fetchmail-users — User questions and discussion

[fetchmail-users] Issue with Fetchmail

[Sridhar A. <ram...@ya...>]

Hi All,

Having issue with configuring email accounts with fetchmail.

I'm keep on getting the following issue:

C:\Program Files\OurInternet\Common\fetchmail\bin>type ..\rt-mailgate.conf   |
etchmail.exe -N -d 300 -f -
fetchmail: removing stale lockfile
fetchmail: starting fetchmail 6.2.5 daemon
fetchmail: Authorization failure on con...@ma...
fetchmail: Query status=3 (AUTHFAIL)
fetchmail: sleeping at Mon Aug  6 12:26:01 2007

And I configured the rt-mailgate.conf as following
poll mail.xyz.com proto pop3:
username contactus password XXXXX mda "c:/Progra~1/OurInternet/Common/perl/bin/perl.exe c:/Progra~1/Ourinternet/Reques~1/rt/bin/rt-mailgate.in --url http://localhost:8284/ --queue xyz --action correspond"

I'm using windows based rt server. Please help me am I doing any wrong?

For your information I'm having different mail domain on the same server.

Thanks and  regards,
Sridhar Adabala.
       
---------------------------------
Building a website is a piece of cake. 
Yahoo! Small Business gives you all the tools to get online.

Re: [fetchmail-users] how to recover lost email due to 553 sorry error

[Peter P. <ro...@ri...>]

On Mon, Aug 06, 2007 at 01:28:12PM +0200, Techtron Computers wrote:
> I had fetchmail running on a FreeBSD Server, which was downloading the email
> off a mail server on the internet, but got the following error msg, see
> below, but now the mail has been downloaded off the server on the internet
> and the mail is not is the local users mailbox, any chance I can recover the
> lost email, where should I look.

Errr, it shouldn't really have been downloaded "off the server on the
Internet"; can you post several more lines of the fetchmail log,
immediately following these?  If there is no "DELE" command sent to
the POP3 server in the following lines, then the mail should still
be there, waiting for you to fetch it.

Or am I assuming too much?  Is this not a POP3 server?  In any case,
a couple more lines from the fetchmail log should help - you cut it off
at almost the worst place possible, to keep us all in suspense :)

> ====================================================
> fetchmail: SMTP> RCPT TO:<general@localhost>
> fetchmail: SMTP< 553 sorry, that domain isn't in my list of allowed
> rcpthosts (#5.7.1)
> fetchmail: SMTP error: 553 sorry, that domain isn't in my list of allowed
> rcpthosts (#5.7.1)
> fetchmail: SMTP listener doesn't really like recipient address
> `general@localhost'
> fetchmail: SMTP> RCPT TO:<postmaster@localhost>
> fetchmail: SMTP< 553 sorry, that domain isn't in my list of allowed
> rcpthosts (#5.7.1)
> fetchmail: can't even send to postmaster!
> fetchmail: SMTP> RSET
> fetchmail: SMTP< 250 flushed
>  flushed
> =====================================================

G'luck,
Peter

-- 
Peter Pentchev	ro...@ri...    ro...@cn...    ro...@Fr...
PGP key:	http://people.FreeBSD.org/~roam/roam.key.asc
Key fingerprint	FDBA FD79 C26F 3C51 C95E  DF9E ED18 B68D 1619 4553
If wishes were fishes, the antecedent of this conditional would be true.

[fetchmail-users] how to recover lost email due to 553 sorry error

[Techtron C. <tec...@gm...>]

I had fetchmail running on a FreeBSD Server, which was downloading the email
off a mail server on the internet, but got the following error msg, see
below, but now the mail has been downloaded off the server on the internet
and the mail is not is the local users mailbox, any chance I can recover the
lost email, where should I look.

Thanks in advance for any help.

====================================================
fetchmail: SMTP> RCPT TO:<general@localhost>
fetchmail: SMTP< 553 sorry, that domain isn't in my list of allowed
rcpthosts (#5.7.1)
fetchmail: SMTP error: 553 sorry, that domain isn't in my list of allowed
rcpthosts (#5.7.1)
fetchmail: SMTP listener doesn't really like recipient address
`general@localhost'
fetchmail: SMTP> RCPT TO:<postmaster@localhost>
fetchmail: SMTP< 553 sorry, that domain isn't in my list of allowed
rcpthosts (#5.7.1)
fetchmail: can't even send to postmaster!
fetchmail: SMTP> RSET
fetchmail: SMTP< 250 flushed
 flushed
=====================================================

Re: [fetchmail-users] BUG: Null pointer dereference in sink.c:265

[Matthias A. <mat...@gm...>]

Am Samstag, den 28.07.2007, 21:19 -0700 schrieb Earl Chew: 
> I've found a problem with fetchmail core dumping via a null
> pointer dereference at sink.c:265 triggered by close_warning_by_mail()
> passing a null pointer for msg.

Is it looks to me, this fetchmail crash would have been triggered by
fetchmail's attempting to send a warning about failed authorization. The
crash then happens when the SMTP server rejects fetchmail's warning
message.

Can you confirm that from the MTA's logs perhaps?

> I'm running Fedora FC6 fetchmail-6.3.6-2 using fetchmail-6.3.6-2.fc6.src.rpm.
> I had a quick look at http://mknod.org/svn/fetchmail/trunk/ (rev 5117) and see the
> following call stack still exists:

It's been in existance since what we today call rev 2216 (committed 1998-11-27,
then released as fetchmail 4.6.8).

> #0  send_bouncemail (ctl=0x968a5b0, msg=0x0, userclass=1,
>     message=0x807854e "General SMTP/ESMTP error.\r\n", nerrors=1,
>     errors=0xbfe7f998) at sink.c:265
> #1  0x0805b77a in handle_smtp_report (ctl=0x968a5b0, msg=0x0) at sink.c:543
> #2  0x0805bbf3 in close_sink (ctl=0x968a5b0, msg=0x0, forward=1 '\001')
>     at sink.c:1386
> #3  0x0805c091 in close_warning_by_mail (ctl=0x968a5b0, msg=0x0) at sink.c:1582
> #4  0x08057a2a in do_session (ctl=0x968a5b0, proto=0x807f9a0, maxfetch=0)
>     at  driver.c:1214
> #5  0x08066ad9 in doPOP3 (ctl=0x0) at pop3.c:1409
> #6  0x0804eaaf in query_host (ctl=0x968a5b0) at fetchmail.c:1470
> #7  0x0804f5d3 in main (argc=Cannot access memory at address 0x0
> ) at fetchmail.c:739
> 
> I don't know whether the appropriate fix is to change:
> 
> 
>      /* don't bounce in reply to undeliverable bounces */
> -    if (!msg->return_path[0] ||
> +    if (!msg || !msg->return_path[0] ||
>   strcmp(msg->return_path, "<>") == 0 ||
>   strcasecmp(msg->return_path, md1) == 0 ||
>   strncasecmp(msg->return_path, md2, strlen(md2)) == 0)

I think it is, because we do not want to get bounces back to warning
messages we send. These are automated messages, and as such should never
trigger non-delivery notices.

Thank you very much for the concise report. Rev 5119 should fix the
problem and will be released as fetchmail 6.3.9 in a few days (or weeks,
depending on my spare time).

Thanks again.

Best regards
Matthias Andree

[fetchmail-users] BUG: Null pointer dereference in sink.c:265

[Earl C. <ear...@ya...>]

I've found a problem with fetchmail core dumping via a null
pointer dereference at sink.c:265 triggered by close_warning_by_mail()
passing a null pointer for msg.

I'm running Fedora FC6 fetchmail-6.3.6-2 using fetchmail-6.3.6-2.fc6.src.rpm.
I had a quick look at http://mknod.org/svn/fetchmail/trunk/ (rev 5117) and see the
following call stack still exists:

#0  send_bouncemail (ctl=0x968a5b0, msg=0x0, userclass=1,
    message=0x807854e "General SMTP/ESMTP error.\r\n", nerrors=1,
    errors=0xbfe7f998) at sink.c:265
#1  0x0805b77a in handle_smtp_report (ctl=0x968a5b0, msg=0x0) at sink.c:543
#2  0x0805bbf3 in close_sink (ctl=0x968a5b0, msg=0x0, forward=1 '\001')
    at sink.c:1386
#3  0x0805c091 in close_warning_by_mail (ctl=0x968a5b0, msg=0x0) at sink.c:1582
#4  0x08057a2a in do_session (ctl=0x968a5b0, proto=0x807f9a0, maxfetch=0)
    at  driver.c:1214
#5  0x08066ad9 in doPOP3 (ctl=0x0) at pop3.c:1409
#6  0x0804eaaf in query_host (ctl=0x968a5b0) at fetchmail.c:1470
#7  0x0804f5d3 in main (argc=Cannot access memory at address 0x0
) at fetchmail.c:739

I don't know whether the appropriate fix is to change:


     /* don't bounce in reply to undeliverable bounces */
-    if (!msg->return_path[0] ||
+    if (!msg || !msg->return_path[0] ||
  strcmp(msg->return_path, "<>") == 0 ||
  strcasecmp(msg->return_path, md1) == 0 ||
  strncasecmp(msg->return_path, md2, strlen(md2)) == 0)

 return(TRUE);
or something more sophisticated.

Earl

       
---------------------------------
Choose the right car based on your needs.  Check out Yahoo! Autos new Car Finder tool.

Re: [fetchmail-users] fetchmail - mailformat

[Rob M. <rob...@gm...>]

On 7/25/07, Gerhard Wolf <le...@gm...> wrote:
> Hi,
>
> i have fetchmail configured with:
>
> poll pop.mailserver.net with proto POP3
>        user 'le...@gm...' there with password 'password' is 'gerhard'
> here mda /usr/bin/procmail
>
> procmail writes to different files but all files do not have the mbox
> format.
> I want as result mbox formated files (Each mail starts with a From line...)
> The format shown below. Where do i have to change what to get a correkt
> mbox-format?

Well, that's nothing to do with fetchmail and entirely down to
procmail.  I've no familiarity with procmail so I'd suggest you try
the procmail mailing list.

-- 
                 Please keep list traffic on the list.

Rob MacGregor
      Whoever fights monsters should see to it that in the process he
        doesn't become a monster.                  Friedrich Nietzsche

[fetchmail-users] fetchmail - mailformat

[Gerhard W. <le...@gm...>]

Hi,

i have fetchmail configured with:

poll pop.mailserver.net with proto POP3
       user 'le...@gm...' there with password 'password' is 'gerhard' 
here mda /usr/bin/procmail

procmail writes to different files but all files do not have the mbox 
format.
I want as result mbox formated files (Each mail starts with a From line...)
The format shown below. Where do i have to change what to get a correkt 
mbox-format?


Return-Path: <wer...@wr...>
X-Flags: 0000
Delivered-To: GMX delivery to ju...@gm...
Received: from pop.gmx.net [213.165.64.22]
        by az with POP3 (fetchmail-6.3.5)
        for <gerhard@localhost> (single-drop); Sun, 08 Apr 2007 18:00:37 
+0200 (CEST)
Received: (qmail 8383 invoked by uid 0); 8 Apr 2007 15:56:29 -0000
Received: from 217.228.195.138 by www093.adss.net with HTTP;
 Sun, 08 Apr 2007 17:56:29 +0200 (CEST)
Content-Type: text/plain; charset="us-ascii"
Date: Sun, 08 Apr 2007 17:56:29 +0200
From: wer...@wr...
Message-ID: <200...@as...>
MIME-Version: 1.0
Subject: testmail 17:56:35
To: as...@as...
X-Authenticated: #20493454
X-Mailer: WWW-Mail 6100 (Global Message Exchange)
X-Priority: 3
X-Provags-ID: V01U2FsdGVkX190l+5oMP50Q3bBbmLgFw4qx8U9EK+XIppmSMYuDb
 lUJ4xPqw9H4onDeFnV+FA9aCx84WgjvPwwFA==
Content-Transfer-Encoding: 7bit
X-GMX-Antivirus: -1 (not scanned, may not use virus scanner)
X-GMX-Antispam: 0 (Mail was not recognized as spam)
X-GMX-UID: miIgfmFeYW0/XgiJo2dppfV0amthc1u9

Re: [fetchmail-users] Fetchmail retrieving message body of only "OK FETCH completed"?

[Matthias A. <mat...@gm...>]

Beau James schrieb:
> --> > In the meantime, I downloaded and installed the source package, built
> --> > it myself, and tried to run the version I had built.  I worked through
> --> > a number of issues but then ran into SSL errors:
> --> > 
> --> > fetchmail: starting fetchmail 6.3.8 daemon
> --> > 25839:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_cl
> --> > nt.c:567:
> --> > fetchmail: SSL connection failed.
> --> > fetchmail: socket error while fetching from bj...@em...
> --> > fetchmail: Query status=2 (SOCKET)
> --> > fetchmail: sleeping at Sun Jul 22 21:24:36 2007 for 300 seconds
> --> 
> --> This looks like fetchmail talking SSL to a non-SSL port. Note that TLS is
> --> not the same as SSL; TLS starts in cleartext and negotiate SSL while there
> --> has been some protocol chit-chat, and SSL starts with the SSL negotiation
> --> right away. TLS and SSL also use separate ports. TLS uses the regular
> --> 110/143 for POP3/IMAP, SSL uses 995/993 for POP3/IMAP.
> --> 
> --> HTH
> 
> Indeed it did.  Thanks!
> 
> Starting "fetchmail --service 993" worked - mail was retrieved from
> the Exchange server with no problem.
> 
> I did get one message in the logfile:
> 
> fetchmail: starting fetchmail 6.3.8 daemon
> fetchmail: Server certificate verification error: self signed certificate in cer
> tificate chain
> 
> This didn't seem to cause any problems.  Sorry, I'm a crypto neophyte.
> I know what this means, literally, but don't know what the implications

The deal is that fetchmail cannot detect "man in the middle" attacks in
this environment and setup.

To fix this, you'd need to install the certificate of the "CA" that signed
the server certificate. Put the CA certificate into /etc/ssl/certs/ (adjust
path as required), run c_rehash on that directory to create the necessary
symlinks, and if that's insufficient you can tell fetchmail where to look
for the certs with the --sslcertpath option.

Once you got rid of the verification error, you should add the --sslcertck
option to have fetchmail terminate the connection if the certificate can't
be verified. That is to make sure fetchmail hands the password out only to
the real server and not any imposters that might have tapped the wire
(particularly easy with WLAN if unencrypted or using WEP), mounted ARP
redirecting attacks or whatever.

HTH
Matthias

Re: [fetchmail-users] Fetchmail retrieving message body of only "OK FETCH completed"?

[Beau J. <bj...@ci...>]

--> > In the meantime, I downloaded and installed the source package, built
--> > it myself, and tried to run the version I had built.  I worked through
--> > a number of issues but then ran into SSL errors:
--> > 
--> > fetchmail: starting fetchmail 6.3.8 daemon
--> > 25839:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_cl
--> > nt.c:567:
--> > fetchmail: SSL connection failed.
--> > fetchmail: socket error while fetching from bj...@em...
--> > fetchmail: Query status=2 (SOCKET)
--> > fetchmail: sleeping at Sun Jul 22 21:24:36 2007 for 300 seconds
--> 
--> This looks like fetchmail talking SSL to a non-SSL port. Note that TLS is
--> not the same as SSL; TLS starts in cleartext and negotiate SSL while there
--> has been some protocol chit-chat, and SSL starts with the SSL negotiation
--> right away. TLS and SSL also use separate ports. TLS uses the regular
--> 110/143 for POP3/IMAP, SSL uses 995/993 for POP3/IMAP.
--> 
--> HTH

Indeed it did.  Thanks!

Starting "fetchmail --service 993" worked - mail was retrieved from
the Exchange server with no problem.

I did get one message in the logfile:

fetchmail: starting fetchmail 6.3.8 daemon
fetchmail: Server certificate verification error: self signed certificate in cer
tificate chain

This didn't seem to cause any problems.  Sorry, I'm a crypto neophyte.
I know what this means, literally, but don't know what the implications

Thanks again for the info about the SSL ports.

Beau

--> Matthias
--> 

Re: [fetchmail-users] Fetchmail retrieving message body of only "OK FETCH completed"?

[Rob M. <rob...@gm...>]

On 7/24/07, Beau James <bj...@ci...> wrote:
>
> I'll see if I can get that info.  If anyone knows how to ask Exchange
> for that info "over the wire", please let me know - I don't have
> access to the machines on which Exchange is running.

You may want to simply ask the admins :)

> I'm trying to convince the admins to upgrade the company-wide version.

Just point them to the list of known vulnerabilities, and the fact
that support on this list will be little more than "upgrade if you
want any real help" :)

> In the meantime, I downloaded and installed the source package, built
> it myself, and tried to run the version I had built.  I worked through
> a number of issues but then ran into SSL errors:
>
> fetchmail: starting fetchmail 6.3.8 daemon
> 25839:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_cl
> nt.c:567:
> fetchmail: SSL connection failed.
> fetchmail: socket error while fetching from bj...@em...
> fetchmail: Query status=2 (SOCKET)
> fetchmail: sleeping at Sun Jul 22 21:24:36 2007 for 300 seconds
>
> at which point I decided I was getting in over my head.

If you run the diagnostic output (--nosyslog --nodetach -vvv) it may
provide more to information to work with.  You may find section K6 of
the FAQ useful.

Alternatively, just configure it without SSL :)

-- 
                 Please keep list traffic on the list.

Rob MacGregor
      Whoever fights monsters should see to it that in the process he
        doesn't become a monster.                  Friedrich Nietzsche

Re: [fetchmail-users] Fetchmail retrieving message body of only "OK FETCH completed"?

[Matthias A. <mat...@gm...>]

Beau James schrieb:
> In the meantime, I downloaded and installed the source package, built
> it myself, and tried to run the version I had built.  I worked through
> a number of issues but then ran into SSL errors:
> 
> fetchmail: starting fetchmail 6.3.8 daemon
> 25839:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_cl
> nt.c:567:
> fetchmail: SSL connection failed.
> fetchmail: socket error while fetching from bj...@em...
> fetchmail: Query status=2 (SOCKET)
> fetchmail: sleeping at Sun Jul 22 21:24:36 2007 for 300 seconds

This looks like fetchmail talking SSL to a non-SSL port. Note that TLS is
not the same as SSL; TLS starts in cleartext and negotiate SSL while there
has been some protocol chit-chat, and SSL starts with the SSL negotiation
right away. TLS and SSL also use separate ports. TLS uses the regular
110/143 for POP3/IMAP, SSL uses 995/993 for POP3/IMAP.

HTH
Matthias

Re: [fetchmail-users] Fetchmail retrieving message body of only "OK FETCH completed"?

[Beau J. <bj...@ci...>]

--> Keep it on the list please!

Sorry, I meant to "Reply-All" but fat-fingered it to a unicast reply.

Our sysadmins replied that there had been a problem with the loadbalancing
frontends for the Exchange server pool.  They tell me that it is fixed now.
Given the intermittent and relatively infrequent nature of the problem, it
will take some time to feel confident that that is really the case.

FWIW, other info inline below.

Thanks again.

Beau

--> On 7/23/07, Beau James <bj...@ci...> wrote:
--> > Is what follows what you meant by "diagnosic", or have I left something out?
--> 
--> That's what a lack of caffeine does for my ability to speel :)
--> 
--> > 220 xfe-sjc-211.amer.cisco.com Microsoft ESMTP MAIL Service, Version: 6.0.3790.1
--> > 830 ready at  Mon, 23 Jul 2007 11:57:54 -0700
--> 
--> Can you find out which version of Exchange this is?

I'll see if I can get that info.  If anyone knows how to ask Exchange
for that info "over the wire", please let me know - I don't have
access to the machines on which Exchange is running.

--> >     6. The output of fetchmail -V called with whatever other command-line
--> >        options you used.
--> >
--> > % fetchmail -V
--> > This is fetchmail release 6.2.2+NTLM+SSL
--> 
--> As Matthias said, you really (*really*) need to upgrade to 6.3.8.  You
--> don't even have to install the software, you can just run the binary
--> from your chosen location :)

I'm trying to convince the admins to upgrade the company-wide version.

In the meantime, I downloaded and installed the source package, built
it myself, and tried to run the version I had built.  I worked through
a number of issues but then ran into SSL errors:

fetchmail: starting fetchmail 6.3.8 daemon
25839:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_cl
nt.c:567:
fetchmail: SSL connection failed.
fetchmail: socket error while fetching from bj...@em...
fetchmail: Query status=2 (SOCKET)
fetchmail: sleeping at Sun Jul 22 21:24:36 2007 for 300 seconds

at which point I decided I was getting in over my head.

--> There's no obvious problems with your config.

Thanks.

--> Sanity check - accessing your mailbox with another IMAP client (or
--> even Outlook Web Access, OWA) for these problem emails doesn't show
--> any problem?

Correct.

--> If that is the case can you provide (as unchanged as possible) a
--> sample problem email?  There may be something in there that helps work
--> out what's going on.

I will do that, if it happens again.

--> -- 
-->                  Please keep list traffic on the list.
--> 
--> Rob MacGregor
-->       Whoever fights monsters should see to it that in the process he
-->         doesn't become a monster.                  Friedrich Nietzsche
--> _______________________________________________
--> fetchmail-users mailing list
--> fet...@li...
--> https://lists.berlios.de/mailman/listinfo/fetchmail-users
--> 

Re: [fetchmail-users] Fetchmail retrieving message body of only "OK FETCH completed"?

[Rob M. <rob...@gm...>]

Keep it on the list please!

On 7/23/07, Beau James <bj...@ci...> wrote:
> Is what follows what you meant by "diagnosic", or have I left something out?

That's what a lack of caffeine does for my ability to speel :)

> 220 xfe-sjc-211.amer.cisco.com Microsoft ESMTP MAIL Service, Version: 6.0.3790.1
> 830 ready at  Mon, 23 Jul 2007 11:57:54 -0700

Can you find out which version of Exchange this is?

>     6. The output of fetchmail -V called with whatever other command-line
>        options you used.
>
> % fetchmail -V
> This is fetchmail release 6.2.2+NTLM+SSL

As Matthias said, you really (*really*) need to upgrade to 6.3.8.  You
don't even have to install the software, you can just run the binary
from your chosen location :)

There's no obvious problems with your config.

Sanity check - accessing your mailbox with another IMAP client (or
even Outlook Web Access, OWA) for these problem emails doesn't show
any problem?

If that is the case can you provide (as unchanged as possible) a
sample problem email?  There may be something in there that helps work
out what's going on.

-- 
                 Please keep list traffic on the list.

Rob MacGregor
      Whoever fights monsters should see to it that in the process he
        doesn't become a monster.                  Friedrich Nietzsche

Re: [fetchmail-users] Fetchmail retrieving message body of only "OK

[Chris B. <chr...@ov...>]

On Mon 23 Jul, Beau James wrote:
> 
> I searched but did not find anyone describing this particular symptom.
> 
> I've been using fetchmail for several years without problem.
> 
> In the past month or so, I've begun to see occasional emails where
> the SMTP header is fetched correctly, but the message body is not,
> even though they body is just simple plain text.  Instead, I get
> the single line:
> 
>    A0007 OK FETCH completed.
> 
> as the body of the message.  This has happened six times in the past
> 5 weeks; prior to that, it had not happened for several years.
> 
> I have not changed anything in my "fetchmail.rc".  I am using the
> fersion of fetchmail currently deployed by our sysadmins, which
> looks like it has not change in a long time:
> 
>     % ls -lL `which fetchmail`
>     -rwxr-xr-x   1 root       989472 Jul  2  2003 /usr/bin/fetchmail
>     % fetchmail --version | head 1
>     This is fetchmail release 6.2.2+NTLM+SSL
>     %
> 
> Any ideas what might trigger this intermittent but recurring problem?
> 
> Any idea how to fix it?
> 
> Thanks,
> 
> Beau
> 

   I have received several junk emails which are indicated as large but show
on my reader as no content because the content is within the header area,
preceeded by a blank line. I can see the contents using a simple text
editor. Note that my computer does not run Microsoft, and is very unlikely
to even understand any code enclosed, so I have no problems viewing the
junk.

-- 
Chris Bell

Re: [fetchmail-users] Fetchmail retrieving message body of only "OK FETCH completed"?

[Matthias A. <mat...@gm...>]

Beau James schrieb:
> I searched but did not find anyone describing this particular symptom.
> 
> I've been using fetchmail for several years without problem.
> 
> In the past month or so, I've begun to see occasional emails where
> the SMTP header is fetched correctly, but the message body is not,
> even though they body is just simple plain text.  Instead, I get
> the single line:
> 
>    A0007 OK FETCH completed.
> 
> as the body of the message.  This has happened six times in the past
> 5 weeks; prior to that, it had not happened for several years.
> 
> I have not changed anything in my "fetchmail.rc".  I am using the
> fersion of fetchmail currently deployed by our sysadmins, which
> looks like it has not change in a long time:
> 
>     % ls -lL `which fetchmail`
>     -rwxr-xr-x   1 root       989472 Jul  2  2003 /usr/bin/fetchmail
>     % fetchmail --version | head 1
>     This is fetchmail release 6.2.2+NTLM+SSL
>     %
> 
> Any ideas what might trigger this intermittent but recurring problem?

> P.S. I see from the fetchmail home page that version 6.3.8 is current.
>      I'll try to get our sysadmins to upgrade.  But any ideas about
>      why this new behavior just cropped up, using the older version,
>      would be much appreciated.

ISTR that there have been relevant fixes in 6.3.5, and if you're in need of
arguments for updating, point the admins to CVE-2005-2335, CVE-2005-4348,
CVE-2006-5867 and CVE-2007-1558 (for instance on the fetchmail home page)
-- and incompatibilities are noted in the "NEWS" file as such and are few
and minor, so that virtually everyone can go that migration path.

As a general remark, nobody should be running a decrepit version such as
fetchmail 6.2.2 (four and a half years old!) today, there have been far too
many bugs (important and security bugs among them) fixed since those days.

Best regards
Matthias

Re: [fetchmail-users] Fetchmail retrieving message body of only "OK FETCH completed"?

[Rob M. <rob...@gm...>]

On 7/23/07, Beau James <bj...@ci...> wrote:
> I searched but did not find anyone describing this particular symptom.
>
> I've been using fetchmail for several years without problem.
>
> In the past month or so, I've begun to see occasional emails where
> the SMTP header is fetched correctly, but the message body is not,
> even though they body is just simple plain text.  Instead, I get
> the single line:
>
>    A0007 OK FETCH completed.
>
> as the body of the message.  This has happened six times in the past
> 5 weeks; prior to that, it had not happened for several years.
>
> I have not changed anything in my "fetchmail.rc".  I am using the
> fersion of fetchmail currently deployed by our sysadmins, which
> looks like it has not change in a long time:

This suggests your ISP has changed something.

> P.S. I see from the fetchmail home page that version 6.3.8 is current.
>      I'll try to get our sysadmins to upgrade.  But any ideas about
>      why this new behavior just cropped up, using the older version,
>      would be much appreciated.

Well, a look at your .fetchmailrc and the output of the diagnostics
command mentioned in the FAQ (under reporting bugs) would help.

-- 
                 Please keep list traffic on the list.

Rob MacGregor
      Whoever fights monsters should see to it that in the process he
        doesn't become a monster.                  Friedrich Nietzsche

[fetchmail-users] Fetchmail retrieving message body of only "OK FETCH completed"?

[Beau J. <bj...@ci...>]

I searched but did not find anyone describing this particular symptom.

I've been using fetchmail for several years without problem.

In the past month or so, I've begun to see occasional emails where
the SMTP header is fetched correctly, but the message body is not,
even though they body is just simple plain text.  Instead, I get
the single line:

   A0007 OK FETCH completed.

as the body of the message.  This has happened six times in the past
5 weeks; prior to that, it had not happened for several years.

I have not changed anything in my "fetchmail.rc".  I am using the
fersion of fetchmail currently deployed by our sysadmins, which
looks like it has not change in a long time:

    % ls -lL `which fetchmail`
    -rwxr-xr-x   1 root       989472 Jul  2  2003 /usr/bin/fetchmail
    % fetchmail --version | head 1
    This is fetchmail release 6.2.2+NTLM+SSL
    %

Any ideas what might trigger this intermittent but recurring problem?

Any idea how to fix it?

Thanks,

Beau

Beau James
Cisco Systems

P.S. I see from the fetchmail home page that version 6.3.8 is current.
     I'll try to get our sysadmins to upgrade.  But any ideas about
     why this new behavior just cropped up, using the older version,
     would be much appreciated.

Re: [fetchmail-users] Invalid SSL certificate

[Phillip S. <ps...@ir...>]

Matthias Andree wrote:
> 1. Fetchmail does not offer direct control over the supported ciphers, but
> you might want to try --sslproto SSL3  (or SSL2; SSL23 is the default, no
> need to try that) to see if that improves your situation.
> 
> 2. Can I ask you to file a BerliOS bug report against fetchmail stating
> that fetchmail does not report SSL negotiation errors properly using
> ERR_error_string(3ssl), and a pointer to this subject?

I will go file that bug report on launchpad now.

In the mean time, I have recompiled openssl with support for the 
TLS_RSA_WITH_RC4_128_MD5 ( 0x0004 ) cipher, but fetchmail still has its 
connection rejected.  When comparing the CLIENT HELLO SSL frames sent by 
thunderbird and fetchmail, I see that fetchmail offers a few additional 
ciphers that thunderbird does not, and support for zlib compression, 
which thunderbird does not.  The only thing I see that thunderbird is 
sending that fetchmail is not, is an extension header of type 
server_name (0x0000).  Would it be possible to have fetchmail send this 
extension as well?

Re: [fetchmail-users] Invalid SSL certificate

[Matthias A. <mat...@gm...>]

Phillip Susi schrieb:

> I can force fetchmail to not use ssl at all and it works, but I'd like 
> it to use ssl.  I have managed to successfully connect to the server 
>>from my windows machine running thunderbird, and I have packet captures 
> of the conversation and compared them to the packet capture from 
> fetchmail.  It appears that for fetchmail, the server closes the 
> connection after sending the certificate, but I notice that it 
> negotiates a different cipher than thunderbird, which works. 
> Thunderbird negotiates the TLS_RSA_WITH_RC4_128_MD5 ( 0x0004 ) cipher, 
> but fetchmail does not list this as a cipher it supports in its client 
> HELLO frame, so the server answers with 
> TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA ( 0x0016 ) as the negotiated cipher, 
> then the next frame it sends its certificate and a two alerts, one 
> fatal, one a warning, both saying Close Notify.
> 
> This leads me to believe that the server does not like any of the 
> ciphers that fetchmail supports.  Does this make sense, and how can I 
> get fetchmail to use the TLS_RSA_WITH_RC4_128_MD5 cipher?

1. Fetchmail does not offer direct control over the supported ciphers, but
you might want to try --sslproto SSL3  (or SSL2; SSL23 is the default, no
need to try that) to see if that improves your situation.

2. Can I ask you to file a BerliOS bug report against fetchmail stating
that fetchmail does not report SSL negotiation errors properly using
ERR_error_string(3ssl), and a pointer to this subject?

Thanks.

Best regards
Matthias Andree

Re: [fetchmail-users] Invalid SSL certificate

[Phillip S. <ps...@ir...>]

Matthias Andree wrote:
> See the socket error? Apparently the server drops the connection.
> 
> Try 6.3.8 - the non-SSL fallback is fixed there (at the expense of not
> encrypting the connection though, so don't do that over WLAN with just WEP
> or via public access networks).

I can force fetchmail to not use ssl at all and it works, but I'd like 
it to use ssl.  I have managed to successfully connect to the server 
from my windows machine running thunderbird, and I have packet captures 
of the conversation and compared them to the packet capture from 
fetchmail.  It appears that for fetchmail, the server closes the 
connection after sending the certificate, but I notice that it 
negotiates a different cipher than thunderbird, which works. 
Thunderbird negotiates the TLS_RSA_WITH_RC4_128_MD5 ( 0x0004 ) cipher, 
but fetchmail does not list this as a cipher it supports in its client 
HELLO frame, so the server answers with 
TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA ( 0x0016 ) as the negotiated cipher, 
then the next frame it sends its certificate and a two alerts, one 
fatal, one a warning, both saying Close Notify.

This leads me to believe that the server does not like any of the 
ciphers that fetchmail supports.  Does this make sense, and how can I 
get fetchmail to use the TLS_RSA_WITH_RC4_128_MD5 cipher?

Re: [fetchmail-users] Invalid SSL certificate

[Matthias A. <mat...@gm...>]

Phillip Susi schrieb:

> Looks to me like the SSL layer is indeed refusing to negotiate the 
> connection due to the name mismatch and self signedness of the server 
> cert.  Then it looks like the server fails or something when fetchmail 
> tries to fall back to non SSL mode.
> 
> fetchmail: 6.3.4 querying xxx.com (protocol POP3) at Mon 16 Jul 2007 
> 11:24:47 AM EDT: poll started
...
> fetchmail: POP3< .
> fetchmail: POP3> STLS
> fetchmail: POP3< +OK Begin TLS negotiation
...
> fetchmail: xxx.com: opportunistic upgrade to TLS failed, trying to continue.
> fetchmail: Unknown login or authentication error on xxx.com
> fetchmail: socket error while fetching from ps...@xx...
> fetchmail: 6.3.4 querying xxx.com (protocol POP3) at Mon 16 Jul 2007 
> 11:24:47 AM EDT: poll completed
> fetchmail: Query status=2 (SOCKET)

See the socket error? Apparently the server drops the connection.

Try 6.3.8 - the non-SSL fallback is fixed there (at the expense of not
encrypting the connection though, so don't do that over WLAN with just WEP
or via public access networks).

HTH
Matthias

Re: [fetchmail-users] Invalid SSL certificate

[Phillip S. <ps...@ir...>]

Matthias Andree wrote:
> It should complain, but continue - providing the server doesn't crash or
> abort. The fetchmail -vv --nosyslog -Nd0 output should shed some light on
> the issue.

Looks to me like the SSL layer is indeed refusing to negotiate the 
connection due to the name mismatch and self signedness of the server 
cert.  Then it looks like the server fails or something when fetchmail 
tries to fall back to non SSL mode.

fetchmail: 6.3.4 querying xxx.com (protocol POP3) at Mon 16 Jul 2007 
11:24:47 AM EDT: poll started
fetchmail: POP3< +OK POP3 server ready.
fetchmail: POP3> CAPA
fetchmail: POP3< +OK Capability list follows
fetchmail: POP3< TOP
fetchmail: POP3< USER
fetchmail: POP3< RESP_CODES
fetchmail: POP3< PIPELINING
fetchmail: POP3< EXPIRE NEVER
fetchmail: POP3< UIDL
fetchmail: POP3< STLS
fetchmail: POP3< .
fetchmail: POP3> STLS
fetchmail: POP3< +OK Begin TLS negotiation
fetchmail: Server certificate verification error: self signed 
certificate in certificate chain
fetchmail: Issuer Organization: Openwave Systems, Inc.
fetchmail: Issuer CommonName: Certificate Authority
fetchmail: Server CommonName: InterMail Test Certificate
fetchmail: Server CommonName mismatch: InterMail Test Certificate != xxx.com
fetchmail: xxx.com key fingerprint: 
3C:99:E5:5E:97:64:F8:6A:2E:3E:AE:39:9C:4A:08:26
21087:error:140943E8:SSL 
routines:SSL3_READ_BYTES:reason(1000):s3_pkt.c:1057:SSL alert number 0
fetchmail: xxx.com: opportunistic upgrade to TLS failed, trying to continue.
fetchmail: Unknown login or authentication error on xxx.com
fetchmail: socket error while fetching from ps...@xx...
fetchmail: 6.3.4 querying xxx.com (protocol POP3) at Mon 16 Jul 2007 
11:24:47 AM EDT: poll completed
fetchmail: Query status=2 (SOCKET)
fetchmail: Deleting fetchids file.
fetchmail: normal termination, status 2
fetchmail: Deleting fetchids file.

Re: [fetchmail-users] Invalid SSL certificate

[Matthias A. <mat...@gm...>]

Phillip Susi schrieb:
> Matthias Andree wrote:
>> Omit the "sslcertck" option from command line AND .fetchmailrc file and
>> also omit the "sslfingerprint" option and its argument, if you use(d) it.
> 
> I don't use these options.  Is there a way to explicitly negate those
> options?

No need, these are disabled by default.

> It is a self signed certificate and I even tried capturing the
> certificate using openssl s_connect, following the instructions I found
> at http://www.dns.net/andras/computer/ssl-fetchmail.html, but fetchmail
> still errors out because the CN does not match the hostname.

It should complain, but continue - providing the server doesn't crash or
abort. The fetchmail -vv --nosyslog -Nd0 output should shed some light on
the issue.

HTH
Matthias

Re: [fetchmail-users] Invalid SSL certificate

[Phillip S. <ps...@ir...>]

Matthias Andree wrote:
> Omit the "sslcertck" option from command line AND .fetchmailrc file and
> also omit the "sslfingerprint" option and its argument, if you use(d) it.

I don't use these options.  Is there a way to explicitly negate those 
options?

> Without sslcertck and sslfingerprint, fetchmail should complain but
> continue, but the best option is to urge them to get a proper certificate
> or at least provide their root signing certficate for download.

It is a self signed certificate and I even tried capturing the 
certificate using openssl s_connect, following the instructions I found 
at http://www.dns.net/andras/computer/ssl-fetchmail.html, but fetchmail 
still errors out because the CN does not match the hostname.

Re: [fetchmail-users] Invalid SSL certificate

[Matthias A. <mat...@gm...>]

Phillip Susi schrieb:
> My ISP recently migrated to a new pop server and they have not figured 
> out how to configure a proper SSL certificate.  The one that is 
> installed is a dummy test certificate which is self signed and has the 
> wrong CN.  This causes fetchmail to bail out with SSL errors.  Is there 
> a way to direct fetchmail to ignore the problems with the certificate 
> and proceed anyhow?

Omit the "sslcertck" option from command line AND .fetchmailrc file and
also omit the "sslfingerprint" option and its argument, if you use(d) it.

Without sslcertck and sslfingerprint, fetchmail should complain but
continue, but the best option is to urge them to get a proper certificate
or at least provide their root signing certficate for download.