Postfix not working

Discussion in 'Installation/Configuration' started by controlmac, Mar 13, 2007.

  1. controlmac

    controlmac New Member

    Whenever I check the status of Postfix I get the answer "dead".

    None of my customers gets any mail.
    When I check /var/log/mail.err I get:

    Mar 13 09:10:17 server1 postfix/master[26788]: fatal: bind 0.0.0.0 port 25: Address already in use
    Mar 13 08:11:18 server1 postfix/postqueue[26989]: fatal: Cannot flush mail queue - mail system is down

    Walter
     
    controlmac, Mar 13, 2007
    #1
  2. Xtreem1986

    Xtreem1986 New Member

    Is this a fresh install? Has it been working before? Have you made any changes lately to your setup? Have you looked in the postfix config to see if maybe it's trying to bind to 0.0.0.0? Can your customers send mail? What happens why you telnet localhost 25? Have you sent any emails to yourself from outside to see what is in the message bounced email you get back?
     
    Xtreem1986, Mar 13, 2007
    #2
  3. martinfst

    martinfst Member Moderator

    What's the output of
    Code:
    netstat -tap
    ?
     
    martinfst, Mar 13, 2007
    #3
  4. controlmac

    controlmac New Member

    It has worked over a year and I did not change anything.
    But I now restarted Postfix again and it works now. I have no idea why it didn't yesterday and this morning. Nothing has changed!

    Walter
     
    controlmac, Mar 13, 2007
    #4
  5. martinfst

    martinfst Member Moderator

    Could your server been hacked? If a hacker installs his own mailer, that would use port 25 and thus effectively block Postfix to start.
     
    martinfst, Mar 13, 2007
    #5
  6. controlmac

    controlmac New Member

    It look like it has been hacked. I see all kind of strange things in the output of netstat -tap. (I cannot post the output entirely because of too many images???)

    tcp 0 0 localhost:smtp localhost:34583 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34584 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34585 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34586 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34587 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34588 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34589 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34590 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34591 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34592 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34593 TIME_WAIT -
    tcp 0 0 server1.controlfil:smtp t1test.wanadoo.nl:42697 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34594 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34595 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34596 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34597 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34598 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34599 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34600 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34601 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34602 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34603 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34604 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34605 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34606 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34607 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34608 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34609 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34610 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34611 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34612 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34613 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34614 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34615 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34616 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34617 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34618 TIME_WAIT -
    tcp 0 0 server1.controlfil:smtp t1test.wanadoo.nl:42706 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34619 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34620 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34621 TIME_WAIT -
    tcp 0 0 server1.controlfil:smtp t1test.wanadoo.nl:42709 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34622 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34623 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34624 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34625 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34626 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34627 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34628 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34629 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34630 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34631 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34632 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34633 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34634 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34635 TIME_WAIT -
    tcp 0 0 localhost:smtp localhost:34636 TIME_WAIT -
    tcp 0 0 server1.controlfil:smtp t1test.wanadoo.nl:42820 TIME_WAIT -
    tcp 0 0 server1.controlfil:smtp dc1img05.digitalr:20283 TIME_WAIT -
    tcp 0 0 server1.controlfil:smtp mx1.euronet.nl:41580 TIME_WAIT -
    tcp 0 0 server1.controlfil:smtp awt229.interne:piranha2 TIME_WAIT -
    tcp 0 0 server1.controlfil:smtp t1test.wanadoo.nl:42793 TIME_WAIT -
     
    controlmac, Mar 13, 2007
    #6
  7. martinfst

    martinfst Member Moderator

    That amount of smtp sessions looks like a hacked server. You could try to run 'chkrootkit'. Maybe you need to install it 1st.

    You'd need to find how you got hacked. Most likely a php scripts. Check the apache logs.

    Look for all directories with read/write/execute rights for world, starting with a . (the hidden entry).
     
    martinfst, Mar 13, 2007
    #7
  8. falko

    falko Super Moderator Howtoforge Staff

    Please check the output of
    Code:
    postqueue -p
    if there are lots of messages that look like spam. Also check your mail log.
     
    falko, Mar 14, 2007
    #8

Share This Page