Why do MTAs need access to AdminConsole in 6.0.8

[juresimsic]

Hi

I have a multiserver setup with mtas in the public namespace and MSS in a private network. Since upgrade to 6.0.8 AUTH through SMTP (both STARTLS and TLS) started failing. It turned out, MTAs need access to backend via port 7071, which is admin console and it was blocked..I made a tcpdump and it seems it has got something to do with the certificates (we have a commercial one), but the rest is encrypted/encoded to me..

I'm rather unhappy about this as I don't see any sensible reason to have AdminConsole exposed to the internet for such silly reasons.. So is this a bug or a result of some misconfiguration?

Tnx
Jure

[juresimsic]

I think I found out the reason for some of my weird behavior. It's been mentioned in this post, and it seems that zimbraMailMode gets reset after the upgrade, which leaves weird results in a proxy setup.. I've cleared the other mess, but I still need port 7071 from the mtas/proxies open to the mss for smtp authentication to work..

[juresimsic]

Just to wrap up, it's the cyrus-sasl that uses soap call on admin console. It just got me confused as I had a complete mixup after having upgraded and mailMode got reset thus all proxy settings got mixed up.. The camels bark or something of the kind... =)