Menu
▾
▴
Re: [Fetchmail-users] ssl with dslextreme.com attempts to send a spurious email
|
From: jdow <jd...@ds...> - 2019-04-27 21:29:12
|
On 20190427 03:11:23, Matthias Andree wrote:
> Am 24.04.19 um 18:47 schrieb jdow:
>> Fetchmail feeds off to Postfix which runs spamassassin via procmail.
>> It is a working configuration from way back so I elected to perpetuate
>> it rather than fix it. {^_-}
>>
>> This (or an older version of it) has been working for a couple decades
>> or more.
>> Along about 2019-Apr-04 it started to try to send an email to a rather
>> enigmatic address,
>> JkiO@JkiO----------------------.{MUNG]us-west-2.compute.amazonaws.com.
>> Old logwatch reports show a few sporadic "Illegal address syntax in
>> SMTP command" errors in the Postfix syslog messages. But now I am
>> getting them nearly every poll cycle. Nothing is going out because I
>> do not use the local Postfix for sending mail. It seems to be an
>> unnecessary step in the sending process. I believe I have determined
>> it is fetchmail itself that is acquiring the localhost socket to send
>> the mail using the audit facility.
>>
>> What configuration error might I have introduced?
>
> Joanne,
>
> you are not using a multi-user mailbox setup unless you stripped more
> than the password from the poll mail.dslextreme.com section. I am
> however wondering if 6.3.24 is really the latest fetchmail package for
> Scientific Linux.
I am fetching from multiple users and ISPs on the source end and feeding a
single user on the local destination end. The second ISP, earthlink, does not
use SSL. A second fetchmail is running in another user's account that is not
showing this problem because it is not using SSL, either.
I have tried two configurations:
Originally
poll mail.dslextreme.com with proto pop3 port 995
user 'jd...@ds...', with password 'xxxxx' ssl,
is 'jdow@lllllll' here pass8bits
poll mail.dslextreme.com with proto pop3 port 995
user 'YY...@ds...', with password 'yyyyyyy' ssl,
is 'jdow@lllllll' here pass8bits
poll pop.earthlink.net with proto pop3
...
And the second one comments out the second poll line in the above:
poll mail.dslextreme.com with proto pop3 port 995
user 'jd...@ds...', with password 'xxxxx' ssl,
is 'jdow@thursday.wizardess.wiz' here pass8bits
#poll mail.dslextreme.com with proto pop3 port 995
user 'YY...@ds...', with password 'yyyyyyy' ssl,
is 'jdow@lllllll' here pass8bits
poll pop.earthlink.net with proto pop3
Both show the same problem. And the --configuration printout appears to make
sense to me.
> Can we look at some logging around the faulty message? Something like:
>
> /usr/bin/fetchmail -vv --nosyslog --nodetach --fetchmailrc
> /home/jdow/.fetchmailrc
>
> (along the lines of <http://www.fetchmail.info/fetchmail-FAQ.html#G3>,
> item 5 would show us how fetchmail sees your configuration)
These look suspicious in the first printout:
fetchmail: mail.dslextreme.com: WARNING: server offered STLS, but sslproto '' given.
fetchmail: POP3> USER jd...@ds...
In the current configuration it looks like the YYYY ID was not polled, too.
The per item 5 log shows the JkiO mail being sent.
> Has your computer running fetchmail developed hardware troubles? Does it
> use ECC-protected RAM, and if so, is there relevant EDAC logging? Is
> other software malfunctioning since c. three weeks? Have there been
> power brownouts or flukes somehow, and has the computer been rebooted since?
>
> Greetings
> Matthias
No, the computer has not been rebooted.
This MAY be related to the ISP changing over from DHCP connections to PPPOE. But
I don't see how the MTU change that brings to the table would change things. The
earliest illegal address log entry I found is more than a year old. So whatever
triggered it a few times over a couple years is now triggering regularly.
I did go ahead and reinstall fetchmail. And, indeed, that is the version of
fetchmail that is current in CENTOS and Scientific Linux. (I'll likely be
gritting my teeth and moving over to CENTOS since SL is not moving on to RHEL8
clone status.) The version is currently 7.6.
{^_^}
fetchmaillog.txt
/usr/bin/fetchmail -vv --nosyslog --nodetach --fetchmailrc
/home/jdow/.fetchmailrc
Old UID list from mail.dslextreme.com: <empty>
Old UID list from mail.dslextreme.com: <empty>
Old UID list from pop.earthlink.net: <empty>
Old UID list from pop.earthlink.net: <empty>
Old UID list from pop.earthlink.net: <empty>
Old UID list from pop.earthlink.net: <empty>
Scratch list of UIDs: <empty>
fetchmail: starting fetchmail 6.3.24 daemon
fetchmail: 6.3.24 querying mail.dslextreme.com (protocol POP3) at Sat 27 Apr
2019 01:30:49 PM PDT: poll started
Trying to connect to 137.118.26.222/995...connected.
fetchmail: Certificate chain, from root to peer, starting at depth 3:
fetchmail: Issuer Organization: The Go Daddy Group, Inc.
fetchmail: Unknown Issuer CommonName
fetchmail: Certificate at depth 2:
fetchmail: Issuer Organization: The Go Daddy Group, Inc.
fetchmail: Unknown Issuer CommonName
fetchmail: Subject CommonName: Go Daddy Root Certificate Authority - G2
fetchmail: Certificate at depth 1:
fetchmail: Issuer Organization: GoDaddy.com, Inc.
fetchmail: Issuer CommonName: Go Daddy Root Certificate Authority - G2
fetchmail: Subject CommonName: Go Daddy Secure Certificate Authority - G2
fetchmail: Server certificate:
fetchmail: Issuer Organization: GoDaddy.com, Inc.
fetchmail: Issuer CommonName: Go Daddy Secure Certificate Authority - G2
fetchmail: Subject CommonName: *.dslextreme.com
fetchmail: Subject Alternative Name: *.dslextreme.com
fetchmail: Subject Alternative Name: dslextreme.com
fetchmail: mail.dslextreme.com key fingerprint:
42:1C:EA:3D:8E:FA:ED:F9:B4:90:79:6C:9E:39:BC:7B
fetchmail: SSL/TLS: using protocol TLSv1.2, cipher DHE-RSA-AES256-GCM-SHA384,
256/256 secret/processed bits
fetchmail: POP3< +OK POP3 ready
fetchmail: POP3> CAPA
fetchmail: POP3< +OK Capability list follows
fetchmail: POP3< EXPIRE 31 USER
fetchmail: POP3< TOP
fetchmail: POP3< UIDL
fetchmail: POP3< USER
fetchmail: POP3< XOIP
fetchmail: POP3< SASL PLAIN
fetchmail: POP3< STLS
fetchmail: POP3< .
fetchmail: mail.dslextreme.com: WARNING: server offered STLS, but sslproto '' given.
fetchmail: POP3> USER jd...@ds...
fetchmail: POP3< +OK
fetchmail: POP3> PASS *
fetchmail: POP3< +OK server ready
fetchmail: selecting or re-polling default folder
fetchmail: POP3> STAT
fetchmail: POP3< +OK 1 1281491
fetchmail: POP3> LAST
fetchmail: POP3< -ERR unknown command
fetchmail: unknown command
fetchmail: POP3> UIDL
fetchmail: POP3< +OK 1 messages
fetchmail: POP3< 1 5928.8p0vRawWBA69Us0DkhdJHmu1RGZ3jq62,Jr1j3KpouQ=
fetchmail: 1 is unseen
fetchmail: POP3< .
1 message for jd...@ds... at mail.dslextreme.com (1281491 octets).
fetchmail: POP3> LIST 1
fetchmail: POP3< +OK 1 1281491
fetchmail: POP3> TOP 1 99999999
fetchmail: POP3< +OK message top follows
reading message jd...@ds...@dslextreme.com.av-mx.com:1 of 1 (1281491
octets) About to rewrite Return-Path: bou...@gr......
...rewritten version is Return-Path: bou...@gr....
About to rewrite From: "Simon Brown" <****@****.com>...
...rewritten version is From: "Simon Brown" <****@****.com>.
About to rewrite To: <SDR...@gr...>...
...rewritten version is To: <SDR...@gr...>.
About to rewrite Sender: SDR...@gr......
...rewritten version is Sender: SDR...@gr....
About to rewrite Reply-To: SDR...@gr......
...rewritten version is Reply-To: SDR...@gr....
Trying to connect to ::1/25...connected.
fetchmail: SMTP< 220 lllllll ESMTP Postfix
fetchmail: SMTP> EHLO lllllll
fetchmail: SMTP< 250-lllllll
fetchmail: SMTP< 250-PIPELINING
fetchmail: SMTP< 250-SIZE 134217728
fetchmail: SMTP< 250-VRFY
fetchmail: SMTP< 250-ETRN
fetchmail: SMTP< 250-ENHANCEDSTATUSCODES
fetchmail: SMTP< 250-8BITMIME
fetchmail: SMTP< 250 DSN
fetchmail: forwarding to localhost
fetchmail: SMTP> MAIL FROM:<bou...@gr...>
BODY=8BITMIME SIZE=1281491
fetchmail: SMTP< 250 2.1.0 Ok
fetchmail: SMTP> RCPT TO:<jdow@lllllll>
fetchmail: SMTP< 250 2.1.5 Ok
fetchmail: SMTP> DATA
fetchmail: SMTP< 354 End data with <CR><LF>.<CR><LF>
... Binary removed
fetchmail: SMTP>. (EOM)
fetchmail: SMTP< 250 2.0.0 Ok: queued as B3AB5419923C
flushed
fetchmail: POP3> DELE 1
fetchmail: POP3< +OK message 1 marked for deletion
fetchmail: POP3> QUIT
fetchmail: POP3< +OK deleted 1 message(s)
fetchmail: SMTP> QUIT
fetchmail: SMTP< 221 2.0.0 Bye
fetchmail: 6.3.24 querying mail.dslextreme.com (protocol POP3) at Sat 27 Apr
2019 01:30:52 PM PDT: poll completed
New UID list from mail.dslextreme.com:
5928.8p0vRawWBA69Us0DkhdJHmu1RGZ3jq62,Jr1j3KpouQ= = EXPUNGED
fetchmail: swapping UID lists
fetchmail: 6.3.24 querying mail.dslextreme.com (protocol POP3) at Sat 27 Apr
2019 01:30:52 PM PDT: poll started
Trying to connect to 137.118.26.222/995...connected.
fetchmail: Certificate chain, from root to peer, starting at depth 3:
fetchmail: Issuer Organization: The Go Daddy Group, Inc.
fetchmail: Unknown Issuer CommonName
fetchmail: Certificate at depth 2:
fetchmail: Issuer Organization: The Go Daddy Group, Inc.
fetchmail: Unknown Issuer CommonName
fetchmail: Subject CommonName: Go Daddy Root Certificate Authority - G2
fetchmail: Certificate at depth 1:
fetchmail: Issuer Organization: GoDaddy.com, Inc.
fetchmail: Issuer CommonName: Go Daddy Root Certificate Authority - G2
fetchmail: Subject CommonName: Go Daddy Secure Certificate Authority - G2
fetchmail: Server certificate:
fetchmail: Issuer Organization: GoDaddy.com, Inc.
fetchmail: Issuer CommonName: Go Daddy Secure Certificate Authority - G2
fetchmail: Subject CommonName: *.dslextreme.com
fetchmail: Subject Alternative Name: *.dslextreme.com
fetchmail: Subject Alternative Name: dslextreme.com
fetchmail: mail.dslextreme.com key fingerprint:
42:1C:EA:3D:8E:FA:ED:F9:B4:90:79:6C:9E:39:BC:7B
fetchmail: SSL/TLS: using protocol TLSv1.2, cipher DHE-RSA-AES256-GCM-SHA384,
256/256 secret/processed bits
fetchmail: POP3< +OK POP3 ready
fetchmail: POP3> CAPA
fetchmail: POP3< +OK Capability list follows
fetchmail: POP3< EXPIRE 31 USER
fetchmail: POP3< TOP
fetchmail: POP3< UIDL
fetchmail: POP3< USER
fetchmail: POP3< XOIP
fetchmail: POP3< SASL PLAIN
fetchmail: POP3< STLS
fetchmail: POP3< .
fetchmail: mail.dslextreme.com: WARNING: server offered STLS, but sslproto '' given.
fetchmail: POP3> USER ll...@ds...
fetchmail: POP3< +OK
fetchmail: POP3> PASS *
fetchmail: POP3< +OK server ready
fetchmail: selecting or re-polling default folder
fetchmail: POP3> STAT
fetchmail: POP3< +OK 0 0
fetchmail: No mail for ll...@ds... at mail.dslextreme.com
fetchmail: POP3> QUIT
fetchmail: POP3< +OK nvl-mbs53.neonova.net Zimbra POP3 server closing connection
fetchmail: 6.3.24 querying mail.dslextreme.com (protocol POP3) at Sat 27 Apr
2019 01:30:53 PM PDT: poll completed
New UID list from mail.dslextreme.com: <empty>
fetchmail: not swapping UID lists, no UIDs seen this query
fetchmail: Query status=1 (NOMAIL)
fetchmail: 6.3.24 querying pop.earthlink.net (protocol POP3) at Sat 27 Apr 2019
01:30:53 PM PDT: poll started
Trying to connect to 209.86.93.201/110...connected.
fetchmail: POP3< +OK NGPopper vEL_0_1_42_P at earthlink.net ready
<276...@mp...>
.... 4 earthlink ID transactions removed
fetchmail: sleeping at Sat 27 Apr 2019 01:30:58 PM PDT for 60 seconds
fetchmaillog per item 5.txt
Syslog from: env LC_ALL=C /usr/bin/fetchmail -d 60 --fetchmailrc
/home/jdow/.fetchmailrc
Apr 27 13:57:30 thursday fetchmail[31459]: starting fetchmail 6.3.24 daemon
Apr 27 13:57:32 thursday fetchmail[31459]: 1 message for jd...@ea... at
pop.earthlink.net (4706 octets).
Apr 27 13:57:32 thursday postfix/smtpd[30762]: connect from localhost[::1]
Apr 27 13:57:32 thursday postfix/smtpd[30762]: warning: Illegal address syntax
from localhost[::1] in MAIL command:
<JkiO@JkiO----------------------.us-west-2.compute.amazonaws.com>
Apr 27 13:57:32 thursday fetchmail[31459]: reading message
jd...@ea...@pop.earthlink.net:1 of 1 (4706 octets) (log message incomplete)
Apr 27 13:57:32 thursday fetchmail[31459]: SMTP error: 501 5.1.7 Bad sender
address syntax
Apr 27 13:57:32 thursday fetchmail[31459]: not flushed
Apr 27 13:57:32 thursday postfix/smtpd[30762]: disconnect from localhost[::1]
On 20190427 03:11:23, Matthias Andree wrote:
> Am 24.04.19 um 18:47 schrieb jdow:
>> Fetchmail feeds off to Postfix which runs spamassassin via procmail.
>> It is a working configuration from way back so I elected to perpetuate
>> it rather than fix it. {^_-}
>>
>> This (or an older version of it) has been working for a couple decades
>> or more.
>> Along about 2019-Apr-04 it started to try to send an email to a rather
>> enigmatic address,
>> JkiO@JkiO----------------------.{MUNG]us-west-2.compute.amazonaws.com.
>> Old logwatch reports show a few sporadic "Illegal address syntax in
>> SMTP command" errors in the Postfix syslog messages. But now I am
>> getting them nearly every poll cycle. Nothing is going out because I
>> do not use the local Postfix for sending mail. It seems to be an
>> unnecessary step in the sending process. I believe I have determined
>> it is fetchmail itself that is acquiring the localhost socket to send
>> the mail using the audit facility.
>>
>> What configuration error might I have introduced?
>
> Joanne,
>
> you are not using a multi-user mailbox setup unless you stripped more
> than the password from the poll mail.dslextreme.com section. I am
> however wondering if 6.3.24 is really the latest fetchmail package for
> Scientific Linux.
>
> Can we look at some logging around the faulty message? Something like:
>
> /usr/bin/fetchmail -vv --nosyslog --nodetach --fetchmailrc
> /home/jdow/.fetchmailrc
>
> (along the lines of <http://www.fetchmail.info/fetchmail-FAQ.html#G3>,
> item 5 would show us how fetchmail sees your configuration)
>
> Has your computer running fetchmail developed hardware troubles? Does it
> use ECC-protected RAM, and if so, is there relevant EDAC logging? Is
> other software malfunctioning since c. three weeks? Have there been
> power brownouts or flukes somehow, and has the computer been rebooted since?
>
> Greetings
> Matthias
>
>
>
>
> _______________________________________________
> Fetchmail-users mailing list
> Fet...@li...
> https://lists.sourceforge.net/lists/listinfo/fetchmail-users
>
|
