dstonek's questions

Centos 7, Apache 2.4, php7, Virtualmin (testing server)

I've read almost all suggested similar questions/answers but still don't realize why httpd log displays these errors despite I don't have any kind of trouble accessing all what is "denied". Html, css, js, imgs all are loaded correctly from browsers.

[Thu Mar 28 19:16:04.717165 2019] [access_compat:error] [pid 13330] [client 192.168.1.251:48510] AH01797: client denied by server configuration: /path-to-/index.php, referer: https://...../index.php?page=4

[Thu Mar 28 19:16:05.034605 2019] [access_compat:error] [pid 13330] [client 192.168.1.251:48510] AH01797: client denied by server configuration: /path-to-/overlib/overlib.js, referer: https://.......index.php?page=13

[Thu Mar 28 19:16:05.039902 2019] [access_compat:error] [pid 13330] [client 192.168.1.251:48510] AH01797: client denied by server configuration: /path-to-/styles.css, referer: https://......./index.php?page=13

[Thu Mar 28 19:16:05.050694 2019] [access_compat:error] [pid 13330] [client 192.168.1.251:48510] AH01797: client denied by server configuration: /path-to-/pat76.gif, referer: https://....../styles.css

[Thu Mar 28 19:16:05.065843 2019] [access_compat:error] [pid 2194] [client 192.168.1.251:48512] AH01797: client denied by server configuration: /path-to-/information.png, referer: https://......../index.php?page=13

[Thu Mar 28 19:16:05.118509 2019] [access_compat:error] [pid 7139] [client 192.168.1.251:48514] AH01797: client denied by server configuration: /path-to-/gps.png, referer: https://......./index.php?page=13

Same logs are accessing from non local ip.

These are the settings of this virtual host port 443. They were set from Virtualmin VH creation.
I guess "allow from all" is not necessary.

<Directory /path-to-/public_html>    
Options -Indexes +IncludesNOEXEC +SymLinksIfOwnerMatch +ExecCGI    
allow from all     
AllowOverride All Options=ExecCGI,Includes,IncludesNOEXEC,Indexes,MultiViews,SymLinksIfOwnerMatch     
Require all granted    
AddType application/x-httpd-php .php    
AddHandler fcgid-script .php     
AddHandler fcgid-script .php7.0    
AddHandler fcgid-script .php7.3     
FCGIWrapper /path-to-/fcgi-bin/php7.3.fcgi .php    
FCGIWrapper /path-to-/fcgi-bin/php7.0.fcgi .php7.0     
FCGIWrapper /path-to-/fcgi-bin/php7.3.fcgi .php7.3     
</Directory>

During that day sender sent four other emails after this one. All of them were delivered as usual.
These are the lines of maillog corresponding to that email that was not delivered to recipient.

Mar 22 06:36:19 host postfix/smtpd[10898]: connect from mail-eopbgr20115.outbound.protection.outlook.com[40.107.X.X]

Mar 22 06:36:20 host postfix/smtpd[10898]: setting up TLS connection from mail-eopbgr20115.outbound.protection.outlook.com[40.107.X.X]

Mar 22 06:36:20 host postfix/smtpd[10898]: Anonymous TLS connection established from mail-eopbgr20115.outbound.protection.outlook.com[40.107.X.X]: TLSv1.2 with cipher AES256-SHA256 (256/256 bits)

Mar 22 06:36:20 host postgrey[2424]: action=pass, reason=client whitelist, client_name=mail-eopbgr20115.outbound.protection.outlook.com, client_address=40.107.X.X, sender=sender@sender, [email protected]

Mar 22 06:36:20 host postfix/smtpd[10898]: D6D441CA09A0: client=mail-eopbgr20115.outbound.protection.outlook.com[40.107.X.X]

Mar 22 06:36:21 host postfix/cleanup[12463]: D6D441CA09A0: message-id=< VI1PR01MB4271639DA076BEED2736C9BBA3430@VI1PR01MB4271.eurprd01.prod.exchangelabs.com>

Mar 22 06:36:21 host postfix/cleanup[12463]: D6D441CA09A0: discard: header x-microsoft-antispam-message-info:? 5rSUbtg9a+8v7qvflcvdu8ODNNDgy6QCo+jk8ASeowDSfUDlGtYCfDanPZJMgeVPyAkrokaTR/GTVXYWmsdxNjKqfXtMFFV5oeBuVMt16oe4C6HjA720zoIc55J2J/Mgzz9DS6vIKQ3BUcbQjjryRvMopmcnkloE8rBr from mail-eopbgr20115.outbound.protection.outlook.com[40.107.X.X]; from=< sender@sender> to=< [email protected]> proto=ESMTP helo=< EUR02-VE1-obe.outbound.protection.outlook.com>

Mar 22 06:36:21 host postfix/smtpd[10898]: disconnect from mail-eopbgr20115.outbound.protection.outlook.com[40.107.X.X]

Spamassassin is running but Procmail is set to deliver normally.

These lines are also from maillog of one of the delivered ones.

Mar 22 12:44:03 host postfix/smtpd[2197]: connect from mail-eopbgr00132.outbound.protection.outlook.com[40.107.X.X]

Mar 22 12:44:03 host postfix/smtpd[2197]: setting up TLS connection from mail-eopbgr00132.outbound.protection.outlook.com[40.107.X.X]

Mar 22 12:44:03 host postfix/smtpd[2197]: Anonymous TLS connection established from mail-eopbgr00132.outbound.protection.outlook.com[40.107.X.X]: TLSv1.2 with cipher AES256-SHA256 (256/256 bits)

Mar 22 12:44:03 host postgrey[2424]: action=pass, reason=client whitelist, client_name=mail-eopbgr00132.outbound.protection.outlook.com, client_address=40.107.X.X, sender=sender@sender, recipient=rec@rec

Mar 22 12:44:03 host postfix/smtpd[2197]: BB5741CA09A0: client=mail-eopbgr00132.outbound.protection.outlook.com[40.107.X.X]

Mar 22 12:44:03 host postfix/cleanup[3184]: BB5741CA09A0: message-id=< VI1PR01MB4271B2A2EA25E7D9246BB185A3430@VI1PR01MB4271.eurprd01.prod.exchangelabs.com>

Mar 22 12:44:04 host opendkim[2109]: BB5741CA09A0: mail-eopbgr00132.outbound.protection.outlook.com [40.107.X.X] not internal

Mar 22 12:44:04 host opendkim[2109]: BB5741CA09A0: not authenticated

Mar 22 12:44:04 host opendkim[2109]: BB5741CA09A0: failed to parse authentication-results: header field

Mar 22 12:44:04 host opendkim[2109]: BB5741CA09A0: DKIM verification successful

Mar 22 12:44:04 host postfix/qmgr[2515]: BB5741CA09A0: from=< sender@sender>, size=12328, nrcpt=1 (queue active)

Mar 22 12:44:04 host postfix/pickup[1223]: 362C71CA0B4D: uid=584 from=< rec>

Mar 22 12:44:04 host postfix/cleanup[3184]: 362C71CA0B4D: message-id=< VI1PR01MB4271B2A2EA25E7D9246BB185A3430@VI1PR01MB4271.eurprd01.prod.exchangelabs.com>

Mar 22 12:44:04 host postfix/local[3190]: BB5741CA09A0: to=< rec@XXhost>, orig_to=< rec@rec>, relay=local, delay=0.54, delays=0.46/0/0/0.08, dsn=2.0.0, status=sent (delivered to command: /usr/bin/procmail-wrapper -o -a $DOMAIN -d $LOGNAME)

Mar 22 12:44:04 host postfix/qmgr[2515]: BB5741CA09A0: removed

Mar 22 12:44:04 host opendkim[2109]: 362C71CA0B4D: no signing table match for 'sender@sender'

Mar 22 12:44:04 host opendkim[2109]: 362C71CA0B4D: failed to parse authentication-results: header field

Mar 22 12:44:04 host opendkim[2109]: 362C71CA0B4D: DKIM verification successful

Mar 22 12:44:04 host postfix/smtpd[2197]: warning: network_biopair_interop: error writing 69 bytes to the network: Connection reset by peer

Mar 22 12:44:04 host postfix/smtpd[2197]: warning: network_biopair_interop: error writing 69 bytes to the network: Broken pipe

Mar 22 12:44:04 host postfix/smtpd[2197]: disconnect from mail-eopbgr00132.outbound.protection.outlook.com[40.107.X.X]

EDIT (Answering some comments/questions)

Postfix Header and Body checks don't contain anything about "Microsoft-antispam" or something like that, only "/Republique du Benin/" and other known strings only are in spam headers/bodies.

Header checks:
Body checks:

cat /path-to-Mar22-procmail.log | grep sender's name

outputs the other 4 delivered messages, not the Mar 22 06:36: one
procmai.rc of this user only has a forward directive regarding sender's name

I understand that that Microsoft antispam header might be causing the issue but I don't get what happened.

EDIT 2:
Looking at the header of the second message sent and delivered it also contains MS antispam msg that wasn't explicity recorded in log file:

x-microsoft-antispam-message-info: Dgz3XVK6DEMeeorg2JFa7q8+XuAbKdJSYQ7Q90u5ByPqwwuvuoBx7bfKh4rWYzkdgu4EYFwgk6idK2YswaKyN8uwCuqVh41lQWVja0GMMiyIA3F2r4h0kHmk+E6aIhMoju4h7mNl6/4KaDYx20AAplVJk99gFq6TEm6I7z4GIu8OngM6FkH6UQj/vF89sa2NkI4edRaMidxoXSujy6umqUVl9qEn74mLttPfLxQkl4DDtV95Idt/hGAGuvYYzzkQc1LaxD/F9ICa6F3l6NHE1d9f2t0ZfAFa7tl3OGUJsMtHK5xL5X/vlWAcfdlqCsqOYIs0wJ+gCgjqYQ6GWZmmXIVAwQuyMwAtw7IxwItfod+bne1k9lMk0iZtooT8Kh6abJYGBemL9wGDtPL9JaArmau4h6rkAcjp2pSQmrD5o4o=

This is quite longer than the other one.

To rsync (incremental) from remote server (Centos 6.x) to local client (Ubuntu 18.04) I copied the public key I created from client to server to execute rsync without password.

PasswordAuthentication yes at sshd_config

At local Ubuntu I have some executable scripts that look like

#!/bin/sh

RSYNC=/usr/local/bin/rsync-incr
SSH=/usr/bin/ssh\ -p\ xxxx
ROTATE=60
RUSER=yyyy
RHOST=zzzz
RPATH=/path-to-remote-dir/
LPATH=/path-to-local-dir/

$RSYNC -az --rsh="$SSH" $ROTATE $RUSER@$RHOST:$RPATH $LPATH

I run this script from command line /path-to-local-script-file

and it performs okay but if I add this line to crontab -e

00 00   * * *   /path-to-local-script-file

I get a cron error "Permission denied, please try again" when it is executed

Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).
rsync: connection unexpectedly closed (0 bytes received so far)
[Receiver] rsync error: unexplained error (code 255) at io.c(235) [Receiver=3.1.2]
*** ERROR: rsync returned code 255

Obviusly it is a permission issue. What I don't get is why I am able to execute /path-to-local-script-file from command line and perform rsync task successfully as user myname and cannot form cron (crontab -e executed as the same user.

Edit 1: I created a new key without passphrase, deleted the old rsa-ssh line with the public key from authorized_keys at remote server.
Same behavior, ok running script from command line, permission denied from cron

Edit 2:
Server log connecting ssh from command line

May 23 10:20:53 host sshd[21067]: Accepted publickey for root from xxx.xxx.6.13 port 42836 ssh2

May 23 10:20:53 host sshd[21067]: pam_unix(sshd:session): session opened for user root by (uid=0)

Server log connecting ssh from cron

May 23 10:17:03 host sshd[18163]: Failed password for root from xxx.xxx.6.13 port 42514 ssh2

May 23 10:17:03 host sshd[18163]: Failed password for root from xxx.xxx.6.13 port 42514 ssh2

May 23 10:17:03 host sshd[18164]: Connection closed by xxx.xxx.6.13

Centos 6.8 Postfix 2.6.6

I still am having problems with Postgrey greylisting. I forgot my Dropbox password so I followed the know procedure. Dropbox sent me a mail to change it. Postgrey is continuously rejecting dropbox retries.

In my maillog each 5/6 minutes I see dropbox rejections, "reason=new"

I guess this is because sender's IP changes. After 4/5 tries dropbox server stops retries.

How can this be fixed apart of manually add sender in whitelist?

Edit 1: I added "dropbox.com" to /etc/postfix/postgrey_whitelist_clients.local, restarted Postfix but sender=01000157d7ee0e57-3626bd2e-5464-4efc-b36b-a61d9df644d2-000000@email.dropbox.com is rejected (sender's "name" changes every try)

Edit 2:

Oct 18 11:30:36 host postgrey[1813]: action=greylist, reason=new, client_name=a10-6.smtp-out.amazonses.com, client_address=54.240.10.6, sender=01000157d7ee0e57-3626bd2e-5464-4efc-b36b-a61d9df644d2-000000@email.dropbox.com, recipient=d@s

Oct 18 11:30:36 host postfix/smtpd[4306]: NOQUEUE: reject: RCPT from a10-6.smtp-out.amazonses.com[54.240.10.6]: 450 4.2.0 : Recipient address rejected: Greylisted, see http://postgrey.schweikert.ch/help/s.html; from=<01000157d7ee0e57-3626bd2e-5464-4efc-b36b-a61d9df644d2-000000@email.dropbox.com> to= proto=ESMTP helo=

Edit 3: After hours one of rejected IPs was used again so mail was delivered

Oct 18 14:03:39 host postgrey[1813]: action=pass, reason=triplet found, delay=10532, client_name=a27-148.smtp-out.us-west-2.amazonses.com, client_address=54.240.27.148, sender=01010157d8133997-c0c68e0b-a976-4319-9e67-0f18785a6bbe-000000@email.dropbox.com, recipient=d@s

Oct 18 14:03:39 host opendkim[1496]: 004561CA0888: message has signatures from dropbox.com, amazonses.com

Oct 18 14:03:40 host postfix/qmgr[12510]: 004561CA0888: from=<01010157d8133997-c0c68e0b-a976-4319-9e67-0f18785a6bbe-000000@email.dropbox.com>, size=6972, nrcpt=1 (queue active)

• SM version 1.4.22 Centos 6.7 PHP 5.3.3 Apache 2.2.15 Plugins:
  1. filters
  2. delete_move_next
  3. message_details
  4. newmail
  5. translate
  6. squirrelspell
  7. set_user_data

last versions Postfix 2.6.6, Dovecot 2.0.9 installed from Webmin CP Tests from Firefox (Ubuntu, XP), Thundirbird (Ubuntu client), Safari Mac

This is a problem about special chars like accented vowels (Spanish language option selected). No problem creating email. Recipient receives it correctly (same in Squirrelmail and Thundirbird).

The problem comes when the recipient answers the sender keeping the original text with those accented vowels or sends a new mail with new ones. Sender receives correctly the replied (or new) message but when he replies again to the recipient those accented vowels are not interpreted correctly.

Below some screenshots.

Sender’s Inbox getting a new email with accented vowels:

Reading incoming email content:

Replying email:

I've contacted SM-i18n group but I didn't get an answer