New Linux mail from ISPConfig: error

I keep getting new mail on the user administrator that says the following:

Code:

From [email protected]  Thu Nov 19 10:00:05 2009
X-Original-To: root@localhost
To: root@localhost
Subject: WARNING: services not running
Date: Thu, 19 Nov 2009 10:00:04 -0500 (EST)
From: [email protected] (root)


WARNING: service ftp not running (server: myserver.mysite.com, port: 21)!

Message generaged at November 19, 2009, 10:00.

But FTP is running fine (proftpd) and even in ISPConfig it says that it's online. How can I stop getting these errors?

 

What's the output of

Code:

netstat -tap

?

 

Code:

netstat -tap
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 *:smtp                  *:*                     LISTEN      14373/master    
tcp        0      0 localhost:953           *:*                     LISTEN      2244/named      
tcp        0      0 localhost:mysql         *:*                     LISTEN      1046/mysqld     
tcp        0      0 *:81                    *:*                     LISTEN      1966/ispconfig_http
tcp        0      0 *:ftp                   *:*                     LISTEN      14147/proftpd: (acc
tcp        0      0 mysite.com:domain *:*                     LISTEN      2244/named      
tcp        0      0 localhost:domain        *:*                     LISTEN      2244/named      
tcp        0      0 *:ssh                   *:*                     LISTEN      872/sshd        
tcp        0      0 mysite.com:ssh    149.152.132.12:6735     ESTABLISHED 23886/sshd: adminis
tcp        0      0 mysite.com:ssh    67.151.204.141:49301    ESTABLISHED 15563/sshd: adminis
tcp6       0      0 [::]:smtp               [::]:*                  LISTEN      14373/master    
tcp6       0      0 ip6-localhost:953       [::]:*                  LISTEN      2244/named      
tcp6       0      0 [::]:https              [::]:*                  LISTEN      2083/apache2    
tcp6       0      0 [::]:imaps              [::]:*                  LISTEN      1179/couriertcpd
tcp6       0      0 [::]:pop3s              [::]:*                  LISTEN      1215/couriertcpd
tcp6       0      0 [::]:pop3               [::]:*                  LISTEN      1194/couriertcpd
tcp6       0      0 [::]:imap2              [::]:*                  LISTEN      1158/couriertcpd
tcp6       0      0 [::]:www                [::]:*                  LISTEN      2083/apache2    
tcp6       0      0 [::]:ssh                [::]:*                  LISTEN      872/sshd        
tcp6       0      0 mysite.com:imap2  mobile-166-137-13:52188 ESTABLISHED 23678/couriertls

 

Looks ok.
Are you sure that the mail is originating from the right server?

 

Yes, I only have one server.

 

I wonder if this might be a firewall issue, but I'm really not sure. What's the output of

Code:

iptables -L

?

 

Code:

iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
fail2ban-proftpd  tcp  --  anywhere             anywhere            multiport dports ftp,ftp-data,ftps,ftps-data 
fail2ban-apache  tcp  --  anywhere             anywhere            multiport dports www,https 
fail2ban-sasl  tcp  --  anywhere             anywhere            multiport dports smtp,ssmtp,imap2,imap3,imaps,pop3,pop3s 
fail2ban-ssh  tcp  --  anywhere             anywhere            multiport dports ssh 
fail2ban-courierimap  tcp  --  anywhere             anywhere            multiport dports imap2 
fail2ban-courierpop3  tcp  --  anywhere             anywhere            multiport dports pop3 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain fail2ban-apache (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere            

Chain fail2ban-courierimap (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere            

Chain fail2ban-courierpop3 (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere            

Chain fail2ban-proftpd (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere            

Chain fail2ban-sasl (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere            

Chain fail2ban-ssh (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere 

 

Can you disable fail2ban and see if you still get warning emails regarding FTP?

 

I just disabled it, and deleted all the mail. I'll see if anything comes back.

 

Ahhhhh ha. I figured out the problem I had monitoring set up in ISPConfig to monitor one of my other servers, and completely forgot that I set it up. Disabled in the settings, and I haven't let the server sit for a while yet but i'm sure it fixed the problem.