Problems with email address use and with DRWEB in 9.2.3

[LegolasTheElf]

Hi all,
i've just made the upgrade from ver. 9.2.2 to 9.2.3 and i've seen that the server have started a mailbombing against himself :-D

what seems happening:
Our server have a name into a domain hosted by him , like hosting.domain.tld, and obviously the mailserver for that domain use addresses like mailaddr@domain.tld, so we can't create emails like mailaddr@hosting.domain.tld.

but from the upgrade to 9.2.3 the server want to send reports via email to the address drweb@hosting.domain.tld , that obviously doesnt' exist, and generate an error like the one pasted here above.
also obviously i haven't' found where i can change the address used into plesk

***** begin email example *****

From: MAILER-DAEMON@hosting..domain.tld
To: anonymous@hosting..domain.tld
Subject: [Tech] failure notice
X-BeenThere: tech@domain.tld
X-Mailman-Version: 2.1.9
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Sender: tech-bounces@domain.tld
Errors-To: tech-bounces@domain.tld

Hi. This is the qmail-send program at hosting.domain.tld
I'm afraid I wasn't able to deliver your message to the following addresses.
This is a permanent error; I've given up. Sorry it didn't work out.

<drweb@hosting.domain.tld>:

--- Below this line is a copy of the message.

Return-Path: <anonymous@hosting.domain.tld>
Received: (qmail 20809 invoked by uid 111); 26 Oct 2009 15:09:33 +0100
Date: 26 Oct 2009 15:03:10 +0100
Message-ID: <20091026140310.20226.qmail@hosting.domain.tld>
From: root@hosting.domain.tld (Cron Daemon)
To: drweb@hosting.domain.tld
Subject: Cron <drweb@hosting> /opt/drweb/update.pl
Content-Type: text/plain; charset=3DUTF-8
Auto-Submitted: auto-generated
X-Cron-Env: <SHELL=3D/bin/sh>
X-Cron-Env: <HOME=3D/var/drweb>
X-Cron-Env: <PATH=3D/usr/bin:/bin>
X-Cron-Env: <LOGNAME=3Ddrweb>
X-Cron-Env: <USER=3Ddrweb>

ERROR: Dr.Web (R) Updater: Unable to connect to update.msk7.drweb.com: Connection timed out !
ERROR: Dr.Web (R) Updater: Unable to connect to update.msk.drweb.com: Connection timed out !
ERROR: Dr.Web (R) Updater: Unable to connect to update.msk3.drweb.com: Connection timed out !

***** end email example *****

Obviously the second trouble is the one that the email give:
the DR.Web updater gives problem in updating himself.

but this seems a sort of "some times" problem , because in others bounced email i can read this


***** begin email example *****
Return-Path: <anonymous@hosting.domain.tld>
Received: (qmail 28505 invoked by uid 111); 26 Oct 2009 16:30:15 +0100
Date: 26 Oct 2009 16:30:15 +0100
Message-ID: <20091026153015.28502.qmail@hosting.domain.tld>
From: root@hosting.domain.tld(Cron Daemon)
To: drweb@hosting.domain.tld
Subject: Cron <drweb@hosting> /opt/drweb/update.pl
Content-Type: text/plain; charset=UTF-8
Auto-Submitted: auto-generated
X-Cron-Env: <SHELL=/bin/sh>
X-Cron-Env: <HOME=/var/drweb>
X-Cron-Env: <PATH=/usr/bin:/bin>
X-Cron-Env: <LOGNAME=drweb>
X-Cron-Env: <USER=drweb>

Dr.Web (R) update details:
Update server: http://update.us1.drweb.com/unix/500
Update has begun at Mon Oct 26 16:30:02 2009
Update has finished at Mon Oct 26 16:30:15 2009

Following files has been updated:
/var/drweb/bases/dwntoday.vdb
/var/drweb/updates/dwntoday.txt
***** end email example *****

so i dont' know if this is a real problem or also, for example, a moment of full working of the drweb servers.

Someone else have the same problem?
and someone have fixed it?
how?
thanks a lot in advance to all

 

[IgorG]

LegolasTheElf

I think that easy way for resolving this problem - creating mail forwarding to drweb@hosting.tld address.
Just create mailbox drweb@hosting.domain.tld if it doesn't exists. It will overwrite all default setting. After that just add mail forward to drweb@hosting.tld

 

[LegolasTheElf]

How?
because
a) domain.tld is one of the domains that we administer from that plesk server, so the email created into it have the email@domain.tld format and not the email@hosting.domain.tld format
b) creating a subdomain hosting.domain.tld can be a problem, because the server name is the same and will risk to create a lot of troubles with all the server defaults, like administrating webpages, admin emails and so on.

so, my doubt is:
if i create a hosting.domain.tld subdomain, i don't give into troubles with the Plesk server configuration?

Thanks a lot

 

[h4inf]

I have this exact same issue.

My hosting domain is hosting.domain.com, so the emails try to go to drweb@hosting.domain.com, but I can't set up a mail account for a subdomain in plesk (at least I can't find how to do this).

 

[h4inf]

My solution for now has been to change the server address to the TLD. I'm sure this probably wouldn't be feasible for everyone, but it's acceptable for me.

 

[IgorG]

Try to check it with:

telnet localhost 25
mail from:root@hosting.domain.tld
250 2.1.0 Ok
rcpt to:drweb@hosting.domain.tld
550 5.1.1 <drweb@hosting.domain.tld>: Recipient address rejected: User unknown in virtual alias table

I think that you will receive this error.
So, try to check content of file /var/qmail/alias/.qmail-drweb-daemon and correct it if there is really drweb@hosting.domain.tld address.

 

[LegolasTheElf]

unfortunately, the test failed :-(

[root@hosting ~]# telnet localhost 25
Trying 127.0.0.1...
Connected to localhost.localdomain (127.0.0.1).
Escape character is '^]'.
220 hosting.domain.tld ESMTP
mail from:root@hosting.domain.tld
250 ok
rcpt to:drweb@hosting.domain.tld
250 ok


if i try to go to see the content of /var/qmail/alias/.qmail-drweb-daemon we can see that into it there is the correct address of an existing ml that we use for our tech support, in specific tech@domain.tld....

 

[IgorG]

LegolasTheElf,

You can try check and change this email address in Preferences for drweb in Scheduled Tasks.

 

[LegolasTheElf]

they contains the infamous "wrong email address" :-D
thanks a lot.
i've changed it and i hope that now the system start to work correctly ;-)

 

[LegolasTheElf]

Sorry IgorG to bother you again, but also changing the email of Scheduled Task for the user DRWEB have changed nothing :-(
now i've tried to change ALL the scheduled task emails, and i'm waiting to see if this resolve

 

[LegolasTheElf]

nothing to do : the email bombing still continue :-(
at now i recieve at least 35 / 40 bouncing email at a day from drweb and KLuser (kaspersky av user)

 

[GeertL]

Hi,

You should change the crontab of the DrWeb update to not mail you in the first place - this will remove all the spam you recieve at every DrWeb update.

Login to Plesk as Admin.

In the Settings -> Scheduled Tasks -> drweb (just click the link)

You change the Command of the cronjob by adding a ">/dev/null 2>&1" to the end of command. I.e.

/opt/drweb/update.pl >/dev/null 2>&1

This will make sure that Crontab does not mail you with the output of the updatescript every time it exits.

Please keep in mind that depending on your OS - for some reason there might also be a crontab entry for the update in your filesystem under

#/etc/cron.d/drweb-update

Where you will also need to edit the commandstring to be "/opt/drweb/update.pl >/dev/null 2>&1"

 

[GeertL]

Hi,

You can get around this by changing the way the crontab runs for the DrWeb scheduled task - this is done by loggin in to Plesk as admin and then go:

Settings -> Scheduled Tasks -> drweb (just click on the name)

In this you just change the command of the DrWeb update task by inserting a ">/dev/null 2>&1" after the command. Ie. change to:

/opt/drweb/update.pl >/dev/null 2>&1

This will make crontab stop messaging the output of the update script every time its runned.

Beware that for some reason (maybe OS dependant) you might also find a cronjob for the update in

/etc/cron.d/drweb-update

You also need to change the commandline there to prevent crontab from mailing you the output at every DrWeb update.

(please excuse me if this posting is posted twice - as it seemed my first posting was not getting posted - but I'm not aware if the behaviour of this board have been changed since the last time I used it)

Kind regards,

 

[Nachtegaalh]

Hi,

When I go to Settings -> Scgheduled Task -> Drweb There are no tasks but I keep recieving the mails.

Anybody now how to solve this

I use Centos 5.3

Tia

kind regards

Henk

 

[IgorG]

Nachtegaalh,

Did you checked file /etc/cron.d/drweb-update as it was suggested by GeertL?

 

[LegolasTheElf]

we have discovered that from plesk we can't see or modify some parts of the root crontab, and that is one of the places that "send emails".
this is not only for the drweb user, is for all the server user.
i've resolved going into the server shell and starting verifying all the linux users crontab options.
i think that this seems to be the only resoving method at now...

 

[IgorG]

Look at following workaround. I hope it will help. And please send me PM results of applied workaround. Thank you.