Last week I had a problem with incoming mails at the Sophos UTM Mail Protection. Here is an output from the smtp.log:
2015:01:05-12:50:36 utm-1 exim-in[24410]: [1\4] 2015-01-05 12:50:36 H=mx-out-p2.techem.XXX [195.242.XX.XX]:58351 Warning: ACL „warn“ statement skipped: condition test deferred: PGSQL connection failed: could not connect to server: Connection refused
2015:01:05-12:50:36 utm-1 exim-in[24410]: [2\4] Is the server running on host „db_host.local“ (127.0.0.1) and accepting
2015:01:05-12:50:36 utm-1 exim-in[24410]: [3\4] TCP/IP connections on port 5432?
2015:01:05-12:50:36 utm-1 exim-in[24410]: [4/4]
This is a problem with the PostgreSQL database. I wanted to restart the postgresql92 daemon via CLI but I got error messages:
<M> utm:/var/log # /etc/init.d/postgresql92 stop
Stopping PostgreSQLpg_ctl: PID file „/var/storage/pgsql92/data/postmaster.pid“ does not exist<M> utm:/var/log # /etc/init.d/postgresql92 start
Starting PostgreSQLpg_ctl: could not start server
I decided to rebuild the database and it works:
/etc/init.d/postgresql92 rebuild
when you have a HA cluster, you will get a mail-notification every hour, that the replication daemon was restarted at the slave unit. To fix this, you need to do the following:
Start PuTTY to connect via SSH to your UTM (use loginuser and change with “su -” to root). You can connect to the slave unit with “ha_utils”.
Slave: pkill repctl
Master: pkill repctl
Master: repctl
wait 1 minute
Slave: repctl
Feel free to extend this instructions.
6 Responses
test
Test
Hi there,
had exactly the same problem…. Well, could it be in relation to the “Ghost” caveat? I didn´t get an satisfying answer from sophos to this question…. The problem exists since many years!! (Backdoor?!)
The attack to exim in the affected Software versions is already described:
https://www.qualys.com/research/security-advisories/GHOST-CVE-2015-0235.txt
What do you think?
Best Regards
Sebastian
Hi Sebastian!
This tutorial is in relation to the poodle bug. But yes, you are right, It can be a problem since years :( we won’t know…
What do you mean, is in relation to the poodle bug?
tnx :-) especially the cluster addition. much appreciated :-)