NS8 - rspamd connection refused

rtrevisan · August 19, 2024, 3:02pm

Hi, i am trying to use the mail app, but when installed and created one domain, i get error messages from rspamd:

Aug 19 11:59:11 nlserver01 rspamd[3101]: /usr/bin/bash: connect: Connection refused
Aug 19 11:59:11 nlserver01 rspamd[3101]: /usr/bin/bash: line 1: /dev/tcp/127.0.0.1/11334: Connection refused
Aug 19 11:59:14 nlserver01 rspamd[3101]: /usr/bin/bash: connect: Connection refused
Aug 19 11:59:14 nlserver01 rspamd[3101]: /usr/bin/bash: line 1: /dev/tcp/127.0.0.1/11334: Connection refused
Aug 19 11:59:17 nlserver01 rspamd[3101]: /usr/bin/bash: connect: Connection refused
Aug 19 11:59:17 nlserver01 rspamd[3101]: /usr/bin/bash: line 1: /dev/tcp/127.0.0.1/11334: Connection refused
Aug 19 11:59:20 nlserver01 rspamd[3101]: /usr/bin/bash: connect: Connection refused
Aug 19 11:59:20 nlserver01 rspamd[3101]: /usr/bin/bash: line 1: /dev/tcp/127.0.0.1/11334: Connection refused
Aug 19 11:59:23 nlserver01 rspamd[3101]: /usr/bin/bash: connect: Connection refused
Aug 19 11:59:23 nlserver01 rspamd[3101]: /usr/bin/bash: line 1: /dev/tcp/127.0.0.1/11334: Connection refused
Aug 19 11:59:26 nlserver01 rspamd[3101]: /usr/bin/bash: connect: Connection refused
Aug 19 11:59:26 nlserver01 rspamd[3101]: /usr/bin/bash: line 1: /dev/tcp/127.0.0.1/11334: Connection refused
Aug 19 11:59:29 nlserver01 rspamd[3101]: /usr/bin/bash: connect: Connection refused
Aug 19 11:59:29 nlserver01 rspamd[3101]: /usr/bin/bash: line 1: /dev/tcp/127.0.0.1/11334: Connection refused

Rocky linux 9.4 fresh installed with NS8.

Could you please help me ?

stephdl · August 19, 2024, 7:26pm

We need more information in logs to understand why

journalctl -e -t rspamd

And/or

journalctl -e _UID=$(id -u mail1)

We need to find evidences

rtrevisan · August 19, 2024, 7:59pm

Hi, tks for reply, see:

[root@nlserver01 ~]# journalctl -e -t rspamd

Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) ; lua; rbl.lua:1180: added rbl rule SURBL_MULTI: checks: alive,helo,dkim,emails,replyto,urls,rdns
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) ; lua; rbl.lua:1180: added rbl rule SURBL_HASHBL: checks: alive,selector
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) ; lua; lua_maps.lua:290: reuse url for complex map definition p1tsamp7: RBL url whitelist for RSPAMD_URIBL
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) ; lua; rbl.lua:1126: added URL whitelist for RBL RSPAMD_URIBL
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) ; lua; rbl.lua:1180: added rbl rule RSPAMD_URIBL: checks: alive,dkim,emails,urls
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) ; lua; lua_maps.lua:290: reuse url for complex map definition p1tsamp7: RBL url whitelist for URIBL_MULTI
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) ; lua; rbl.lua:1126: added URL whitelist for RBL URIBL_MULTI
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) ; lua; rbl.lua:1180: added rbl rule URIBL_MULTI: checks: alive,helo,dkim,emails,replyto,urls,rdns
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) ; lua; rbl.lua:1180: added rbl rule MAILSPIKE: checks: alive,user,local,ip
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) ; lua; rbl.lua:1180: added rbl rule RBL_VIRUSFREE_UNKNOWN: checks: alive,user,local,ip
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) ; lua; rbl.lua:1180: added rbl rule BLOCKLISTDE: checks: alive,user,local,ip,received
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) ; cfg; rspamd_init_lua_filters: init lua module rbl from /usr/share/rspamd/plugins/rbl.lua; digest: 007a55d1>
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) ; lua; lua_redis.lua:603: use default Redis settings for replies
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) ; cfg; rspamd_init_lua_filters: init lua module replies from /usr/share/rspamd/plugins/replies.lua; digest: >
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) ; lua; lua_redis.lua:603: use default Redis settings for reputation
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) ; cfg; rspamd_init_lua_filters: init lua module reputation from /usr/share/rspamd/plugins/reputation.lua; di>
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) ; cfg; rspamd_config_is_module_enabled: lua module rspamd_update is disabled in the configuration
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) ; cfg; rspamd_init_lua_filters: init lua module settings from /usr/share/rspamd/plugins/settings.lua; digest>
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) ; cfg; rspamd_init_lua_filters: init lua module spamassassin from /usr/share/rspamd/plugins/spamassassin.lua>
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) ; cfg; rspamd_config_is_module_enabled: lua module spamtrap is disabled in the configuration
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) ; cfg; rspamd_init_lua_filters: init lua module spf from /usr/share/rspamd/plugins/spf.lua; digest: 864ad0d3>
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) ; lua; trie.lua:169: no tries defined
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) ; cfg; rspamd_init_lua_filters: init lua module trie from /usr/share/rspamd/plugins/trie.lua; digest: d75d7b>
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) ; lua; lua_redis.lua:603: use default Redis settings for url_redirector
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) ; lua; url_redirector.lua:379: no redirector_hosts_map option is specified, disabling module
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) ; cfg; rspamd_init_lua_filters: init lua module url_redirector from /usr/share/rspamd/plugins/url_redirector>
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) ; cfg; rspamd_map_parse_backend: map ‘/etc/rspamd/local.d/maps.d/spf_dkim_whitelist.inc.local’ is not found,>
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) ; cfg; rspamd_map_parse_backend: map ‘/var/lib/rspamd/spf_dkim_whitelist.inc.local’ is not found, but it can>
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) ; cfg; rspamd_map_parse_backend: map ‘/etc/rspamd/local.d/maps.d/dkim_whitelist.inc.local’ is not found, but>
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) ; cfg; rspamd_map_parse_backend: map ‘/var/lib/rspamd/dkim_whitelist.inc.local’ is not found, but it can be >
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) ; cfg; rspamd_map_parse_backend: map ‘/etc/rspamd/maps.d/dkim_whitelist.inc’ is not found, but it can be loa>
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) ; cfg; rspamd_map_parse_backend: map ‘/etc/rspamd/local.d/maps.d/spf_whitelist.inc.local’ is not found, but >
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) ; cfg; rspamd_map_parse_backend: map ‘/var/lib/rspamd/spf_whitelist.inc.local’ is not found, but it can be l>
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) ; cfg; rspamd_map_parse_backend: map ‘/etc/rspamd/maps.d/spf_whitelist.inc’ is not found, but it can be load>
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) ; cfg; rspamd_map_parse_backend: map ‘/etc/rspamd/local.d/maps.d/dmarc_whitelist.inc.local’ is not found, bu>
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) ; cfg; rspamd_map_parse_backend: map ‘/var/lib/rspamd/dmarc_whitelist.inc.local’ is not found, but it can be>
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) ; cfg; rspamd_init_lua_filters: init lua module whitelist from /usr/share/rspamd/plugins/whitelist.lua; dige>
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) rspamd_url_init: start compiling of 9628 TLD suffixes; it might take a long time
Aug 19 16:58:32 nlserver01 rspamd[2274]: /usr/bin/bash: connect: Connection refused
Aug 19 16:58:32 nlserver01 rspamd[2274]: /usr/bin/bash: line 1: /dev/tcp/127.0.0.1/11334: Connection refused

[root@nlserver01 ~]# journalctl -e _UID=$(id -u mail4)
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) ; cfg; rspamd_map_parse_backend: map ‘/etc/rspamd/local.d/maps.d/dmarc_whitelist.inc.local’ is not found, bu>
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) ; cfg; rspamd_map_parse_backend: map ‘/var/lib/rspamd/dmarc_whitelist.inc.local’ is not found, but it can be>
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) ; cfg; rspamd_init_lua_filters: init lua module whitelist from /usr/share/rspamd/plugins/whitelist.lua; dige>
Aug 19 16:58:30 nlserver01 rspamd[2266]: (main) rspamd_url_init: start compiling of 9628 TLD suffixes; it might take a long time
Aug 19 16:58:32 nlserver01 rspamd[2274]: /usr/bin/bash: connect: Connection refused
Aug 19 16:58:32 nlserver01 rspamd[2274]: /usr/bin/bash: line 1: /dev/tcp/127.0.0.1/11334: Connection refused
Aug 19 16:58:35 nlserver01 rspamd[2274]: /usr/bin/bash: connect: Connection refused
Aug 19 16:58:35 nlserver01 rspamd[2274]: /usr/bin/bash: line 1: /dev/tcp/127.0.0.1/11334: Connection refused
Aug 19 16:58:38 nlserver01 rspamd[2274]: /usr/bin/bash: connect: Connection refused
Aug 19 16:58:38 nlserver01 rspamd[2274]: /usr/bin/bash: line 1: /dev/tcp/127.0.0.1/11334: Connection refused
Aug 19 16:58:41 nlserver01 rspamd[2274]: /usr/bin/bash: connect: Connection refused
Aug 19 16:58:41 nlserver01 rspamd[2274]: /usr/bin/bash: line 1: /dev/tcp/127.0.0.1/11334: Connection refused
Aug 19 16:58:44 nlserver01 rspamd[2274]: /usr/bin/bash: connect: Connection refused
Aug 19 16:58:44 nlserver01 rspamd[2274]: /usr/bin/bash: line 1: /dev/tcp/127.0.0.1/11334: Connection refused
Aug 19 16:58:47 nlserver01 rspamd[2274]: /usr/bin/bash: connect: Connection refused
Aug 19 16:58:47 nlserver01 rspamd[2274]: /usr/bin/bash: line 1: /dev/tcp/127.0.0.1/11334: Connection refused
Aug 19 16:58:50 nlserver01 rspamd[2274]: /usr/bin/bash: connect: Connection refused
Aug 19 16:58:50 nlserver01 rspamd[2274]: /usr/bin/bash: line 1: /dev/tcp/127.0.0.1/11334: Connection refused
Aug 19 16:58:53 nlserver01 rspamd[2274]: /usr/bin/bash: connect: Connection refused

stephdl · August 19, 2024, 8:54pm

Speak us about your server. What are the ressources, core and ram

Sound like the rspamd is missing a lot of important configuration files, it seems that the first init of the container has failed !

rtrevisan · August 19, 2024, 9:53pm

Yes, the server is a virtual kvm guest, Rocky linux 9.4 fresh install, 2 cpus 8GB RAM.

First install of NS8.

LayLow · August 19, 2024, 9:58pm

And first topic here Welcome!

stephdl · August 20, 2024, 7:31am

well I could be interested by why rspamd failed to init, so go to the journald and check what occurred during the install

journalctl -e _UID=$(id -u mail1)

if you want to init again, two ways

1.remove mail1 and install mail2 again
2. remove rspamd only if you have already data in mail

[root@r3-pve ~]# runagent -m mail1
runagent: [INFO] starting bash -l
runagent: [INFO] working directory: /home/mail1/.config/state
[mail1@r3-pve state]$ podman volume ls
DRIVER      VOLUME NAME
local       clamav-cus-cfg
local       clamav-db
local       clamav-cus
local       rspamd-override
local       rspamd-redis
local       rspamd-data
local       postfix-cert
local       postfix-queue
local       dovecot-lmtp
local       postfix-custom
local       dovecot-custom
local       dovecot-cert
local       dovecot-dict
local       dovecot-data
[mail1@r3-pve state]$ systemctl stop --user rspamd
[mail1@r3-pve state]$ podman volume rm rspamd-redis
rspamd-redis
[mail1@r3-pve state]$ podman volume rm rspamd-data
rspamd-data
[mail1@r3-pve state]$ systemctl start --user rspamd
[mail1@r3-pve state]$ podman ps
CONTAINER ID  IMAGE                                     COMMAND     CREATED         STATUS         PORTS       NAMES
1fbce7eef694  ghcr.io/nethserver/mail-clamav:sdl-6998               3 minutes ago   Up 3 minutes               clamav
6e11e13adb88  ghcr.io/nethserver/mail-dovecot:sdl-6998              3 minutes ago   Up 3 minutes               dovecot
5fe9d8060417  ghcr.io/nethserver/mail-postfix:sdl-6998              3 minutes ago   Up 3 minutes               postfix
aaa25ec3dabb  ghcr.io/nethserver/mail-rspamd:sdl-6998               28 seconds ago  Up 29 seconds              rspamd

stephdl · August 20, 2024, 7:33am

by the what what version did you install ?

rtrevisan · August 20, 2024, 11:17am

Hi, thank you again !

About the options, i did the first one (1.remove mail1 and install mail2 again), because of this i am with mail4 instance now, but no success.

I am going to try the second option, thank you very much.

rtrevisan · August 20, 2024, 11:18am

Latest version, the version number is 1.45

rtrevisan · August 20, 2024, 11:23am

Hi, i did all the steps, with mail4 instance but got error in the last step (systemctl start --user rspamd), see:

[root@nlserver01 ~]# runagent -m mail4
runagent: [INFO] starting bash -l
runagent: [INFO] working directory: /home/mail4/.config/state

[mail4@nlserver01 state]$ podman volume ls
DRIVER VOLUME NAME
local clamav-db
local clamav-cus
local clamav-cus-cfg
local rspamd-redis
local rspamd-data
local rspamd-override
local postfix-cert
local postfix-queue
local dovecot-lmtp
local postfix-custom
local dovecot-data
local dovecot-custom
local dovecot-cert
local dovecot-dict
[mail4@nlserver01 state]$

[mail4@nlserver01 state]$ systemctl stop --user rspamd

[mail4@nlserver01 state]$ podman volume rm rspamd-redis
rspamd-redis

[mail4@nlserver01 state]$ podman volume rm rspamd-data
rspamd-data

[mail4@nlserver01 state]$ systemctl start --user rspamd
Job for rspamd.service failed because a timeout was exceeded.
See “systemctl --user status rspamd.service” and “journalctl --user -xeu rspamd.service” for details.

[mail4@nlserver01 state]$ journalctl --user -xeu rspamd.service
Hint: You are currently not seeing messages from the system.
Users in groups ‘adm’, ‘systemd-journal’, ‘wheel’ can see all messages.
Pass -q to turn off this notice.
No journal files were opened due to insufficient permissions.

[mail4@nlserver01 state]$ systemctl --user status rspamd.service
● rspamd.service - Rspamd mail filter
Loaded: loaded (/home/mail4/.config/systemd/user/rspamd.service; enabled; preset: disabled)
Active: activating (start-post) since Tue 2024-08-20 08:20:53 -03; 34s ago
Process: 67435 ExecStartPre=/bin/rm -f /run/user/1005/rspamd.pid /run/user/1005/rspamd.ctr-id (code=exited, status=0/SUCCESS)
Process: 67436 ExecStartPre=runagent discover-services (code=exited, status=0/SUCCESS)
Process: 67438 ExecStart=/usr/bin/podman run --detach --init --conmon-pidfile=/run/user/1005/rspamd.pid --cidfile=/run/user/1005/rspamd.ctr-id --cgroups=no-conm>
Main PID: 67447 (conmon); Control PID: 67454 (bash)
Tasks: 3 (limit: 11112)
Memory: 1.2M
CPU: 2.786s
CGroup: /user.slice/user-1005.slice/user@1005.service/app.slice/rspamd.service
├─67447 /usr/bin/conmon --api-version 1 -c bb00477d3e85c60b3f226b690a477f6cf6e727c4a3802e87154436d279ab4dbf -u bb00477d3e85c60b3f226b690a477f6cf6e727c4>
├─67454 /usr/bin/bash -c “while ! exec 3<>/dev/tcp/127.0.0.1/11334 &>/dev/null; do sleep 3 ; done ; printf ‘GET /ping\r\n\r\n’ >&3”
└─67487 sleep 3
[mail4@nlserver01 state]$

stephdl · August 20, 2024, 12:07pm

Catch the journald log of the installation you can reproduce a bug that is related to your server

rtrevisan · August 20, 2024, 7:36pm

yes, i did this search, but no clear error that causes spamd not run …

rtrevisan · August 20, 2024, 9:11pm

I still don’t know what the problem is with my environment, so I decided to download the official qcow image from the nethserver website. I ran the same kvm guest vm with the qcow ns8 image, applied updates (dnf update) and then configured the samba domain + Mail app install. When creating the domain in the mail app, rspamd starts giving errors:

text HTTP/2.0" 200 326 “-” “-” 1191 “ApiServer-https@file” “http://127.0.0.1:9311” 20ms Aug 20 21:09:48 node rspamd[6776]: /usr/bin/bash: connect: Connection refused Aug 20 21:09:48 node rspamd[6776]: /usr/bin/bash: line 1: /dev/tcp/127.0.0.1/11334: Connection refused Aug 20 21:09:51 node rspamd[6776]: /usr/bin/bash: connect: Connection refused Aug 20 21:09:51 node rspamd[6776]: /usr/bin/bash: line 1: /dev/tcp/127.0.0.1/11334: Connection refused Aug 20 21:09:51 node traefik[2060]: 192.168.88.11 - - [20/Aug/2024:21:09:51 +0000] “GET /cluster -admin/api/module/mail1/task/729ca999-6cee-4705-9fa6-4cc67b8cf139/context HTTP/2.0” 200 326 “-” “-” 1192 “ApiServer-https@file” “http://127.0.0.1:9311” 20ms

Now with the official qcow image from the nethserver website 8 !

Any ideas?

stephdl · August 20, 2024, 9:30pm

What do you use ssd or hd.

I need the full log

Journalctl > dump

rtrevisan · August 20, 2024, 9:31pm

The disk of this vm is nvme

stephdl · August 20, 2024, 9:34pm

Ok fun.

Export the full log and send me it.

rtrevisan · August 20, 2024, 9:50pm

upload error, file not authorized here, how can i send the dump file to you ?

stephdl · August 21, 2024, 6:57am

what is the size, either by email: stephdl at de-labrusse.fr

or by any provider for file sharing, you nextcloud instance could do it also for you

you could try a github gist, but maybe you could reach a limit

stephdl · August 21, 2024, 9:07am

speak us about your server
what account provider do you use, external, internal, samba AD or openldap

describe the steps you followed