Postal: Smtp server cannot bind to port 25

[fschndr]

On my Ubuntu 16.04.2 LTS (GNU/Linux 4.4.0-87-generic x86_64) machine the smtp server cannot bind to port 25.

17:24:32 smtp.1          | => Errno::EACCES: Permission denied - bind(2) for "::" port 25

I recently installed some updates via apt (including linux-headers 4.4.0-87 and ruby 2.3) and i also know that it's not trivial to bind to privileged ports for security reasons without root permissions.

So i wonder how this worked in the first place and what made it stop working after the updates.

Here is the complete list of the updates:

````
Start-Date: 2017-07-26 09:40:05
Commandline: apt upgrade
Requested-By: fabian (1000)
Install: linux-headers-4.4.0-87:amd64 (4.4.0-87.110, automatic), linux-image-4.4.0-87-generic:amd64 (4.4.0-87.110, automatic), linux-image-extra-4.4.0-87-generic:amd64 (4.4.0-87.110, automatic), linux-headers-4.4.0-87-generic:amd64 (4.4.0-87.110, automatic)
Upgrade: libgssapi3-heimdal:amd64 (1.7~git20150920+dfsg-4ubuntu1, 1.7~git20150920+dfsg-4ubuntu1.16.04.1), libdns-export162:amd64 (1:9.10.3.dfsg.P4-8ubuntu1.6, 1:9.10.3.dfsg.P4-8ubuntu1.7), libisccfg140:amd64 (1:9.10.3.dfsg.P4-8ubuntu1.6, 1:9.10.3.dfsg.P4-8ubuntu1.7), libwind0-heimdal:amd64 (1.7~git20150920+dfsg-4ubuntu1, 1.7~git20150920+dfsg-4ubuntu1.16.04.1), uuid-runtime:amd64 (2.27.1-6ubuntu3.2, 2.27.1-6ubuntu3.3), linux-headers-generic:amd64 (4.4.0.81.87, 4.4.0.87.93), libfdisk1:amd64 (2.27.1-6ubuntu3.2, 2.27.1-6ubuntu3.3), linux-libc-dev:amd64 (4.4.0-81.104, 4.4.0-87.110), ruby2.3:amd64 (2.3.1-2~16.04, 2.3.4-1bbox1~xenial2), libmysqlclient-dev:amd64 (5.7.18-0ubuntu0.16.04.1, 5.7.19-0ubuntu0.16.04.1), libsystemd0:amd64 (229-4ubuntu17, 229-4ubuntu19), linux-image-generic:amd64 (4.4.0.81.87, 4.4.0.87.93), libheimntlm0-heimdal:amd64 (1.7~git20150920+dfsg-4ubuntu1, 1.7~git20150920+dfsg-4ubuntu1.16.04.1), libmount1:amd64 (2.27.1-6ubuntu3.2, 2.27.1-6ubuntu3.3), nginx-core:amd64 (1.10.0-0ubuntu0.16.04.4, 1.10.3-0ubuntu0.16.04.2), bind9-host:amd64 (1:9.10.3.dfsg.P4-8ubuntu1.6, 1:9.10.3.dfsg.P4-8ubuntu1.7), dnsutils:amd64 (1:9.10.3.dfsg.P4-8ubuntu1.6, 1:9.10.3.dfsg.P4-8ubuntu1.7), libheimbase1-heimdal:amd64 (1.7~git20150920+dfsg-4ubuntu1, 1.7~git20150920+dfsg-4ubuntu1.16.04.1), linux-headers-generic-lts-vivid:amd64 (4.4.0.81.87, 4.4.0.87.93), util-linux:amd64 (2.27.1-6ubuntu3.2, 2.27.1-6ubuntu3.3), coreutils:amd64 (8.25-2ubuntu2, 8.25-2ubuntu3~16.04), libisc160:amd64 (1:9.10.3.dfsg.P4-8ubuntu1.6, 1:9.10.3.dfsg.P4-8ubuntu1.7), udev:amd64 (229-4ubuntu17, 229-4ubuntu19), libexpat1:amd64 (2.1.0-7ubuntu0.16.04.2, 2.1.0-7ubuntu0.16.04.3), ruby2.3-dev:amd64 (2.3.1-2~16.04, 2.3.4-1bbox1~xenial2), nginx-common:amd64 (1.10.0-0ubuntu0.16.04.4, 1.10.3-0ubuntu0.16.04.2), libudev1:amd64 (229-4ubuntu17, 229-4ubuntu19), mount:amd64 (2.27.1-6ubuntu3.2, 2.27.1-6ubuntu3.3), ntpdate:amd64 (1:4.2.8p4+dfsg-3ubuntu5.4, 1:4.2.8p4+dfsg-3ubuntu5.5), apport:amd64 (2.20.1-0ubuntu2.6, 2.20.1-0ubuntu2.10), libblkid1:amd64 (2.27.1-6ubuntu3.2, 2.27.1-6ubuntu3.3), libisc-export160:amd64 (1:9.10.3.dfsg.P4-8ubuntu1.6, 1:9.10.3.dfsg.P4-8ubuntu1.7), libruby2.3:amd64 (2.3.1-2~16.04, 2.3.4-1bbox1~xenial2), python3-apport:amd64 (2.20.1-0ubuntu2.6, 2.20.1-0ubuntu2.10), ruby:amd64 (1:2.3.0+1, 2:2.3.0+1bbox1~xenial1), systemd-sysv:amd64 (229-4ubuntu17, 229-4ubuntu19), libuuid1:amd64 (2.27.1-6ubuntu3.2, 2.27.1-6ubuntu3.3), libgcrypt20:amd64 (1.6.5-2ubuntu0.2, 1.6.5-2ubuntu0.3), liblwres141:amd64 (1:9.10.3.dfsg.P4-8ubuntu1.6, 1:9.10.3.dfsg.P4-8ubuntu1.7), libhcrypto4-heimdal:amd64 (1.7~git20150920+dfsg-4ubuntu1, 1.7~git20150920+dfsg-4ubuntu1.16.04.1), libpam-systemd:amd64 (229-4ubuntu17, 229-4ubuntu19), systemd:amd64 (229-4ubuntu17, 229-4ubuntu19), libsmartcols1:amd64 (2.27.1-6ubuntu3.2, 2.27.1-6ubuntu3.3), mysql-common:amd64 (5.7.18-0ubuntu0.16.04.1, 5.7.19-0ubuntu0.16.04.1), linux-generic-lts-vivid:amd64 (4.4.0.81.87, 4.4.0.87.93), libmysqlclient20:amd64 (5.7.18-0ubuntu0.16.04.1, 5.7.19-0ubuntu0.16.04.1), bsdutils:amd64 (1:2.27.1-6ubuntu3.2, 1:2.27.1-6ubuntu3.3), libdns162:amd64 (1:9.10.3.dfsg.P4-8ubuntu1.6, 1:9.10.3.dfsg.P4-8ubuntu1.7), libroken18-heimdal:amd64 (1.7~git20150920+dfsg-4ubuntu1, 1.7~git20150920+dfsg-4ubuntu1.16.04.1), libasn1-8-heimdal:amd64 (1.7~git20150920+dfsg-4ubuntu1, 1.7~git20150920+dfsg-4ubuntu1.16.04.1), libisccc140:amd64 (1:9.10.3.dfsg.P4-8ubuntu1.6, 1:9.10.3.dfsg.P4-8ubuntu1.7), libkrb5-26-heimdal:amd64 (1.7~git20150920+dfsg-4ubuntu1, 1.7~git20150920+dfsg-4ubuntu1.16.04.1), libbind9-140:amd64 (1:9.10.3.dfsg.P4-8ubuntu1.6, 1:9.10.3.dfsg.P4-8ubuntu1.7), libhx509-5-heimdal:amd64 (1.7~git20150920+dfsg-4ubuntu1, 1.7~git20150920+dfsg-4ubuntu1.16.04.1), linux-generic:amd64 (4.4.0.81.87, 4.4.0.87.93), python3-problem-report:amd64 (2.20.1-0ubuntu2.6, 2.20.1-0ubuntu2.10), nginx:amd64 (1.10.0-0ubuntu0.16.04.4, 1.10.3-0ubuntu0.16.04.2)

````

I hope you find this useful.

Kind Regards

Fabian

[willpower232]

can you run netstat -lnp and see what is blocking port 25? have you tried restarting the server?

[catphish]

You need to give Ruby permission to listen on privileged ports. This will have been lost when you upgraded ruby:

sudo setcap 'cap_net_bind_service=+ep' /usr/bin/ruby2.3

[fschndr]

Yes, Thank you @catphish this was my fault. Now the bind works again. And you got it perfectly documented in the installation section in the wiki under "Preparing your operating system". So shame on me.

I would have liked a hint in the logs while failing. Maybe a simple check prior to the bind of ports below 1024 would be helpful? Maybe a simple getcap /usr/bin/ruby2.3 with regex in the task of the smtp server? I must admit that i'm not confident with your process/task/procodile structure to find the right spot to put this check.

[willpower232]

It might be worth adding to the documentation to say that the permission is revoked when the software gets updated

[catphish]

Sounds like a more helpful error message with a hint would be an excellent idea :slightly_smiling_face:

[shopglobal]

This solved an issue we were having as well... Worth noting that this is certainly better than reinstalling..