Hello,
AWS shut down my instance's mail sending abilities after they noticed that my instance was sending too many emails. I spoke with their support team and they confirmed that to avoid possible spam my instance was stopped from emailing. Does anyone have any ideas what could be causing that? I haven't shared my password key with anyone. It's stored locally on my computer. Outside of the Mercury AMI nothing else was installed. My mail.log file has a bunch of activity. Here's some for log entries:
Nov 13 18:14:04 domU-12-31-39-02-61-98 postfix/qmgr[1201]: 67EB334902: from=<>, size=4500, nrcpt=1 (queue active)
Nov 13 18:14:34 domU-12-31-39-02-61-98 postfix/smtp[23412]: connect to ip-10-245-122-129.ec2.internal[10.245.122.129]:25: Connection timed out
Nov 13 18:14:34 domU-12-31-39-02-61-98 postfix/smtp[23412]: 67EB334902: to=www-data@ip-10-245-122-129.ec2.internal, relay=none, delay=231567, delays=231537/0.01/30/0, dsn=4.4.1, status=deferred (connect to ip-10-245-122-129.ec2.internal[10.245.122.129]:25: Connection timed out)
Nov 13 18:49:04 domU-12-31-39-02-61-98 postfix/qmgr[1201]: 616F134C55: from=<>, size=4534, nrcpt=1 (queue active)
Nov 13 18:49:34 domU-12-31-39-02-61-98 postfix/smtp[23467]: connect to ip-10-245-122-129.ec2.internal[10.245.122.129]:25: Connection timed out
Nov 13 18:49:34 domU-12-31-39-02-61-98 postfix/smtp[23467]: 616F134C55: to=www-data@ip-10-245-122-129.ec2.internal, relay=none, delay=128753, delays=128723/0.01/30/0, dsn=4.4.1, status=deferred (connect to ip-10-245-122-129.ec2.internal[10.245.122.129]:25: Connection timed out)
Nov 13 18:54:04 domU-12-31-39-02-61-98 postfix/qmgr[1201]: 9067A34A2A: from=<>, size=4500, nrcpt=1 (queue active)
Nov 13 18:54:34 domU-12-31-39-02-61-98 postfix/smtp[23483]: connect to ip-10-245-122-129.ec2.internal[10.245.122.129]:25: Connection timed out
Nov 13 18:54:34 domU-12-31-39-02-61-98 postfix/smtp[23483]: 9067A34A2A: to=www-data@ip-10-245-122-129.ec2.internal, relay=none, delay=229489, delays=229459/0.01/30/0, dsn=4.4.1, status=deferred (connect to ip-10-245-122-129.ec2.internal[10.245.122.129]:25: Connection timed out)
Nov 13 19:19:04 domU-12-31-39-02-61-98 postfix/qmgr[1201]: 4A2F434A2C: from=<>, size=4500, nrcpt=1 (queue active)
Nov 13 19:19:34 domU-12-31-39-02-61-98 postfix/smtp[23540]: connect to ip-10-245-122-129.ec2.internal[10.245.122.129]:25: Connection timed out
Nov 13 19:19:34 domU-12-31-39-02-61-98 postfix/smtp[23540]: 4A2F434A2C: to=www-data@ip-10-245-122-129.ec2.internal, relay=none, delay=227333, delays=227303/0.01/30/0, dsn=4.4.1, status=deferred (connect to ip-10-245-122-129.ec2.internal[10.245.122.129]:25: Connection timed out)
Nov 13 19:24:04 domU-12-31-39-02-61-98 postfix/qmgr[1201]: 67EB334902: from=<>, size=4500, nrcpt=1 (queue active)
Thank you
Comments
This just in from AWS: Hi
This just in from AWS:
Hi Ryan,
We have investigated the Pantheon AMI that you're using and it looks like there is a minor bug with the postfix (mail service) configuration, which is causing your instance to attempt to send email to a different instance that is not yours.
I recommend that you try the following:
1) Edit /etc/mailname, and change the internal hostname listed (ip-10-245-122-129.ec2.internal
) to the same external address that your instance responds to (probably something like www.lowdown.us).
2) Empty your postfix mail queue:
PROMPT> postsuper -d ALL
3) Restart your postfix mail service: /etc/init.d/postfix restart
At this point you should no longer be sending out unexpected emails. Note that if you terminate your instance, these changes will be lost, unless you bundle them into a new AMI.
I haven't had a chance to
I haven't had a chance to look into this, I presume ip-10-245-122-129.ec2.internal might be the hostname of the originally bundled instance. Did Amazon email you to let you know they'd disabled emailing? I was just wondering what their process was so I can watch out for it in the future.
Hello, Yes, I got an email
Hello,
Yes, I got an email saying they were disabling email on my account because too many emails were being sent from my instance. I then changed the mail name, emptied my queue and restarted postfix.
Can you explain what type of emails were being sent?
What's this log entry saying:
Nov 13 18:54:34 domU-12-31-39-02-61-98 postfix/smtp[23483]: 9067A34A2A: to=www-data@ip-10-245-122-129.ec2.internal, relay=none, delay=229489, delays=229459/0.01/30/0, dsn=4.4.1, status=deferred (connect to ip-10-245-122-129.ec2.internal[10.245.122.129]:25: Connection timed out)
Nov 13 19:19:04 domU-12-31-39-02-61-98 postfix/qmgr[1201]: 4A2F434A2C: from=<>, size=4500, nrcpt=1 (queue active)
Nov 13 19:19:34 domU-12-31-39-02-61-98 postfix/smtp[23540]: connect to ip-10-245-122-129.ec2.internal[10.245.122.129]:25: Connection timed out
Linux servers often send
Linux servers often send email to users on the server, this is a normal process and nothing to be concerned about, it's most likely something to do with logs.
What you log seems to be saying is it's sending an email to www-data but because postfix thinks the address is ip-10-245-122-129.ec2.internal it tries to send it to that server. Of course it can't find that server so it times out.
I just fired up an instance and can confirm ip-10-245-122-129.ec2.internal is in /etc/mailname
We will fix asap
Also, if you don't mind forwarding me the email (josh@chapterthree.com) I will follow up with the AWS techs to try and minimize the collateral damage.
https://pantheon.io | http://www.chapterthree.com | https://www.outlandishjosh.com
Fixed
Hi all,
A fix has been submitted to launchpad and will be included in the next version of Mercury. In the meantime, the following command will fix this on already-launched AMIs:
/usr/local/bin/ec2-metadata -p | sed 's/public-hostname: //' > /etc/mailname
Hope this helps,
Greg
--
Greg Coit
Systems Administrator
http://www.chapterthree.com
Still seeing this on Mercury 1.0
I just confirmed my /etc/mailname contains domU-12-31-39-09-CC-28.compute-1.internal.
re: Still seeing this on Mercury 1.0
Ugh, we had this fixed back in (I think) 0.90 and somehow it got removed from 1.0. It's been added into launchpad and any new servers launched will get this fix. For those who servers already that are already running, the above fix still works.
Sorry, and thanks kcoop for catching this!!!
Greg
--
Greg Coit
Systems Administrator
http://www.chapterthree.com
domU-12-31-39-09-CC-28
This isn't quite the right thread to post this question, but I don't know where Mercury discussion group lives:
The AMI with Mercury 1.0 has a root@domU-12-31-39-09-CC-28 user in MySQL, no password, - what's this used for? I would like to secure my install, - is it safe to remove this user?
Thank you for Mercury!
-Arman.
re: domU-12-31-39-09-CC-28
Arman,
As long as you have a valid, working admin account setup on mysql, then yes you can remove this one.
Greg
--
Greg Coit
Systems Administrator
http://www.chapterthree.com
Same cause
We were having a problem caused by the same issue. I just wanted to confirm that altering /etc/mailname was the solution. By default, emails are sent from the machine with this blablabla.internal address in the reply-to header. More discerning emails hosts actually check this address and because .internal is not a valid TLD (top level domain), they were rejecting the emails.
re: Same cause
Yes, I believed editing /etc/mailname should fix the issue.
Greg
--
Greg Coit
Systems Administrator
http://www.chapterthree.com