Lots of not known domains in the Queue Administration

[stuasch]

Hey all, i have been running proxmox for quite a bit now, but recently i noticed a massive load of unknown domains in my spamfilter list (domains that i do not use to deliver mail to). Also when that happens i see mail not being send (looks like some kind of spam attack) and when this happens i also get this when sending email

delivery temporarily suspended: connect to
127.0.0.1[127.0.0.1]:10024: Connection refused

the box has 8gb of ram and 4 cores. So i would expect this to be able to handle some load, what worries me is the big list of unknown domains in the queue administration.

If you need any more info let me know.

 

[Stoiko Ivanov]

is pmg-smtp-filter running?

 

[stuasch]

hi thanks for the reply, yes it is just checked it.

 

[stuasch]

something tells me its trying to deliver mails to domains outside of the delivery list, how and where can i check that this is blocked (i know its not an open relay) as i have tested this.

 

[Stoiko Ivanov]

127.0.0.1[127.0.0.1]:10024: Connection refused

would indicate that nothing is listening on port 10024 on localhost - this is normally where pmg-smtp-filter is listening for mails from the external port.

I would try to restart pmg-smtp-filter

- else check the complete journal for hints: `journalctl -r`
- also check if and what is listening on port 10024 on the pmg: `ss -tlnp |grep 10024`

I hope this helps!

 

[stuasch]

hey there soiko thanks for the reply, well its only temporary that it does that it seems...seems like the process dies if it gets flooded with spam.
Also do you have any idea about the massive ammount of emails that appear in the queue?

 

[Stoiko Ivanov]

well its only temporary that it does that it seems...seems like the process dies if it gets flooded with spam.

hmm - haven't seen this here during our load-tests - could you please post the journal (the part where the process dies/exits/crashes) - could help to find an issue if there is one.

Also do you have any idea about the massive ammount of emails that appear in the queue?

depends on the mails - but for all those that got sent while pmg-smtp-filter is down - they are queued on PMG - and will get delivered once pmg-smtp-filter runs again

you can flush the queue to get the mails delivered:
`postqueue -f`

I hope this helps

 

[stuasch]

hi there the issues keep happening, the mails dont go in and the connection refused on port 10024 and 10022 keep happening. this is starting to get a thing. What info do i need to give you so we can debug this?

 

[Stoiko Ivanov]

The anonymized journal for the timeframe where the problems occur (one hour before the connection refused shows up and 10 minutes afterwards should be enough)
* `journalctl --since '2020-02-19 00:05:00' --until '2020-02-19 01:05:00' ` (is an example you of course need to adapt the timeframe)
you need to redact/anonymize all information, which you do not want to post publicly (or send it to me via e-mail (it's on my profile-page))

 

[stuasch]

the journalctl seems to have made a new one since i had to reboot the spamfilter again, is the syslog file sufficient too?
This morning there where a massive load of mails in the queue again (legit ones) and when i checked it said again connection refused to port 10024. I also upgraded to the latest version of proxmox mail gateway yesterday as i was hoping it would fix this.

 

[Stoiko Ivanov]

the journalctl seems to have made a new one since i had to reboot the spamfilter again, is the syslog file sufficient too?

should work out!
please also include the output of `dmesg` (before rebooting

the journalctl seems to have made a new one since i had to reboot the spamfilter again

consider enabling persistent journalling - see https://www.freedesktop.org/software/systemd/man/journald.conf.html
(usually `mkdir /var/log/journal ; systemctl restart systemd-journald` is enough for this)