unable to restart zimbra after reboot

[KevinH]

1) sh -x /opt/zimbra/bin/postfix status

Try to dig deeper on why postfix thinks it down.

2) This looks like a bug where the zimbra script was not installed. Can you file it with details about your OS, and the version you installed. For now you can get it from libexex/zimbra

3) Looks like tomcat came up ok. Does ps -ef | grep tomcat find it?

[lievacke]

So I did

find /etc/rc* -name ???zimbra -exec rm -f {} \;
update-rc.d zimbra defaults

And finally, a hard powercycle on the running installation seems to get a LIVE zimbra mailbox store!!!

Regards,

Lieven

langoest:~# su - zimbra
zimbra@langoest:~$ zmcontrol start
Host langoest.ugent.be
Starting logger...Done.
Starting mailbox...Done.
Starting spell...Done.
zimbra@langoest:~$ ps -ef | grep tomcat
zimbra 9433 1 39 10:33 pts/0 00:00:03 /opt/zimbra/jdk1.5.0_06/bin/java -Xms607m -Xmx607m -client -XX:NewRatio=2 -Dcatalina.base=/opt/zimbra/apache-tomcat-5.5.15 -Dcatalina.home=/opt/zimbra/apache-tomcat-5.5.15 -Djava.io.tmpdir=/opt/zimbra/apache-tomcat-5.5.15/temp -Djava.library.path=/opt/zimbra/lib/jars -Djava.endorsed.dirs=/opt/zimbra/apache-tomcat-5.5.15/common/endorsed -classpath /opt/zimbra/apache-tomcat-5.5.15/bin/bootstrap.jar:/opt/zimbra/apache-tomcat-5.5.15/bin/commons-logging-api.jar org.apache.catalina.startup.Bootstrap start
zimbra 9663 8853 0 10:33 pts/0 00:00:00 grep tomcat
zimbra@langoest:~$ zmcontrol status
Host langoest.ugent.be
logger Running
mailbox Running
spell Running

[lievacke]

hmmm.. part of my post vanished!

* /opt/zimbra/redolog/redo.log was owned by root:

langoest:~# ls -l /opt/zimbra/redolog/redo.log
-rw-r----- 1 root root 512 Apr 15 10:46 /opt/zimbra/redolog/redo.log

langoest:~# chown root:root /opt/zimbra/redolog/redo.log

langoest:~# su - zimbra -c 'zmcontrol start'
Host langoest.ugent.be
Starting logger...Done.
Starting mailbox...Done.
Starting spell...Done.

langoest:~# su - zimbra -c 'zmcontrol status'
Host langoest.ugent.be
logger Running
mailbox Running
spell Running

The rest of the story indicated a missing init script (previous post of droefs)

langoest:~# cp -a /opt/zimbra/libexec/zimbra /etc/init.d/

[paste the previous post here]

Lieven

[lievacke]

the script /opt/zimbra/bin/postfix contains a

postqueue -p

(At least) on a debian install, this returns with a rc of 70...

Hacked

/opt/zimbra/bin/postfix: (prepend sudo to postque line)
...
if [ $1 = "status" ]; then
sudo ${zimbra_home}/postfix-${postfix_version}/sbin/postqueue -p > /dev/null 2>&1
R=$?
...

and /etc/sudoers: (add line)

...
%zimbra ALL=NOPASSWD:/opt/zimbra/postfix-2.2.9/sbin/postqueue
...

This fixes the non-zero rc of postque....

Regarding the problem above, there still seems to be an issue with the sasl-config... I look into that later.

Regards,
Lieven

[bobby]

lieven

1. postqueue should run setgid so you shouldn't need to sudo it; try running it by hand as the zimbra user "postqueue -p"

2. that line in the sudoers file will break after postfix gets upgraded

3. is the mta status showing that saslauthd isn't running?

[lievacke]

lieven

1. postqueue should run setgid so you shouldn't need to sudo it; try running it by hand as the zimbra user "postqueue -p"

zimbra@krab:~/log$ /opt/zimbra/postfix/sbin/postqueue -p
postqueue: fatal: Connect to the Postfix showq service: Permission denied

2. that line in the sudoers file will break after postfix gets upgraded

indeed.. but then I must first have another way to track down the problem

3. is the mta status showing that saslauthd isn't running?

indeed, it doesn't get started on zmcontrol start:

zimbra@krab:~/postfix/spool$ zmcontrol start
Host krab.ugent.be
Starting antispam...Done.
Starting antivirus...Done.
Starting mta...FAILED
getService: sasl
getService: webxml
getService: mailbox
getService: perdition
DO: /opt/zimbra/postfix/sbin/postconf -e content_filter='smtp-amavis:[127.0.0.1]:10024'
DO: /opt/zimbra/postfix/sbin/postconf -e myhostname='krab.ugent.be'
DO: /opt/zimbra/postfix/sbin/postconf -e recipient_delimiter=''
DO: /opt/zimbra/postfix/sbin/postconf -e smtpd_sasl_auth_enable='yes'
DO: /opt/zimbra/postfix/sbin/postconf -e smtpd_tls_auth_only='yes'
DO: /opt/zimbra/postfix/sbin/postconf -e smtpd_use_tls='yes'
DO: /opt/zimbra/postfix/sbin/postconf -e disable_dns_lookups='no'
DO: /opt/zimbra/postfix/sbin/postconf -e message_size_limit='10240000'
DO: /opt/zimbra/postfix/sbin/postconf -e relayhost=''
DO: /opt/zimbra/postfix/sbin/postconf -e smtpd_recipient_restrictions='reject_non_fqdn_reci pient, permit_sasl_authenticated, permit_mynetworks, reject_invalid_hostname, reject_non_fqdn_sender, reject_unauth_destination, permit'
DO: /opt/zimbra/postfix/sbin/postconf -e alias_maps='hash:/etc/aliases'
DO: /opt/zimbra/postfix/sbin/postconf -e broken_sasl_auth_clients='yes'
DO: /opt/zimbra/postfix/sbin/postconf -e command_directory='/opt/zimbra/postfix-2.2.9/sbin'
DO: /opt/zimbra/postfix/sbin/postconf -e daemon_directory='/opt/zimbra/postfix-2.2.9/libexec'
DO: /opt/zimbra/postfix/sbin/postconf -e header_checks='pcre:/opt/zimbra/conf/postfix_header_checks'
DO: /opt/zimbra/postfix/sbin/postconf -e mailq_path='/opt/zimbra/postfix-2.2.9/sbin/mailq'
DO: /opt/zimbra/postfix/sbin/postconf -e manpage_directory='/opt/zimbra/postfix-2.2.9/man'
DO: /opt/zimbra/postfix/sbin/postconf -e newaliases_path='/opt/zimbra/postfix-2.2.9/sbin/newaliases'
DO: /opt/zimbra/postfix/sbin/postconf -e queue_directory='/opt/zimbra/postfix-2.2.9/spool'
DO: /opt/zimbra/postfix/sbin/postconf -e sender_canonical_maps='ldap:/opt/zimbra/conf/ldap-scm.cf'
DO: /opt/zimbra/postfix/sbin/postconf -e sendmail_path='/opt/zimbra/postfix-2.2.9/sbin/sendmail'
DO: /opt/zimbra/postfix/sbin/postconf -e smtpd_client_restrictions='reject_unauth_pipelinin g'
DO: /opt/zimbra/postfix/sbin/postconf -e smtpd_data_restrictions='reject_unauth_pipelining'
DO: /opt/zimbra/postfix/sbin/postconf -e smtpd_helo_required='yes'
DO: /opt/zimbra/postfix/sbin/postconf -e smtpd_tls_cert_file='/opt/zimbra/conf/smtpd.crt'
DO: /opt/zimbra/postfix/sbin/postconf -e smtpd_tls_key_file='/opt/zimbra/conf/smtpd.key'
DO: /opt/zimbra/postfix/sbin/postconf -e smtpd_tls_loglevel='3'
DO: /opt/zimbra/postfix/sbin/postconf -e transport_maps='ldap:/opt/zimbra/conf/ldap-transport.cf'
DO: /opt/zimbra/postfix/sbin/postconf -e version='2.2.9'
DO: /opt/zimbra/postfix/sbin/postconf -e virtual_alias_domains='ldap://opt/zimbra/conf/ldap-vad.cf'
DO: /opt/zimbra/postfix/sbin/postconf -e virtual_alias_maps='ldap:/opt/zimbra/conf/ldap-vam.cf'
DO: /opt/zimbra/postfix/sbin/postconf -e virtual_mailbox_domains='ldap:/opt/zimbra/conf/ldap-vmd.cf'
DO: /opt/zimbra/postfix/sbin/postconf -e virtual_mailbox_maps='ldap:/opt/zimbra/conf/ldap-vmm.cf'
DO: /opt/zimbra/postfix/sbin/postconf -e virtual_transport='error'
saslauthd[31706] :set_auth_mech : failed to initialize mechanism zimbra
zmsaslauthdctl failed to start

MTA reports being stopped, but actually it is running but the problem is the saslauthd connection:

zimbra@krab:~/postfix/spool$ zmcontrol status
Host krab.ugent.be
antispam Running
antivirus Running
mta Stopped
zmsaslauthdctl is not running

I'm digging further...

[bobby]

is it actually running (ps ax | grep sasl) ? if so, does the pid match the one in /opt/zimbra/cyrus-sasl/state/saslauthd.pid?


you might just need to verify that the auth host is set:

runing this on the mta server should list the mailbox server:
zmprov gs MTAHOSTNAME | grep zimbraMtaAuthHost

if not, you can set it like this (on the mta host):
zmprov ms MTAHOSTNAME zimbraMtaAuthHost MAILBOXHOSTNAME



p.s. there should be a symlink from ~/postfix/ to ~/postfix-<version>/ so you should be able to use that path in the sudoers to survive a postfix upgrade

what's the permissions look like on ~/sbin/postqueue?

[lievacke]

Allright, we're one step further down the road:

zimbra@krab:~$ zmprov ms krab.ugent.be zimbraMtaAuthHost langoest.ugent.be
zimbra@krab:~$ zmcontrol stop
Host krab.ugent.be
Stopping antispam...Done
Stopping antivirus...Done
Stopping logger...Done
Stopping mailbox...Done
Stopping mta...Done
Stopping snmp...Done
Stopping spell...Done
zimbra@krab:~$ zmcontrol start
Host krab.ugent.be
Starting antispam...Done.
Starting antivirus...Done.
Starting mta...Done.
zimbra@krab:~$ zmcontrol status
Host krab.ugent.be
antispam Running
antivirus Running
mta Running
zimbra@krab:~$

about the postqueue permissions, is setuid postdrop:

zimbra@krab:~$ ls -al ~/postfix/sbin/postqueue
-rwxr-sr-x 1 root postdrop 462628 Mar 10 00:24 /opt/zimbra/postfix/sbin/postqueue
zimbra@krab:~$

Looked a bit further to the defaults on a postfix debian package, and it seems like the diff is in the postfix/spool/public (mind the postdrop group ownership of the public dir and its contents and the setgid on the dir itselve):

krab:/opt/zimbra# ls -al postfix/spool/public/
total 8
drwx--x--- 2 postfix postdrop 4096 Apr 16 22:54 .
drwxr-xr-x 16 root postfix 4096 Apr 14 14:58 ..
srw-rw-rw- 1 postfix postfix 0 Apr 16 22:54 cleanup
srw-rw-rw- 1 postfix postfix 0 Apr 16 22:54 flush
prw--w--w- 1 postfix postfix 0 Apr 16 23:02 pickup
prw--w--w- 1 postfix postfix 0 Apr 16 22:59 qmgr
srw-rw-rw- 1 postfix postfix 0 Apr 16 22:54 showq
krab:/opt/zimbra#

While a debian package lists the permissions as follows:

lieven@grasshop:/var/spool$ sudo ls -al postfix/public/
totaal 8
drwx--s--- 2 postfix postdrop 4096 2006-04-08 22:48 .
drwxr-xr-x 19 root root 4096 2006-04-08 00:05 ..
srw-rw-rw- 1 postfix postdrop 0 2006-04-08 22:48 cleanup
srw-rw-rw- 1 postfix postdrop 0 2006-04-08 22:48 flush
prw--w--w- 1 postfix postdrop 0 2006-04-16 23:03 pickup
prw--w--w- 1 postfix postdrop 0 2006-04-16 22:59 qmgr
srw-rw-rw- 1 postfix postdrop 0 2006-04-08 22:48 showq
lieven@grasshop:/var/spool$

[lievacke]

p.s. there should be a symlink from ~/postfix/ to ~/postfix-<version>/ so you should be able to use that path in the sudoers to survive a postfix upgrade

Well I followed existing conventions, which all seem to reference version-qualified references in the sudoers file... Maybe this should be changed in general?