1

Topic: Having an self-inflicted issue and I'm rejecting all email...

==== Required information ====
- iRedMail version: 0.8.7,  with pro-admin (latest version)
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): mysql
- Linux/BSD distribution name and version: debian wheezy
- Related log if you're reporting an issue:
====

I changed a setting somewhere I have a vague memory about changing a policy somewhere about a hard reject on a check rather than whatever the default was. I don't recall if it was a hand edit of a .conf file or if I edited it via one of the interfaces (cluebringer/iredadmin-pro/etc). I'm having trouble finding what I did because of how long ago I mucked with a working configuration. It seems to have taken awhile but all of a sudden on Monday I started rejecting all email. It's a low volume server so I didn't notice there was a problem till Wednesday and didn't realize it's severity till last night.

This is one of the last emails the server successfully passed, the log is typical of all the transactions before it.
====== This is a prior good transaction that later passed through after the greylisting expired.
Nov 10 14:37:56 mail cbpolicyd[3244]: module=Greylisting, action=defer, host=173.165.xxx.xxx, helo=jirik-6108cf314, from=rahvin@bagatelle.pe, to=foo3@foo2.net, reason=greylisted
Nov 10 14:37:56 mail postfix/smtpd[16913]: NOQUEUE: reject: RCPT from foo2.net[173.165.xxx.xxx]: 451 4.7.1 <foo3@foo2.net>: Recipient address rejected: Greylisting in effect, please come back later; from=<rahvin@bagatelle.pe> to=<foo3@foo2.net> proto=ESMTP helo=<jirik-6108cf314>
======

This is what I'm currently getting in the logs for most emails now. Others are being rejected for non-compliant headers which is probably normal but I don't remember seeing these kind of entries before.
======This is a typical entry I'm getting now for all email.
Nov 14 16:01:49 mail cbpolicyd[4880]: module=Greylisting, action=reject, host=173.165.xxx.xxx, helo=mail-wg0-f42.google.com, from=foo@gmail.com, to=nospam@foo2.net, reason=auto-blacklisted
Nov 14 16:01:49 mail postfix/smtpd[6699]: NOQUEUE: reject: RCPT from foo2.net[173.165.xxx.xxx]: 554 5.7.1 <nospam@foo2.net>: Recipient address rejected: Greylisting in effect, sending server blacklisted; from=<foo@gmail.com> to=<nospam@foo2.net> proto=ESMTP helo=<mail-wg0-f42.google.com>
====== This is a typical bad format rejection:
Nov 14 06:29:34 mail postfix/smtpd[5491]: NOQUEUE: reject: RCPT from foo2.net[173.165.xxx.xxx]: 554 5.7.1 <107.7.114.194>: Helo command rejected: ACCESS DENIED. Your email was rejected because the sending mail server sent non RFC compliant HELO identity (107.7.114.194); from=<> to=<foo3@foo2.net> proto=SMTP helo=<107.7.114.194>
======

As you can see all of sudden rather than doing a defer on cluebringer I'm getting a reject with the reason auto-blacklisted (says the same thing for every single attempt from every domain).

After cluebringer hands off to postfix I go from reject, come back later to reject sending server blacklisted.

I'm not sure if it's connected but fail2ban's log has entries for banning my mail server's IP address which is very odd. Though this is the last entry so it hasn't done it today yet.
============
2014-11-13 13:02:32,935 fail2ban.actions: WARNING [ssh-iredmail] Ban 173.165.xxx.xxx
2014-11-13 14:02:33,090 fail2ban.actions: WARNING [ssh-iredmail] Unban 173.165.xxx.xxx
===========

Finally I used google to send a test email to the server and it was rejected instantly. This is what the bounce showed:

=======
Technical details of permanent failure:
Google tried to deliver your message, but it was rejected by the server for the recipient domain foo.net by mail.foo.net. [173.165.xxx.xxx].

The error that the other server returned was:
554 5.7.1 <nospam@foo.net>: Recipient address rejected: Greylisting in effect, sending server blacklisted
=======

I could use a point in the right direction of where I need to be looking. I've been through a bunch of config files and nothing appears to look like what I changed, nor do I see anything that looks wrong.

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2

Re: Having an self-inflicted issue and I'm rejecting all email...

Looks like it was auto-blacklisted by Cluebringer, try to find this IP address in SQL table "cluebringer.greylisting_autoblacklist".