postfix/qmgr[129005]: warning: connect to transport private/mydomain.tld: Connection refused

Discussion in 'Installation/Configuration' started by omolinete, Jun 20, 2024.

  1. omolinete

    omolinete New Member

    Hi All,
    I've recently migrated this week my personal server with ISPConfig installed on it, and after changed the IP address and touching nothing else, now Postfix cannot send or receive any email (?!).
    I've checked all the configurations and I can't figure out what's going on...
    I've Googled about this error, and it seems to be something known since many years. I've also saw threads from HowToForge where ISPConfig's Staff help other users with this exact problem and they told them that it is on the clamav+amavis side, that must be running in order Postfix to work normally.
    Problem is that these services --and also others expected to be up too-- are really running normally, so I don't know what is happening.
    I paste you the contents of the "/etc/postfix/master.conf" and "/etc/postfix/main.cf" files if you kindly want to help me with this:

    Code:
    root@aio:~# cat /etc/postfix/master.cf
    #
    # Postfix master process configuration file.  For details on the format
    # of the file, see the master(5) manual page (command: "man 5 master" or
    # on-line: http://www.postfix.org/master.5.html).
    #
    # Do not forget to execute "postfix reload" after editing this file.
    #
    # ================================================================================
    # service          type  private  unpriv  chroot  wakeup  maxproc  command + args
    #                         (yes)   (yes)   (yes)   (never) (100)
    # ================================================================================
    
    #smtp              inet    n       -       -       -       1       postscreen
    
    #smtpd             pass    -       -       -       -       -       smtpd
    
    #dnsblog           unix    -       -       -       -       0       dnsblog
    
    #tlsproxy          unix    -       -       -       -       0       tlsproxy
    
    smtp               inet    n       -       y       -       -       smtpd
    #   -o smtpd_reject_unlisted_recipient=no
    #   -o smtpd_client_restrictions=$mua_client_restrictions
    #   -o smtpd_helo_restrictions=$mua_helo_restrictions
    #   -o smtpd_sender_restrictions=$mua_sender_restrictions
    #   -o smtpd_recipient_restrictions=
    #   -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
    #   -o milter_macro_daemon_name=ORIGINATING
    
    submission         inet    n       -       y       -       -       smtpd
        -o syslog_name=postfix/submission
        -o smtpd_tls_security_level=encrypt
        -o smtpd_sasl_auth_enable=yes
        -o smtpd_client_restrictions=permit_sasl_authenticated,reject
    #   -o smtpd_reject_unlisted_recipient=no
    #   -o smtpd_client_restrictions=$mua_client_restrictions
    #   -o smtpd_helo_restrictions=$mua_helo_restrictions
    #   -o smtpd_sender_restrictions=$mua_sender_restrictions
    #   -o smtpd_recipient_restrictions=
    #   -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
    #   -o milter_macro_daemon_name=ORIGINATING
    
    #628               inet    n       -       -       -       -       qmqpd
    
    #submission        inet    n       -       y       -       -       smtpd
    
    smtps              inet    n       -       y       -       -       smtpd
        -o syslog_name=postfix/smtps
        -o smtpd_tls_wrappermode=yes
        -o smtpd_sasl_auth_enable=yes
        -o smtpd_client_restrictions=permit_sasl_authenticated,reject
    
    pickup             unix    n       -       y       60      1       pickup
    
    cleanup            unix    n       -       y       -       0       cleanup
    
    qmgr               unix    n       -       n       300     1       qmgr
    
    #qmgr              unix    n       -       n       300     1       oqmgr
    
    tlsmgr             unix    -       -       y       1000?   1       tlsmgr
    
    rewrite            unix    -       -       y       -       -       trivial-rewrite
    
    bounce             unix    -       -       y       -       0       bounce
    
    defer              unix    -       -       y       -       0       bounce
    
    trace              unix    -       -       y       -       0       bounce
    
    verify             unix    -       -       y       -       1       verify
    
    flush              unix    n       -       y       1000?   0       flush
    
    proxymap           unix    -       -       n       -       -       proxymap
    
    proxywrite         unix    -       -       n       -       1       proxymap
    
    smtp               unix    -       -       y       -       -       smtp
    #   -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
    
    relay              unix    -       -       y       -       -       smtp
    
    showq              unix    n       -       y       -       -       showq
    
    error              unix    -       -       y       -       -       error
    
    retry              unix    -       -       y       -       -       error
    
    discard            unix    -       -       y       -       -       discard
    
    local              unix    -       n       n       -       -       local
    
    virtual            unix    -       n       n       -       -       virtual
    
    lmtp               unix    -       -       y       -       -       lmtp
    
    anvil              unix    -       -       y       -       1       anvil
    
    #
    # ====================================================================
    # Interfaces to non-Postfix software. Be sure to examine the manual
    # pages of the non-Postfix software to find out what options it wants.
    #
    # Many of the following services use the Postfix pipe(8) delivery
    # agent.  See the pipe(8) man page for information about ${recipient}
    # and other message envelope options.
    # ====================================================================
    #
    # maildrop. See the Postfix MAILDROP_README file for details.
    # Also specify in main.cf: maildrop_destination_recipient_limit=1
    #
    
    scache             unix    -       -       y       -       1       scache
    
    maildrop           unix    -       n       n       -       -       pipe
        flags=DRhu user=vmail argv=/usr/bin/maildrop -d vmail ${extension} ${recipient} ${user} ${nexthop} ${sender}
    
    #
    # ====================================================================
    #
    # Recent Cyrus versions can use the existing "lmtp" master.cf entry.
    #
    # Specify in cyrus.conf:
    #   lmtp    cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
    #
    # Specify in main.cf one or more of the following:
    #  mailbox_transport = lmtp:inet:localhost
    #  virtual_transport = lmtp:inet:localhost
    #
    # ====================================================================
    #
    # Cyrus 2.1.5 (Amos Gouaux)
    # Also specify in main.cf: cyrus_destination_recipient_limit=1
    #
    #cyrus             unix    -       n       n       -       -       pipe
    #   user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
    
    #
    # ====================================================================
    # Old example of delivery via Cyrus.
    #
    #old-cyrus         unix    -       n       n       -       -       pipe
    #   flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
    
    #
    # ====================================================================
    #
    # See the Postfix UUCP_README file for configuration details.
    #
    uucp               unix    -       n       n       -       -       pipe
        flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
    
    #
    # Other external delivery methods.
    #
    ifmail             unix    -       n       n       -       -       pipe
        flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
    
    bsmtp              unix    -       n       n       -       -       pipe
        flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
    
    scalemail-backend  unix    -       n       n       -       2       pipe
        flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
    
    mailman            unix    -       n       n       -       -       pipe
        flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py ${nexthop} ${user}
    
    dovecot            unix    -       n       n       -       -       pipe
        flags=DRhu user=vmail:vmail argv=/usr/lib/dovecot/deliver -f ${sender} -d ${user}@${nexthop}
    
    
    amavis unix - - - - 2 smtp
            -o smtp_data_done_timeout=1200
            -o smtp_send_xforward_command=yes
            -o smtp_bind_address=
    
    
    127.0.0.1:10025 inet n - n - - smtpd
            -o content_filter=
            -o local_recipient_maps=
            -o relay_recipient_maps=
            -o smtpd_restriction_classes=
            -o smtpd_client_restrictions=
            -o smtpd_helo_restrictions=
            -o smtpd_sender_restrictions=
            -o smtpd_recipient_restrictions=permit_mynetworks,reject
            -o smtpd_end_of_data_restrictions=
            -o mynetworks=127.0.0.0/8
            -o strict_rfc821_envelopes=yes
            -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
            -o smtp_send_xforward_command=yes
            -o disable_dns_lookups=yes
            -o address_verify_virtual_transport=$virtual_transport
            -o address_verify_transport_maps=$transport_maps
    
    
    127.0.0.1:10027 inet n - n - - smtpd
            -o content_filter=
            -o local_recipient_maps=
            -o relay_recipient_maps=
            -o smtpd_restriction_classes=
            -o smtpd_client_restrictions=
            -o smtpd_helo_restrictions=
            -o smtpd_sender_restrictions=
            -o smtpd_recipient_restrictions=permit_mynetworks,reject
            -o smtpd_end_of_data_restrictions=
            -o mynetworks=127.0.0.0/8
            -o strict_rfc821_envelopes=yes
            -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
            -o smtp_send_xforward_command=yes
            -o disable_dns_lookups=yes
            -o address_verify_virtual_transport=$virtual_transport
            -o address_verify_transport_maps=$transport_maps
            -o milter_default_action=accept
            -o milter_macro_daemon_name=ORIGINATING
    
    root@aio:~#
    Code:
    root@aio:~# cat /root/main.cf
    # See /usr/share/postfix/main.cf.dist for a commented, more complete version
    
    
    # Debian specific:  Specifying a file name will cause the first
    # line of that file to be used as the name.  The Debian default
    # is /etc/mailname.
    #myorigin = /etc/mailname
    myorigin = mail.mydomain.tld
    
    smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
    
    biff = no
    
    # appending .domain is the MUA's job.
    append_dot_mydomain = no
    
    # Uncomment the next line to generate "delayed mail" warnings
    delay_warning_time = 4h
    
    readme_directory = /usr/share/doc/postfix
    
    # TLS parameters
    smtpd_tls_cert_file = /etc/postfix/smtpd.cert
    smtpd_tls_key_file = /etc/postfix/smtpd.key
    smtpd_use_tls = yes
    smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
    smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
    
    # See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
    # information on enabling SSL in the smtp client.
    
    smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
    
    myhostname = mail.mydomain.tld
    
    alias_maps = hash:/etc/aliases, hash:/var/lib/mailman/data/aliases
    
    alias_database = hash:/etc/aliases, hash:/var/lib/mailman/data/aliases
    
    mydestination = mail.mydomain.tld, localhost, localhost.localdomain
    
    #relayhost =
    
    mynetworks =
        127.0.0.0/8,
        [::ffff:127.0.0.0]/104,
        [::1]/128,
        10.0.0.0/8,
        212.xxx.xxx.xxx/27,
        [2a03:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx]/56
    
    mailbox_command = procmail -a "$EXTENSION"
    
    mailbox_size_limit = 0
    
    recipient_delimiter = +
    
    inet_interfaces = all
    
    html_directory = /usr/share/doc/postfix/html
    
    virtual_alias_domains = proxy:mysql:/etc/postfix/mysql-virtual_alias_domains.cf
    
    virtual_alias_maps = hash:/var/lib/mailman/data/virtual-mailman, proxy:mysql:/etc/postfix/mysql-virtual_forwardings.cf, proxy:mysql:/etc/postfix/mysql-virtual_alias_maps.cf, proxy:mysql:/etc/postfix/mysql-virtual_email2email.cf
    
    virtual_mailbox_domains = proxy:mysql:/etc/postfix/mysql-virtual_domains.cf
    
    virtual_mailbox_maps = proxy:mysql:/etc/postfix/mysql-virtual_mailboxes.cf
    
    virtual_mailbox_base = /var/vmail
    
    virtual_uid_maps = proxy:mysql:/etc/postfix/mysql-virtual_uids.cf
    
    virtual_gid_maps = proxy:mysql:/etc/postfix/mysql-virtual_gids.cf
    
    inet_protocols = all
    
    smtpd_sasl_auth_enable = yes
    
    broken_sasl_auth_clients = yes
    
    smtpd_sasl_authenticated_header = yes
    
    smtpd_helo_restrictions = permit_mynetworks, reject_unknown_recipient_domain, check_helo_access regexp:/etc/postfix/helo_access, permit_sasl_authenticated, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, reject_non_fqdn_hostname, reject_invalid_hostname, reject_non_fqdn_sender, reject_non_fqdn_recipient, reject_unauth_destination, reject_unauth_pipelining, reject_rbl_client sbl.spamhaus.org, reject_rbl_client bl.spamcop.net, reject_rbl_client b.barracudacentral.org, reject_rbl_client xbl.spamhaus.org, reject_rbl_client cbl.abuseat.org, reject_rbl_client bl.score.senderscore.com, check_helo_access regexp:/etc/postfix/blacklist_helo, reject_unknown_helo_hostname, permit
    
    smtpd_recipient_restrictions = permit_mynetworks, reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_unlisted_recipient, check_recipient_access proxy:mysql:/etc/postfix/mysql-verify_recipients.cf, permit_sasl_authenticated, reject_invalid_hostname, reject_non_fqdn_sender, reject_non_fqdn_recipient, reject_non_fqdn_hostname, reject_unauth_destination, reject_unauth_pipelining, reject_rbl_client sbl.spamhaus.org, reject_rbl_client bl.spamcop.net, reject_rbl_client b.barracudacentral.org, reject_rbl_client xbl.spamhaus.org, reject_rbl_client cbl.abuseat.org, reject_rbl_client bl.score.senderscore.com, check_recipient_access proxy:mysql:/etc/postfix/mysql-virtual_recipient.cf, check_recipient_access mysql:/etc/postfix/mysql-virtual_policy_greylist.cf, check_policy_service unix:private/quota-status, check_client_access hash:/etc/postfix/rbl_override
    
    smtpd_tls_security_level = may
    
    transport_maps = hash:/var/lib/mailman/data/transport-mailman, proxy:mysql:/etc/postfix/mysql-virtual_transports.cf
    
    relay_domains = proxy:mysql:/etc/postfix/mysql-virtual_relaydomains.cf
    
    relay_recipient_maps = proxy:mysql:/etc/postfix/mysql-virtual_relayrecipientmaps.cf
    
    sender_dependent_default_transport_maps = regexp:/etc/postfix/sdd_transport_maps.regexp
    
    proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $sender_bcc_maps $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $smtpd_sender_login_maps $virtual_uid_maps $virtual_gid_maps $smtpd_client_restrictions $smtpd_sender_restrictions $smtpd_recipient_restrictions $smtp_sasl_password_maps $sender_dependent_relayhost_maps
    
    smtpd_sender_restrictions = reject_authenticated_sender_login_mismatch, check_sender_access regexp:/etc/postfix/tag_as_originating.re, permit_mynetworks, check_sender_access proxy:mysql:/etc/postfix/mysql-virtual_sender.cf, reject_sender_login_mismatch, permit_sasl_authenticated, reject_non_fqdn_sender, reject_unlisted_sender, check_sender_access regexp:/etc/postfix/tag_as_foreign.re
    
    smtpd_client_restrictions = check_client_access proxy:mysql:/etc/postfix/mysql-virtual_client.cf, permit_inet_interfaces, permit_mynetworks, permit_sasl_authenticated, reject_rbl_client sbl.spamhaus.org, reject_rbl_client bl.spamcop.net, reject_rbl_client b.barracudacentral.org, reject_rbl_client xbl.spamhaus.org, reject_rbl_client cbl.abuseat.org, reject_rbl_client bl.score.senderscore.com, reject_unauth_pipelining, reject_unknown_client_hostname, permit
    
    smtpd_client_message_rate_limit = 100
    
    maildrop_destination_concurrency_limit = 1
    
    maildrop_destination_recipient_limit = 1
    
    virtual_transport = lmtp:unix:private/dovecot-lmtp
    
    header_checks = regexp:/etc/postfix/header_checks
    
    mime_header_checks = regexp:/etc/postfix/mime_header_checks
    
    nested_header_checks = regexp:/etc/postfix/nested_header_checks
    
    body_checks = regexp:/etc/postfix/body_checks
    
    owner_request_special = no
    
    smtp_tls_security_level = dane
    
    smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
    
    smtpd_tls_protocols = !SSLv2,!SSLv3
    
    smtp_tls_protocols = !SSLv2,!SSLv3
    
    dovecot_destination_recipient_limit = 1
    
    smtpd_sasl_type = dovecot
    
    smtpd_sasl_path = private/auth
    
    content_filter = lmtp:[127.0.0.1]:10024
    
    receive_override_options = no_address_mappings
    
    message_size_limit = 0
    
    sender_bcc_maps = proxy:mysql:/etc/postfix/mysql-virtual_outgoing_bcc.cf
    
    smtpd_restriction_classes = greylisting
    
    greylisting = check_policy_service inet:127.0.0.1:10023
    
    smtpd_sender_login_maps = proxy:mysql:/etc/postfix/mysql-virtual_sender_login_maps.cf
    
    smtpd_helo_required = yes
    
    smtpd_tls_exclude_ciphers = RC4, aNULL
    
    smtp_tls_exclude_ciphers = RC4, aNULL
    
    smtpd_etrn_restrictions = permit_mynetworks, reject
    
    smtpd_data_restrictions = permit_mynetworks, reject_unauth_pipelining, reject_multi_recipient_bounce, permit
    
    smtpd_tls_mandatory_ciphers = medium
    
    tls_medium_cipherlist = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA
    
    tls_preempt_cipherlist = yes
    
    address_verify_negative_refresh_time = 60s
    
    enable_original_recipient = yes
    
    smtpd_forbidden_commands = CONNECT,GET,POST,USER,PASS
    
    address_verify_sender_ttl = 15686s
    
    smtp_dns_support_level = dnssec
    
    #smtp_use_tls = yes
    #smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
    smtp_sasl_auth_enable = yes
    #relayhost = w.x.y.z:26
    smtp_sasl_password_maps = proxy:mysql:/etc/postfix/mysql-virtual_sender-relayauth.cf, texthash:/etc/postfix/sasl_passwd
    smtp_sasl_security_options = noanonymous, noplaintext
    smtpd_reject_unlisted_sender = no
    sender_dependent_relayhost_maps = proxy:mysql:/etc/postfix/mysql-virtual_sender-relayhost.cf
    smtp_sender_dependent_authentication = yes
    smtp_sasl_tls_security_options = noanonymous
    authorized_flush_users =
    authorized_mailq_users = nagios, icinga
    address_verify_virtual_transport = smtp:[127.0.0.1]:10025
    address_verify_transport_maps = static:smtp:[127.0.0.1]:10025
    
    root@aio:~#
    Thank you so much in advance!
    Olivier
     
  2. till

    till Super Moderator Staff Member ISPConfig Developer

Share This Page