POPIMAPDaemon Dead

Hi UJay Thank you for connecting with the Sophos community team, You may check the warren.log, csc.log, and applg.log to get the clue. Please validate below old thread steps if any log lines matches.

https://community.sophos.com/sophos-xg-firewall/f/discussions/98766/upgrade-from-17-mr1-to-mr2-breaks-imappop-daemon

I would also suggest opening a support case to work on the same to have the next investigation.

Hi UJay Thank you for connecting with the Sophos community team, You may check the warren.log, csc.log, and applg.log to get the clue. Please validate below old thread steps if any log lines matches.

https://community.sophos.com/sophos-xg-firewall/f/discussions/98766/upgrade-from-17-mr1-to-mr2-breaks-imappop-daemon

I would also suggest opening a support case to work on the same to have the next investigation.

Hi Vishal

I have already open a support case and they are working on it but so far no positive outcome. 

BR

Uditha

Did you get any feedback on the problem? Well, this error happened to me too.

I still haven't got a proper solution from them. One of the support personnel collected logs and went off but so far no resolution. I have downgraded it to previous firmware version and it helps to run without that error. 

The support personnel told me that this issue has reported by a few others too. May be you should also create a support request. Then SOPHOS engineers will wake up from the hibernation to develop a resolution.  

I am disappointed about the lethargic support response they have

Here is the solution I found in the link below.

(+) POPIMAPDEAMON is dead after updating to SFOS 19 - Discussions - Sophos Firewall - Sophos Community

The solution was to do the following steps.

1. Chang the CA settings

• Login to your Sophos XG
• Go to Certificates
• Go to Certificate authorities
• Click on edit by the CA called Default
• Set here state, company and mail
• Save

2. Regenerat the ApplianceCertificate

• Go to Certificates
• Click on the gear behind ApplianceCertificate
• Accept the popup message

3. Start the warren service

• Start an SSH connection
• Open the advanced shell
• service warren:start -dsnosync

After that the service is running without any problems.

followed the instructions but the service is still showing dead

XGS126w_XN01_SFOS 19.0.0 GA-Build317# service warren:start -dsnosync
503 Service Failed
XGS126w_XN01_SFOS 19.0.0 GA-Build317#

Hello Geoffrey Stoner

Can you provide us the logs here tail -f /log/warren.log 

XGS126w_XN01_SFOS 19.0.0 GA-Build317# tail -f /log/warren.log
MSG May 17 12:45:43Z [4150933248]: register_protocol: "POP3" for port: 109
MSG May 17 12:45:44Z [4150933248]: SSL global pk initialization done
MSG May 17 12:45:44Z [4150933248]: maxscansize = 1024000
MSG May 17 12:45:44Z [4150933248]: action: KW_DO_S_VIRUSSCAN
MSG May 17 12:45:44Z [4150933248]: KW_PREFIXSUBJECT [Infected attachment remov ed]
MSG May 17 12:45:44Z [4150933248]: ACCEPT hard_action
MSG May 17 12:45:44Z [4150933248]: initializing SSL context
MSG May 17 12:45:44Z [4150933248]: TRUSTED CACERT DIR: '/conf/certificate/cace rts/'
ERR May 17 12:45:44Z [4150933248]: reading private key '/conf/certificate/capr ivate/Default.key' failed for 'error:06065064:digital envelope routines:EVP_Decr yptFinal_ex:bad decrypt'
CRT May 17 12:45:44Z [4150933248]: FATAL: /cfs/proxy/warren/conf/policy.conf : ERROR - init_policy_config

Okay, this is a certificate error, under the general settings of the email > change the certificate from appliance certificate to security appliance certificate and then restart the warren service again "service warren:restart -ds nosync" 

Then check the status...

worked thank you