Re: [Fetchmail-users] SECURITY ANNOUNCE (INTERIM): fetchmail users should configure --ssl wherever available, and also require at least TLS1.2

[Matthias A. <mat...@gm...>]

Am 15.08.21 um 20:58 schrieb Peter Scott via Fetchmail-users:
> Dear Matthias,
>
> Fedora 34 just upgraded fetchmail for us.
>
> Now fetchmail --version shows
>
> This is fetchmail release 6.4.20+GSS+RPA+NTLM+SDPS+SSL-SSLv2-SSLv3+NLS+KRB5.
> Compiled with SSL library 0x101010bf "OpenSSL 1.1.1k  FIPS 25 Mar 2021"
> Run-time uses SSL library 0x101010bf "OpenSSL 1.1.1k  FIPS 25 Mar 2021"
> OpenSSL: OPENSSLDIR: "/etc/pki/tls"
> Engines: ENGINESDIR: "/usr/lib64/engines-1.1"
>
> Since this upgrade my fetchmail logfile is showing the
> "run-together-lines" behavior, lacking the usual newline chars.
>
> This is not a big deal of course, but if there's a way to fix it,
> let me know.

Dear Peter,

yes they did, same for Fedora 33.

Unfortunately, the --logfile option and also --syslog are broken in
6.4.20, truncating log messages. While syslog does not run the lines
together, it still misses log message pieces.

The workaround for 6.4.20 would be to disable or remove the logfile
option, add -N for "nodetach" (meaning fetchmail will stick to the
console, and nodetach has a side effect of making log output unbuffered,
sidestepping the issue if and only if the output goes to console
directly) and then redirect its output to the log file, for instance with:

fetchmail --nodetach >>mylogfile.txt     (add your other options, if any)

or, if you want a copy of the log printed to console:

fetchmail --nodetach (your other options here) | tee -a mylogfile.txt

> It looks as if you're struggling a bit, so I wish you the best of
> luck.  I really appreciate your depth of knowledge and years and
> years of dealing with this stuff.  fetchmail is so useful.

Oh, I am not struggling, but thanks for your wishes - it's just a
somewhat unlucky timing. First the security issue, then the logging bug
in fixing it and then I receive word of the STARTTLS issue... I figured
this requires lots of code review, and some rewriting, and some more
review. Ideally, all this would have been part of one perfect release,
but alas that's not how things worked out.

Kind regards,
Matthias