I have a google compute cloud VM (Ubuntu 17.10) and I am trying to setup a mail daemon. I have installed postfix and dovecot according to this article (all steps followed exactly, from a fresh install). Running sudo netstat -tuplen yields:

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State           User       Inode      PID/Program name    
tcp        0      0  *               LISTEN          102        15523      829/systemd-resolve 
tcp        0      0 *               LISTEN          0          142345     6971/spamd.pid --cr 
tcp        0      0    *               LISTEN          0          24342      2190/sshd           
tcp        0      0   *               LISTEN          0          122740     31644/dovecot       
tcp6       0      0 :::5355                 :::*                    LISTEN          102        15526      829/systemd-resolve 
tcp6       0      0 ::1:783                 :::*                    LISTEN          0          142343     6971/spamd.pid --cr 
tcp6       0      0 :::80                   :::*                    LISTEN          0          44991      13243/apache2       
tcp6       0      0 :::22                   :::*                    LISTEN          0          24351      2190/sshd           
tcp6       0      0 :::443                  :::*                    LISTEN          0          58960      13243/apache2       
tcp6       0      0 :::993                  :::*                    LISTEN          0          122741     31644/dovecot       
udp        0      0  *                               102        15522      829/systemd-resolve 
udp        0      0 *                               102        15530      829/systemd-resolve 
udp        0      0 *                               101        96631      599/systemd-network 
udp        0      0*                               0          96928      27031/ntpd          
udp        0      0 *                               0          96926      27031/ntpd          
udp        0      0   *                               0          96922      27031/ntpd          
udp6       0      0 :::5355                 :::*                                    102        15525      829/systemd-resolve 
udp6       0      0 fe80::4001:aff:fe98:123 :::*                                    0          96932      27031/ntpd          
udp6       0      0 ::1:123                 :::*                                    0          96930      27031/ntpd          
udp6       0      0 :::123                  :::*                                    0          96919      27031/ntpd          

Which means the service is active and listening for incoming connections. My firewall status:

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22/tcp (OpenSSH)           ALLOW IN    Anywhere                  
80,443/tcp (Apache Full)   ALLOW IN    Anywhere                  
25/tcp (Postfix)           ALLOW IN    Anywhere                  
993                        DENY IN     Anywhere                  
587                        DENY IN     Anywhere                  
143/tcp (Dovecot IMAP)     ALLOW IN    Anywhere                  
993/tcp (Dovecot Secure IMAP) ALLOW IN    Anywhere                  
465/tcp (Postfix SMTPS)    ALLOW IN    Anywhere                  
587/tcp (Postfix Submission) ALLOW IN    Anywhere                  
22/tcp (OpenSSH (v6))      ALLOW IN    Anywhere (v6)             
80,443/tcp (Apache Full (v6)) ALLOW IN    Anywhere (v6)             
25/tcp (Postfix (v6))      ALLOW IN    Anywhere (v6)             
993 (v6)                   DENY IN     Anywhere (v6)             
587 (v6)                   DENY IN     Anywhere (v6)             
143/tcp (Dovecot IMAP (v6)) ALLOW IN    Anywhere (v6)             
993/tcp (Dovecot Secure IMAP (v6)) ALLOW IN    Anywhere (v6)             
465/tcp (Postfix SMTPS (v6)) ALLOW IN    Anywhere (v6)             
587/tcp (Postfix Submission (v6)) ALLOW IN    Anywhere (v6)

And in the firewall rules of google cloud platform: google cloud platform firewall screenshot

So it seems as everything is ok, telnet localhost 993 returns

Connected to localhost
Escape character is '^]'.
Connection closed by foreign host.

(The connection closes immediately)

When I try telnet <ipaddress> 993 from a remote host, it returns

Trying <ipaddress>...
telnet: Unable to connect to remote host: Connection timed out

What am I doing wrong?

  • Did you try the same command on the server itself? That would help you find if the problem is on the host or in the network between the host and you. – Patrick Mevzek Feb 1 '18 at 2:03
  • @PatrickMevzek I have updated my question – kurdtpage Feb 1 '18 at 2:49
  • Just to be clear: I don't want to send mail, I need to receive email from other people – kurdtpage Feb 1 '18 at 3:09
  • The command fails from the host itself: so it is not a firewall problem, maybe the IMAP daemon configuration. – Patrick Mevzek Feb 1 '18 at 3:23
  • I'm assuming you would get the same results if you invoked openssl to test the connection, but does running openssl s_client -connect <remote host>:993 give similar timeout results? – booshlinux Feb 1 '18 at 4:26

It's worth checking if the instance has SSH guard enabled (since Ubuntu normally has it enabled by default). sshguard works by monitoring /var/log/auth.log, syslog-ng or the systemd journal for failed login attempts. For each failed attempt, the offending host is banned from further communication for a limited amount of time.

So you can list the current procceses running on the GCE instace by running: $ ps ax | grep ssh

And if the sshGuard daemon is running you can unban your ip by using either iptables or nftables depending on what's configured on the system. To unban your IP address with iptables, you can check if your IP is banned by sshGuard by running: $ iptables --list sshguard --line-numbers --numeric

And to unban you can run: $ iptables --delete sshguard line-number

This documentation digs deeper on the topic: https://wiki.archlinux.org/index.php/sshguard

  • I wasn't aware of this, so it's good to know. sshguard is enabled, but the list of banned IP's is blank – kurdtpage Feb 1 '18 at 19:27
  • If the sshGuard banned IP list is blank it means all traffic is permitted so I would continue troubleshooting on a different line. – Shibboleet Feb 5 '18 at 16:01

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.