Zimbra 8.8.15_P9: updating zimbraMtaRestriction from GUI not working, but ok from CLI

[lovelord]

Hello all,

I'm experiencing a strange phenomenon on my live Zimbra 8.8.15 install (Release 8.8.15.GA.3869.UBUNTU18.64 UBUNTU18_64 FOSS edition, Patch 8.8.15_P9.), let me quick describe it:

I'm trying to add/remove flags from Admin GUI > Configure > Global Settings > MTA > DNS Checks

every stuff I modify under this tab (adding/removing/changing) is not replicated into system, and zmconfigd does not apply any changes.

Instead, if from cli I'll try to modifiy server side flags, zmconfigd recognize that change and apply in a few seconds , restarting services correctly.

Just an example:

Added from GUI a new rbl check: cbl.abuseat.org

comparing system's flags

Code: Select all

clear; echo "Server specific flags:" ; zmprov gs `zmhostname` |grep rbl ; echo -e "\nGeneral Settings flags:"; zmprov gacf |grep rbl

Server specific flags:
zimbraMtaRestriction: check_client_access lmdb:/opt/zimbra/conf/postfix_rbl_override
zimbraMtaRestriction: reject_rbl_client dyna.spamrats.com
zimbraMtaRestriction: reject_rbl_client noptr.spamrats.com
zimbraMtaRestriction: reject_rbl_client spam.spamrats.com
zimbraMtaRestriction: reject_rbl_client bl.spamcop.net
zimbraMtaRestriction: reject_rbl_client zen.spamhaus.org
zimbraMtaRestriction: reject_rbl_client psbl.surriel.com
zimbraMtaRestriction: reject_rbl_client b.barracudacentral.org

General Settings flags:
zimbraMtaRestriction: check_client_access lmdb:/opt/zimbra/conf/postfix_rbl_override
zimbraMtaRestriction: reject_rbl_client dyna.spamrats.com
zimbraMtaRestriction: reject_rbl_client noptr.spamrats.com
zimbraMtaRestriction: reject_rbl_client spam.spamrats.com
zimbraMtaRestriction: reject_rbl_client bl.spamcop.net
zimbraMtaRestriction: reject_rbl_client zen.spamhaus.org
zimbraMtaRestriction: reject_rbl_client psbl.surriel.com
zimbraMtaRestriction: reject_rbl_client b.barracudacentral.org
zimbraMtaRestriction: reject_rbl_client cbl.abuseat.org <------------- LINE ADDED

as you can see last line (global settings) has my reject_rbl_client line present in place, but counterpart in local server has not. This issue is causing zmconfigd to not apply any changes to system, so postfix doesn't know about it at all.

Manually adding the same flag from CLI

Code: Select all

zmprov ms `zmhostname` +zimbraMtaRestriction "reject_rbl_client cbl.abuseat.org"

Result in:

Server specific flags:
zimbraMtaRestriction: check_client_access lmdb:/opt/zimbra/conf/postfix_rbl_override
zimbraMtaRestriction: reject_rbl_client dyna.spamrats.com
zimbraMtaRestriction: reject_rbl_client noptr.spamrats.com
zimbraMtaRestriction: reject_rbl_client spam.spamrats.com
zimbraMtaRestriction: reject_rbl_client bl.spamcop.net
zimbraMtaRestriction: reject_rbl_client zen.spamhaus.org
zimbraMtaRestriction: reject_rbl_client psbl.surriel.com
zimbraMtaRestriction: reject_rbl_client b.barracudacentral.org
zimbraMtaRestriction: reject_rbl_client cbl.abuseat.org <------------- LINE ADDED

General Settings flags:
zimbraMtaRestriction: check_client_access lmdb:/opt/zimbra/conf/postfix_rbl_override
zimbraMtaRestriction: reject_rbl_client dyna.spamrats.com
zimbraMtaRestriction: reject_rbl_client noptr.spamrats.com
zimbraMtaRestriction: reject_rbl_client spam.spamrats.com
zimbraMtaRestriction: reject_rbl_client bl.spamcop.net
zimbraMtaRestriction: reject_rbl_client zen.spamhaus.org
zimbraMtaRestriction: reject_rbl_client psbl.surriel.com
zimbraMtaRestriction: reject_rbl_client b.barracudacentral.org
zimbraMtaRestriction: reject_rbl_client cbl.abuseat.org

Now same flag is present in them both, just few seconds later zmconfigd take care of this change and apply them to system:

zimbra@mail:~/conf/zmconfigd$ May 25 12:43:58 mail zmconfigd[5669]: Fetching All configs
May 25 12:43:58 mail zmconfigd[5669]: All configs fetched in 0.03 seconds
May 25 12:44:03 mail zmconfigd[5669]: Watchdog: service antivirus status is OK.
May 25 12:44:03 mail zmconfigd[5669]: Var zimbraMtaRestriction changed from 'check_client_access lmdb:/opt/zimbra/conf/postfix_blacklist reject_non_fqdn_recipient permit_sasl_authenticated permit_mynetworks reject_unlisted_recipient check_client_access lmdb:/opt/zimbra/conf/fqrdns_whitelist check_reverse_client_hostname_access pcre:/opt/zimbra/conf/fqrdns.pcre reject_non_fqdn_sender reject_unknown_sender_domain check_recipient_access lmdb:/opt/zimbra/conf/postfix_recipient_access check_client_access lmdb:/opt/zimbra/conf/postfix_rbl_override reject_rhsbl_sender dbl.spamhaus.org' -> 'check_client_access lmdb:/opt/zimbra/conf/postfix_blacklist reject_non_fqdn_recipient permit_sasl_authenticated permit_mynetworks reject_unlisted_recipient check_client_access lmdb:/opt/zimbra/conf/fqrdns_whitelist check_reverse_client_hostname_access pcre:/opt/zimbra/conf/fqrdns.pcre reject_non_fqdn_sender reject_unknown_sender_domain check_recipient_access lmdb:/opt/zimbra/conf/postfix_recipient_access check_client_access lmd...
May 25 12:44:03 mail zmconfigd[5669]: ...b:/opt/zimbra/conf/postfix_rbl_override reject_rbl_client cbl.abuseat.org'
May 25 12:44:03 mail zmconfigd[5669]: Var zmconfigd/smtpd_recipient_restrictions.cf changed from 'check_client_access lmdb:/opt/zimbra/conf/postfix_blacklist, reject_non_fqdn_recipient, permit_sasl_authenticated, permit_mynetworks, reject_unlisted_recipient, reject_non_fqdn_sender, reject_unknown_sender_domain, check_recipient_access lmdb:/opt/zimbra/conf/postfix_recipient_access, check_client_access lmdb:/opt/zimbra/conf/postfix_rbl_override, check_reverse_client_hostname_access pcre:/opt/zimbra/conf/fqrdns.pcre, reject_rbl_client dyna.spamrats.com, reject_rbl_client noptr.spamrats.com, reject_rbl_client spam.spamrats.com, reject_rbl_client bl.spamcop.net, reject_rbl_client zen.spamhaus.org, reject_rbl_client psbl.surriel.com, reject_rbl_client b.barracudacentral.org, reject_rhsbl_client dbl.spamhaus.org, reject_rhsbl_client rhsbl.sorbs.net, reject_rhsbl_sender rhsbl.sorbs.net, reject_rhsbl_sender dbl.spamhaus.org, permit' -> 'check_client_access l...
May 25 12:44:03 mail zmconfigd[5669]: ...mdb:/opt/zimbra/conf/postfix_blacklist, reject_non_fqdn_recipient, permit_sasl_authenticated, permit_mynetworks, reject_unlisted_recipient, reject_non_fqdn_sender, reject_unknown_sender_domain, check_recipient_access lmdb:/opt/zimbra/conf/postfix_recipient_access, check_client_access lmdb:/opt/zimbra/conf/postfix_rbl_override, check_reverse_client_hostname_access pcre:/opt/zimbra/conf/fqrdns.pcre, reject_rbl_client dyna.spamrats.com, reject_rbl_client noptr.spamrats.com, reject_rbl_client spam.spamrats.com, reject_rbl_client bl.spamcop.net, reject_rbl_client zen.spamhaus.org, reject_rbl_client psbl.surriel.com, reject_rbl_client b.barracudacentral.org, reject_rbl_client cbl.abuseat.org, reject_rhsbl_client dbl.spamhaus.org, reject_rhsbl_client rhsbl.sorbs.net, reject_rhsbl_sender rhsbl.sorbs.net, reject_rhsbl_sender dbl.spamhaus.org, permit'
May 25 12:44:03 mail zmconfigd[5669]: Rewrote: /opt/zimbra/common/conf/tag_as_originating.re with mode 440 (0.01 sec)
May 25 12:44:03 mail zmconfigd[5669]: Rewrote: /opt/zimbra/conf/postfix_header_checks with mode 440 (0.01 sec)
May 25 12:44:03 mail zmconfigd[5669]: Rewrote: /opt/zimbra/common/conf/tag_as_foreign.re with mode 440 (0.01 sec)
May 25 12:44:03 mail zmconfigd[5669]: Rewrote: /opt/zimbra/common/conf/master.cf with mode 440 (0.01 sec)
May 25 12:44:03 mail zmconfigd[5669]: Rewrote: /opt/zimbra/conf/mta_milter_options with mode 440 (0.01 sec)
May 25 12:44:07 mail zmconfigd[5669]: All rewrite threads completed in 3.73 sec
May 25 12:44:07 mail zmconfigd[5669]: controlProcess mta restart (-1)
May 25 12:44:07 mail zmconfigd[5669]: CONTROL mta: bin/zmmtactl reload norewrite
May 25 12:44:07 mail zmconfigd[5669]: mta reload initiated from zmconfigd
May 25 12:44:12 mail zmconfigd[5669]: All restarts completed in 5.08 sec

Do you know what could be happened and how to solve this issue?

Thanks all for you time.

Andrea

[lovelord]

I know it's a difficult question... Nobody has any idea about it? I don't know how and where GUI is acting in backend when something is being changed, any advice will be greatly appreciated ...

Thanks all.

[DualBoot]

Hello,

when acting in the GUI you should enable browser debug mode to see if you can catch an error or another helpful clue.
On the other hand, you should investigate also the log not only the one related to zmconfigd but the one related
to the mailbox (mailbox.log) and maybe access.log .

Regards,