NFC Troubleshooting Document.

Auto-generated from the uploaded PDF NFC_Troubleshooting_Document..pdf. This is an extracted-text rendering for searchability; see the original PDF for exact formatting, diagrams, tables, and images.

Index:

Table of Contents
1. How to add DAE IP’s in MTA servers. ..............................................................................................2
2. How to add DAE domains in MTA servers........................................................................................3
3. How to Find differed mails in MTA servers. .....................................................................................3
4. If Mails are in Deferred mode we need to flush manually by using below command. .......................4
5. CLUSTER CHECKING ........................................................................................................................5
6. We should check that shared storage(/opt) mounted or not in both mbox servers...........................6
7. Mails Trace out ..............................................................................................................................7
8. Mail sent but mail delivery failed ....................................................................................................8
9. Email Log Analysis ..........................................................................................................................8
10. Attachment restriction is ON/OFF .................................................................................................9
11. change Mail Routing from UUCP to Anunet and Vice Versa.......................................................... 10
12. USER PERMISSIONS FOR OUTSIDE MAILS WITH AND WITHOUT ATTACHMENTS ....................... 11
13. User Transfer From NFC to ZC/KOTA or vice versa ....................................................................... 13
14. Restrict Users to send a mail outside (Gmail, yahoo) ................................................................... 14
15. Gal sync accounts. ...................................................................................................................... 16
16. User Unable to send/receive Mails ............................................................................................. 18
17. Drbd is checking in both serves in KOTA and ZC locations. ........................................................... 19
18. Zimbra email flow: ..................................................................................................................... 21
19. To check all services status at all three location status, start & stop check below ......................... 22
20. Check HAProxy 1 &HAProxy 2 status, we have to login 10.172.98.207& 208................................. 23
21. All port’s & bridges from HYD KVM BM ....................................................................................... 24
22. To enable SSL certificate for mails……………………………………………………………………………………………………30

23. To enable Rocket Chat SSL certificate for mail's………………………………………………………………………………31

24. SOP for Antivirus updation on Email Systems…………………………………………………………………………………33

25. Change Mail Routing from UUCP to Anunet and Vice Versa …………………………………………….35

26. Account Setup Status of User Accounts Admin Console…………………………….37

1|Page

1. How to add DAE IP’s in MTA servers.
We need to login to both MTA servers and follow the below process.

# cd /opt/zimbra/common/conf

2. How to add DAE domains in MTA servers.

We need to login to both MTA servers and follow the below process.

# cd /opt/zimbra/common/conf

# vi local_domains

2|Page

3. How to Find differed mails in MTA servers .
 MTA 1
 MTA 2

We need to login to both MTA servers and follow the below process.

# cd /var/spool/postfix-2/deferred

# ls

3|Page

4. If Mails are in Deferred mode we need to flush manually by using below
command.

# /usr/sbin/postqueue-c /etc/postfix-2/ -f

# /opt/zimbra/common/sbin/postqueue -f

# /usr/sbin/postqueue -f

5. CLUSTER CHECKING

1. Login to mailbox servers and check cluster status.
2. Both Nodes should be online otherwise we will get problem.
3. Please find the below process
4. How to check the cluster status and stand by and unstand by the nodes?

4|Page

# pcs status

 In above image displays both nodes show Online.
 We can find the ip and zimbra running on which node .
 If only one node is online, it may cause the problem when online machine is down. Production
will stop.
 Because of that reason both nodes should be online.
 Please find the below image.

# pcs status

5|Page

 If we want move the cluster services manually follow the below commands.

# pcs node standby mbox2-hyd.nfc.gov.in (It means mbox2 should be going to offline)

# pcs node unstandby mbox2-hyd.nfc.gov.in (It means mbox2 should be going to online)

6. We should check that shared storage(/opt) mounted or not in both mbox
servers.

 Please find the below command and images.

# df –h

 /dev/mapper/vg_gfs2-lv_gfs2 7.0T 4.2T 2.9T 60% /opt (shared storage)

6|Page

7. Mails Trace out
 We need to login to both MTA servers
 After logging switch to zimbra user and run below commands.
 Please find the below image.

# su – zimbra

# ./libexec/zmmsgtrace -s sender@nfc.gov.in -r receiver@nfc.gov.in /var/log/zimbra.log-20240511.gz
(path)

8. Mail sent but mail delivery failed
1) First we need to log in MTA SERVERS as a root user.

2)Switch to zimbra user

a) su – zimbra

3) Then there is a reason for delivery failed.

i) Mail in mailq.

ii) differed: blocked in Imsva level

iii) Bounce back: If we didn’t get any bounce back we can trace out the mail by the following command.

7|Page

ii) We require both sender and reciver address

# ./libexec/zmmsgtrace -s sender@mail.com -r reciver@mail.com.

9. Email Log Analysis
 Important logs.

a. /var/log/maillog
b. /var/log/zimbra.log
c. /opt/zimbra/log/mailbox.log
d. /opt/zimbra/log/audit.log

# /var/log/maillog : In this log we can find delivery of mails.

# /var/log/zimbra.log: In this log we can find delivery of mails and also amavis everything.

# /opt/zimbra/log/mailbox.log: In this log we can find user what is mail id Orgin IP and type of
webclient.

# /opt/zimbra/log/audit.log: In this log we can find user what is mail id Orgin IP and also authentications.

Examples:
# tail –f /var/log/maillog : For continous logs

# less /var/log/maillog | grepuser@nfc.gov.in : we can find mail deliver r not.

# cat /opt/zimbra/log/audit.log | grepuser@nfc.gov.in : to find a user login time and IP

10. Attachment restriction is ON/OFF
1. First we need to login to MTA Servers of Hyderabad (mta1 and mta2).
2. Login through putty.
3. Please follow the below commands
a) cd /opt/zimbra/common/conf
b) In this path two files
i) group1_transport and group2_transport
ii) group1_transport = this file has some users they have attachment facility
iii) If we want to give permission to any user to send attachment outside add in this file. After
adding need to run following command.
iv) postmap /opt/zimbra/common/conf/group1_transport .

8|Page

 Please follow the below commands

a) cd /opt/zimbra/common/conf

group2_transport

i) group2_transport = this file has some users they have without attachment facility.
ii) If we want to give permission outside to any user without attachment add in this file after
adding need to run following command.
iii) postmap /opt/zimbra/common/conf/group2_transport
iv) Please find the below image.

9|Page

11. change Mail Routing from UUCP to Anunet and Vice Versa
 Become zimbra user after login to the both Hyderabad MTA servers (98.201 and 98.204).
 Open /opt/zimbra/common/conf/transportfile

 Comment all the lines containing 172.16.29.100 (Anunet SMTP server) and save the file.
 run postmap /opt/zimbra/common/conf/transportfile.
 To revert back to anunet gateway repeat 3rd step uncommenting and run step 4.

10 | P a g e

12. USER PERMISSIONS FOR OUTSIDE MAILS WITH AND WITHOUT ATTACHMENTS

1. After creation of email and archive accounts we need to give outside mails
permission.
2. Generally we have “2” MTA Servers in our system we need to add user in that
servers.
3. We have “2” groups in each MTA Servers.
4. group1_transport ( In this group of users able to send attachments outside with
25MB only).
5. group2_transport (In this group of users able to send only mails outside without
attachments).
6. Login to “MTA SERVERS “as a Zimbra user and execute the following commands
and find the below images.
7. After adding mail id in groups we need to run postmap command which is given
below.

# su – zimbra

$ cd /opt/zimbra/common/conf/

$ vi group1_transport

$ postmap /opt/zimbra/common/conf/group1_transport

$ vi group1_2ransport

$ postmap /opt/zimbra/common/conf/group2_transport

11 | P a g e

$ postmap /opt/zimbra/common/conf/group1_transport

12 | P a g e

13. User Transfer From NFC to ZC/KOTA or vice versa

 First Login into admin panel

 Search a user we want to transfer account from one location to another.

13 | P a g e

 Select Move mailbox.

 The selected user previously in Hyderabad server as shown below.

 We can move to Kota or ZC locations as shown below image and Vice-versa archive mail id also need
to move.

 Save it

14. Restrict Users to send a mail outside (Gmail, yahoo)

 Login to MTA Servers and switch to zimbra user
 Run following commands.

14 | P a g e

# su – zimbra

# cd /opt/zimbra/common/conf

# cat restricted_senders

15 | P a g e

15. Gal sync accounts.

 Please find the gal sync accounts depends on location
 If user’s mailbox takes more time for loading, please check different location gal sync account
mounted.

galsync.0xcn_3eu4z@nfc.gov.in - Kota archive

galsync.9ljcthrp@nfc.gov.in - Hyd archive

galsync.osnphefhw7@nfc.gov.in - ZC archive

galsync.aewzjywpp@nfc.gov.in - ZC mailbox

galsync.qq7du2_vc@nfc.gov.in - Kota mailbox

galsync.yxn8jp0m@nfc.gov.in - Hyd mailbox

 Please find the below commands to check and remove.
 Login to mailbox server and switch to zimbra user.

# su – zimbra
# zmmailbox -z -m vsai@nfc.gov.in gaf (to get the user mount information)

16 | P a g e

 In Above image if any different gal sync account mount we can remove by using below
command.

# zmmailbox -z -m vsai@nfc.gov.in (hyd-user)df/galsync.0xcn_3eu4z_InternalGAL( kota-archive mount
point)

17 | P a g e

16. User Unable to send/receive Mails

 User unable send/receive mails.
 Please check the quota of user.

18 | P a g e

17. Drbd is checking in both serves in KOTA and ZC locations .

 We need to check every day weather data sync or not in between two mail box servers.
 If both are not sync means data is not replicating into secondary.
 mbox 1 is primary and mbox2 is secondary both should be up to date.
 If mbox1 down all service shifted to mbox 2 that time data will not be lost
 If both are not up to date mbox1 down all service shifted tombox 2 that time data will
be lost.
 So before doing any changes need to check

#drbdadm status

# drbdadm connect drbd1

 Mbox1

19 | P a g e

 Mbox2

Zcmbox1

#drbdadm status

# drbdadm connect drbd1

Zcmbox2

#drbdadm status

20 | P a g e

18. Zimbra email flow:

21 | P a g e

19. To check all services status at all three location status, start & stop check
below
 Login as a root user then swith to zimbra user then please follow the below commands:
# zmcontrol status
# zmcontrol start
# zmcontrol restart
# zmcontrol stop

10.172.98.204 & 201 [MTA 1 & 2]

10.172.98.203 & 206 [Ldap 1 & 2]

10.172.98.209 archive server

22 | P a g e

Need to verify with below commands:

Service Status Services Start Services Restart Services Stop
zmcontrol status zmcontrol start zmcontrol restart zmcontrol stop
to check all If some services are If all services are If we need to stop the
services are not running or not running we services, we have to
running or not stopped, we have to have to restart use above command
use above command the services using
above command

20. Check HAProxy 1 &HAProxy 2 status, we have to login 10.172.98.207& 208
#systemctl status haproxy (to check the status of the service)

#systemctl start haproxy (to start the service if it is inactive)

#systemctl stop haproxy (to stop the running service)

23 | P a g e

21. All port’s & bridges from HYD KVM BM
HYD BM KVM 1 IP: [10.172.98.199:9090]
bridge0 & bridge1

bridge0 ports

24 | P a g e

bridge1 ports

HYD BM KVM2 IP: [10.172.98.198:9090]
Brige0 & bridge1

25 | P a g e

Bridge0 ports

Bridge1 ports

26 | P a g e

HYD BM Archive : IP [10.172.98.200:9090]
Bridge0 ports

Bridge0 ports

27 | P a g e

HYD Internal KSMG Anunet: IP [10.172.98.194:9090]
Bridge0 & bridge1

Bridge0 ports

28 | P a g e

Bridge1 ports

29 | P a g e

22. To enable SSL certificate for mails
 We have to login HAProxy 1 & 2 in all 3 locations, IP’s mentioned below
 HYD HAProxy 1 & 2 [10.172.98.207 & 208]
 KOTA HAProxy 1 & 2 [10.174.98.77 & 78]
 ZC HAProxy 1 & 2 [10.173.120.47 & 48]
Commands to enter the path

# cd /etc/haproxy/certs/
# ls

 For Previous file we are taking backup file name bundle.pem renamed as
bundle_old.pem
 We combined 3 SSL files into a new file named as bundle-new-4.pem
# cat privatekey.key EndEntity_wc.nfc.gov.in.cer 'CA_emSign SSL CA - G1.cer' > bundle-new-
4.pem
# mv bundle-new-4.pem bundle.pem (we renamed bundle-new-4.pem as bundle.pem)

 After making changes we need to restart the HAProxy services
 After restart check the status commands are mentioned below
# systemctl restart haproxy
# systemctl status haproxy

30 | P a g e

Chat SSL certificate:

IP: 10.172.98.228

# cd /etc/nginx/

# ls

# ll

We have taken backup old files as certificate_old.crt certificate_old.key

# mv certificate.crt certificate_old.crt

# mv certificate.key certificate_old.key

After adding new ssl certificate file, We need to restart the service

# systemclt restart nginx

31 | P a g e

SOP for Antivirus updation on Email Systems:

1. Download latest updates from website using the following links

https://www.qnap.com/en-as/how-to/faq/article/how-to-update-clamav-virus-database-
manually

2. Process to update ClamAV & Process for placing the files on 10.172.98.227

# cd /clamav_backup/

32 | P a g e

#ls
bytecode.cvd daily.cvd main.cvd
#rm -rf bytecode.cvd daily.cvd main.cvd

 We will take backup for old updated files in clamav_backup folder

# cd /var/www/html/clamavdb
# mv bytecode.cvd daily.cvd main.cvd /clamav_backup

 After taking backup from /var/www/html/clamavdb folder to clamav_backup folder

3. Procedure for Verify and copy the downloaded files from Internet to NFCNet :
 After downloading from internet we will place those files in antivirus server with the
help of hardisk
 Through Winscp We will copy the files after downloading from internet

Winscp:

# cd /var/www/html/clamavdb
# ls
bytecode-334.cdiff bytecode.cvd daily-27184.cdiff daily.cvd dns.txt main-62.cdiff main.cvd

33 | P a g e

4. Verification procedure:

# /opt/zimbra/common/bin/freshclam --version --config-file=/opt/zimbra/conf/freshclam.conf

Result:
ClamAV 1.0.1/27313/Fri Jun 21 13:58:08 2024

34 | P a g e

Change Mail Routing from UUCP to Anunet and Vice Versa
Switch to zimbra user after login to the both Hyderabad MTA servers, IP’s mentioned below
IP’s : (10.172.98.201 and 10.172.98.204)
Open #Cd /opt/zimbra/common/conf/transportfile
# ls
# Cat transportfile

To change the routing from anunet to internet IMSVA

# vi transportfile

After opening we need to give # comment for domains in both mta1 & mta2 as shown below image

After giving # comment we need to run postmap, command given below

# postmap transportfile (in both MTA’s)

35 | P a g e

After running postmap in both MTA’s mails go through internet IMSVA

To revert back to anunet gateway repeat the step uncommenting and run #postmap transportfile in
both MTA’s

36 | P a g e

Account Setup Status of User Accounts Admin Console:
Active: Mail account can open and operate

Closed: Mail account can’t be opened, mails won’t be received and can’t be sent by end user.

Locked: Mail account will can’t open mails can receive can send by end user.

Pending: Mail account can’t be opened, mails won’t be received and can’t be sent by end user.
Maintenance: Mail account will can’t open mails can receive can send by end user.

Please find the below step’s:

1. Active: Active Normal state for mailbox account. Mail is delivered and users can log in to the client
interface. The account is fully active and operational. The user can log in, send, and receive
emails without there restrictions.

2. Closed: When a domain status is marked as closed, Login for accounts on the domain is disabled and
messages are bounced The user cannot log in or access the account.

3. Locked: The account is locked. The user cannot log in, but incoming emails are still accepted
and delivered to the mailbox, Used as a temporary measure when an account needs to be
suspended without rejecting incoming emails, such as during an investigation or security
concern.

4. Pending: The account is pending activation. It is not yet active, and the user cannot log in or
use the account. Used for accounts that have been created but are awaiting some form of
approval or activation process.

5. Maintenance: The account is in maintenance mode. The user cannot log in, and incoming
emails will receive. Used when an account needs to be temporarily disabled for maintenance
purposes, such as data migration or troubleshooting.

37 | P a g e

Please find the image below for Maintenance mode:

This account is currently in maintenance mode.

38 | P a g e

BRIEFCASE SHARE FOLDER

 Briefcase is used to share a document/files to anyone of the user.

1. Please login to mail your account.
2. Go to Briefcase and select folder.
3. Under briefcase we have created one folder nfc_highlights.
4. Right click on that folder.
5. Please find the below images.

39 | P a g e

 Upload a document.
 Please find the below image.

 Upload a document under nfc_highlights folder.
 Please find below image.

40 | P a g e

 Right click on nfc_highlights folder.
 Share folder with view or editable permissions.
 Please find below image.

41 | P a g e

42 | P a g e