Postfix unable to receive mail

Rudy · 06-26-2010, 05:04 PM

The subject says it all.

I am using postfix in conjunction with the ispCP Control Panel.

Here's some of the recent entries in maillog, when I try to send an email from my gmail address to an email address on this server (I underlined the email addresses).

Code:

2010-06-26T17:57:43.581654-04:00 li136-183 postfix/smtpd[30721]: fatal: No server certs available. TLS can't be enabled
2010-06-26T17:57:43.838633-04:00 li136-183 postfix/smtpd[30710]: warning: connect to 127.0.0.1:12525: Connection refused
2010-06-26T17:57:43.838677-04:00 li136-183 postfix/smtpd[30710]: warning: problem talking to server 127.0.0.1:12525: Connection refused
2010-06-26T17:57:43.838690-04:00 li136-183 postfix/smtpd[30710]: NOQUEUE: reject: RCPT from mail-pz0-f43.google.com[209.85.210.43]: 451 4.3.5 Server configuration problem; from=<emailaddressremoved@gmail.com> to=<emailaddressremoved@cancertips.org> proto=ESMTP helo=<mail-pz0-f43.google.com>
2010-06-26T17:57:43.928050-04:00 li136-183 postfix/smtpd[30710]: disconnect from mail-pz0-f43.google.com[209.85.210.43]
2010-06-26T17:57:44.583042-04:00 li136-183 postfix/master[29065]: warning: process /usr/libexec/postfix/smtpd pid 30721 exit status 1

Here's the results of postconf -n:

My hostname, as you can see, is myers.smoothstoneservices.com

Code:

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_at_myorigin = yes
append_dot_mydomain = no
biff = no
broken_sasl_auth_clients = yes
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/libexec/postfix
inet_interfaces = all
local_destination_recipient_limit = 1
local_recipient_maps = unix:passwd.byname $alias_database
local_transport = local
mail_spool_directory = /var/mail
mailbox_command = procmail -a "$EXTENSION"
mailbox_size_limit = 0
message_size_limit = 0
mydestination = $myhostname, $mydomain
mydomain = myers.smoothstoneservices.com.local
myhostname = myers.smoothstoneservices.com
mynetworks_style = host
myorigin = $myhostname
recipient_delimiter = +
setgid_group = postdrop
smtpd_banner = $myhostname ESMTP ispCP 1.0.5 OMEGA Managed
smtpd_data_restrictions = reject_multi_recipient_bounce,                               reject_unauth_pipelining
smtpd_helo_required = yes
smtpd_helo_restrictions = permit_mynetworks,                               permit_sasl_authenticated,                               reject_invalid_helo_hostname,                               reject_non_fqdn_helo_hostname
smtpd_recipient_restrictions = reject_non_fqdn_recipient,                               reject_unknown_recipient_domain,                               permit_mynetworks,                               permit_sasl_authenticated,                               reject_unauth_destination,                               reject_unlisted_recipient,                               check_policy_service inet:127.0.0.1:12525,                               check_policy_service inet:127.0.0.1:60000,                               permit
smtpd_sasl_auth_enable = yes
smtpd_sasl_local_domain =
smtpd_sasl_security_options = noanonymous
smtpd_sender_restrictions = reject_non_fqdn_sender,                               reject_unknown_sender_domain,                               permit_mynetworks,                               permit_sasl_authenticated
transport_maps = hash:/etc/postfix/ispcp/transport
virtual_alias_maps = hash:/etc/postfix/ispcp/aliases
virtual_gid_maps = static:12
virtual_mailbox_base = /var/mail/virtual
virtual_mailbox_domains = hash:/etc/postfix/ispcp/domains
virtual_mailbox_limit = 0
virtual_mailbox_maps = hash:/etc/postfix/ispcp/mailboxes
virtual_minimum_uid = 3001
virtual_transport = virtual
virtual_uid_maps = static:3001

Any help would be appreciated.

Thanks,
David

sneakyimp · 06-26-2010, 07:44 PM

I am no expert at all in postfix, but have struggled through a configuration before. Looking at your log file, I see a few problems:

Code:

2010-06-26T17:57:43.581654-04:00 li136-183 postfix/smtpd[30721]: fatal: No server certs available. TLS can't be enabled

TSL/SSL requires the proper types of security certificates to function. Either the location of these certs is incorrectly specified, or they don't exist.

Code:

2010-06-26T17:57:43.838633-04:00 li136-183 postfix/smtpd[30710]: warning: connect to 127.0.0.1:12525: Connection refused
2010-06-26T17:57:43.838677-04:00 li136-183 postfix/smtpd[30710]: warning: problem talking to server 127.0.0.1:12525: Connection refused

Postfix attempts to connect to 127.0.0.1 (which is 'localhost' -- the same machine) on port 12525 and this connection is refused. Why? Probably because of this item in your config file:

Code:

smtpd_recipient_restrictions = reject_non_fqdn_recipient, reject_unknown_recipient_domain, permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, reject_unlisted_recipient, check_policy_service inet:127.0.0.1:12525, check_policy_service inet:127.0.0.1:60000, permit

Look at the part where it says check_policy_service inet:127.0.0.1:12525. I have no idea what this means but it would appear that postfix is attempting to connect to some kind of locally hosted service to check policies of some kind. If you haven't got that service set up, the connection gets refused by your server.

That's just for starters.

Not sure what distro you are using, but there are some 'perfect setup' tutorials on howtoforge.com. I use this one for debian lenny quite a bit. I've linked to the page that discusses postfix. howtoforge also has a whole section on postfix how-to's.

Rudy · 06-26-2010, 08:16 PM

You have just helped me immensely. I remember seeing the "System Status" in ispCP's GUI interface mentioning that "policyd-weight" is down, and it listed a port number. Guess what port it is?

Code:

localhost   (Port 12525)

I'm running on CentOS 5.5, if you were curious. I'm going to work backwards and get this taken care of until ispCP stops complaining that it's "down" and then run my tests again.

The TLS/SSL thing is a bit confusing because I remember specifically generating a certificate a few days ago during the install process for this whole thing. I'll dig deeper into that though.

Thanks again,
David

sneakyimp · 06-26-2010, 08:33 PM

I'd maybe focus on the certs because that error says "fatal" and not "warning". You might well have created the certs and put them in the wrong place. Another problem I had with certs once is that I created them with a password and apache couldn't use them for HTTPS when booting up because the bootup process didn't supply that password.