zmtrainsa exception

[ldotc]

Hello:

I have open source edition release 3.1.1_GA394 installed on Fedora Core 3 and am running into a problem with the zmtrainsa and auto-learning of spam/ham. This installation has been upgraded since the 3.0 M1 release and although I haven't had any significant problems I never had the spam/ham training accounts created. (At the very least I don't remember having removed them.)

I followed the instructions here to create the two training accounts and create the configuration parameters. To try things out I am running zmtrainsa from the command line as the Zimbra user. What I get back is an exception when it tries to run zmspamextract:

[zimbra@mail1 ~]$ /opt/zimbra/bin/zmtrainsa
Exception in thread "main" com.zimbra.cs.service.ServiceException: system failure: admin auth failed url=https://mail1.ldotc.com:7071/service/admin/soap/
at com.zimbra.cs.service.ServiceException.FAILURE(Ser viceException.java:131)
at com.zimbra.cs.util.SpamExtract.getAdminAuthToken(S pamExtract.java:446)
at com.zimbra.cs.util.SpamExtract.main(SpamExtract.ja va:198)
Caused by: com.zimbra.soap.SoapFaultException: authentication failed for zimbra
at com.zimbra.soap.Soap12Protocol.soapFault(Soap12Pro tocol.java:97)
at com.zimbra.soap.SoapTransport.extractBodyElement(S oapTransport.java:140)
at com.zimbra.soap.SoapTransport.parseSoapResponse(So apTransport.java:127)
at com.zimbra.soap.SoapHttpTransport.invoke(SoapHttpT ransport.java:214)
at com.zimbra.soap.SoapTransport.invokeWithoutSession (SoapTransport.java:186)
at com.zimbra.cs.util.SpamExtract.getAdminAuthToken(S pamExtract.java:441)
... 1 more
Exception in thread "main" com.zimbra.cs.service.ServiceException: system failure: admin auth failed url=https://mail1.ldotc.com:7071/service/admin/soap/
at com.zimbra.cs.service.ServiceException.FAILURE(Ser viceException.java:131)
at com.zimbra.cs.util.SpamExtract.getAdminAuthToken(S pamExtract.java:446)
at com.zimbra.cs.util.SpamExtract.main(SpamExtract.ja va:198)
Caused by: com.zimbra.soap.SoapFaultException: authentication failed for zimbra
at com.zimbra.soap.Soap12Protocol.soapFault(Soap12Pro tocol.java:97)
at com.zimbra.soap.SoapTransport.extractBodyElement(S oapTransport.java:140)
at com.zimbra.soap.SoapTransport.parseSoapResponse(So apTransport.java:127)
at com.zimbra.soap.SoapHttpTransport.invoke(SoapHttpT ransport.java:214)
at com.zimbra.soap.SoapTransport.invokeWithoutSession (SoapTransport.java:186)
at com.zimbra.cs.util.SpamExtract.getAdminAuthToken(S pamExtract.java:441)
... 1 more
bayes: perform_upgrade: bayes: unable to find bayes_toks and bayes_seen, stopping

archive-iterator: readdir found no mail in '/tmp/spam.3290' directory
Learned from 0 message(s) (0 message(s) examined).
archive-iterator: readdir found no mail in '/tmp/ham.3290' directory
Learned from 0 message(s) (0 message(s) examined).
bayes: synced databases from journal in 0 seconds: 302 unique entries (304 total entries)
dspam_clean starting
PROCESSING USER: zimbra
Processing sigs; age: 14
Processing probabilities; age: 0
Processing unused; any: 90 quota: 30 nospam: 15 onehit: 15

Is there an additional step in creating the spam training users? I just set them up from within the admin console under the default COS. I tried both with, and without passwords and had the same results either way.

Thanks Much,

Terry

[jholder]

Hi ldotc and welcome!

Exception in thread "main" com.zimbra.cs.service.ServiceException: system failure: admin auth failed url=https://mail1.ldotc.com:7071/service/admin/soap/

The problem is an access denied message, and not a crash (I assume you probably knew that

So, let's look and see what your authentications return by running(AS Zimbra):
zmprov gs [FQDN here] | grep zimbraMtaAuth
zmprov gs [FQDN here] | grep zimbraMailMode
zmprov gs [FQDN here] | grep zimbraMailPort
zmprov gs [FQDN here] | grep zimbraMailSSLPort

Please post the results here so we can look through them. You are welcome to edit out the domain name so that no one tries to hack into your domain.



Good luck

[ldotc]

O.K. Here's what I came up with:

> zmprov gs mail1.ldotc.com | grep zimbraMtaAuth
zimbraMtaAuthEnabled: TRUE
zimbraMtaAuthHost: mail1.ldotc.com
zimbraMtaAuthURL: http://mail1.ldotc.com:80/service/soap/

> zmprov gs mail1.ldotc.com | grep zimbraMailMode
zimbraMailMode: http

> zmprov gs mail1.ldotc.com | grep zimbraMailPort
zimbraMailPort: 80

> zmprov gs mail1.ldotc.com | grep zimbraMailSSLPort
zimbraMailSSLPort: 443

Terry

[jholder]

I was thinking it was the auth url. . .but Kevin is online. I'll ask him.

[KevinH]

Maybe try to reset your admin password.

[ldotc]

I just gave it a try but it did not make any difference. zmspamextract failed with the same exception text logged.

Terry

[jholder]

Well, there are only three things (that i can think of) that cause that type of error:

• Can't reach the SOAP auth (although this might cause a different error)

• Permissions arn't set correctly

• Your password isn't quite right

You can try to run zmfixperms to see if somehow your permissions got messed up.

Your SOAP auth url seems okay. . .

So.....all I can think of is the password.
Perhaps some other member of the Zimbra staff or Phoenix can help.

I'm all outta ideas. . Sorry

[ldotc]

Watching the zimbra.log while zmtrainsa fails I find the following:

2006-05-21 00:48:00,332 INFO  [http-7071-Processor47] [ip=192.168.1.100;] SoapEngine - handler exception
com.zimbra.cs.account.AccountServiceException: authentication failed for zimbra
        at com.zimbra.cs.account.AccountServiceException.AUTH_FAILED(AccountServiceException.java:77)
        at com.zimbra.cs.account.ldap.LdapProvisioning.verifyPassword(LdapProvisioning.java:2223)
        at com.zimbra.cs.account.ldap.LdapProvisioning.authAccount(LdapProvisioning.java:2082)
        at com.zimbra.cs.account.ldap.LdapProvisioning.authAccount(LdapProvisioning.java:2066)

There's more but I only kept the first few lines as they seemed to be the most relevant.

It looks like it is trying to log in as user "zimbra" and failing as it does not have the right password. Earlier, when I changed the admin user's password, I changed the password for the adminstration account named "admin" not "zimbra".

Apparently, I actually do have an administrator account named "zimbra" as I found that I was able to log in to the admin console with user name zimbra and password zimbra! This suprised me as I have not specifically created such a user and certainly would not have configured it with a password that is identical to the user name. As far as I can tell there is no way to change the "zimbra" administrator's password as it doesn't actually show up in the accounts list in the admin app.

At any rate, I am thinking/guessing the problem with zmtrainsa is that it is trying to authenticate itself as the "zimbra" admin user but has retrieved the password of the "admin" user instead.

Once that's straightened out I'd also like to get rid of or at least change the password of the "zimbra" administrator I've now encountered. Help with that would be much appreciated as well.

Thanks again for your time.

Terry

[ldotc]

Aha!

Poking around through the code in CVS gave me the idea to try re-setting the LDAP password with zmldappasswd. That worked and zmtrainsa is now functioning correctly.

Interesting though that whatever I have as the LDAP password can be used to log in to the admin console as user "zimbra". I'm unsure about why that is the case but at least it is now set to a password that only I know.

Thanks much for everyone's suggestions.

Terry

[jholder]

Hi Terry,
Really glad you got that sorted out.
The Zimbra account is what ZCS uses to perform many actions, such as spam detection. You'd be really good not deleting the account. If you do, you'll be in a world of hurt.

Good Job.