rSpamd Maps: Connection refused

capote · January 23, 2021, 3:00pm

Server: NS 7.9, full updated
rSpamd: 2.5

I have 2 different web servers with different domains. Both are configured as mail server.

On both systems I’m getting identical error messages in rspamd-history, like:

error reading https://maps.rspamd.com/freemail/free.txt.zst(135.181.149.121:443): connection with http server terminated incorrectly: ssl connect error: syscall fail: Connection refused

error reading https://maps.rspamd.com/rspamd/surbl-whitelist.inc.zst(135.181.149.121:443): connection with http server terminated incorrectly: ssl connect error: syscall fail: Connection refused

error reading https://maps.rspamd.com/freemail/free.txt.zst(135.181.149.121:443): connection with http server terminated incorrectly: ssl connect error: syscall fail: Connection refused

…and so on with the other maps.

What is happened here?

pike · January 23, 2021, 3:11pm

I’ve tried to download the file few seconds ago, succeeding.
So, maybe your mirror is… experiencing issues.
After a lookup i found these ip addresses:

A maps.rspamd.com 135.181.149.121
Hetzner Online GmbH (AS24940)
60 min
A maps.rspamd.com 151.115.41.123
ONLINE S.A.S. (AS12876)
60 min

Maybe Hetzner is experiencing some issues? IDK…
Did you try to download the file from your computer? (around 20k )

capote · January 23, 2021, 5:21pm

Yes I did, it’s impossible.

ps.:

from my Laptop:
dig is possible, ping also


curl https://maps.rspamd.com/freemail/free.txt.zst
curl: (35) error:1400410B:SSL routines:CONNECT_CR_SRVR_HELLO:wrong version number

dnutan · January 23, 2021, 5:27pm

capote · January 23, 2021, 5:32pm

Same issue - Debian 10, LXC, my quick workaround:

echo "151.115.41.123 maps.rspamd.com" >> /etc/hosts
systemctl restart rspamd

This resolves only problems with DNS resolution. But dig is possible.

I tried to curl https://maps.rspamd.com/freemail/free.txt.zst from my server: curl is possible.

pike · January 23, 2021, 9:40pm

Issues seem outside rSpamd/your system…

capote · January 24, 2021, 10:16am

I checked the IPs in logs:

Thread shield
IPS
Firewall

–> no log entries

only in var/log/maillog-yyyymmdd

capote · January 24, 2021, 12:19pm

resolved by…

systemctl restart rspamd

capote · October 8, 2021, 7:08am

The problem persits:
error reading https://maps.rspamd.com/rspamd/redirectors.inc.zst(151.115.41.123:443): connection with http server terminated incorrectly: ssl connect error: syscall fail: Connection timed out

On Github exits an issue: https://github.com/rspamd/rspamd/issues/3616

I tried to wget the file from web console … without any problems.

Heinlein has committed an individual fix: https://github.com/HeinleinSupport/rspamd/commit/8ebcc2d409d82e40c2e7adafe682f7504bdd4318

Can we do anything on Nethserver?

mrmarkuz · October 8, 2021, 7:55am

Did you install the latest updates?

stephdl · October 8, 2021, 8:17am

We are testing the rspamd 3.0 it works well since a while on my server

yum update rspamd --enablerepo=nethserver-testing

It seems the fix has been pushed to 2.8 and probably you run 2.7

pike · October 8, 2021, 8:20am

@stephdl how confident you feel to tell people “try it”?
I am using a “going to production” installation, feeling bold enough to start it.

stephdl · October 8, 2021, 8:22am

You can safely come back with a

yum downgrade rspamd

Eventually restart all the services stack
signal-event nethserver-mail-filter-update

Well for sure your are the captain of your server

pike · October 8, 2021, 8:43am

For whom still not used any kind of testing package, might ask you to approve the key of the server.

capote · October 8, 2021, 5:33pm

yes, I did.

capote · October 8, 2021, 5:34pm

I will try it

capote · October 8, 2021, 5:40pm

I did it. The installtion was w7o n issue. After installation, one error occurs in history section:
8.10.2021, 19:37:00 controller 1015 csession 0a4878 http error occurred: Not found

I think it can only be definitively evaluated once the filter has been running for a few hours.

capote · October 9, 2021, 5:49am

I found a lot of new errors again, all the same IP:

Time	Worker type	PID	Module	Internal ID	Message
9.10.2021, 07:00:19	controller	1015	map	o33omj	error reading https://maps.rspamd.com/rspamd/mime_types.inc.zst(151.115.41.123:443): connection with http server terminated incorrectly: ssl connect error: syscall fail: Connection timed out
9.10.2021, 06:51:18	rspamd_proxy	1014	proxy	735623	cannot compare parts with more than 8192 words: (5080 + 5151)
9.10.2021, 06:02:51	controller	1015	map	fdp86m	error reading https://maps.rspamd.com/freemail/free.txt.zst(151.115.41.123:443): connection with http server terminated incorrectly: ssl connect error: syscall fail: Connection timed out
9.10.2021, 05:50:59	controller	1015	map	qamb1r	error reading https://maps.rspamd.com/rspamd/dmarc_whitelist_new.inc.zst(151.115.41.123:443): connection with http server terminated incorrectly: ssl connect error: syscall fail: Connection timed out
9.10.2021, 05:49:23	controller	1015	map	7n3qic	error reading https://maps.rspamd.com/rspamd/mid.inc.zst(151.115.41.123:443): connection with http server terminated incorrectly: ssl connect error: syscall fail: Connection timed out
9.10.2021, 04:31:31	controller	1015	map	o33omj	error reading https://maps.rspamd.com/rspamd/mime_types.inc.zst(151.115.41.123:443): connection with http server terminated incorrectly: ssl connect error: syscall fail: Connection timed out
9.10.2021, 03:57:27	controller	1015	map	1u5hdp	error reading https://maps.rspamd.com/rspamd/redirectors.inc.zst(151.115.41.123:443): connection with http server terminated incorrectly: ssl connect error: syscall fail: Connection timed out
9.10.2021, 03:33:02	controller	1015	map	yhcyzt	error reading https://maps.rspamd.com/rspamd/phishing_whitelist.inc.zst(151.115.41.123:443): connection with http server terminated incorrectly: ssl connect error: syscall fail: Connection timed out
9.10.2021, 03:13:35	controller	1015	map	fdp86m	error reading https://maps.rspamd.com/freemail/free.txt.zst(151.115.41.123:443): connection with http server terminated incorrectly: ssl connect error: syscall fail: Connection timed out
9.10.2021, 03:00:17	controller	1015	map	qamb1r	error reading https://maps.rspamd.com/rspamd/dmarc_whitelist_new.inc.zst(151.115.41.123:443): connection with http server terminated incorrectly: ssl connect error: syscall fail: Connection timed out

The data are downloadable from webconsole.

The DNS record still exits in /etc/hosts


#
# 40hosts_local
#

151.115.41.123 maps.rspamd.com

stephdl · October 9, 2021, 6:50am

IP Tools (www.iptools.su)
Whois
Hôte: maps.rspamd.com

Réponse DNS

Type: A
maps.rspamd.com. 1196 IN A 88.198.198.21

Type: A
maps.rspamd.com. 1196 IN A 151.115.41.123

pike · October 9, 2021, 7:31am

@capote are you using Threatshield?