[SOLVED] Open Relay amavis warnings in zimbra.log

[ewilen]

I just noticed a bunch of warnings like the following in /var/log/zimbra.log:

Apr 10 13:22:12 zimbra amavis[31557]: (31557-05) Open relay? Nonlocal recips but not originating: recipient_name@recipient_domain.com

Earlier I'd also noticed in the Admin GUI that Configuration > Servers > servername >MTA > Web Mail MTA Hostnames was set to the fully qualified domain name of Zimbra, but there was a button to "reset to COS".

Since I don't remember seeing that before, I suspected it had been inadvertently set by another admin, or somehow created during an upgrade. (Our most recent upgrade was 5.0.20 to 6.0.5.) So I tested sending mail by various means (ZWC, IMAP client, ActiveSync) to a nonlocal address to make sure it triggered the warning, then I set the value to the one found under Global Settings > MTA, which is simply "localhost". This produced a cautionary popup in the Admin GUI:

Warning: this will cause the web server to send outbound mail to localhost. You should do this only if an MTA is installed and running on localhost! Do you want to proceed with this change?

I ignored it--I could change it back if something got screwed up.

Sure enough, the amavis warning didn't reappear in zimbra.log and everything else seems to be working properly.

So I'm posting to see if anyone has any advice on this--which is the proper setting for a single-server ZCS config? And also to compare notes with anyone else who's seen this amavis warning.

[Blinkiz]

I have the same error.
Anyone?

[uxbod]

Just set it to be the same as the global if running on a single server install.

[Blinkiz]

I still have the warning:

10 13:22:12 zimbra amavis[31557]: (31557-05) Open relay? Nonlocal recips but not originating: recipient_name@recipient_domain.com

[mutinda]

Originally Posted by ewilen

I just noticed a bunch of warnings like the following in /var/log/zimbra.log:

Apr 10 13:22:12 zimbra amavis[31557]: (31557-05) Open relay? Nonlocal recips but not originating: recipient_name@recipient_domain.com

Earlier I'd also noticed in the Admin GUI that Configuration > Servers > servername >MTA > Web Mail MTA Hostnames was set to the fully qualified domain name of Zimbra, but there was a button to "reset to COS".

Since I don't remember seeing that before, I suspected it had been inadvertently set by another admin, or somehow created during an upgrade. (Our most recent upgrade was 5.0.20 to 6.0.5.) So I tested sending mail by various means (ZWC, IMAP client, ActiveSync) to a nonlocal address to make sure it triggered the warning, then I set the value to the one found under Global Settings > MTA, which is simply "localhost". This produced a cautionary popup in the Admin GUI:

Warning: this will cause the web server to send outbound mail to localhost. You should do this only if an MTA is installed and running on localhost! Do you want to proceed with this change?

I ignored it--I could change it back if something got screwed up.

Sure enough, the amavis warning didn't reappear in zimbra.log and everything else seems to be working properly.

So I'm posting to see if anyone has any advice on this--which is the proper setting for a single-server ZCS config? And also to compare notes with anyone else who's seen this amavis warning.

Worked for me man! Thanks a heap :-)

[dagall]

I followed the instructions above but still no luck

[phoenix]

Originally Posted by dagall

I followed the instructions above but still no luck

Posting an 'it doesn't work' isn't really much use. You need to provide the exact details (including some evidence from the log files and email headers) of the problem and the steps you've followed to fix it and further evidence that it's still happening - you should post the information in this thread.

[dagall]

here is the log, i replaced my real domain, ip, sender & recipient for security reason.

Dec 12 23:38:44 mail2 saslauthd[11118]: auth_zimbra: myusername auth OK
Dec 12 23:38:44 mail2 postfix/smtpd[29896]: E9EAFF65A22: client=unknown[180.194.151.46], sasl_method=PLAIN, sasl_username=myusername
Dec 12 23:38:45 mail2 postfix/cleanup[29986]: E9EAFF65A22: message-id=<4EE6212C.90108@mydomain.com>
Dec 12 23:38:45 mail2 postfix/qmgr[12162]: E9EAFF65A22: from=<myusername@mydomain.com>, size=4151, nrcpt=2 (queue active)
Dec 12 23:38:45 mail2 amavis[19496]: (19496-16) ESMTP::10024 /opt/zimbra/data/amavisd/tmp/amavis-20111212T210216-19496: <myusername@mydomain.com> -> <recipient@gmail.com>,<alwaysbbc_user@mydomain.com > SIZE=4151 Received: from mail2.mydomain.com ([127.0.0.1]) by localhost (mail2.mydomain.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP; Mon, 12 Dec 2011 23:38:45 +0800 (PHT)
Dec 12 23:38:45 mail2 amavis[19496]: (19496-16) Checking: ZrcTFtkMX2Ek [180.194.151.46] <myusername@mydomain.com> -> <recipient@gmail.com>,<alwaysbbc_user@mydomain.com >
Dec 12 23:38:45 mail2 amavis[19496]: (19496-16) Open relay? Nonlocal recips but not originating: recipient@gmail.com
Dec 12 23:38:46 mail2 postfix/smtpd[29896]: disconnect from unknown[180.194.151.46]
Dec 12 23:38:46 mail2 postfix/smtpd[29990]: connect from localhost.localdomain[127.0.0.1]
Dec 12 23:38:46 mail2 postfix/smtpd[29990]: CF564F65A4C: client=localhost.localdomain[127.0.0.1]
Dec 12 23:38:46 mail2 postfix/cleanup[29986]: CF564F65A4C: message-id=<4EE6212C.90108@mydomain.com>
Dec 12 23:38:46 mail2 postfix/smtpd[29990]: disconnect from localhost.localdomain[127.0.0.1]
Dec 12 23:38:46 mail2 postfix/qmgr[12162]: CF564F65A4C: from=<myusername@mydomain.com>, size=4604, nrcpt=1 (queue active)
Dec 12 23:38:46 mail2 amavis[19496]: (19496-16) FWD via SMTP: <myusername@mydomain.com> -> <recipient@gmail.com>,BODY=7BIT 250 2.0.0 from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as CF564F65A4C
Dec 12 23:38:46 mail2 postfix/smtpd[29990]: connect from localhost.localdomain[127.0.0.1]
Dec 12 23:38:46 mail2 postfix/smtpd[29990]: E2303F65A8C: client=localhost.localdomain[127.0.0.1]
Dec 12 23:38:46 mail2 postfix/cleanup[29986]: E2303F65A8C: message-id=<4EE6212C.90108@mydomain.com>
Dec 12 23:38:46 mail2 postfix/smtpd[29990]: disconnect from localhost.localdomain[127.0.0.1]
Dec 12 23:38:46 mail2 postfix/qmgr[12162]: E2303F65A8C: from=<myusername@mydomain.com>, size=4802, nrcpt=1 (queue active)
Dec 12 23:38:46 mail2 amavis[19496]: (19496-16) FWD via SMTP: <myusername@mydomain.com> -> <alwaysbbc_user@mydomain.com>,BODY=7BIT 250 2.0.0 from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as E2303F65A8C
Dec 12 23:38:46 mail2 amavis[19496]: (19496-16) Passed CLEAN, [180.194.151.46] [180.194.151.46] <myusername@mydomain.com> -> <recipient@gmail.com>,<alwaysbbc_user@mydomain.com >, Message-ID: <4EE6212C.90108@mydomain.com>, mail_id: ZrcTFtkMX2Ek, Hits: -2.899, size: 4145, queued_as: CF564F65A4C/E2303F65A8C, 1127 ms
Dec 12 23:38:46 mail2 postfix/smtp[29987]: E9EAFF65A22: to=<recipient@gmail.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=2.3, delays=1.2/0.01/0/1.1, dsn=2.0.0, status=sent (250 2.0.0 from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as CF564F65A4C)
Dec 12 23:38:46 mail2 postfix/smtp[29987]: E9EAFF65A22: to=<alwaysbbc_user@mydomain.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=2.3, delays=1.2/0.01/0/1.1, dsn=2.0.0, status=sent (250 2.0.0 from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as CF564F65A4C)
Dec 12 23:38:46 mail2 postfix/qmgr[12162]: E9EAFF65A22: removed
Dec 12 23:38:47 mail2 postfix/lmtp[29992]: E2303F65A8C: to=<alwaysbbc_user@mydomain.com>, relay=mail2.mydomain.com[124.106.22.22]:7025, delay=0.25, delays=0.06/0.01/0.03/0.15, dsn=2.1.5, status=sent (250 2.1.5 Delivery OK)
Dec 12 23:38:47 mail2 postfix/qmgr[12162]: E2303F65A8C: removed
Dec 12 23:38:49 mail2 postfix/smtpd[29773]: SSL_accept error from unknown[124.106.43.173]: -1
Dec 12 23:38:49 mail2 postfix/smtpd[29773]: lost connection after CONNECT from unknown[124.106.43.173]
Dec 12 23:38:49 mail2 postfix/smtpd[29773]: disconnect from unknown[124.106.43.173]
Dec 12 23:38:50 mail2 postfix/smtp[29991]: CF564F65A4C: to=<recipient@gmail.com>, relay=gmail-smtp-in.l.google.com[74.125.53.27]:25, delay=3.2, delays=0.07/0.01/0.83/2.3, dsn=2.0.0, status=sent (250 2.0.0 OK 1323704336 e6si23856837pbd.209)
Dec 12 23:38:50 mail2 postfix/qmgr[12162]: CF564F65A4C: removed

[phoenix]

Is this a single server? Have you made sure that 'localhost' is in the MTA tab on both the Global Settings and the server settings?

[dagall]

yes, this is a single host server.. Im sure localhost is in the MTA tab on both Global and server settings