Postfix incoming Mail problem

[Joooop]

Hello,

there is a situation in one of my servers and I think it is not normal.
I'm running Plesk 11.0.9 (Update #58) on Cent-OS 5.8 x64. postfix version is 2.8.4-12052415
2 days ago I found that my smtp server is down. after a service restart every thing back normal, but just for few minute. (my smtp was working on the secondary port 587 with no delay or any error).

there is about 350 Open Incoming connection on port 25 and there is more than 300 files in "/var/spool/postfix/incoming/".
it seems that some one is opening a smtp connection to my server and leave it, postfix wait for it and after its timeout postfix close the connection. this cause postfix reach its maximum connection and nobody could send any email to my server.
I read lot about this on postfix forum, some one told that it might be because slow DNS server or slow networking. in my case both of them working properly.
at first step I increase my postfix maximum connection to 600 and now server is working, but the problem exist yet.
I checked my other servers on none of them I had same situation.

Is it normal? if no, what can I do for this?

 

[abdi]

Start by looking at the logs to find out who is doing such an act, then next is block the IP if found guilty in your firewall ...

CSF + LFD is a good firewall combination, it would detect such abuses and have them locked out of your server ...Also limiting the number of emails a user can send out per hour is a good practice in helping to control SPAM.

 

[Joooop]

Hello,
I checked incoming IP, they are different. so maybe It has another reason and solution.
but I really like to set per hour limit for my user. I had this option and CSF + LFD on my old Cpanel. but I tough these option are not available on plesk.
Please let me know if there is any way to use these on plesk.

 

[abdi]

Yes of-course, all of them available on Plesk too, but you have to install them manually and manage them through SHELL. For CSF + LFD installations:

cd /tmp/
rm -fv csf.tgz
wget http://www.configserver.com/free/csf.tgz
tar -xzf csf.tgz
cd csf
sh install.sh
sh /etc/csf/remove_apf_bfd.sh

You create a non priveledged user

/usr/sbin/useradd -r csf
/etc/csf/csftest.pl

Thereafter ensure iptables modules are loaded on server:

xt_connlimit, ipt_recent,ipt_REDIRECT

Configuration file is

/etc/csf/csf.conf

Much more info here:

http://www.configserver.com/free/csf/readme.txt

 

[Joooop]

Hello,
I installed CSF + LFD. but problem exist yet.
right now I have more than 600 incoming connection on port 25 and about 600 files in postfix incoming folder.
diffidently something is wrong!

 

[roadrash]

Perhaps you do not want to hear this: I use plesk since 2001 with Qmail.
Tried several times on Plesk with PostFix, because I love postfix (use it on our spamfiltering cluster).
But I removed it from the Plesk servers again
Simply it gave me too many problems if all different kinds.
My problems were solved after I switched (back) to Qmail. Easily done with the updater.

 

[Joooop]

Perhaps you do not want to hear this: I use plesk since 2001 with Qmail.
Tried several times on Plesk with PostFix, because I love postfix (use it on our spamfiltering cluster).
But I removed it from the Plesk servers again
Simply it gave me too many problems if all different kinds.
My problems were solved after I switched (back) to Qmail. Easily done with the updater.

postfix is a very powerfull mail server (I love it too) and getting back to qmail really is not an option
There must be a setting somewhere in postfix to drop connection if they did not sent any data during an interval. maybe reducing that help.. but I found nothing!

 

[Joooop]

Hello,
I solved the problem finally.
as I found, somewhere between my server and some other servers (not all the world) a router changed its MTU value. This change cause the connections to some other mail server be useless. these connection made ad wait to timeout and disconnect. mail servers retry to sent their mail and they made more connection. At the end of this cycle, I had lots of connection from different IP.
I changed my server network card MTU to 1400 and the problem completely solved!