UT7 After (auto) upgrade SMTP problem

[cybo01]

Hi,

This morning different customers called us having problems with their email. The aren't receiving email anymore.
So i checked some things. f.i. telnet [maildomain] 25. And yes, mail doenst work. The message i get (same at all locations) lost connection at CONNECT. Suddenly i get step further. I can connect but when i enter EHLO me i got the same error.
But when i type HELO me it works. Even when enter EHLO me after HELO me I can send e-mail. So there's the problem.
But how can i resolve this ?

thanks,
sylvester

[WebFooL]

Hi cybo01,
Can you take a look in your Protocol Control and turn off kugoo and xunalei signatures if they are active.

And for more tips read this thread.
http://forums.untangle.com/networkin...rnal-mail.html

[cybo01]

webFool,

thanks, that worked.
But what is really the problem ?

thnx,

[WebFooL]

You can find more info about the problem here:
http://forums.untangle.com/protocol-...e-warning.html

Glad it was i quick and simple fix.

[asaberan]

Wow, what a major pain in the ass this has caused me. I have been working on this issue thinking it is reverse DNS issues or server issues for DAYS. On a whim I decided to reboot the Untangle box and all mail went through. I thought the Untangle box was locked up and a reboot fixed the problem; nope, it seems that mail just went through while the Untangle box was rebooting and then immediately stopped again!!!!

Checked the logs and saw that my mail server was going out and being filtered as "Kugoo". Disabled blocking of "Kugoo" and everything went through fine.

[itcinc]

First of all THANKS for a great product that is an outstanding value!

However, I had a phone call from a client early this morning. No incoming mail. Worked fine for months with 6.2 and I knew that the box had been upgraded to 7. Mail delivery stopped about the same time the upgrade was likely installed. The weird thing is that about 1 in 10 incoming e-mail messages would be delivered but most of the messages were terminated right after the connection was established. (220 -> connection dropped)

Nothing in the UT Spam events - not even an indication that the session ever connected. After some basic troubleshooting and e-mail log review I bypassed the Untangle box and incoming mail was delivered normally. The forum here was the next stop where I found the problem. Unblocked these two protocols and everything was back to normal.

I don't understand how SMTP traffic can be detected as a P2P sharing protocol. Blocking SMTP traffic is a serious problem and is very basic to the operation of UT. Why was this problem not detected in the 7.0 beta?

However, I hope that you will disable these protocols for future 7.0 upgrades so everybody does not have to "enjoy" this experience.

[dmorris]

However, I hope that you will disable these protocols for future 7.0 upgrades so everybody does not have to "enjoy" this experience.

These protocols always have been, and will continue to be off by default.
They may be removed entirely in 7.1

[itcinc]

These protocols always have been, and will continue to be off by default.
They may be removed entirely in 7.1

These protocols may have been off by default - as most protocols are. I had turned them on in 6.2 to tighten security at the client site. Having them on caused no problems in 6.2. Incoming SMTP traffic worked fine for months.

An upgrade to 7.0 was released that DID cause a problem with these protocols being on. I was suggesting that if you KNOW the upgrade caused a problem when these protocols were on then PLEASE turn them OFF during the upgrade - even if I had turned them on!

[sky-knight]

No one knew about those signatures breaking SMTP until after the roll out happened. And I don't want UT playing with my settings... ever.

[dmorris]

its a delicate balance. We can't change settings on upgrade unless we are positive its what people want.
If a user adds a new custom signature - should we nuke it? That would get old.
What if they modify an existing signature? What if they rename the signature? Is it still the same signature? These issues are long and hairy.

The KuGoo and Xunlei both had many false positives in 6.2
They have many false positives in 7.0 - the only difference is that now they false positive on SMTP (seemingly only for some people)

Yes, we will try to improved the introduction of new / changed signatures.
Regardless, I would suggest only using log in Protocol Control, if you spot an issue or offender - then try blocking and monitor the reports.