.02, delays=0.01/0/0/0, dsn=4.4.1, status=deferred (delivery temporarily suspended: connect to 127.0.0.1[127.0.0.1]:10027: Connection timed out)
...
(the xy are from me, originally there are valid accounts from my system or outside.)

I have a look at master.cf:
...
127.0.0.1:10027 inet n n n - - spawn user=mhandlers-user argv=/usr/lib/plesk-9.0/postfix-queue 127.0.0.1 10026 before-remote
...

so I assume an issue with /usr/lib/plesk-9.0/postfix-queue !

/opt/psa/admin/sbin/mchk
==> Checking for: mail_spam_restore... ok
==> Checking for: mailsrv_conf_init... ok
==> Checking for: mail_mailbox_restore... ok
==> Checking for: mailsrv_entities_dump... ok
==> Checking for: mail_admin_aliases... ok
==> Checking for: mail_auth_dump... ok
==> Checking for: mailman_lists_dump... ok
==> Checking for: mail_responder_restore... ok
==> Checking for: mail_drweb_restore... not exists
==> Checking for: mail_kav8_restore... ok
==> Checking for: mail_spf_restore... ok
==> Checking for: mail_dk_restore... ok
==> Checking for: mail_grey_restore... ok


This issue becomes critical because the mails from the shops are business.

firewall permits from and to localhost

I hope someone has a hint for me.

David.

 

[bigfrog]

additional info

thought I'd post some more info

netstat -atnp
tcp 0 0 127.0.0.1:10025 0.0.0.0:* LISTEN 1647/master
tcp 0 0 127.0.0.1:10026 0.0.0.0:* LISTEN 1647/master
tcp 0 0 127.0.0.1:10027 0.0.0.0:* LISTEN 1647/master
tcp 0 0 0.0.0.0:25 0.0.0.0:* LISTEN 1647/master
tcp 0 0 0.0.0.0:465 0.0.0.0:* LISTEN 1647/master
[...]

ps axu | grep 10027
postfix 1665 0.0 0.0 39272 2172 ? S 22:05 0:00 pickup -l -t fifo -u -c -o content_filter=smtp:127.0.0.1:10027
postfix 5939 0.0 0.0 39268 2152 ? S 22:10 0:00 spawn -n 127.0.0.1:10025 -t inet user=mhandlers-user argv=/usr/lib/plesk-9.0/postfix-queue 127.0.0.1 10027 before-queue
postfix 5941 0.0 0.0 39268 2144 ? S 22:10 0:00 spawn -n 127.0.0.1:10027 -t inet user=mhandlers-user argv=/usr/lib/plesk-9.0/postfix-queue 127.0.0.1 10026 before-remote

 

[bigfrog]

ok, got the solution

In case somebody runs into the same problem, I found the error.
It was a problem in the firewall config, or in the way postfix connects
to that port 10027.

My iptables config reads like this:

...
/sbin/iptables -A INPUT -s 127.0.0.1 -j ACCEPT
...

by examining the logs a bit more intese I see packets
FROM <official_IP_Address> TO 127.0.0.1

This is a very strange behaviour from postfix but leads me to the solution
or better said to the workaround: Adding a line

/sbin/iptables -A INPUT -d 127.0.0.1 -j ACCEPT

to the firewall fixes the problem.

 

[LuZiFeR67]

I have the same problem.

Is it not possible to configure a firewall-rule in plesk for this ?

I've tried a rule with port 10027 incoming and outgoing from 127.0.0.1, but it does'nt work....

 

[bigfrog]

Hi,
it's better to see whats really happening with your firewall config. So do a
iptables -L -n -v

on the console to have a list of your rules, and especially the order of the rules. If you now add the localhost rule on top:
/sbin/iptables -I INPUT -s 127.0.0.1 -j ACCEPT
/sbin/iptables -I INPUT -d 127.0.0.1 -j ACCEPT

you can be sure that the rule will be triggered. Also have a look at your OUTPUT policy of iptables to be sure.

If the problem persists, it's not a firewall issue in this sense.

 

[LuZiFeR67]

Hi....thank you for the fast answer....

I have tried this, but same problem...

telnet 127.0.0.1 10027 brings still a timeout....

When i stop the firewall the access is no problem...

I've checked, that the changes are listed in iptables....

 

[bigfrog]

well then check the OUTPUT chain also and check with
iptables -L -n -v
if the rules got triggered