Causing: e-mail lost connection while sending RCPT TO

[ms308680]

Hello,

To start off, everything is up to date with version 16.2.2 as of this post.

I thought I fixed this issue by disabling the SMTP scanning, but just today, even with that disabled, I got a message stuck in the queue with the following message. (I am including another historical one that got stuck in the past as well)



[email protected]



dsn=4.4.2, status=deferred (lost connection with mx2c40.carrierzone.com[64.29.151.237] while sending RCPT TO)

and


[email protected] (using a known public address instead of a direct address)


dsn=4.4.2, status=deferred (lost connection with mx2c1.megamailservers.com[69.49.103.243] while sending RCPT TO)


When I completely disable the virus scanner (which is what I did the first time) and I go flush the Postfix mail queue, I have no issues. As I stated above, I thought I could just disable the SMTP scanning and everything would be fine. I look at the reports and I do not see anything being done to these messages, or any messages since I have the SMTP scanning off.

this accounts for less than 2% of what is sent through, but if we end up with more customers that use these services, it can climb.

While I am using generic public addresses, they do exist.

The server running the mail server is a Virtualmin server, all the software versions are listed below:

Webmin version	1.973	Usermin version	1.823
Virtualmin version	6.16

I am providing all this information since I have no other mail server behind the firewall to test with.

I felt fine with disabling the Virus scanner for SMTP since the server has ClamAV enabled, but since it seems like there is a deeper issue, I really would not mind being able to turn it back on after this issue is fixed, if it can be just rectified even with SMTP scanning turned off and me not having to completely disable the Virus Scanner, it will be very appreciative as well.

Thank you very much, I hope I have enough information

[ms308680]

I would like to add to this, another mail server that I have, it is a little older that is behind a similarly configured Untangle environment and the Virus Blocker lite is enabled, but I do not seem to have the Virus scanner enabled on the Virtualmin server instance of that box. Due to the age, it will be getting updated soon, but I did want to mention that a message I sent to one of those domains did NOT get stuck in the queue. The only real difference(s) are, the OS version of the server running Virtualmin, the Postfix version, and the fact that the older machine is not running the ClamAV on it.

Since I already posted the software versions of the new mail server that this problem is happening on, then I will post the versions for the older server in case it helps anyone. Again, thank you and I hope we can find a workaround (without having to disable the Virus Scanner Lite) or solution.

Operating system	Ubuntu Linux 18.04.5
Perl version	5.026001
Path to Perl	/usr/bin/perl
BIND version	9.11
Postfix version	3.3.0
Mail injection command	/usr/lib/sendmail -t
Apache version	2.4.29
PHP versions	7.2.33, 7.4.9
Webalizer version	2.23-08
Logrotate version	3.11.0
MySQL version	5.7.31-0ubuntu0.18.04.1
ProFTPD version	1.35
SpamAssassin version	3.4.2

Webmin version	1.955	Usermin version	1.803
Virtualmin version	6.12

Again, thank you

[ms308680]

Due to the discovery above, as a test, I have tried disabling the ClamAV on the Virtualmin server and sent a test with the Virus Scanner lite enabled on the Untangle Firewall, and it still gets stopped in the queue until I disable the Virus Scanner on the Untangle firewall and it can go through.

as a work around for the time being, I have created a bypass rule as follows:
destination port 25
source IP - local IP of virtualmin server
source interface - internal

this should only affect traffic outgoing from our server on port 25 if I am thinking this through properly, if anyone has any input on my workaround for this in the interim, I would really love to hear it since I would really like to stop having to check the queue.


Thank you,

[johnsonx42]

I've encountered similar issues a number of times at different sites; it seems having Untangle monitor and interfere with the SMTP conversation sometimes creates a problem that results in a timeout. I now always bypass SMTP outbound as you have done, and sometimes I even have to temporarily bypass SMTP inbound from a specific host to get an email to come through; the reports will show the email is being passed by all modules, but the mail server never receives the email and times out and it repeats over and over until I discover it and put in the bypass.

[ms308680]

The strange part is that this still interferes with SMTP traffic even with SMTP scanning turned off in the Virus Scanner Lite module settings though... I have not heard of any problems with not getting incoming messages though.

Thank you for your reply,

[sky-knight]

Disabling SMTP processing in this case just gets AV Blocker out of the way, it's not the only module that works with SMTP though and therefore not the only place where potential issues can arise.

[ms308680]

thank you for the reply, but in this instance, I do not have phishing or spam modules not even installed, this was to check if they were interfering with this even if they were disabled, and the purpose of this post was to bring to lite that Virus Blocker lite was still interfering with SMTP even though it was unchecked in the Virus Blocker lite settings. I made the above bypass rule to get around this, but I created this post before all that. I still think the developers would/should like to know that Virus Blocker lite is interfering with SMTP traffic even with it disabled. Traffic direction is from internal to external, on outgoing mail.

Again, thank you