Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.


I have a dedicated server (debian) on which I have installed Exim and Dovecot. Everything worked fine until around a month ago. I tried to reinstall and reconfigure exim but I keep having all the incoming emails rejected.


Outlook says:

A message that you sent could not be delivered to one or more of its recipients. This is a permanent error. The following address(es) failed:

technical@mydomain.com SMTP error from remote mail server after RCPT TO:: host mail.mydomain.com [94.76.##.##]: 550 relay not permitted

GMAIL:

Delivery to the following recipient failed permanently:

technical@mydomain.com

Technical details of permanent failure: Google tried to deliver your message, but it was rejected by the recipient domain. We recommend contacting the other email provider for further information about the cause of this error. The error that the other server returned was: 550 550 relay not permitted (state 14).


On the server side, my rejectlog file shows:

2011-01-04 17:09:21 H=mail-qw0-f53.google.com [209.85.216.53] F=<####@gmail.com> rejected RCPT : relay not permitted

... and the mainlog file:

2011-01-04 17:00:01 1PaAEr-0007vN-DX <= root@ETC_MAILNAME U=root P=local S=869
2011-01-04 17:00:01 1PaAEr-0007vN-DX ** root@etc_mailname: Unrouteable address
2011-01-04 17:00:01 1PaAEr-0007vY-Kn Error while reading message with no usable sender address (R=1PaAEr-0007vN-DX): at least one malformed recipient address: root@ETC_MAILNAME - malformed address: _MAILNAME may not follow root@ETC
2011-01-04 17:00:01 1PaAEr-0007vN-DX Process failed (1) when writing error message to root@ETC_MAILNAME (frozen)
2011-01-04 17:09:21 no IP address found for host MAIN_RELAY_NETS (during SMTP connection from mail-qw0-f53.google.com [209.85.216.53])
2011-01-04 17:09:21 H=mail-qw0-f53.google.com [209.85.216.53] F=<####@gmail.com> rejected RCPT : relay not permitted

then after the message becomes frozen:

2011-01-04 17:28:44 1PaAEr-0007vN-DX Message is frozen



Thank you for your help, any idea/comment is welcomed as I am really running out of idea to fix this issue,
Nicolas.

Oh and the PHP mail() function does not do anything as well, would it be linked to? I think mail() uses sendmail from my php.ini.

share|improve this question
1  
A recent bug in Exim debian.org/security/2010/dsa-2131 allowed an attacker to open remote a shell anonymously on our server. Exim4 also allowed that shell to execute commands as root! This caused damage. A quick research (security-tracker.debian.org/tracker/source-package/exim4) shows that Exim had 7 arbitrary code execution bugs since 2002. Four (4) of those are doable remotely. After the incident we switched to Postfix (security-tracker.debian.org/tracker/source-package/postfix) - as you can see it also has 7 security bugs, but none are remote, most are DOS related. –  Aleksandr Levchuk Jan 5 '11 at 15:46
    
Yeah I saw it, and it was EXACTLY my issue, we switched to Google Apps mail. Thank you for your input. –  Nicolas Jan 6 '11 at 13:11
add comment

4 Answers

up vote 2 down vote accepted

Dunno excatly yet, but I have the same problem here since about 22hrs ago...

Maybe you should have a look at this http://forums.debian.net/viewtopic.php?f=11&t=58312 and that http://www.reddit.com/r/netsec/comments/en650/details_of_the_root_kit_that_got_installed_on_my/

Maybe you got rooted?

share|improve this answer
    
Hi, I have all the same symptoms! Even the /etc/init.d/xfs3, what should I do now? –  Nicolas Jan 6 '11 at 11:49
    
Instructions:rm /dev/null && mknod /dev/null c 1 3 && chmod 666 /dev/null chattr -ai /var/spool/exim4/s* rm -r /var/spool/exim4/{a.conf*,e.conf*,rk*,s*,setuid*} chattr -ai /usr/include/sslv3/{dropbear,mig} rm -r /usr/include/sslv3/ update-rc.d -f xfs3 remove rm /etc/init.d/xfs3 rm /usr/include/mysql/mysql.hh1 chattr -ai /usr/bin/free /bin/kill /usr/bin/pgrep /usr/bin/pkill /usr/bin/pmap /bin/ps /usr/bin/pwdx /usr/bin/skill /usr/bin/slabtop /usr/bin/snice /sbin/sysctl /usr/bin/tload /usr/bin/top /usr/bin/uptime /usr/bin/vmstat /usr/bin/w /usr/bin/watch rm /usr/bin/w aptitude reinstall procps –  Nicolas Jan 6 '11 at 11:58
    
Following the instructions pasted above thanks to davemmm on reddit.com/r/netsec/comments/en650/… , I cleaned everything on the server and jsut got rid of exim by using Google Apps SMTP feature instead. Thanks a LOT for that! –  Nicolas Jan 6 '11 at 12:07
    
I'm afraid, but following this instructions is just some kind of quick-fix, workaround or something. There may be more rootkits installed. For example: my machine didn't have dorpbear installed, but at least there were a few irc-bots and a "patched" sshd. I cleand what I could find, but to make sure that you have a clean machine you have to set it up from scratch. Well, mine is still online, too. I'm currently thinking of moving to Google and switching off this machine... –  Lost Carrier Jan 7 '11 at 9:22
    
I've cleaned the ssh connections as well, and I had dropbear installed. Everything exactly like him. As I am not using Exim anymore and I think I've cleaned a lot of things already I'm going to keep my server as it is -plus it's a live server...-. Google Apps is worth the changes. –  Nicolas Jan 7 '11 at 11:58
add comment

A very handy trick to see what exim is doing with an email address is to run:

exim -bt example@domain.com

If it immediately uses the remote_smtp transport, then you need to tell exim what domains it's responsible for.

share|improve this answer
    
Hi Niall, here's the result of the exim -bt ######@gmail.com command: ######@gmail.com is undeliverable: Unrouteable address. Cheers –  Nicolas Jan 5 '11 at 8:32
    
Even exim -bt ######@mydomain.com says the unrouteable address issue. –  Nicolas Jan 5 '11 at 8:56
    
Then your exim.conf is well and truly screwed in some way. Can you try running "dpkg-reconfigure exim4-config" and see if you can reset the config? –  Niall Donegan Jan 5 '11 at 11:23
add comment

Looks as though you're using /etc/exim4/exim4.conf.template as your /etc/exim4/exim4.conf file, verbatim, which is broken.

You should look at /usr/share/doc/exim4-base/README.Debian.gz as this is all Debian-specific. Stock Exim from upstream does not have any macro pre-processing or split configurations or the like. Section 2.1.6.1 talks about how you use a single config file, which is what I think you've tried to do.

Try first mv /etc/exim4/exim4.conf /etc/exim4/exim4.conf-old and then running: update-exim4.conf. (You could also first check that update-exim4.conf.conf is up-to-date.).

Ultimately, you'll want exim -bV to show that the configuration file in use is /var/lib/exim4/config.autogenerated, which means that the mass of tangled definitions all comes into play.

share|improve this answer
add comment

I wonder if you have somehow mixed up debian-specific Exim configuration (they use a packager-friendly config that is not part of the standard Exim distribution) with non-debian-specific? It appears that your outbound mail is being automatically tagged with the sender domain ETC_MAILNAME. I'm guessing that's a macro which is supposed to be replaced with the contents of /etc/mailname, but somehow the macro-definition is missing, so you just get the literal string.

Does /etc/mailname exist on your server? If not, you might try creating it and putting your server's FQDN (or whatever you want your default domain to be) in it. Beyond that I don't know anything about debian's packaging so you might seek help on the debian-exim4 help list.

share|improve this answer
    
Hi, the file did not exist but putting mydomain.com in a new file /etc/mailname did not fix the issue -unfortunately-. What I do not understand is I even uninstalled and reinstalled it and nothing's changed. Cheers –  Nicolas Jan 5 '11 at 8:31
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.