What started as a suspected internet issue now looks like an issue with postfix Hopefully someone can help me fix?

I seem to be having some random connection issues with my amazon AWS I upgraded 2 servers. A home server through SSH and my amazon server through SSH one after the other.

MY home server has no issues with connecting to the internet but it seems that my amazon does only recently.

I noticed this code in MOTD and started to investigate.

I can connect fine with SSH and seem to check "some" updates the list seems very short but nothing fails with apt

Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check     your Internet connection or proxy settings

Last login: Sun Sep 23 12:19:05 2018 from
ubuntu@ip-***-**-**-**:~$ ping https://changelogs.ubuntu.com/meta-release-    lts
ping: https://changelogs.ubuntu.com/meta-release-lts: Name or service not     known
ubuntu@ip-***-**-**-**:~$ ping ubuntu.com
PING ubuntu.com ( 56(84) bytes of data.

--- ubuntu.com ping statistics ---
68 packets transmitted, 0 received, 100% packet loss, time 68613ms

ubuntu@ip-***-**-**-**:~$ ping google.com
PING google.com ( 56(84) bytes of data.
--- google.com ping statistics ---
14 packets transmitted, 0 received, 100% packet loss, time 13292ms

ubuntu@ip-***-**-**-**:~$ sudo apt update
Hit:1 http://us-west-2.ec2.archive.ubuntu.com/ubuntu bionic InRelease
Hit:2 http://us-west-2.ec2.archive.ubuntu.com/ubuntu bionic-updates     InRelease
Hit:3 http://us-west-2.ec2.archive.ubuntu.com/ubuntu bionic-backports     InRelease
Hit:4 http://security.ubuntu.com/ubuntu bionic-security InRelease              
Reading package lists... Done                      
Building dependency tree      
Reading state information... Done
All packages are up to date.

Can anyone help?

I have checked my mailserver on ssl-tools and connection is fine. I have been receiving emails but just discovered that I cannot send emails.


I figured maybe a firewall issue as only incoming connections are affected and got this

ubuntu@ip-***-**-**-**:~$ sudo ufw status
WARN: Duplicate profile 'Dovecot IMAP', using last found
WARN: Duplicate profile 'Dovecot Secure IMAP', using last found
WARN: Duplicate profile 'Dovecot POP3', using last found
WARN: Duplicate profile 'Dovecot Secure POP3', using last found
Status: inactive


I actually think now that it is a postfix issue. I cannot get postfix to start?

systemctl status postfix -l

● postfix.service - Postfix Mail Transport Agent
   Loaded: loaded (/lib/systemd/system/postfix.service; enabled; vendor     preset: 
   Active: active (exited) since Mon 2018-10-01 18:38:57 BST; 2h 34min ago
 Main PID: 1379 (code=exited, status=0/SUCCESS)
    Tasks: 0 (limit: 1108)
   CGroup: /system.slice/postfix.service

Oct 01 18:38:57 mail.**********.com systemd[1]: Starting Postfix     Mail Tra
Oct 01 18:38:57 mail.**********.com systemd[1]: Started Postfix Mail Tran

As you can see (Active: active (exited))


tail /var/log/mail.log

Oct  8 19:06:07 mail postfix/smtpd[8803]: Anonymous TLS connection  established from mail133-16.atl131.mandrillapp.com[]: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
Oct  8 19:06:07 mail postfix/smtpd[8803]: warning: SASL: Connect to private/dovecot-auth failed: Connection refused
Oct  8 19:06:07 mail postfix/smtpd[8803]: fatal: no SASL authentication mechanisms
Oct  8 19:06:08 mail postfix/master[8206]: warning: process /usr/lib/postfix/sbin/smtpd pid 8803 exit status 1
Oct  8 19:06:08 mail postfix/master[8206]: warning: /usr/lib/postfix/sbin/smtpd: bad command startup -- throttling
Oct  8 19:07:48 mail postfix/anvil[8805]: statistics: max connection rate 1/60s for (smtpd: at Oct  8 19:06:07
Oct  8 19:07:48 mail postfix/anvil[8805]: statistics: max connection count 1 for (smtpd: at Oct  8 19:06:07
Oct  8 19:07:48 mail postfix/anvil[8805]: statistics: max cache size 1 at Oct  8 19:06:07
Oct  8 19:07:50 mail dovecot: auth: passwd-file(*******@******.com,,<2BSQf7t3su2xCsVM>): Password mismatch
Oct  8 19:07:55 mail dovecot: imap-login: Disconnected (auth failed, 1 attempts in 9 secs): user=<*******@******.com>, method=PLAIN, rip=, lip=, TLS, session=<2BSQf7t3su2xCsVM>

postconf -n

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = no
broken_sasl_auth_clients = yes
canonical_maps = hash:/etc/postfix/canonical
default_destination_concurrency_limit = 5
disable_vrfy_command = yes
dovecot_destination_recipient_limit = 1
home_mailbox = Maildir/
inet_interfaces = all
inet_protocols = all
mailbox_command = /usr/lib/dovecot/deliver -c /etc/dovecot/conf.d/99-mail-    stack-delivery.conf -m "${EXTENSION}"
mailbox_size_limit = 0
message_size_limit = 104857600
mydestination = **********.com, localhost, mail.**********.com, localhost.**********.com
myhostname = mail.**********.com
mynetworks = [::ffff:]/104 [::1]/128
myorigin = /etc/mailname
postscreen_access_list = permit_mynetworks
postscreen_dnsbl_action = enforce
postscreen_dnsbl_sites = zen.spamhaus.org, b.barracudacentral.org, bl.spamcop.net
postscreen_greet_action = enforce
readme_directory = no
recipient_delimiter = +
relay_destination_concurrency_limit = 1
relayhost =
smtp_tls_note_starttls_offer = yes
smtp_tls_security_level = may
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtpd_banner = $myhostname ESMTP
smtpd_helo_required = yes
smtpd_helo_restrictions = permit_mynetworks,reject_non_fqdn_helo_hostname,     reject_invalid_helo_hostname,reject_unknown_helo_hostname, permit
smtpd_recipient_restrictions = reject_unknown_client_hostname,reject_unknown_sender_domain, reject_unknown_recipient_domain,reject_unauth_pipelining, permit_mynetworks,permit_sasl_authenticated, reject_unauth_destination,reject_invalid_hostname, reject_non_fqdn_sender
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
smtpd_sasl_local_domain = $myhostname
smtpd_sasl_path = private/dovecot-auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_sender_login_maps = $virtual_mailbox_maps
smtpd_sender_restrictions = reject_unknown_sender_domain,reject_sender_login_mismatch
smtpd_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
smtpd_tls_ask_ccert = yes
smtpd_tls_auth_only = yes
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.**********.com/fullchain.pem
smtpd_tls_ciphers = high
smtpd_tls_key_file = /etc/letsencrypt/live/mail.**********.com/privkey.pem
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_security_level = may
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom
unknown_address_reject_code = 550
unknown_client_reject_code = 550
unknown_hostname_reject_code = 550
virtual_alias_maps = hash:/etc/postfix/virtual
virtual_mailbox_domains = hash:/etc/postfix/virtual-mailbox-domains
virtual_mailbox_maps = hash:/etc/postfix/virtual-mailbox-users
virtual_transport = dovecot

doveconf -n

# (d6601f4ec): /etc/dovecot/dovecot.conf
# Pigeonhole version 0.4.21 (92477967)
# OS: Linux 4.15.0-36-generic x86_64 Ubuntu 18.04.1 LTS ext4
auth_mechanisms = plain login
auth_verbose = yes
mail_home = /var/mail/vmail/%d/%n
mail_location = maildir:/var/mail/vmail/%d/%n/mail:LAYOUT=fs
mail_privileged_group = mail
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope encoded-character     vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext
namespace inbox {
  inbox = yes
  location = 
  mailbox Drafts {
    auto = subscribe
    special_use = \Drafts    
  mailbox Junk {
    auto = subscribe
    special_use = \Junk
  mailbox Sent {
    auto = subscribe
    special_use = \Sent
  mailbox "Sent Messages" {
    auto = subscribe
    special_use = \Sent
  mailbox Trash {
    auto = subscribe
    special_use = \Trash
  prefix = 
passdb {
  args = username_format=%u scheme=ssha512 /etc/dovecot/passwd.db
  driver = passwd-file
plugin {
  sieve = ~/.dovecot.sieve
  sieve_after = /var/mail/vmail/sieve-after
  sieve_before = /var/mail/vmail/sieve-before
  sieve_dir = ~/sieve
protocols = imap
service auth {
  unix_listener /var/spool/postfix/private/auth {
    group = postfix
    mode = 0660
    user = postfix
ssl = required
ssl_cert = </etc/letsencrypt/live/mail.**********.com/fullchain.pem
ssl_client_ca_dir = /etc/ssl/certs
ssl_key =  # hidden, use -P to show it
userdb {
  args = uid=5000 gid=5000 home=/var/mail/vmail/%d/%n
  driver = static
protocol lda {
  deliver_log_format = msgid=%m: %$
  mail_plugins = sieve
  postmaster_address = postmaster@**********.com
  quota_full_tempfail = yes
  rejection_reason = Your message to <%t> was automatically rejected:%n%r
protocol imap {
  imap_client_workarounds = delay-newmail tb-extra-mailbox-sep
  mail_max_userip_connections = 10

EDIT 4 as comment

sudo ss -nlt 'sport = 25'

State                      Recv-Q                      Send-Q                                            Local Address:Port                                           Peer Address:Port                     
LISTEN                     0                           100                                                                                   *                        
LISTEN                     0                           100                                                        [::]:25                                                     [::]:*                                      


sudo tail -n10 -f /var/log/mail.err

Been browsing log files and have noticed this. Not sure if I have broken things trying to 'fix'

Oct  8 21:06:53 mail postfix/smtpd[9357]: fatal: no SASL authentication mechanisms
Oct  8 21:07:54 mail postfix/smtpd[9360]: fatal: no SASL authentication mechanisms
Oct  8 21:21:55 mail postfix/smtpd[9442]: fatal: no SASL authentication mechanisms
Oct  8 21:25:13 mail postfix/smtpd[9456]: fatal: no SASL authentication mechanisms
Oct  8 21:31:39 mail postfix/smtpd[9473]: fatal: no SASL authentication mechanisms
Oct  8 21:34:36 mail dovecot: doveadm: Error: This is Dovecot's error log (1539030876)
Oct  8 21:34:36 mail dovecot: doveadm: Fatal: This is Dovecot's fatal log (1539030876)
Oct  8 21:34:47 mail dovecot: doveadm: Error: This is Dovecot's error log (1539030887)
Oct  8 21:34:47 mail dovecot: doveadm: Fatal: This is Dovecot's fatal log (1539030887)
Oct  8 21:36:58 mail postfix/smtpd[9576]: fatal: no SASL authentication mechanisms
Oct  8 21:40:17 mail postfix/smtpd[9701]: fatal: no SASL authentication mechanisms

Can anyone help me? I am pulling my hair out :(

Thank you

  • What does /var/log/mail.log show for the postfix startup? It would give you specific errors or such – Thomas Ward Oct 8 '18 at 18:07
  • I have a tail command above not sure if that includes startup? Sorry was editing the post as your comment came through. – Jinx13 Oct 8 '18 at 18:29
  • Can you show what sudo ss -nlt 'sport = 25' shows, please? (I assume your postfix is configured to do SMTP on the default port 25?) – Thomas Ward Oct 8 '18 at 19:30
  • Added output to OP – Jinx13 Oct 8 '18 at 20:32

So you actually don't have a Postfix "startup" issue.

Per the output of the ss command, there is something listening on Port 25 - that's very likely to be Postfix.

The issues you do have is you haven't configured authentication for SMTP and such correctly. That requires you to look into your Dovecot configurations and your Postfix configurations and configure them properly. You may want to review the Digital Ocean guide on POstfix Email Server with Dovecot to get the configurations set up properly for both Postfix and Dovecot to have proper SASL auth backend handoff to Dovecot. However, as I don't know if you followed another guide, you should probably review whatever guide you were following if you did use one to try and diagnose the core problems there, as you probably missed a step or misconfigured something.

  • Thank you for your help, this mailserver has been running fine for 4 years and only broke after upgrading to 18.04 apologies for saying I had a postfix startup issue it's all about trying to get to the bottom of a particular issue right? You have to understand that this started as an Internet port issue 2 weeks ago and I've been trying to fix since. I don't think I've missed a step because the server would not have been running so long correct? Thanks again for your help I'll review the link you posted – Jinx13 Oct 9 '18 at 14:03
  • @Jinx13 The upgrade tends to have a problem with potentially overwriting things. If you went from a really old server like 12.04 to a 16.04 or 18.04 it won't be 'identical' and you will have to manually do the reconfiguration steps. Which is a problem unfortunately, but I've run into that at several places I"ve done consulting with. – Thomas Ward Oct 9 '18 at 14:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.