System I/O error (in reply to end of DATA command) for LMTP delivery

[Stephen Ingram]

I'm receiving a 451 4.3.0 System I/O error (in reply to end of DATA
command) error from Postfix when trying to deliver to cyrus-imap and not
really sure why. I'm on CentOS 7 (2.4.17-8) after downgrading from current
version. I'm using Kerberos GSSAPI to connect to the front end, but
authentication appears to be working fine as I can see authenticated when
enabling LMTP debugging in Postifx. All messages are refused for delivery
though. I'm not sure what to do. Any suggestions?

Steve

[Patrick Boutilier]

I'm receiving a 451 4.3.0 System I/O error (in reply to end of DATA
command) error from Postfix when trying to deliver to cyrus-imap and not
really sure why. I'm on CentOS 7 (2.4.17-8) after downgrading from
current version. I'm using Kerberos GSSAPI to connect to the front end,
but authentication appears to be working fine as I can see authenticated
when enabling LMTP debugging in Postifx. All messages are refused for
delivery though. I'm not sure what to do. Any suggestions?

Should be something of value in /var/log/messages .

Steve
----
Cyrus Home Page: http://www.cyrusimap.org/
List Archives/Info: http://lists.andrew.cmu.edu/pipermail/info-cyrus/
https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus

[Stephen Ingram]

Patrick-

Actually, nothing. I've got everything piped into /var/log/maillog and not
too much there either beyond the actual error message.

Steve

Post by Patrick Boutilier

Post by Stephen Ingram
I'm receiving a 451 4.3.0 System I/O error (in reply to end of DATA
command) error from Postfix when trying to deliver to cyrus-imap and not
really sure why. I'm on CentOS 7 (2.4.17-8) after downgrading from current
version. I'm using Kerberos GSSAPI to connect to the front end, but
authentication appears to be working fine as I can see authenticated when
enabling LMTP debugging in Postifx. All messages are refused for delivery
though. I'm not sure what to do. Any suggestions?

Should be something of value in /var/log/messages .

Post by Stephen Ingram
Steve
----
Cyrus Home Page: http://www.cyrusimap.org/
List Archives/Info: http://lists.andrew.cmu.edu/pipermail/info-cyrus/
https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus

----
Cyrus Home Page: http://www.cyrusimap.org/
List Archives/Info: http://lists.andrew.cmu.edu/pipermail/info-cyrus/
https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus

[Patrick Boutilier]

Post by Stephen Ingram
Patrick-
Actually, nothing. I've got everything piped into /var/log/maillog and
not too much there either beyond the actual error message.

Hmmm... Usually when I have seen the System I/O error the log entry also
records what the actual directory/file that it wants to write to. Going
by memory here since it has been a long time since I have seen the error.

Post by Stephen Ingram
Steve
I'm receiving a 451 4.3.0 System I/O error (in reply to end of
DATA command) error from Postfix when trying to deliver to
cyrus-imap and not really sure why. I'm on CentOS 7 (2.4.17-8)
after downgrading from current version. I'm using Kerberos
GSSAPI to connect to the front end, but authentication appears
to be working fine as I can see authenticated when enabling LMTP
debugging in Postifx. All messages are refused for delivery
though. I'm not sure what to do. Any suggestions?
Should be something of value in /var/log/messages .
Steve
----
Cyrus Home Page: http://www.cyrusimap.org/
http://lists.andrew.cmu.edu/pipermail/info-cyrus/
<http://lists.andrew.cmu.edu/pipermail/info-cyrus/>
https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus
<https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus>
----
Cyrus Home Page: http://www.cyrusimap.org/
http://lists.andrew.cmu.edu/pipermail/info-cyrus/
<http://lists.andrew.cmu.edu/pipermail/info-cyrus/>
https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus
<https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus>

[Stephen Ingram]

Patrick-

I'm also trying to get more debugging about he system I/O error, but never
see it in the cyrus logs, only in the postfix logs.

Steve

Post by Patrick Boutilier

Post by Stephen Ingram
Patrick-
Actually, nothing. I've got everything piped into /var/log/maillog and
not too much there either beyond the actual error message.

Hmmm... Usually when I have seen the System I/O error the log entry also
records what the actual directory/file that it wants to write to. Going by
memory here since it has been a long time since I have seen the error.
Steve

Post by Stephen Ingram
I'm receiving a 451 4.3.0 System I/O error (in reply to end of
DATA command) error from Postfix when trying to deliver to
cyrus-imap and not really sure why. I'm on CentOS 7 (2.4.17-8)
after downgrading from current version. I'm using Kerberos
GSSAPI to connect to the front end, but authentication appears
to be working fine as I can see authenticated when enabling LMTP
debugging in Postifx. All messages are refused for delivery
though. I'm not sure what to do. Any suggestions?
Should be something of value in /var/log/messages .
Steve
----
Cyrus Home Page: http://www.cyrusimap.org/
http://lists.andrew.cmu.edu/pipermail/info-cyrus/
<http://lists.andrew.cmu.edu/pipermail/info-cyrus/>
https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus
<https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus>
----
Cyrus Home Page: http://www.cyrusimap.org/
http://lists.andrew.cmu.edu/pipermail/info-cyrus/
<http://lists.andrew.cmu.edu/pipermail/info-cyrus/>
https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus
<https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus>

[Patrick Boutilier]

Anything in /var/log/audit/audit.log ?

Post by Stephen Ingram
Patrick-
I'm also trying to get more debugging about he system I/O error, but never
see it in the cyrus logs, only in the postfix logs.
Steve
On Fri, Jun 1, 2018 at 9:37 AM, Patrick Boutilier

Post by Patrick Boutilier

Post by Stephen Ingram
Patrick-
Actually, nothing. I've got everything piped into /var/log/maillog

and

Post by Patrick Boutilier

Post by Stephen Ingram
not too much there either beyond the actual error message.

Hmmm... Usually when I have seen the System I/O error the log entry

also

Post by Patrick Boutilier
records what the actual directory/file that it wants to write to.

Going by

Post by Patrick Boutilier
memory here since it has been a long time since I have seen the

error.

Post by Patrick Boutilier
Steve

Post by Stephen Ingram
On Fri, Jun 1, 2018 at 9:23 AM, Patrick Boutilier
I'm receiving a 451 4.3.0 System I/O error (in reply to end

of

Post by Patrick Boutilier

Post by Stephen Ingram
DATA command) error from Postfix when trying to deliver to
cyrus-imap and not really sure why. I'm on CentOS 7

(2.4.17-8)

Post by Patrick Boutilier

Post by Stephen Ingram
after downgrading from current version. I'm using Kerberos
GSSAPI to connect to the front end, but authentication

appears

Post by Patrick Boutilier

Post by Stephen Ingram
to be working fine as I can see authenticated when enabling

LMTP

Post by Patrick Boutilier

Post by Stephen Ingram
debugging in Postifx. All messages are refused for delivery
though. I'm not sure what to do. Any suggestions?
Should be something of value in /var/log/messages .
Steve
----
Cyrus Home Page: http://www.cyrusimap.org/
http://lists.andrew.cmu.edu/pipermail/info-cyrus/
<http://lists.andrew.cmu.edu/pipermail/info-cyrus/>
https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus
<https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus>
----
Cyrus Home Page: http://www.cyrusimap.org/
http://lists.andrew.cmu.edu/pipermail/info-cyrus/
<http://lists.andrew.cmu.edu/pipermail/info-cyrus/>
https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus
<https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus>

[Stephen Ingram]

Patrick-

My thought too, but nothing but success entries for all of the cyrus
commands. Is there a way to increase logging on the frontend? I seem to be
getting details on the backends, but not the frontend. That might help
diagnose this. Ken asked for cyrus logs, but I don't really have anything
to give him because I don't see anything of consequence there.

Steve

Post by Patrick Boutilier
Anything in /var/log/audit/audit.log ?

Post by Stephen Ingram
Patrick-
I'm also trying to get more debugging about he system I/O error, but
never see it in the cyrus logs, only in the postfix logs.
Steve

Post by Patrick Boutilier

Post by Stephen Ingram
Patrick-
Actually, nothing. I've got everything piped into /var/log/maillog and
not too much there either beyond the actual error message.

Hmmm... Usually when I have seen the System I/O error the log entry also
records what the actual directory/file that it wants to write to. Going by
memory here since it has been a long time since I have seen the error.
Steve

Post by Stephen Ingram
I'm receiving a 451 4.3.0 System I/O error (in reply to end of
DATA command) error from Postfix when trying to deliver to
cyrus-imap and not really sure why. I'm on CentOS 7 (2.4.17-8)
after downgrading from current version. I'm using Kerberos
GSSAPI to connect to the front end, but authentication appears
to be working fine as I can see authenticated when enabling LMTP
debugging in Postifx. All messages are refused for delivery
though. I'm not sure what to do. Any suggestions?
Should be something of value in /var/log/messages .
Steve
----
Cyrus Home Page: http://www.cyrusimap.org/
http://lists.andrew.cmu.edu/pipermail/info-cyrus/
<http://lists.andrew.cmu.edu/pipermail/info-cyrus/>
https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus
<https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus>
----
Cyrus Home Page: http://www.cyrusimap.org/
http://lists.andrew.cmu.edu/pipermail/info-cyrus/
<http://lists.andrew.cmu.edu/pipermail/info-cyrus/>
https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus
<https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus>

[Stephen Ingram]

Well, I finally figured out how to turn up the logging. Alas, the logging
inside cyrus tells me less than postfix. How can that be?

Jun 1 17:58:56 imap lmtp[20994]: connection from mx.x.x [10.0.13.69]
Jun 1 17:58:56 imap lmtp[20994]: SSL_accept() incomplete -> wait
Jun 1 17:58:56 imap lmtp[20994]: Doing a peer verify
Jun 1 17:58:56 imap lmtp[20994]: Doing a peer verify
Jun 1 17:58:56 imap lmtp[20994]: Doing a peer verify
Jun 1 17:58:56 imap lmtp[20994]: Doing a peer verify
Jun 1 17:58:56 imap lmtp[20994]: SSL_accept() succeeded -> done
Jun 1 17:58:56 imap lmtp[20994]: received client certificate
Jun 1 17:58:56 imap lmtp[20994]: subject=/OU=Domain Control
Validated/OU=PositiveSSL/CN=mx.x.x
Jun 1 17:58:56 imap lmtp[20994]: starttls: TLSv1.2 with cipher
DHE-RSA-AES256-GCM-SHA384 (256/256 bits new) authenticated as mx.x.x
Jun 1 17:58:56 imap lmtp[20994]: login: mx.x.x [10.0.13.69] smtp/mx.x.x
GSSAPI+TLS User logged in
Jun 1 17:58:56 imap lmtp[20994]: USAGE x user: 0.009004 sys: 0.002318
Jun 1 17:58:56 imap lmtp[20994]: telling master 1

Steve

Post by Stephen Ingram
Patrick-
My thought too, but nothing but success entries for all of the cyrus
commands. Is there a way to increase logging on the frontend? I seem to be
getting details on the backends, but not the frontend. That might help
diagnose this. Ken asked for cyrus logs, but I don't really have anything
to give him because I don't see anything of consequence there.
Steve

Post by Patrick Boutilier
Anything in /var/log/audit/audit.log ?

Post by Stephen Ingram
Patrick-
I'm also trying to get more debugging about he system I/O error, but
never see it in the cyrus logs, only in the postfix logs.
Steve

Post by Patrick Boutilier

Post by Stephen Ingram
Patrick-
Actually, nothing. I've got everything piped into /var/log/maillog and
not too much there either beyond the actual error message.

Hmmm... Usually when I have seen the System I/O error the log entry
also records what the actual directory/file that it wants to write to.
Going by memory here since it has been a long time since I have seen the
error.
Steve

Post by Stephen Ingram
On Fri, Jun 1, 2018 at 9:23 AM, Patrick Boutilier <
I'm receiving a 451 4.3.0 System I/O error (in reply to end of
DATA command) error from Postfix when trying to deliver to
cyrus-imap and not really sure why. I'm on CentOS 7 (2.4.17-8)
after downgrading from current version. I'm using Kerberos
GSSAPI to connect to the front end, but authentication appears
to be working fine as I can see authenticated when enabling LMTP
debugging in Postifx. All messages are refused for delivery
though. I'm not sure what to do. Any suggestions?
Should be something of value in /var/log/messages .
Steve
----
Cyrus Home Page: http://www.cyrusimap.org/
http://lists.andrew.cmu.edu/pipermail/info-cyrus/
<http://lists.andrew.cmu.edu/pipermail/info-cyrus/>
https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus
<https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus>
----
Cyrus Home Page: http://www.cyrusimap.org/
http://lists.andrew.cmu.edu/pipermail/info-cyrus/
<http://lists.andrew.cmu.edu/pipermail/info-cyrus/>
https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus
<https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus>

[Jason L Tibbitts III]

If you suspect selinux, please do 'ausearch -m avc -ts today' and see what
you get. You may also wish to do 'setenforce 0' and try again, just to
make sure.

I can provide some basic help with selinux if that's needed.

- J<

[Stephen Ingram]

Jason-

That came up clean for my latest config, but it did highlight problems when
I didn't have the auth working. Thank you so much as this is a great search
command to help sleuth out those SELinux issues. I did turn it off just to
see what happened, but it was not the problem. Nice though, because I
learned how to relabel a volume to get back in the good graces of SELinux.

I have this mostly working now, but I'm not exactly sure how so I don't
really have any tips to post. I am going back through the system though
piece by piece to try and find any one out of place configuration/package
that may have caused the problem. My thought is that is was some strange
cacheing issue, but I'm not totally sure.

Steve

Post by Jason L Tibbitts III
If you suspect selinux, please do 'ausearch -m avc -ts today' and see what
you get. You may also wish to do 'setenforce 0' and try again, just to
make sure.
I can provide some basic help with selinux if that's needed.
- J<

[Jason L Tibbitts III]

SI> I did turn it off just to see what happened, but it was not
SI> the problem. Nice though, because I learned how to relabel a volume
SI> to get back in the good graces of SELinux.

Well, just using setenforce doesn't disable selinux; it just disables
enforcement. You would still get denials in the audit logs and such.
So it's a nice way to do a quick test that selinux isn't the problem.
Just setenforce 0, test, and setenforce 1. If the behavior changed then
yeah, it's probably selinux.

If you actually really disabled selinux via the kernel command or by
setting SELINUX=disabled in /etc/selinux/config then, indeed any files
you created while it was in the disabled state would not be labeled and
the easiest way out of that is probably 'touch /.autorelabel; reboot'.
Which is why it's generally best to not disable it if you intend for
that system to normally use selinux.

Once you get used to ausearch -m AVC -ts recent (or today, or whatever)
then it's a pretty small leap to using audit2why and audit2allow to make
small modifications to the policy, or using semanage fcontext -a to make
sure the proper labels are applied.

- J<

[Ken Murchison]

Post by Stephen Ingram
I'm receiving a 451 4.3.0 System I/O error (in reply to end of DATA
command) error from Postfix when trying to deliver to cyrus-imap and
not really sure why. I'm on CentOS 7 (2.4.17-8) after downgrading from
current version. I'm using Kerberos GSSAPI to connect to the front
end, but authentication appears to be working fine as I can see
authenticated when enabling LMTP debugging in Postifx. All messages
are refused for delivery though. I'm not sure what to do. Any suggestions?

Any chance that Kerberos is negotiating a security layer?

[Stephen Ingram]

Ken-

That all appears to be working correctly. Here's a cut from the Postfix
debug with addresses obfuscated:

Jun 1 16:48:52 mx postfix/lmtp[18136]: send attr offset = 682
Jun 1 16:48:52 mx postfix/lmtp[18136]: send attr dsn_orig_rcpt =
rfc822;***@x.com
Jun 1 16:48:52 mx postfix/lmtp[18136]: send attr notify_flags = 0
Jun 1 16:48:52 mx postfix/lmtp[18136]: send attr status = 4.3.0
Jun 1 16:48:52 mx postfix/lmtp[18136]: send attr diag_type = smtp
Jun 1 16:48:52 mx postfix/lmtp[18136]: send attr diag_text = 451 4.3.0
System I/O error
Jun 1 16:48:52 mx postfix/lmtp[18136]: send attr mta_type = dns
Jun 1 16:48:52 mx postfix/lmtp[18136]: send attr mta_mname = imap.x.x
Jun 1 16:48:52 mx postfix/lmtp[18136]: send attr action = delayed
Jun 1 16:48:52 mx postfix/lmtp[18136]: send attr reason = host
imap.x.x[10.0.13.83] said: 451 4.3.0 System I/O error (in reply to end of
DATA command)
Jun 1 16:48:52 mx postfix/lmtp[18136]: private/defer socket: wanted
attribute: status
Jun 1 16:48:52 mx postfix/lmtp[18136]: input attribute name: status
Jun 1 16:48:52 mx postfix/lmtp[18136]: input attribute value: 0
Jun 1 16:48:52 mx postfix/lmtp[18136]: private/defer socket: wanted
attribute: (list terminator)
Jun 1 16:48:52 mx postfix/lmtp[18136]: input attribute name: (end)
Jun 1 16:48:52 mx postfix/lmtp[18136]: B7B0B9A2EB0: to=<***@x.x>,
orig_to=<***@x.x>, relay=imap.x.x[10.0.13.83]:24, delay=0.3,
delays=0.19/0/0.09/0.02, dsn=4.3.0, status=deferred (host
imap.x.x[10.0.13.83] said: 451 4.3.0 System I/O error (in reply to end of
DATA command))

Steve

Post by Ken Murchison

Post by Stephen Ingram
I'm receiving a 451 4.3.0 System I/O error (in reply to end of DATA
command) error from Postfix when trying to deliver to cyrus-imap and not
really sure why. I'm on CentOS 7 (2.4.17-8) after downgrading from current
version. I'm using Kerberos GSSAPI to connect to the front end, but
authentication appears to be working fine as I can see authenticated when
enabling LMTP debugging in Postifx. All messages are refused for delivery
though. I'm not sure what to do. Any suggestions?

Any chance that Kerberos is negotiating a security layer?
--
Kenneth Murchison
Cyrus Development Team
FastMail Pty Ltd
----
Cyrus Home Page: http://www.cyrusimap.org/
List Archives/Info: http://lists.andrew.cmu.edu/pipermail/info-cyrus/
https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus

[Ken Murchison]

OTH, my guess is that Cyrus is failing to create the tmpfile to stage
the message.  Is /tmp (or its equivalent) full, or not writeable?

Without something from the Cyrus syslog, this will be hard to diagnose.

Post by Stephen Ingram
Ken-
That all appears to be working correctly. Here's a cut from the
Jun  1 16:48:52 mx postfix/lmtp[18136]: send attr offset = 682
Jun  1 16:48:52 mx postfix/lmtp[18136]: send attr dsn_orig_rcpt =
Jun  1 16:48:52 mx postfix/lmtp[18136]: send attr notify_flags = 0
Jun  1 16:48:52 mx postfix/lmtp[18136]: send attr status = 4.3.0
Jun  1 16:48:52 mx postfix/lmtp[18136]: send attr diag_type = smtp
Jun  1 16:48:52 mx postfix/lmtp[18136]: send attr diag_text = 451
4.3.0 System I/O error
Jun  1 16:48:52 mx postfix/lmtp[18136]: send attr mta_type = dns
Jun  1 16:48:52 mx postfix/lmtp[18136]: send attr mta_mname = imap.x.x
Jun  1 16:48:52 mx postfix/lmtp[18136]: send attr action = delayed
Jun  1 16:48:52 mx postfix/lmtp[18136]: send attr reason = host
imap.x.x[10.0.13.83] said: 451 4.3.0 System I/O error (in reply to end
of DATA command)
Jun  1 16:48:52 mx postfix/lmtp[18136]: private/defer socket: wanted
attribute: status
Jun  1 16:48:52 mx postfix/lmtp[18136]: input attribute name: status
Jun  1 16:48:52 mx postfix/lmtp[18136]: input attribute value: 0
Jun  1 16:48:52 mx postfix/lmtp[18136]: private/defer socket: wanted
attribute: (list terminator)
Jun  1 16:48:52 mx postfix/lmtp[18136]: input attribute name: (end)
delays=0.19/0/0.09/0.02, dsn=4.3.0, status=deferred (host
imap.x.x[10.0.13.83] said: 451 4.3.0 System I/O error (in reply to end
of DATA command))
Steve
I'm receiving a 451 4.3.0 System I/O error (in reply to end of
DATA command) error from Postfix when trying to deliver to
cyrus-imap and not really sure why. I'm on CentOS 7 (2.4.17-8)
after downgrading from current version. I'm using Kerberos
GSSAPI to connect to the front end, but authentication appears
to be working fine as I can see authenticated when enabling
LMTP debugging in Postifx. All messages are refused for
delivery though. I'm not sure what to do. Any suggestions?
Any chance that Kerberos is negotiating a security layer?
--
Kenneth Murchison
Cyrus Development Team
FastMail Pty Ltd
----
Cyrus Home Page: http://www.cyrusimap.org/
http://lists.andrew.cmu.edu/pipermail/info-cyrus/
<http://lists.andrew.cmu.edu/pipermail/info-cyrus/>
https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus
<https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus>

[Stephen Ingram]

Ken-

That could be. I noticed that the SELinux policy updated on the server as
well and Redhat might have changed something that is not allowing Cyrus to
write there?? It is able to write the Kerberos credential cache there
though. I thought it wrote everything else to /var/lib/imap.

I don't see anything in the cyrus syslog besides the postfix server logging
into the cyrus server successfully. Is there a way to increase the
debugging?

Steve

OTH, my guess is that Cyrus is failing to create the tmpfile to stage the
message. Is /tmp (or its equivalent) full, or not writeable?
Without something from the Cyrus syslog, this will be hard to diagnose.
Ken-
That all appears to be working correctly. Here's a cut from the Postfix
Jun 1 16:48:52 mx postfix/lmtp[18136]: send attr offset = 682
Jun 1 16:48:52 mx postfix/lmtp[18136]: send attr dsn_orig_rcpt =
Jun 1 16:48:52 mx postfix/lmtp[18136]: send attr notify_flags = 0
Jun 1 16:48:52 mx postfix/lmtp[18136]: send attr status = 4.3.0
Jun 1 16:48:52 mx postfix/lmtp[18136]: send attr diag_type = smtp
Jun 1 16:48:52 mx postfix/lmtp[18136]: send attr diag_text = 451 4.3.0
System I/O error
Jun 1 16:48:52 mx postfix/lmtp[18136]: send attr mta_type = dns
Jun 1 16:48:52 mx postfix/lmtp[18136]: send attr mta_mname = imap.x.x
Jun 1 16:48:52 mx postfix/lmtp[18136]: send attr action = delayed
Jun 1 16:48:52 mx postfix/lmtp[18136]: send attr reason = host
imap.x.x[10.0.13.83] said: 451 4.3.0 System I/O error (in reply to end of
DATA command)
Jun 1 16:48:52 mx postfix/lmtp[18136]: private/defer socket: wanted
attribute: status
Jun 1 16:48:52 mx postfix/lmtp[18136]: input attribute name: status
Jun 1 16:48:52 mx postfix/lmtp[18136]: input attribute value: 0
Jun 1 16:48:52 mx postfix/lmtp[18136]: private/defer socket: wanted
attribute: (list terminator)
Jun 1 16:48:52 mx postfix/lmtp[18136]: input attribute name: (end)
delays=0.19/0/0.09/0.02, dsn=4.3.0, status=deferred (host
imap.x.x[10.0.13.83] said: 451 4.3.0 System I/O error (in reply to end of
DATA command))
Steve

Post by Ken Murchison

Post by Stephen Ingram
I'm receiving a 451 4.3.0 System I/O error (in reply to end of DATA
command) error from Postfix when trying to deliver to cyrus-imap and not
really sure why. I'm on CentOS 7 (2.4.17-8) after downgrading from current
version. I'm using Kerberos GSSAPI to connect to the front end, but
authentication appears to be working fine as I can see authenticated when
enabling LMTP debugging in Postifx. All messages are refused for delivery
though. I'm not sure what to do. Any suggestions?

Any chance that Kerberos is negotiating a security layer?
--
Kenneth Murchison
Cyrus Development Team
FastMail Pty Ltd
----
Cyrus Home Page: http://www.cyrusimap.org/
List Archives/Info: http://lists.andrew.cmu.edu/pipermail/info-cyrus/
https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus

--
Ken Murchison
Cyrus Development Team
FastMail US LLC

[Stephen Ingram]

Ken-

Here is the only entry in the cyrus logs I can see from that postfix server:

Jun 1 17:01:19 imap lmtp[12597]: starttls: TLSv1.2 with cipher
DHE-RSA-AES256-GCM-SHA384 (256/256 bits new) authenticated as x.x.x
Jun 1 17:01:19 imap lmtp[12597]: login: x.x.x [10.0.13.69] smtp/x.x.x
GSSAPI+TLS User logged in

Steve

Post by Stephen Ingram
Ken-
That could be. I noticed that the SELinux policy updated on the server as
well and Redhat might have changed something that is not allowing Cyrus to
write there?? It is able to write the Kerberos credential cache there
though. I thought it wrote everything else to /var/lib/imap.
I don't see anything in the cyrus syslog besides the postfix server
logging into the cyrus server successfully. Is there a way to increase the
debugging?
Steve

OTH, my guess is that Cyrus is failing to create the tmpfile to stage the
message. Is /tmp (or its equivalent) full, or not writeable?
Without something from the Cyrus syslog, this will be hard to diagnose.
Ken-
That all appears to be working correctly. Here's a cut from the Postfix
Jun 1 16:48:52 mx postfix/lmtp[18136]: send attr offset = 682
Jun 1 16:48:52 mx postfix/lmtp[18136]: send attr dsn_orig_rcpt =
Jun 1 16:48:52 mx postfix/lmtp[18136]: send attr notify_flags = 0
Jun 1 16:48:52 mx postfix/lmtp[18136]: send attr status = 4.3.0
Jun 1 16:48:52 mx postfix/lmtp[18136]: send attr diag_type = smtp
Jun 1 16:48:52 mx postfix/lmtp[18136]: send attr diag_text = 451 4.3.0
System I/O error
Jun 1 16:48:52 mx postfix/lmtp[18136]: send attr mta_type = dns
Jun 1 16:48:52 mx postfix/lmtp[18136]: send attr mta_mname = imap.x.x
Jun 1 16:48:52 mx postfix/lmtp[18136]: send attr action = delayed
Jun 1 16:48:52 mx postfix/lmtp[18136]: send attr reason = host
imap.x.x[10.0.13.83] said: 451 4.3.0 System I/O error (in reply to end of
DATA command)
Jun 1 16:48:52 mx postfix/lmtp[18136]: private/defer socket: wanted
attribute: status
Jun 1 16:48:52 mx postfix/lmtp[18136]: input attribute name: status
Jun 1 16:48:52 mx postfix/lmtp[18136]: input attribute value: 0
Jun 1 16:48:52 mx postfix/lmtp[18136]: private/defer socket: wanted
attribute: (list terminator)
Jun 1 16:48:52 mx postfix/lmtp[18136]: input attribute name: (end)
delays=0.19/0/0.09/0.02, dsn=4.3.0, status=deferred (host
imap.x.x[10.0.13.83] said: 451 4.3.0 System I/O error (in reply to end of
DATA command))
Steve

Post by Ken Murchison

Post by Stephen Ingram
I'm receiving a 451 4.3.0 System I/O error (in reply to end of DATA
command) error from Postfix when trying to deliver to cyrus-imap and not
really sure why. I'm on CentOS 7 (2.4.17-8) after downgrading from current
version. I'm using Kerberos GSSAPI to connect to the front end, but
authentication appears to be working fine as I can see authenticated when
enabling LMTP debugging in Postifx. All messages are refused for delivery
though. I'm not sure what to do. Any suggestions?

Any chance that Kerberos is negotiating a security layer?
--
Kenneth Murchison
Cyrus Development Team
FastMail Pty Ltd
----
Cyrus Home Page: http://www.cyrusimap.org/
List Archives/Info: http://lists.andrew.cmu.edu/pipermail/info-cyrus/
https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus

--
Ken Murchison
Cyrus Development Team
FastMail US LLC