amavisd.service failed with result protocol failed to start mail content checher

[anandmys]

Everything was running smooth.

But last 3 days, everyday, mails stop working.

I saw some error messages like

cwp amavisd.service failed with result 'protocol'
failed to start mail content checker

Most of the times, cant login to cwp admin

Restarting the server fixing the issue for few hours.

Please suggest

[anandmys]

Jun 24 03:10:25 hosting systemd[1]: lfd.service: Can't open PID file /run/lfd.pid (yet?) after start: No such file or directory
Jun 24 03:10:25 hosting systemd[1]: Started ConfigServer Firewall & Security - lfd.
Jun 23 22:10:25 hosting chronyd[717]: Selected source 144.202.62.209 (2.almalinux.pool.ntp.org)
Jun 23 22:10:25 hosting chronyd[717]: System clock wrong by -17999.783626 seconds
Jun 23 22:10:25 hosting chronyd[717]: System clock was stepped by -17999.783626 seconds
Jun 23 22:10:25 hosting chronyd[717]: System clock TAI offset set to 37 seconds
Jun 23 22:10:25 hosting rsyslogd[959]: imjournal: journal files changed, reloading...  [v8.2102.0-15.el8_10.1 try https://www.rsyslog.com/e/0 ]

Anything to do with this issue?

[overseer]

Are you running stock CSF/LFD provided by CWP or the Aetherinox fork (I run the latter).
https://starburst.help/control-web-panel-cwp/control-web-panel-cwp-admin-tutorials/aetherinox-csf-firewall-update-to-v15-10-on-almalinux-8-9/

Can you make sure your system time is right? I usually use 0.pool.ntp.org and 1.pool.ntp.org for time servers.

The 0.pool.ntp.org address is part of the global NTP Pool project. It directs your system to a large, dynamic cluster of volunteer time servers, automatically assigning you the geographically closest available server to ensure high precision and minimum network delay

You may need to temporarily disable Amavis if it is the cause of your error. Try commenting out the relevant section in

Code Select Expand

/etc/postfix/master.cf and restart postfix.

[anandmys]

Thank you. Where to look for and use these values for time servers?

[anandmys]

I am already running v15.10

[overseer]

Edit your chrony configuration to set the timeservers:

Code Select Expand

nano /etc/chrony.conf

[anandmys]

If i restarr the server

1. I will be able to login to admin (i cant without restart)
2. I see that amavis and spamassasin in failed state. If I start, they start without issue

amavisd.service - Amavis mail content checker
   Loaded: loaded (/usr/lib/systemd/system/amavisd.service; disabled; vendor preset: disabled)
   Active: inactive (dead)
     Docs: http://www.ijs.si/software/amavisd/#doc


spamassassin.service - Spamassassin daemon
   Loaded: loaded (/usr/lib/systemd/system/spamassassin.service; disabled; vendor preset: disabled)
   Active: inactive (dead)

[overseer]

Want me to take a look at your server? If so, PM me connection details.

[anandmys]

Send PM

[overseer]

Ouch! Looks to need some serious cleanup work, unless you can roll back a few days before the infection. See this thread for remediation techniques and scripts:
https://forum.centos-webpanel.com/centos-webpanel-bugs/i-think-there-is-a-very-serious-security-vulnerability-in-cwp-right-now/