Queue browse error after 8.7 upgrade

[juergenmw]

Everyone running in the same issue - the permission changes above indeed are the solution BUT for me a server stop/start (or restart) did not help. The postdrop process was still hanging around after a stop. Hence for some a reboot worked. Killing the postdrop process before a zmcontrol start works, too.

[florianh]

Jul 15 16:30:03 mail1 postfix/postdrop[7889]: warning: mail_queue_enter: create file maildrop/370137.7889: Permission denied
Jul 15 16:30:13 mail1 postfix/postdrop[7889]: warning: mail_queue_enter: create file maildrop/378964.7889: Permission denied
Jul 15 16:30:23 mail1 postfix/postdrop[7889]: warning: mail_queue_enter: create file maildrop/402504.7889: Permission denied

Hi folks,

I had the same rights issue, and was able to fix it. I have some theory on how all the weird behaviours reported in this thread might fit together.

In my case, the issue was clearly triggered by / during the update of Zimbra.
Luckily, I have another Zimbra server on the same version levels (before and after upgrade), and that one didn't have such an issue.
Like this, I was able to compare all the users, groups, rights and ownerships of every item mentioned in this thread so far, and the result was: No differences at all!

So what did I do to fix the issue?

Fix: temporarily (!)

Code: Select all

root@someserver:~# chmod 777 /opt/zimbra/data/postfix/spool/maildrop

Instantly after changing the access rights to the maildrop directory, the temporary mail files could be created. Here's a shortened example:

Code: Select all

root@someserver:/opt/zimbra/data/postfix/spool/maildrop# ll
total 32
drwxrwxrwx  2 postfix postdrop 4096 Sep 10 08:41 ./
drwxr-xr-x 16 root    root     4096 Mär 16  2013 ../
-rwxr--r--  1 zimbra  zimbra    309 Sep 10 08:41 1B0425E0162*

Then set back the access rights to the original settings, which were:

Code: Select all

# ls -ald /opt/zimbra/data/postfix/spool/maildrop
drwx-wx--- 2 postfix postdrop 4096 Sep 10 08:41 /opt/zimbra/data/postfix/spool/maildrop

So what was this staying undelivered so long?

It's been a bunch of duplicate messages of only two differing bodies, all of them sent in the same minute of some time during the upgrade process.

The content of those messages was:

To: root@someserver
From: zimbra@someserver
Auto-Submitted: auto-generated
Subject: *** SECURITY information for someserver ***
Message-Id: <20190910064153.someid@someserver>
Date: Mon, 2 Sep 2019 22:44:08 +0200 (CEST)

someserver : Sep 2 22:44:08 : zimbra : /etc/sudoers.d/02_zimbra-proxy is owned by uid 503, should be 0 ; TTY=unknown ; PWD=/opt/zimbra ;

To: root@someserver
From: zimbra@someserver
Auto-Submitted: auto-generated
Subject: *** SECURITY information for someserver ***
Message-Id: <20190910064153.someid@someserver>
Date: Mon, 2 Sep 2019 22:44:08 +0200 (CEST)

someserver : Sep 2 22:44:08 : zimbra : /etc/sudoers.d/02_zimbra-store is owned by uid 503, should be 0 ; TTY=unknown ; PWD=/opt/zimbra ;

Checking the system showed that the reported issues don't seem to exist anymore:

Code: Select all

root@someserver:/opt/zimbra/data/postfix/spool/maildrop# ll /etc/sudoers.d/02_zimbra-proxy
-r--r----- 1 root root 51 Jul 18 21:54 /etc/sudoers.d/02_zimbra-proxy
root@someserver:/opt/zimbra/data/postfix/spool/maildrop# ll /etc/sudoers.d/02_zimbra-store
-r--r----- 1 root root 55 Jul 18 21:53 /etc/sudoers.d/02_zimbra-store

So in the end it looks like a temporary issue during the upgrade, maybe caused by some race condition the upgrade script developers didn't foresee. This would IMHO also explain why zmfixperms won't have any effect in this case.

Hope this helps anyone in the future.

Kind regards
Florian

[davidkillingsworth]

I've been seeing this a bit after patching 8.8.15 and it is fixed after a complete server reboot.

Not just a zimcontrol restart.

Commenting here for anyone that sees this error after a recent patch upgrade, and to remind myself.

[starrtiktokk]

Thanks for the help eveThank you so much for this. I was into this issue and tired to tinker around to check if its possible but couldnt get it done. Now that i have seen the way you did it, thanks guys
with
regardsryone!
vidmate app mobdro app