Rudie's questions

I've followed tutorial on http://flurdy.com/docs/postfix/ to set up an email server, and most of it works (after switching from Courier to Dovecot). Just not sending email through SMTP. Sending with sendmail works.

This is what I see in /var/log/auth.log when I try to send an email with Thunderbird:

May 22 18:45:59 myserver postfix/submission/smtpd[16560]: sql auxprop plugin using mysql
May 22 18:45:59 myserver saslauthd[16141]: pam_unix(smtp:auth): check pass; user unknown
May 22 18:45:59 myserver saslauthd[16141]: pam_unix(smtp:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=
May 22 18:46:01 myserver saslauthd[16141]: DEBUG: auth_pam: pam_authenticate failed: Authentication failure
May 22 18:46:01 myserver saslauthd[16141]:                 : auth failure: [user=user1] [service=smtp] [realm=myserver.nl] [mech=pam] [reason=PAM auth error]
May 22 18:46:01 myserver saslauthd[16142]: pam_unix(smtp:auth): check pass; user unknown
May 22 18:46:01 myserver saslauthd[16142]: pam_unix(smtp:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=
May 22 18:46:04 myserver saslauthd[16142]: DEBUG: auth_pam: pam_authenticate failed: Authentication failure
May 22 18:46:04 myserver saslauthd[16142]:                 : auth failure: [user=user1] [service=smtp] [realm=myserver.nl] [mech=pam] [reason=PAM auth error]

(I'm logged in as [email protected], and IMAP works.)

And I can see something query mysql for user [email protected], but there are some many processes and daemons and configs working together, I have no idea which part fails.

A summary:

• postfix is set up to use sasl (in /etc/postfix/main.cf and /etc/postfix/sasl/smtpd.conf)
• saslauthd is set up to use pam (in /etc/default/saslauthd)
• pam smtp is set up to use mysql for its user db (but it never seems to?) (in /etc/pam.d/smtp)

The sql_select from /etc/postfix/sasl/smtpd.conf is used to query for user1. I can see changes there in the mysql log.

The configured table and columns in /etc/pam.d/smtp are never used. Changes there don't do anything.

testsaslauthd only 'works' for me if I add -f /var/spool/postfix/var/run/saslauthd/mux, but it ALWAYS returns a NO "authentication failed" and NEVER queries mysql, so I've no idea how that could ever work. But the auth.log output is very similar to the output from Thunderbird's real request (that does trigger a mysql query/lookup):

May 22 18:59:56 myserver saslauthd[16756]: pam_unix(imap:auth): check pass; user unknown
May 22 18:59:56 myserver saslauthd[16756]: pam_unix(imap:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=
May 22 18:59:58 myserver saslauthd[16756]: DEBUG: auth_pam: pam_authenticate failed: Authentication failure
May 22 18:59:58 myserver saslauthd[16756]:                 : auth failure: [[email protected]] [service=imap] [realm=] [mech=pam] [reason=PAM auth error]

And then there's the password hash. I've set up Dovecot to only accept SSL and use the plaintext password (users.clear). I don't know if the hashed password (users.crypt) is correct, or if it's even used by Postfix. I've tried all combinations in all config files. The auth.log output is always the same. No details.

Thunderbird tells me it can't send the message, and then shows a kind of error message: ... "unexpected error 80004005" ... "could not be sent for an unknown reason". That doesn't seem like a wrong password error, but an internal server error somewhere. But no horrible error messages in the logs...

After adding some debug level somewhere (sorry I can't remember, so many config files!!) the syslog contains more on the smtp connection:

May 22 19:10:45 myserver postfix/submission/smtpd[16779]: SSL_accept:SSLv3/TLS read finished
...
May 22 19:10:45 myserver postfix/submission/smtpd[16779]: Anonymous TLS connection established from ip-1.2.3.4.ip.myisp.net[4.3.2.1]: TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)
...
May 22 19:10:45 myserver postfix/submission/smtpd[16779]: Read 22 chars: EHLO [192.168.0.101]??
...
May 22 19:10:45 myserver postfix/submission/smtpd[16779]: Read 49 chars: AUTH PLAIN AHVzZXIxQG15c2VydmVyLm5sAHBp
May 22 19:10:48 myserver postfix/submission/smtpd[16779]: warning: SASL authentication failure: Password verification failed
May 22 19:10:48 myserver postfix/submission/smtpd[16779]: warning: ip-1.2.3.4.ip.myisp.net[4.3.2.1]: SASL PLAIN authentication failed: authentication failure
May 22 19:10:48 myserver postfix/submission/smtpd[16779]: Write 64 chars: 535 5.7.8 Error: authentication failed:
...
May 22 19:10:48 myserver postfix/submission/smtpd[16779]: Read 12 chars: AUTH LOGIN??
May 22 19:10:48 myserver postfix/submission/smtpd[16779]: Write 18 chars: 334 VXNlcm5hbWU6??
...
May 22 19:10:50 myserver postfix/submission/smtpd[16779]: warning: ip-1.2.3.4.ip.myisp.net[4.3.2.1]: SASL LOGIN authentication failed: authentication failure
May 22 19:10:50 myserver postfix/submission/smtpd[16779]: Write 64 chars: 535 5.7.8 Error: authentication failed:
...
May 22 19:10:52 myserver postfix/submission/smtpd[16779]: disconnect from ip-1.2.3.4.ip.myisp.net[4.3.2.1] ehlo=2 starttls=1 auth=0/2 quit=1 commands=4/6

The EHLO + AUTH PLAIN ... are interesting... The EHLO isn't myserver? The logged base64 is cut off? And then "Password verification failed", but no details on which part failed.

I can't find any more debugging than this. syslog, mail log, auth log, mysql log. All the config files are huge, so I didn't add most. I followed http://flurdy.com/docs/postfix/ pretty exactly, and verified every step several times, so that's what I got. EXCEPT clear vs crypt, I've changed that around a few times.

Any brilliant ideas?

I have a queue script that finds new jobs from the db every second and handles them. Sometimes it doesn't do anything for 10 hours, and sometimes it receives 1000 new jobs in 3 min. The queue works fine, mostly.

It needs restarting though. (I'm not entirely sure why. I think other services the jobs talk to don't like connections being open for a long time. Restarting the queue, resets all connections. Maybe that's not why.) And sometimes the queue script just dies. Maybe memory error, I can't pinpoint it.

There's 2 ways to restart that I'm both fine with, (but it has to be automatic):

1. Explicitly restart it every 24h: ctrl C + ./queue.sh
2. Wait until it dies, and start it again

I'm not sure about either... The queue runs in a screen so I can follow output when I want. How can one command listen for another command to finish and restart it, without being a daemon?

I can't install anything. It's a crappy Redhat server that I don't have decent admin access to.

I've thought about creating a cronjob that fires every 24h and kills itself after 24h, but that just sounds so wrong... I can't use the cronjob for the queue, because new jobs must be executed almost-instantly.

In this case, it's an HTTP request to https://www.instagram.com/, but it has happened before like this.

• From my home (Ubuntu, i686) server it's very fast (~ 0.3 sec).
• From my online, modern (Ubuntu, x86_64) server it's very slow (~3.5 sec).
• From another online, older (Redhat, x86_64) server it's in between (~ 0.6 sec).

All 3 servers are in the same country. They all run Linux, though not the exact same. Results are consistent.

dig from all 3 servers gives the same ipv4 result.

Why the difference? I'm not worried about the middle (0.6 sec), but 3.5 sec is waaay to slow.

I've had a similar problem with a very slow SSH handshake, which was due to ipv6 vs ipv4. Could that be the problem? How would I find out?

I have a vhost that accepts all domains and subdomains from 4 top domain names, e.g. example.com, example.org, three.example.co.uk etc.

I want the entire VHost to redirect to the exact same URL as requested, but HTTPS.

I know of this:

<VirtualHost *:80>
    ServerName example.com
    ServerAlias *.all *.other *.domains
    Redirect permanent / https://example.com/
</VirtualHost>

but that won't work for subdomains, because explicit target URL.

It's so easy in nginx:

return 301 https://$host$request_uri;

so I thought Apache would have a thing for that, and it sort-of does, but this doesn't work (no Apache error, just broken redirect):

Redirect permanent / https://%{HTTP_HOST}/

Is there any way to use a domain/host variable? Bonus points for not using RewriteRule!

I have a wildcard domain certificate from StartSSL for a site (https://later.webblocks.nl/).

When I check it in any browser on my home PC, it's all good. (Green lock in Chrome.) When I check it in Chrome on my work PC, it's not good:

The page loads like no problem. There are no other requests, so nothing over HTTP. It uses safe protocols etc. I checked the connection on SSL Labs and Global Sign and they agree it's perfectly safe.

On the same computer, other browsers are fine with it. On other computers, Chrome is fine with it too. I tried restarting, flushing caches, incognito mode, etc. Nothing changes.

It's no real problem for me, because I know it's safe, but it's still annoying.

Any ideas?

PS. Chrome did something like this a while ago with Windows XP: suddenly websites were 'unsafe' because Windows protocols were unsafe. Both PC's are Windows 7 and the same version of Chrome, so that's probably not it...

More info:

For some reason the 2 computers have different certificate chains. The domain certificate and root certificate are the same, but the intermediary is different. On my home PC it uses sha2, on my work PC it uses sha1. The intermediary is included in the server cert (which has sha2), so that's weird. All the SSL checkers only detect the sha2 intermediary cert. What's going on!?

I don't get it. I have a VPS with Nginx and php-fpm and MySQL. Should be very lightweight. No Apache, right? When I reboot, it is very lightweight. ~ 50/481 MB MEM usage. Very acceptable IMO.

And after a few days there are ~ 20 mysqld processes running and ~ 7 php-fpm processes and ~ 8 getty processes and 3/4 of 1024 MB swap full and the server is out of memory!

I'm not a pro, but I'm pretty sure that's not right...

I think the crons have something to do with it. I have 3 jobs scheduled:

• a simple one (read smtp for new mail) every minute
• a big one (read RSS from ~ 30 blogs) every night
• a simple one (mysqldump of 2 small databases) every morning

I'm not sure why I think that =) Probably because the simple job (SMTP, every minute) is always in the htop list. (But always with 0% cpu, 0% mem and 0:00:00 time...)

The 20 mysqld's are also very strange, but they don't seem to require a lot of memory.

The php-fpm's apparently do consume a lot of memory. In the 10 minutes it took to write this, the mem has gone from 66 MB to 120 MB! The top 6 mem consuming processes are php-fpm: pool www. When I restart /etc/init.d/php5-fpm the mem goes down to ~ 70 MB. How does php-fpm require 400+ MB of mem? What's up with that?

Swap has been pretty steady at ~ 98 MB the last 10 mins.

Anyone know what might be going on? (I know it's very little info on a whole server.) I can add details if you wish.

I'm not even running any decent sized websites!

More info:

A screen of htop --sort-key PERCENT_MEM:

Pastebin with ps xv, cat /proc/meminfo and top: http://pastebin.com/PfXeupMN