Kloxo mail issue

[WISTFUL]

When I try to send mail by Mozilla Thunderbird, this error appeared:

An error occurred while sending mail. The mail server responded:  http://www.spamhaus.org/query/bl?ip=xx.xxx.x.xxx. Please check the message recipient MAILER-DAEMON@domain.ltd
Subject: failure notice

Hi. This is the qmail-send program at domain.ltd.
I'm afraid I wasn't able to deliver your message to the following addresses.
This is a permanent error; I've given up. Sorry it didn't work out.

<root@localhost.domain.ltd>:
Sorry, I couldn't find any host named localhost.domain.ltd. (#5.1.2)

--- Below this line is a copy of the message.

Return-Path: <root@domain.ltd>
Received: (qmail 14453 invoked by uid 0); 18 Feb 2013 00:14:11 -0000
Message-ID: <20130218001411.14448.qmail@domain.ltd>
From: root@localhost.domain.ltd
Subject: rkhunter Daily Run on vmi10823
User-Agent: Heirloom mailx 12.4 7/29/08
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit


--------------------- Start Rootkit Hunter Update ---------------------
[ Rootkit Hunter version 1.4.0 ]

Checking rkhunter data files...
  Checking file mirrors.dat                                  [ No update ]
  Checking file programs_bad.dat                             [ No update ]
  Checking file backdoorports.dat                            [ No update ]
  Checking file suspscan.dat                                 [ No update ]
  Checking file i18n/cn                                      [ No update ]
  Checking file i18n/de                                      [ No update ]
  Checking file i18n/en                                      [ No update ]
  Checking file i18n/zh                                      [ No update ]
  Checking file i18n/zh.utf8                                 [ No update ]

---------------------- Start Rootkit Hunter Scan ----------------------
Warning: Checking for prerequisites               [ Warning ]
         The file of stored file properties (rkhunter.dat) does not exist, and should be created. To do this type in 'rkhunter --propupd'.
Warning: WARNING! It is the users responsibility to ensure that when the '--propupd' option
         is used, all the files on their system are known to be genuine, and installed from a
         reliable source. The rkhunter '--check' option will compare the current file properties
         against previously stored values, and report if any values differ. However, rkhunter
         cannot determine what has caused the change, that is for the user to do.
Warning: Found enabled xinetd service: /etc/xinetd.d/pureftp
Warning: Network TCP port 7777 is being used by /usr/local/lxlabs/ext/lxlighttpd/sbin/kloxo.httpd. Possible rootkit: Possible rogue IRC bot
         Use the 'lsof -i' or 'netstat -an' command to check this.
Warning: Network TCP port 7778 is being used by /usr/local/lxlabs/ext/lxlighttpd/sbin/kloxo.httpd. Possible rootkit: Possible rogue IRC bot
         Use the 'lsof -i' or 'netstat -an' command to check this.
Warning: User 'nginx' has been added to the passwd file.
Warning: User 'xxxxx' has been added to the passwd file.
Warning: User 'lighttpd' has been added to the passwd file.
Warning: Group 'nginx' has been added to the group file.
Warning: Group 'xxxxx' has been added to the group file.
Warning: Group 'lighttpd' has been added to the group file.
Warning: The SSH and rkhunter configuration options should be the same:
         SSH configuration option 'PermitRootLogin': without-password
         Rkhunter configuration option 'ALLOW_SSH_ROOT_USER': unset

----------------------- End Rootkit Hunter Scan -----------------------

[MRatWork]

Yes, I found email issue when sending from mail client (like thunderbird). It's ok from webmail.

[WISTFUL]

This means that we can never send mail via Thunderbierd on kloxo-mr?

What is your opinion about spamdyke and failure notice?

[MRatWork]

Maybe Spacedust have solutions. Read viewtopic.php?f=4&t=731&start=440

[WISTFUL]

Is it OK that I get spamdyke message despite that I've disabled spamdyke?

[WISTFUL]

I found follow links related to spamdyke issue:

[Resolved]Inform "run-parts /etc/cron.daily" that I recived email every day
and
Bug #957

Except that /usr/bin/find: invalid argument `+30240.00000000000000000000' to `-mmin' line there is not on my emails.

This is for me:

Code: [Select]

From: Anacron <root@domain.ltd>
Subject: Anacron job 'cron.daily' on xxx

/etc/cron.daily/spamdyke:

(standard_in) 1: illegal character: S
(standard_in) 1: illegal character: SPlease fix this issue on kloxo-mr.
Thanks

[MRatWork]

This is content of spamdyke

Code: [Select]

#!/bin/sh

# Delete empty files (older than one week)
/usr/bin/find /var/qmail/spamdyke/greylist/ -type f -mmin +10080 -size 0 -exec rm -f {} ;

if [ -f /usr/bin/bc ] ; then
        # If installed, it can automatically be determined
        GRAYLIST_MAX_SECS=`grep 'graylist-max-secs' /etc/spamdyke.conf | cut -d = -f 2`
        GRAYLIST_MAX_SECS=`echo "scale=0 ; $GRAYLIST_MAX_SECS / 60" | bc -l`
else
        # Note: should work with graylist-max-secs / 60 / etc / spamdyke.conf identical
        # older than 30240 minutes (= 3 weeks)
        GRAYLIST_MAX_SECS=30240
fi
# Delete outdated posts
/usr/bin/find /var/qmail/spamdyke/greylist/ -type f -mmin +$GRAYLIST_MAX_SECS -exec rm -f {} ;

It's try delete files inside /var/qmail/spamdyke/greylist/. Maybe something wrong inside this dir. Delete if necessary.

[WISTFUL]

There isn't any file in this directory ...

[MRatWork]

Or maybe something wrong inside /etc/crontab

[WISTFUL]

Content of my /etc/crontab file:

Code: [Select]

SHELL=/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=root
HOME=/

# For details see man 4 crontabs

# Example of job definition:
# .---------------- minute (0 - 59)
# |  .------------- hour (0 - 23)
# |  |  .---------- day of month (1 - 31)
# |  |  |  .------- month (1 - 12) OR jan,feb,mar,apr ...
# |  |  |  |  .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
# |  |  |  |  |
# *  *  *  *  * user-name command to be executed


01 01 * * * root /var/qmail/bin/dh_key 2>&1 > /dev/null

[MRatWork]

This is content crontab on my servers:

Code: [Select]

SHELL=/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=root
HOME=/

# run-parts
01 * * * * root run-parts /etc/cron.hourly
02 4 * * * root run-parts /etc/cron.daily
22 4 * * 0 root run-parts /etc/cron.weekly
42 4 1 * * root run-parts /etc/cron.monthly





01 01 * * * root /var/qmail/bin/dh_key 2>&1 > /dev/null


[WISTFUL]

Yes, I found email issue when sending from mail client (like thunderbird). It's ok from webmail.

I can not send any email from webmail too. (e.g. on AfterLogic appeared : "Can't send message.")

Also I change default value of below fields (that I think is related to this issue) to my server IP but did not help me.

Code: [Select]

AfterLogic > Settings > Email Accounts > Properties
Incoming Mail = 127.0.0.1
Outgoing Mail = 127.0.0.1

[MRatWork]

Must un-tick 'Use authentication'.

[WISTFUL]

Must un-tick 'Use authentication'.

Can't send message.

[MRatWork]

Again, the same issue with roundcube/t-dah/horde?