Topic: https://mail/server-manager not working after upgrading to 9.0

[cyberwatcher]

I upgraded from 7.x to 9.0 and the server is able to send receive mail fine. However the server-manger page is not working. I restored from backup all settings and verified that my local network is permitted. I can ssh ping etc.

Can anyone assist please? I have rebooted reset my browser etc. Thanks.

[guest22]

server-manger page is not working.

A lot more detail is required....

[Stefano]

"it's not working" does not help us to help you

how did you upgrade?
you say you can ssh.. take a look to the logs and tell us more..
moreover, please remember that sentences like "I have rebooted reset my browser etc" don't tell us nothing.. you must be as much verbose as you can

thank you

[cyberwatcher]

I have sent my tcpdump output, I have let you know what the result is when attempting to access the server-manager page. If I knew "much more info" i would probably not be contacting you for assistance.

[cyberwatcher]

I upgraded via installation disk then performed a workstation restore. based on my tcpdump output looks like its using the external server name: mail.cyberwatchers.com however I am within the network. Could that be part of the problem?

when it asked my domain name during the setup I chose cyberwatchers.com. should that be cyberwatchers.local? my domain name is cyberwatchers.com to access mail, web server etc. I have since changed the resolve.conf file to cyberwatchers.local VS .com but no dice. I have also added in our internal DNS server there as well.

[guest22]

As per your title, that will never work, and has never worked with any SME Server version.

[cyberwatcher]

RequestedDeletion can you provide some more detail? I am not sure what you mean by my title. What is it that I have misconfigured please. Thanks.

[Stefano]

I have sent my tcpdump output,

what? where? how?

I have let you know what the result is when attempting to access the server-manager page.

you let us know WHAT exactly?

If I knew "much more info" i would probably not be contacting you for assistance.

ok, no problem..

[guest22]

Your title says "https://mail/server-manager" whilst acessing server manager should be simply https://cyberwatchers.com/server-manager. But only then when you are on the local LAN or have added a remote management network.

I bet it works on the console as root: console -> access server manager

[cyberwatcher]

What I have provided:
TCPDUMP output via previous post
My explanation of how I did the upgrade (as per SME instructions) using upgrade CD then workstation restore
I have Also explained my name resolution as well (internal DNS server as well as how I have modified the resolve.conf) file
the logs are not showing me anything.

[cyberwatcher]

yes RequestedDeletion it works on the console. I am able to access it just fine that way. with exception to administration

[cyberwatcher]

hfwany it HAS worked in the past https://localserver/server-manager for the past 10 years. when I attempt to access using my external https://servername.com/server-manager is says permission denied because I don't allow external admin access to the console.

[guest22]

anytime I have requested help from you people I am supposed to be the professional it seems. ALWAYS some smart ass person on YOUR end.

I provided the output in the previous posts. if you cannot understand that the issue is THE PAGE IS NOT LOADING I am supposed to do what? Provide you the answer? look the page isn't loading, I told you the steps I have taken, I provided tcpdump output and explained how I did the upgrade.

What else are you looking for other than being indifferent?

Simply follow the manual. And we are not smart arses, we're trying to help, but we do require that you have basic understanding of SME Server. for example:


1. TCPdump, where?
2. "Page is not loading". How can you tell, what do you see, what do the logs tell you, what apache error do you see, what does your browser tell you?


guest


(typo)

[Stefano]

anytime I have requested help from you people I am supposed to be the professional it seems. ALWAYS some smart ass person on YOUR end.

cyberwatcher: I can't see any evidence of your professionality here.. and, for sure, I did not start being unpolite and rude..
you are here asking for help, we need info to help you

I provided the output in the previous posts.

I re read twice, three times all the posts in this topic but I can't find it.. can you please link the post you are referring to? thank you

if you cannot understand that the issue is THE PAGE IS NOT LOADING I am supposed to do what? Provide you the answer? look the page isn't loading, I told you the steps I have taken, I provided tcpdump output and explained how I did the upgrade.

the only thing I see is you being a bit "hot".. this is not a good attitude..
please calm down and be more collaborative (see my previous request)

What else are you looking for other than being indifferent?

I'm trying to help you, but it seems to me you are in flaming mood..
relax, take a deep breath.. your server is not dead, you have always your backup..

[guest22]

hfwany it HAS worked in the past https://localserver/server-manager

That is a different URL then you posted as your main problem/title. But in both cases you should use a FQDN.

[guest22]

with exception to administration

So you can not access logs, backup, reboor or shutdown via the server manager, but you can access all other menu items?? Again, what doe you SEE or read in the logs. Obviously you have root access.

"Can not access" or does not work" are very poor pointers to work with.

[cyberwatcher]

when accessing the server-manater your way:
https://mail.cyberwatchers.com/server-manager - I get the following when browsing using Internet Explorer   

More information  More information   
This error (HTTP 403 Forbidden) means that Internet Explorer was able to connect to the website, but it does not have permission to view the webpage.
For more information about HTTP errors, see Help

in version 7.x and prior I needed to use internal naming conventions when on the LAN
when on the WAN I would do what you are telling me now.

When accessing the server my method on the LAN:
I get the RED shield letting me know the site is not trusted, I choose ignore however, still nothing

here! I found some logs!
:27:33 2015] [error] [client 75.151.247.29] client denied by server configuration: proxy:http://127.0.0.1:980/server-manager
[Sun Jan 25 16:46:40 2015] [error] [client 75.151.247.29] client denied by server configuration: proxy:http://127.0.0.1:980/server-manager
[Sun Jan 25 16:47:30 2015] [error] [client 75.151.247.29] client denied by server configuration: proxy:http://127.0.0.1:980/server-manager
 

[Stefano]

ok.. from your client, try to ping mail.cyberwatchers.com: does it resolve to a private/lan ip or to the public ip?
who's the dns server for you client?

(BTW, I still can't find your tcpdump logs..)

[cyberwatcher]

when I ping mail.cyberwatchers.com I get the external. when I ping mail I get the internal I use a DNS server as this is a domain. I have the setup using it and the resolve.conf is setup with it.

here are the tcpdump files699854], length 0
16:58:30.715116 IP mail.cyberwatchers.com.https > gbook.cyberwatchers.local.49278: Flags [P.], seq 963:1048, ack 736, win 130, options [nop,nop,TS val 14714869 ecr 273244396], length 85
16:58:30.715165 IP mail.cyberwatchers.com.https > gbook.cyberwatchers.local.49278: Flags [F.], seq 1048, ack 736, win 130, options [nop,nop,TS val 14714869 ecr 273244396], length 0
16:58:30.735773 IP gbook.cyberwatchers.local.49278 > mail.cyberwatchers.com.https: Flags [.], ack 1048, win 4093, options [nop,nop,TS val 273259421 ecr 14714869], length 0
16:58:30.736141 IP gbook.cyberwatchers.local.49278 > mail.cyberwatchers.com.https: Flags [.], ack 1049, win 4093, options [nop,nop,TS val 273259421 ecr 14714869], length 0
16:58:35.025536 IP gbook.cyberwatchers.local.49278 > mail.cyberwatchers.com.https: Flags [F.], seq 736, ack 1049, win 4096, options [nop,nop,TS val 273263688 ecr 14714869], length 0
16:58:35.025563 IP mail.cyberwatchers.com.https > gbook.cyberwatchers.local.49278: Flags [.], ack 737, win 130, options [nop,nop,TS val 14719180 ecr 273263688], length 0

[cyberwatcher]

here is the httpd error log:[Sun Jan 25 16:46:40 2015] [error] [client 75.151.247.29] client denied by server configuration: proxy:http://127.0.0.1:980/server-manager
[Sun Jan 25 16:47:30 2015] [error] [client 75.151.247.29] client denied by server configuration: proxy:http://127.0.0.1:980/server-manager
[Sun Jan 25 16:55:31 2015] [error] [client 192.168.2.7] File does not exist: /home/e-smith/files/ibays/Primary/html/server-manager:980
[Sun Jan 25 16:55:38 2015] [error] [client 192.168.2.7] File does not exist: /home/e-smith/files/ibays/Primary/html/server-manager:980
[Sun Jan 25 16:57:20 2015] [error] [client 68.180.228.94] File does not exist: /home/e-smith/files/ibays/Primary/html/robots.txt
[Sun Jan 25 16:57:20 2015] [error] [client 68.180.228.94] client denied by server configuration: proxy:http://127.0.0.1:980/server-manager
[Sun Jan 25 16:57:45 2015] [error] [client 68.180.228.44] File does not exist: /home/e-smith/files/ibays/Primary/html/robots.txt
[Sun Jan 25 16:57:46 2015] [error] [client 68.180.228.44] client denied by server configuration: proxy:http://127.0.0.1:980/server-manager

[Stefano]

if your client resolve mail.cyberwatchers.com to external ip than you can't access your server manager.. it's a feature, it's so by design..

so.. if you want to use the real FQDN you need to use SME as your DNS server or setup your dns server to resolve correctly

[cyberwatcher]

Ok. I had this setup exact last version and it was fine. I have now changed the configuration to allow the server to be the DNS server. I changed the resolve.conf back to mail.cyberwatchers.com as well as name server to be the internal IP like it was by default.

now the errors when using https://mail.cyberwatchers.com/server-manager:

Sun Jan 25 17:08:43 2015] [notice] Graceful restart requested, doing restart
[Sun Jan 25 17:08:43 2015] [notice] Digest: generating secret for digest authentication ...
[Sun Jan 25 17:08:43 2015] [notice] Digest: done
[Sun Jan 25 17:08:43 2015] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Sun Jan 25 17:08:43 2015] [warn] RSA server certificate CommonName (CN) `mail.cyberwatchers.com' does NOT match server name!?
[Sun Jan 25 17:08:43 2015] [notice] Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/1.0.1e-fips configured -- resuming normal operations
[Sun Jan 25 17:10:33 2015] [error] [client 75.151.247.29] client denied by server configuration: proxy:http://127.0.0.1:980/server-manager
[Sun Jan 25 17:12:11 2015] [error] [client 75.151.247.29] client denied by server configuration: proxy:http://127.0.0.1:980/server-manager
[Sun Jan 25 17:16:41 2015] [error] [client 75.151.247.29] client denied by server configuration: proxy:http://127.0.0.1:980/server-manager

[cyberwatcher]

also this:
Forbidden

You don't have permission to access /server-manager on this server.


the logs with the above:
[Sun Jan 25 17:23:49 2015] [error] [client 75.151.247.29] client denied by server configuration: proxy:http://127.0.0.1:980/server-manager

[Stefano]

I changed the resolve.conf back to mail.cyberwatchers.com as well

please define.. where did you change it?

[cyberwatcher]

/etc/resolv.conf file
current settings:
mail.cyberwatchers.com
nameserver 172.16.10.3 (localhost)

I had it
mail.cyberwatchers.local
10.1.1.5 (internal DNS)

I am doing a roboot now maybe after all the changes wouldn't be a bad idea.

[Stefano]

are you talking about resolv.conf on SME?

[cyberwatcher]

yes on the SME (resolve.conf)

I have made changes and rebooted still the exact same thing. you see that certificate error saying that the name doesn't match whats on the cert? I had it in the other post a just 1 or 2 back if you can't find it I will:

here
Sun Jan 25 17:08:43 2015] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Sun Jan 25 17:08:43 2015] [warn] RSA server certificate CommonName (CN) `mail.cyberwatchers.com' does NOT match server name!?
[Sun Jan 25 17:08:43 2015] [notice] Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/1.0.1e-fips configured -- resuming normal operations
[Sun Jan 25 17:10:33 2015] [error] [client 75.151.247.29] client denied by server configuration: proxy:http://127.0.0.1:980/server-manager
[Sun Jan 25 17:12:11 2015] [error] [client 75.151.247.29] client denied by server configuration: proxy:http://127.0.0.1:980/server-manager
[Sun Jan 25 17:16:41 2015] [error] [client 75.151.247.29] client denied by server configuration: proxy:http://127.0.0.1:980/server-manager
[Sun Jan 25 17:23:49 2015] [error] [client 75.151.247.29] client denied by server configuration: proxy:http://127.0.0.1:980/server-manager
[Sun Jan 25 17:26:59 2015] [error] [client 75.151.247.29] client denied by server configuration: proxy:http://127.0.0.1:980/server-manager
[Sun Jan 25 17:28:34 2015] [notice] caught SIGTERM, shutting down
[Sun Jan 25 17:30:59 2015] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Sun Jan 25 17:30:59 2015] [warn] RSA server certificate CommonName (CN) `mail.cyberwatchers.com' does NOT match server name!?
[Sun Jan 25 17:30:59 2015] [notice] Digest: generating secret for digest authentication ...
[Sun Jan 25 17:30:59 2015] [notice] Digest: done
[Sun Jan 25 17:31:03 2015] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Sun Jan 25 17:31:03 2015] [warn] RSA server certificate CommonName (CN) `mail.cyberwatchers.com' does NOT match server name!?
[Sun Jan 25 17:31:03 2015] [notice] Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/1.0.1e-fips configured -- resuming normal operations
[Sun Jan 25 17:41:13 2015] [error] [client 75.151.247.29] client denied by server configuration: proxy:http://127.0.0.1:980/server-manager
[Sun Jan 25 17:42:05 2015] [error] [client 66.249.65.140] File does not exist: /home/e-smith/files/ibays/Primary/html/robots.txt
[Sun Jan 25 17:42:06 2015] [error] [client 66.249.65.144] client denied by server configuration: proxy:http://127.0.0.1:980/server-manager

Also since I made the changes I'm not getting internal relay emails because the internal servers cannot see mail server internaly. I am sure I can figure that out. but really I don't see the problem being the way it was setup (DNS) because this is an option SME offers and also I used it like that for the past 10 years. It has to be obviously something else because my settings are what you have asked me to make them now.

that error above may have something to do with it.

[Stefano]

please re read the first 10 rows on your /etc/resolv.conf

you are doing in the wrong way

please post the output of

Code: [Select]

db domains show
hostname -f

thank you

[cyberwatcher]

I put it back the way it was when it was working which is resolve locally. I have relay servers on my network that won't relay mail to me if it is to resolve externally. I can figure it out if it really has to resolve with external DNS servers but why is it an option 1 and 2 why has it worked perfectly for me the past 10 years doing in internal? I am not trying to argue I just don't think this issue resolves around DNS.

here are the results you asked for
root@mail etc]# db domains show
cyberwatchers.com=domain
    Content=Primary
    Description=Primary domain
    Nameservers=localhost
    Removable=no
    SystemPrimaryDomain=yes
[root@mail etc]# hostname -f
mail.cyberwatchers.com
[root@mail etc]#

[cyberwatcher]

total guess this is your IP testing it?

[Sun Jan 25 18:24:39 2015] [error] [client 66.249.73.199] File does not exist: /home/e-smith/files/ibays/Primary/html/robots.txt
[Sun Jan 25 18:24:39 2015] [error] [client 66.249.73.191] client denied by server configuration: proxy:http://127.0.0.1:980/server-manager

which is why I prefer to access it locally. there is that option to allow external access. However I have tired both ways. I am going to try it again using allow external. my server is on a 172 subnet. my desktop laptop are on a 10 and a 192. I have allowed both of them access vis the local networks config in server-manager (accessing it via root)

[cyberwatcher]

when accessing the console via an ssh session it specifically says when accessing the url from a web browser us:
https://mail/server-manager
 

so RequestedDeletion appreciate your help and everyone else but you telling me that SME never worked that was is not correct.

let me know if you need anymore logs or anything. I am still trying to figure this out.

[guest22]

when accessing the console via an ssh session it specifically says when accessing the url from a web browser us:
https://mail/server-manager

This is a very confusing sentence to me.

Your domain is cyberwatch.com, nothing else. Forget about mail.whatever.  Let's focus on a normal functioning of the server and leave mai setup out of the mix here.

You granted access to your local sub networks to server manager. Did you enter the correct netmasks?

[cyberwatcher]

yes I did that. It came over from the restore but I checked everything over and over. I will say this, and I should have mentioned it and would have but I didnt remember until today, I was able to access the server-manager before doing the restore. Not after :/

cyberwatchers.com is working for everything else. mail flow working fine. it is weird. I even deleted my IE and mozilla folders from my computer so that I can access the server new with no cert. didnt work. I am going to connect my mac to the DMZ port the mail server is on (172 network) and see if directly connecting to the network it is on lets me in.

[cyberwatcher]

RESOLVED!!!

it worked when connecting directly to the subnet my mail server is on. So when looking at my firewall policy lol yep that was it. Its working now. I am not sure why but the upgrade uses port 80 when accessing the server-manager even thought I am using https.... I never needed that port to go from "trust to dmz" before. I saw port 80 being blocked each time I access the server via https://mail/server-manager.

Why is that? I am sure there is a logical reason. Thanks for you help and if I hit up on something interesting let me know.

so the fix was allow port 80 from my trust LAN out to my DMZ where my server is located.

do you close this case or can I? thanks again for the help.

[janet]

cyberwatcher, RequestedDeletion et al

[root@mail etc]# hostname -f
mail.cyberwatchers.com

root@mail etc]# db domains show
cyberwatchers.com=domain
    Content=Primary
    Description=Primary domain
    Nameservers=localhost
    Removable=no
    SystemPrimaryDomain=yes

The mail hostname name works/resolves as that is how the server is configured/named.
Instead of the servername being server123 it is named mail, so therefore http://mail/server-manager will work on the LAN,
as would http://server123/server-manager.

[janet]

cyberwatcher

I realise you now say this is resolved ie as a local firewall issue.

I will say this, and I should have mentioned it and would have but I didnt remember until today, I was able to access the server-manager before doing the restore. Not after :/

Did you remove any custom templates that were created for sme7 ?
You should have, & then recreated them for sme9.

Also there are significant changes between sme7 & sme9 & somewhere along the way I recall changes to how server manager was being accessed (local port or something....), so maybe some unexpected effect.

Referring to my earlier post, perhaps naming your server as "mail" is not the best idea, it can create confusion.

The URL mail.cyberwatchers.com will automatically be created by the system, refer server manager Configuration overview page.

[cyberwatcher]

no I didnt recreate any templates or remove any. I did this as a new install on another server. I still have the old one if incase I need to rebuild this one. I could always do that and this time name it mail1 or something. Its working fine now. I have added my OSSEC agent on it with is reporting fine to my OSSEC server. the only thing I need to do now is get syslog messages to pass to my syslog-ng server. I realize rsyslog is being used now version 9.0 and will be opening up a ticket.

for now it seems to be fine but now I am worried since it is named mail. I have had it that way for years on the other versions. renaming it would be more work as I would have to change the MX record at my name provider. not a big deal I guess.

what issues should I be looking for now since it is currently names mail?

[janet]

cyberwatcher

Your SystemName appears to be mail.
Just to be sure what is output of
config show SystemName

no I didnt recreate any templates or remove any. I did this as a new install on another server.

Yes but you said you did a restore of the sme7 backup to a fresh install of sme9, so any custom templates that were on sme7 will now be on sme9.
You should delete those after the restore, or recreate/check to see if the custom templates match the template code being used natively in sme9.

You can log in to the console (as admin) & run through the Configure this server screens & simply rename the server to something less "conflicting"
eg mymachine1 or whatever, anything other than mail, as that name conflicts (in a naming sense) with automatically created URL names.

You do not need your server to have a domain name of mail.yourdomain.com nor do you need external DNS to be configured for that, the sme server will respond to mail sent to yourdomain.com

I do not think it is causing serious issues, other than confusing those trying to help you.

[cyberwatcher]

ahhh ok I see. Yeah I expanded templates a few times for something I can't remember now. not many at all though. but I get it. so I will just change my nat rule on my firewall to point to the new name something other than mail.

If I do find templates that are 7.0 ones how can I get the 9.0 ones to replace ? thanks for the help and sorry for the confusion.

[janet]

cyberwatcher

If I do find templates that are 7.0 ones how can I get the 9.0 ones to replace ? thanks for the help and sorry for the confusion.

Theoretically any custom templates you find (in the custom templates tree) on your sme9 server, will be sme7 ones, unless you have been creating new ones on sme9.
So you could move any/all those custom templates to a safe place (folder) & then copy the original sme9 templates from the templates tree to the custom template tree & modify as necessary based on your requirements & what it is you were doing in the sme7 custom templates (use them as a guide).

Note I have seen many instances where the templates in older & newer versions of sme server are different & older templates do cause problems (errors etc), so it is best to recreate your custom templates based on the sme9 templates.
Some templates remain the same/similar, & some do not.

Follow with
signal-event post-upgrade
signal-event reboot

[cyberwatcher]

ok thanks I will research and figure that out. makes sense. this case can be closed though If I have any issues I will get with you guys. thanks for what you do.

[CharlieBrady]

That is a different URL then you posted as your main problem/title. But in both cases you should use a FQDN.

Or an IP address, which would eliminate the possibility of a name resolution problem.

OP should look in /var/log/httpd/error_log and /var/log/httpd/admin_error_log. And remain calm, be friendly and polite, and provide more clear information.

[cyberwatcher]

Janet I have searched /etc/e-smith/templates-custom and templates-user-custom and don't see anything in there actually. I don't think it copied anything over. I remember expanding a template I think for user console to create vacation time and such but that did not get installed with this new version. I will install it later.

[cyberwatcher]

Charlie Brady yes I did use the local IP address when testing thanks. the logs which I included in previous posts I did add. I didnt see anything in the logs stating port 80 was being blocked.

I still find it odd that I had to enable 80 from one network segment to the segment my mail server is on in order to get https to work. I didnt have to do that in last version. its working though so. thanks again.

[CharlieBrady]

Charlie Brady yes I did use the local IP address when testing thanks. the logs which I included in previous posts

You didn't include any logs or tcpdumps in any previous posts, as you can verify by just reading this thread. You didn't say anything about different network segments or anything about port 80.

We do not have a crystal ball and cannot read your mind.

I think it would be useful for you to read this essay:

http://www.chiark.greenend.org.uk/~sgtatham/bugs.html

I'm glad that your system is now working.

[janet]

cyberwatcher

If there is nothing in the custom template tree(s) then you did not have any in sme7 & that's why none were restored from the backup.

That just means that old custom templates are not causing you any problem, which is good.
It was worth checking.

Templates installed by contribs are not included in backups, so do not get transferred to the new server during a backup restore, any contribs need to be reinstalled on sme9 (el6 compatible versions).

[cyberwatcher]

Charlie

I don't need to read your essay and don't need to deal with your attitude either. I have posted the TCPDUMP log files more than once in the thread and also have added in logs. Its not my fault that you either haven't taken the time to look through the thread or the thread is auto deleting what I have added. Quite frankly I don't care what you think. I fixed the issue myself.

I Also did mention the different segments on my network. YOU go re-read.

If you want people to be "friendly and polite" maybe you should also?

Go scold your kids or something. who are you to talk to me like that? You people have attitudes then get upset if someone responds back with one.

[cyberwatcher]

Thank you Janet for the information I appreciate it.

[Stefano]

Charlie

I don't need to read your essay and don't need to deal with your attitude either. I have posted the TCPDUMP log files more than once in the thread and also have added in logs. Its not my fault that you either haven't taken the time to look through the thread or the thread is auto deleting what I have added. Quite frankly I don't care what you think. I fixed the issue myself.

I Also did mention the different segments on my network. YOU go re-read.

If you want people to be "friendly and polite" maybe you should also?

Go scold your kids or something. who are you to talk to me like that? You people have attitudes then get upset if someone responds back with one.

Cyberwatcher.. your tcpdump's logs are useless and you posted them after many, too many posts.. meanwhile your attitude was (too) unpolite, and now you are offending (another) forum member.. please cease this kind of attitude..
if YOU need help, the first thing YOU have to do is to help US to help YOU.. you are our eyes, no one here can see what you see and for sure no one knows what you did and how.

so, in the end, YOU must be more verbose and collaborative, remembering that this is a forum, not an helpdesk.

I think that you should apologize and thank all

[cyberwatcher]

thanks all I totally don't know what I was thinking please forgive.