Process failed (1) when writing error message

[Thasaidon]

Hi all,

it's been a while since I've been on the Forum, but since Freesco is still going strong , and my time is short , I didn't get a chance to visit.
However, I've been having a problem with Exim lately.

Running Freesco 0.3.8 with Exim 4.20 (phbc50) and Teapop 3x.

When I send a mail to an undeliverable address, or when there is an error from the remote mail server, my message gets frozen.
This is normal behaviour, however, Exim is also supposed to send an error message back to me stating an error has occured.

And here is the problem... Exim seems unable to send the error message.

Code: Select all

Feb  4 10:20:20 - exim[7539]: 2011-02-04 10:20:20 1PlIm3-0001xa-TE ** nonexistentuser@some.domain.net R=dnslookup T=remote_smtp: SMTP error from remote mailer after RCPT TO:<nonexistentuser@some.domain.net>: host deliver.mail.sp.isp-net.nl [123.123.123.123]: 550 5.1.1 <nonexistentuser@some.domain.net>... User unknown
Feb  4 10:20:30 - exim[7541]: 2011-02-04 10:20:30 Failed to get user name for uid 65534
Feb  4 10:20:30 - exim[7541]: 2011-02-04 10:20:30 Failed to get user name for uid 65534
Feb  4 10:20:30 - exim[7539]: 2011-02-04 10:20:30 1PlIm3-0001xa-TE Process failed (1) when writing error message to my_user@my_domain.net (frozen)

addresses and ip's are changed to protect the innocent

I've been searching the internet with both the "Failed to get user name for uid..." and the "Process failed (1) ...." message, but came up empty so far.

When I do a debug (as found on the internet), I get this:

Code: Select all

[root@Linux] exim -d -bd -q15m
Exim version 4.20 uid=0 gid=0 pid=7549 D=fbb95cfd
Probably GDBM (compatibility mode)
Support for:
Authenticators: plaintext
Routers: accept dnslookup ipliteral manualroute queryprogram redirect
Transports: appendfile/maildir/mailstore/mbx autoreply pipe smtp
changed uid/gid: forcing real = effective
  uid=0 gid=0 pid=7549
  auxiliary group list: <none>
configuration file is /usr/local/exim/configure
log selector = 020d89d8
trusted user
admin user
originator: uid=0 gid=0 login=root name=root
 7549 LOG: MAIN
 7549   socket bind() to port 25 for address (any IPv4) failed: Address already in use: waiting before trying again

but I'm not sure what to do with this...[/code]
Other packages installed are:
apache_1.3.27_dingetje*
perl_5.6.1_dingetje*
exim_4.20_phbc50*
phpsysinfo_2.0p2_nachoman77*
mc-4.6.0-lightning*
teapop3x*
mysql-3.23.37-lightning*
utils_1.0_dingetje*
openssl-0.9.6g_user_nadegda*
utils_1.1_dingetje*

Does anyone know what could cause these errors and how to fix them?

I know an upgrade to 0.4.x would be best, but at the moment I simply lack the time to reconfigure a complete new system (even thought it's very easy with Freesco...)

[Lightning]

The exim server on my own system was attacked recently with thousands of spam attempts to use my system as a relay. The final outcome of this was a completely plugged server that was unable to do anything including writing a log. The cure for me was to manually remove all of 15,000+ undeliverable mail messages and empty the log file which was to large for exim to write to it any more. I then proceeded to block several IP addresses from accessing my system.
So the place to start is to look at /pkg/mail/
You will find all of the exim logs and if any of them are displayed with a "K" at the end they are plainly to big and need to be removed. Which can be done with

:> file_name

Of course you may want to browse through them for a while first to see who has been possibly attacking you. You then can go into the ./input directory and see what is there that can't be delivered and delete them if necessary. Then look in the ./db directory and empty the ".lockfiles" of any entries as well and then restart the exim server. Which at that point should stop the various errors.

I know an upgrade to 0.4.x would be best, but at the moment I simply lack the time to reconfigure a complete new system (even thought it's very easy with Freesco

I think the support is also better for the 04x system

[Thasaidon]

Yeah, I know about attacks... they've been trying my server for relay ever since I'm using Exim.
That's why I use separate domains for my http and my mail and all my "mailto:" links on the websites are in ASCII, so bot's can't read them (yet).
I also blocked half the China and Asia ip ranges in my firewall, since that's where most of the attempts originate from.

However...
An Exim -bp shows no messages frozen (except for the one test mail, that couldn't be send, but I removed that with Exim -Mrm [msg id])
Also, when looking in my /pkg/mail dir, I only see the aliases file and the spool dir.
No log files at all...

The /var/log/exim_mailog shows:

Code: Select all

2011-02-05 05:11:39 exim 4.20 daemon started: pid=3894, -q5m, listening for SMTP on port 25 (IPv4)
2011-02-05 05:11:39 exim 4.20 daemon started: pid=3896, -q30m, not listening for SMTP

There is no exim_rejectlog or exim_paniclog available.
The only ./db dir I could find was located in ./pkg/db, but this only shows the packages I have installed.
And I couldn't find any lockfiles.

So all in all, Exim seems to be working just fine, except it isn't able to send any error messages if a mail is undeliverable or an error has occurred...
All other mail is send and delivered correctly.

I think the support is also better for the 04x system

Yeah, I would love to do a complete reinstall , but I just don't have the time right now...

btw...
Sending a mail from a 3rd party domain to the wrong domain (my http domain) works just fine too...

Code: Select all

Feb  5 11:09:13 - exim[4908]: 2011-02-05 11:09:13 H=mail-ew0-f50.google.com [209.85.215.50] F=<someone@gmail.com> rejected RCPT <user@my-http-domain.net>: relay not permitted

[Lightning]

Sorry I did not look at the version of Exim you were running and just assumed 4.50
The directory you want to look in for Exim 4,20 is /usr/local/exim/var/log for the log files.

[Thasaidon]

Well, no problem about the mixup , but there is no /usr/local/exim/var/log dir.
The only things located in the /usr/local/exim dir are:

Code: Select all

# ls -l
-rw-r--r--    1 root     root        12115 May 30  2002 attachments.filter
-rw-r--r--    1 root     root         2247 Apr 26  2002 auth.txt
drwxr-xr-x    2 root     root        32768 Mar 10  2004 bin
-rw-r--r--    1 root     root        24053 Sep 25 13:34 configure

All exim logs (as far as I can tell) are located in the /var dir.

Code: Select all

[root@Linux] pwd
/var
[root@Linux] ls -l |grep exim
-rw-r-----    1 65534    mail         2153 Feb  6 10:49 exim_mainlog
-rw-r-----    1 65534    mail          149 Feb  6 10:48 exim_rejectlog
[root@Linux]

The rejectlog only shows a "relay not permitted" because of a mail from a 3rd party send to a wrong domain.
The mainlog shows all correct deliveries and the "relay not permitted", but no errors

When I send a message to an undeliverable address... the exim_paniclog is created with the message stating

Code: Select all

2011-02-06 12:00:46 Failed to get user name for uid 65534

The exim_mainlog shows the message is undeliverable, and "the error message can't be send"

Code: Select all

2011-02-06 12:00:36 1Pm3IC-0001LV-CM ** unknow-user@some-domain.net R=dnslookup T=remote_smtp: SMTP error from remote mailer after RCPT TO:<unknow-user@some-domain.net>: host deliver.mail.sp.isp-net.nl [123.123.123.123]: 550 5.1.1 <unknow-user@some-domain.net>... User unknown
2011-02-06 12:00:46 Failed to get user name for uid 65534
2011-02-06 12:00:46 1Pm3IC-0001LV-CM Process failed (1) when writing error message to my-user@my-domain.net (frozen)

I've been doing some searching, and If I understand things correctly, Exim is trying to send a mail using the UID 65534, but there is no such user in the passwd file.
Normally the 65534 UID is supposed to correspond with the user "nobody", but this user has UID 99 according to the passwd file.

Code: Select all

[root@Linux] id nobody
uid=99(nobody) gid=99(nobody) groups=99(nobody)

Could this be the problem? If so, can I just change the UID 99 into 65534 for user nobody? or would that kill other services like the FTP and HTTP server?
What's the default UID for the nobody user in Freesco?

[Lightning]

Hmmmm, you are running an Exim package that I have never seen and do not have.

If so, can I just change the UID 99 into 65534 for user nobody?

Yes you can just manually change the /etc/passwd file user "nobody" to UID 65534:65534 which also sets the group to "nobody" as it is in most systems. But be sure to modify the /etc/group file with a update to the nobody group of 65534 as well as copy that file to /boot/etc/
Of course you could probably just keep it as 65534:99 and not modify the /etc/group file as well without any issue. There is some dispute between older systems and newer ones with which group the user nobody belongs to. Older systems use "nogroup" at -2 and newer systems use it at 65534 and FREESCO has the user nobody group set as nobody at 99

The default UID:GID of 99:99 was set by Serge in the first version of FREESCO and has just been that way for no specific reason that I know of.

A third or forth option would be to create a new user of something like "no_exim" with the modified UID:GID for Exim to use for the UID of 65534

[Thasaidon]

Thanx for the explanation.
I've been using this exim version eversince running Freesco 038. Not sure what the difference is with newer ones...
but this version was downloaded from the freescosoft site.
All I changed was the location of the spool folder because that was a bug in this version.

Anyway, I think I'll try creating a new user with UID 65534 and put him in group nobody first, just to be safe.
I take it the first number in the passwd file is the UID and the second is the GID?
So in this case a new "exim" user would get 65534:90 ?

[Lightning]

I take it the first number in the passwd file is the UID and the second is the GID?

Yes exactly

So in this case a new "exim" user would get 65534:90 ?

Hmmm probably not if you are trying to maintain what newer systems are doing with that specific user UID:GID. Because the newer systems have the "nobody" user belonging to the "nogroup" group. So if you are creating a completely new user for it you might as well give them the "nogroup" group. Which in FREESCO would be 65534:-2

I changed this on my own system and as of yet I have not seen any side effects from doing it. But I also do not have the error logs with exim due to the newer version. Of course it could also have to do with the "exim" username in my passwd file. Which is what exim runs under and creates all of it's files as well using the "exim" user of

Code: Select all

exim:*:600:12:exim:/home/exim:/bin/false

This line was added to the /etc/passwd file when exim installed on my system. Actually when I made the 04x package I created the script that automatically adds that line.

[Thasaidon]

Mmm.. thanx for the info.
I'll try some different things and let you know.

[Thasaidon]

Well, I created the user exim without a password, but like I thought... the UID didn't match, so it didn't work.
I changed the UID to 65534, and left the GID to 100 (default), changed the home dir to / and set the /bin/false.
i send a mail to a bogus user, and exim was able to send the error message!

Code: Select all

Feb  7 20:19:04 - exim[3339]: 2011-02-07 20:19:04 1PmXY8-0000rr-CU <= me@my-domain.net H=172.16.0.15 [172.16.0.15] P=asmtp A=plain:me S=451 id=1297102744.1974.2.camel@DellBuntu
Feb  7 20:19:05 - exim[3379]: 2011-02-07 20:19:05 1PmXY8-0000rr-CU ** invalid-user@some-domain.net R=dnslookup T=remote_smtp: SMTP error from remote mailer after RCPT TO:<invalid-user@some-domain.net>: host deliver.mail.sp.isp-net.nl [217.149.192.60]: 550 5.1.1 <invalid-user@some-domain.net>... User unknown
Feb  7 20:19:05 - exim[4398]: 2011-02-07 20:19:05 1PmXY9-00018w-I4 <= <> R=1PmXY8-0000rr-CU U=exim P=local S=1418
Feb  7 20:19:05 - exim[3379]: 2011-02-07 20:19:05 1PmXY8-0000rr-CU Completed
Feb  7 20:19:05 - exim[4409]: 2011-02-07 20:19:05 1PmXY9-00018w-I4 => me <me@my-domain.net> R=localuser T=local_delivery
Feb  7 20:19:05 - exim[4409]: 2011-02-07 20:19:05 1PmXY9-00018w-I4 Completed

I also changed the GID to 99 (nobody), but that didn change a thing. It still works.
So for now, I'm leaving it as it is.

Code: Select all

exim:*:65534:99:exim:/:/bin/false

I'm guessing this never worked before, but I just didn't notice until now...A friends ISP has started blocking "free" domains (like DYNDNS ans NO-IP).

btw...
Is there a command to show what GID matches which group?

Thanx for helping out here.
It's much appreciated, as always!

[Lightning]

Is there a command to show what GID matches which group?

Just look at /etc/group

If you want to change anything from the default /etc/group file be sure to copy it to /boot/etc/ after the changes.

[Thasaidon]

Thanx for the support.