[toaster] smtp-auth, badmailfrom/to hit log

2003-05-30 Thread Héja Tibor
Hi,

help me, please to solve this problem:
I'm using the 0.5 patch. I tried to find the way to send the 
badmailfrom-badmailto and mfcheck rejection messages to my smtpd 
logfile. There is a patch at http://www.svm.cz/~jirka/qmail/ for this, I 
wrote the differences into the smtpd.c. It works vell in that case, when 
I don't use the smtp authentication. After the authentication the smtpd 
send these error messages to the smtp-session, not into the logfile. I 
know that there is a 2>&1 at the and of the smtpd run script, which 
redirect the stderr to the stdout (as I see the patch above send the 
errormessage to the stderr), but this will cause problem only in that 
case, when I use the smtp authentication.

Thank you
ps: sorry for my poor english


Re: [toaster] smtp-auth, badmailfrom/to hit log

2003-05-30 Thread Tom Collins
On Thursday, May 29, 2003, at 08:20  AM, Héja Tibor wrote:
I'm using the 0.5 patch. I tried to find the way to send the 
badmailfrom-badmailto and mfcheck rejection messages to my smtpd 
logfile. There is a patch at http://www.svm.cz/~jirka/qmail/ for this, 
I wrote the differences into the smtpd.c. It works vell in that case, 
when I don't use the smtp authentication. After the authentication the 
smtpd send these error messages to the smtp-session, not into the 
logfile. I know that there is a 2>&1 at the and of the smtpd run 
script, which redirect the stderr to the stdout (as I see the patch 
above send the errormessage to the stderr), but this will cause 
problem only in that case, when I use the smtp authentication.
I notice that the SMTP AUTH patch includes the following line:

  if (fd_copy(2,1) == -1) return err_pipe();

I'm not sure why it does that, and why the call to vchkpw needs to use 
descriptors 2 and 3.  There was a patch to that patch posted to the 
vpopmail list that fixed the problem of closing file descriptor 3 in 
the parent, perhaps the fdcopy (2,1) should be in the child process as 
well.

--- qmail-smtpd.c.orig  Sat Jan 18 09:13:50 2003
+++ qmail-smtpd.c   Sat Jan 18 19:51:09 2003
@@ -459,14 +459,13 @@
   if (!stralloc_0(&resp)) die_nomem();
   if (fd_copy(2,1) == -1) return err_pipe();
-  close(3);
   if (pipe(pi) == -1) return err_pipe();
-  if (pi[0] != 3) return err_pipe();
   switch(child = fork()) {
 case -1:
   return err_fork();
 case 0:
   close(pi[1]);
+  if (0 > fd_copy(3,pi[0])) _exit(1);
   sig_pipedefault();
   execvp(*childargs, childargs);
   _exit(1);
--
Tom Collins
[EMAIL PROTECTED]


[toaster] chkuser patch problems

2003-05-30 Thread Jason 'XenoPhage' Frisvold
Hi all,

I'm trying to get the chkuser patch installed on my qmail system. 
Currently installed are the following :

qmail-1.03 (with the 0.5 toaster patch) (ucspi-tcp and daemontools too)

vpopmail 5.3.20 (compiled with --enable-roaming-users=y
--enable-logging=y --enable-default-domain=emcs.net --enable-mysql=y
--enable-mysql-replication=y --enable-defaultquota=50M)

courier-imap 1.7.0

I've extracted the qmail archive, patched with the 0.5 patch, and then
the chkuser patch.  I modified the conf-vpopmail file to reflect the
actual home directory of vpopmail, and then run make.  The errors are
listed below (large snippet)...  Any idea how to fix this?  Does the
chkuser patch not work with mysql?  Am I missing something here?

Any and all help is much appreciated!

Thanks!

/usr2/vpopmail/lib/libvpopmail.a(vauth.o): In function
`vauth_open_update':
/usr/local/src/vpopmail-5.3.20/vauth.c:105: undefined reference to
`mysql_init'
/usr/local/src/vpopmail-5.3.20/vauth.c:108: undefined reference to
`mysql_real_connect'
/usr/local/src/vpopmail-5.3.20/vauth.c:112: undefined reference to
`mysql_error'
/usr/local/src/vpopmail-5.3.20/vauth.c:118: undefined reference to
`mysql_real_connect'
/usr/local/src/vpopmail-5.3.20/vauth.c:123: undefined reference to
`mysql_error'
/usr/local/src/vpopmail-5.3.20/vauth.c:132: undefined reference to
`mysql_query'
/usr/local/src/vpopmail-5.3.20/vauth.c:137: undefined reference to
`mysql_error'
/usr/local/src/vpopmail-5.3.20/vauth.c:140: undefined reference to
`mysql_store_result'
/usr/local/src/vpopmail-5.3.20/vauth.c:141: undefined reference to
`mysql_free_result'
/usr/local/src/vpopmail-5.3.20/vauth.c:144: undefined reference to
`mysql_select_db'
/usr2/vpopmail/lib/libvpopmail.a(vauth.o): In function
`vauth_open_read':
/usr/local/src/vpopmail-5.3.20/vauth.c:163: undefined reference to
`mysql_init'
/usr/local/src/vpopmail-5.3.20/vauth.c:164: undefined reference to
`mysql_real_connect'
/usr/local/src/vpopmail-5.3.20/vauth.c:169: undefined reference to
`mysql_real_connect'
/usr2/vpopmail/lib/libvpopmail.a(vauth.o): In function
`vauth_open_read_getall':
/usr/local/src/vpopmail-5.3.20/vauth.c:195: undefined reference to
`mysql_init'
/usr/local/src/vpopmail-5.3.20/vauth.c:196: undefined reference to
`mysql_real_connect'
/usr/local/src/vpopmail-5.3.20/vauth.c:201: undefined reference to
`mysql_real_connect'
/usr2/vpopmail/lib/libvpopmail.a(vauth.o): In function
`vauth_adddomain':
/usr/local/src/vpopmail-5.3.20/vauth.c:231: undefined reference to
`mysql_query'
/usr/local/src/vpopmail-5.3.20/vauth.c:236: undefined reference to
`mysql_store_result'
/usr/local/src/vpopmail-5.3.20/vauth.c:237: undefined reference to
`mysql_free_result'
/usr2/vpopmail/lib/libvpopmail.a(vauth.o): In function `vauth_adduser':
/usr/local/src/vpopmail-5.3.20/vauth.c:310: undefined reference to
`mysql_query'
/usr/local/src/vpopmail-5.3.20/vauth.c:311: undefined reference to
`mysql_error'
/usr/local/src/vpopmail-5.3.20/vauth.c:314: undefined reference to
`mysql_store_result'
/usr/local/src/vpopmail-5.3.20/vauth.c:315: undefined reference to
`mysql_free_result'
/usr2/vpopmail/lib/libvpopmail.a(vauth.o): In function `vauth_getpw':
/usr/local/src/vpopmail-5.3.20/vauth.c:364: undefined reference to
`mysql_query'
/usr/local/src/vpopmail-5.3.20/vauth.c:365: undefined reference to
`mysql_error'
/usr/local/src/vpopmail-5.3.20/vauth.c:369: undefined reference to
`mysql_store_result'
/usr/local/src/vpopmail-5.3.20/vauth.c:374: undefined reference to
`mysql_num_rows'
/usr/local/src/vpopmail-5.3.20/vauth.c:393: undefined reference to
`mysql_fetch_row'
/usr/local/src/vpopmail-5.3.20/vauth.c:408: undefined reference to
`mysql_free_result'
/usr/local/src/vpopmail-5.3.20/vauth.c:405: undefined reference to
`mysql_free_result'
/usr2/vpopmail/lib/libvpopmail.a(vauth.o): In function
`vauth_deldomain':
/usr/local/src/vpopmail-5.3.20/vauth.c:429: undefined reference to
`mysql_query'
/usr/local/src/vpopmail-5.3.20/vauth.c:432: undefined reference to
`mysql_store_result'
/usr/local/src/vpopmail-5.3.20/vauth.c:433: undefined reference to
`mysql_free_result'
/usr/local/src/vpopmail-5.3.20/vauth.c:442: undefined reference to
`mysql_query'
/usr/local/src/vpopmail-5.3.20/vauth.c:445: undefined reference to
`mysql_store_result'
/usr/local/src/vpopmail-5.3.20/vauth.c:446: undefined reference to
`mysql_free_result'
/usr2/vpopmail/lib/libvpopmail.a(vauth.o): In function `vauth_deluser':
/usr/local/src/vpopmail-5.3.20/vauth.c:477: undefined reference to
`mysql_query'
/usr/local/src/vpopmail-5.3.20/vauth.c:480: undefined reference to
`mysql_store_result'
/usr/local/src/vpopmail-5.3.20/vauth.c:481: undefined reference to
`mysql_free_result'
/usr/local/src/vpopmail-5.3.20/vauth.c:487: undefined reference to
`mysql_query'
/usr/local/src/vpopmail-5.3.20/vauth.c:490: undefined reference to
`mysql_store_result'
/usr/local/src/vpopmail-5.3.20/vauth.c:491: undefined reference to
`mysql_free_result'
/usr2/vpopmail/lib/libvpopmail.a(vauth.o): In funct

Re: [toaster] chkuser patch problems

2003-05-30 Thread Bill Shupp
On Thursday, May 29, 2003, at 12:10  PM, Jason 'XenoPhage' Frisvold 
wrote:

Hi all,

I'm trying to get the chkuser patch installed on my qmail system.
Currently installed are the following :
qmail-1.03 (with the 0.5 toaster patch) (ucspi-tcp and daemontools too)

vpopmail 5.3.20 (compiled with --enable-roaming-users=y
--enable-logging=y --enable-default-domain=emcs.net --enable-mysql=y
--enable-mysql-replication=y --enable-defaultquota=50M)
courier-imap 1.7.0

I've extracted the qmail archive, patched with the 0.5 patch, and then
the chkuser patch.  I modified the conf-vpopmail file to reflect the
actual home directory of vpopmail, and then run make.  The errors are
listed below (large snippet)...  Any idea how to fix this?  Does the
chkuser patch not work with mysql?  Am I missing something here?
Yeah.  Read shupp.org.  You'll find that the chkuser.patch is for 
*cdb*, not mysql.  There's a patch right below that will alter your 
Makefile to work with mysql auth.

Regards,

Bill



Re: [toaster] chkuser patch problems

2003-05-30 Thread Jason 'XenoPhage' Frisvold
Doh!

It's always something obvious... *sigh*  And here I was looking through
code, trying to figure it all out... *groan*

On Thu, 2003-05-29 at 16:35, Bill Shupp wrote:
> On Thursday, May 29, 2003, at 12:10  PM, Jason 'XenoPhage' Frisvold 
> wrote:
> 
> > Hi all,
> >
> > I'm trying to get the chkuser patch installed on my qmail system.
> > Currently installed are the following :
> >
> > qmail-1.03 (with the 0.5 toaster patch) (ucspi-tcp and daemontools too)
> >
> > vpopmail 5.3.20 (compiled with --enable-roaming-users=y
> > --enable-logging=y --enable-default-domain=emcs.net --enable-mysql=y
> > --enable-mysql-replication=y --enable-defaultquota=50M)
> >
> > courier-imap 1.7.0
> >
> > I've extracted the qmail archive, patched with the 0.5 patch, and then
> > the chkuser patch.  I modified the conf-vpopmail file to reflect the
> > actual home directory of vpopmail, and then run make.  The errors are
> > listed below (large snippet)...  Any idea how to fix this?  Does the
> > chkuser patch not work with mysql?  Am I missing something here?
> 
> Yeah.  Read shupp.org.  You'll find that the chkuser.patch is for 
> *cdb*, not mysql.  There's a patch right below that will alter your 
> Makefile to work with mysql auth.
> 
> Regards,
> 
> Bill
-- 
---
Jason 'XenoPhage' Frisvold
Engine / Technology Programmer
[EMAIL PROTECTED]
RedHat Certified - RHCE # 807302349405893
MySQL Core Certified - ID# 205982910
---
"Something mysterious is formed, born in the silent void. Waiting alone
and unmoving, it is at once still and yet in constant motion. It is the
source of all programs. I do not know its name, so I will call it the
Tao of Programming."


signature.asc
Description: This is a digitally signed message part


Re: [toaster] Odd Delivery Problems...

2003-05-30 Thread Matthew Walker
Anyone have any more insight on this? I've double and triple checked the
configuration and DNS entries for both machines involved, and they're
configured just fine, and both recieving mail from other machines just fine.

The issue is /specifically/ when sending mail from the machine that hosts
kydance.net to the machine that hosts forgeglobal.com. I've now discovered
that any mail sent from any domain on the kydance.net machine destined for
the forgeglobal.com machine gets it's domain rewritted to kydance.net by the
forgeglobal.com machine, and sent back.

I'm at wits end... Help?

Matthew Walker said:
> Tom Collins said:
>> On Monday, May 19, 2003, at 02:59  PM, Matthew Walker wrote:
>>> However, when I try and send mail from kydance.net to
>>> forgeglobal.com, the mail gets delivered to kydance.net. Looking at the
>>> headers and logs, I can see that the message does in fact get
>>> delivered to
>>> the machine that hosts forgeglobal.com. However, it then gets
>>> delivered to
>>> kydance.net.
>>
>> Check the MX records for each hostname, along with the contents of the
>> following files on each server:
>>
>> /var/qmail/control/locals
> Kydance.net server:
> arsenic.mthmarketing.com
>
> ForgeGlobal.com server:
> lanparty.mthmarketing.com
>
>> /var/qmail/control/virtualdomains
> Kydance.net server:
> kydance.net:kydance.net
> kaneq.com:kaneq.com
> slamr.org:slamr.org
> tarynn.net:tarynn.net
> companyrank.com:companyrank.com
> culvercrest.com:culvercrest.com
> vorkink.com:vorkink.com
> witrailblazers.info:witrailblazers.info
> we-rank-media.com:we-rank-media.com
> sacreddragons.com:sacreddragons.com
>
> ForgeGlobal.com server:
> test.com:test.com
> forgeglobal.com:forgeglobal.com
> missionties.com:missionties.com
> lanpartyinc.com:lanpartyinc.com
> thewildernesswoods.com:thewildernesswoods.com
>
>> /var/qmail/control/rcpthosts
> Kydance.net server:
> arsenic.mthmarketing.com
> kydance.net
> kaneq.com
> slamr.org
> tarynn.net
> companyrank.com
> culvercrest.com
> vorkink.com
> witrailblazers.info
> we-rank-media.com
> sacreddragons.com
>
> ForgeGlobal.com server:
> lanparty.mthmarketing.com
> test.com
> forgeglobal.com
> missionties.com
> lanpartyinc.com
> thewildernesswoods.com
>
>> /var/qmail/control/morercpthosts
> Kydance.net server:
> meubox.net
>
> ForgeGlobal.com Server:
> <>
>
>> /var/qmail/users/assign
>
> Kydance.net server:
> +kydance.net-:kydance.net:1028:408:/home/vpopmail/domains/kydance.net:-::
> +kaneq.com-:kaneq.com:1028:408:/home/vpopmail/domains/kaneq.com:-::
> +slamr.org-:slamr.org:1028:408:/home/vpopmail/domains/slamr.org:-::
> +tarynn.net-:tarynn.net:1028:408:/home/vpopmail/domains/tarynn.net:-::
> +companyrank.com-:companyrank.com:1028:408:/home/vpopmail/domains/companyrank.com:-::
> +culvercrest.com-:culvercrest.com:1028:408:/home/vpopmail/domains/culvercrest.com:-::
> +vorkink.com-:vorkink.com:1028:408:/home/vpopmail/domains/vorkink.com:-::
> +witrailblazers.info-:witrailblazers.info:1028:408:/home/vpopmail/domains/witrailblazers.info:-::
> +we-rank-media.com-:we-rank-media.com:1028:408:/home/vpopmail/domains/we-rank-media.com:-::
> +sacreddragons.com-:sacreddragons.com:1028:408:/home/vpopmail/domains/sacreddragons.com:-::
>
> ForgeGlobal.com Server:
> +test.com-:test.com:89:89:/var/vpopmail/domains/test.com:-::
> +forgeglobal.com-:forgeglobal.com:89:89:/var/vpopmail/domains/forgeglobal.com:-::
> +missionties.com-:missionties.com:89:89:/var/vpopmail/domains/missionties.com:-::
> +lanpartyinc.com-:lanpartyinc.com:89:89:/var/vpopmail/domains/lanpartyinc.com:-::
> +thewildernesswoods.com-:thewildernesswoods.com:89:89:/var/vpopmail/domains/thewildernesswoods.com:-::
>
>>
>> Make sure that forgeglobal.com is only listed on the server hosting it,
>> and kydance.net is likewise, only listed on the server hosting it.
>>
>> Make sure that the address you're sending to isn't an alias to an
>> address at kydance.net.
>
> Definately no aliases. The ForgeGlobal.com domain recieves email just fine
> from everyone but kydance.net addresses. Those get looped back to
> Kydance.net by the ForgeGlobal.com server.
>
> Matthew Walker
>



Re: [toaster] Odd Delivery Problems...

2003-05-30 Thread Tom Collins
On Thursday, May 29, 2003, at 03:06  PM, Matthew Walker wrote:
The issue is /specifically/ when sending mail from the machine that 
hosts
kydance.net to the machine that hosts forgeglobal.com. I've now 
discovered
that any mail sent from any domain on the kydance.net machine destined 
for
the forgeglobal.com machine gets it's domain rewritted to kydance.net 
by the
forgeglobal.com machine, and sent back.
Log into machine X, the one hosting kydance.net.

Telnet to port 25 of machine Y, the one hosting forgegobal.com.

Type 'HELP' and hit return.  Is it qmail?

Try an SMTP test message:

--
MAIL FROM:<[EMAIL PROTECTED]>
RCPT TO:<[EMAIL PROTECTED]>
DATA
To: [EMAIL PROTECTED]
From: [EMAIL PROTECTED]
Subject: Test
This is a test.
.
--
What do you see in the logs on machine Y?

On machine Y, what happens if you `grep kydance.net 
/var/qmail/control/*`?  On machine X, what if you `grep forgeglobal.com 
/var/qmail/control/*`?  Maybe an odd entry in smtproutes?

What does /var/vpopmail/domains/forgeglobal.com/.qmail-default look 
like?

--
Tom Collins
[EMAIL PROTECTED]


[toaster] Disturbing Logs

2003-05-30 Thread Peter Maag








    Hi
All,

Have another quick question for the list regarding some
outgoing mail I have found in my log files that worries me:

 

@40003ed69e020fb9a08c new msg
213846

@40003ed69e020fb9db24 info msg
213846: bytes 1218 from <[EMAIL PROTECTED]> qp 19758 uid 514

@40003ed69e021112f2e4 starting delivery 2368: msg 213846 to remote [EMAIL PROTECTED]

@40003ed69e02111344ec status: local 0/10 remote 1/20

@40003ed69e032b2b5a7c delivery 2368: success:
216.103.215.80_accepted_messag

e./Remote_host_said:_250_2.6.0_<[EMAIL PROTECTED]>_Queued_mail_for_delivery/

@40003ed69e032b2bcbc4 status: local 0/10 remote 0/20

@40003ed69e032b2bdf4c end msg
213846

 

The message appears to be coming from my server and is being
delivered to an external server that is not being hosted by my server.  The local account that QMail is claiming the mail is being sent from is not even a
valid POP3 account.

 

Any ideas?

 

    Peter
Maag








Re: [toaster] Disturbing Logs

2003-05-30 Thread Tom Collins
On Thursday, May 29, 2003, at 05:05  PM, Peter Maag wrote:
The message appears to be coming from my server and is being delivered to an external server that is not being hosted by my server. The local account that QMail is claiming the mail is being sent from is not even a valid POP3 account.

Try `grep -ri "email.domain.com" /home/vpopmail/domains` (where the address in your log that the message went to is [EMAIL PROTECTED]) to see if the address in question is a forwarding address on any account you host.  It is possible that it's a remote catchall, and could get listed in the log that way.

--
Tom Collins
[EMAIL PROTECTED]



Re: [toaster] Odd Delivery Problems...

2003-05-30 Thread Matthew Walker
Tom Collins said:
> On Thursday, May 29, 2003, at 03:06  PM, Matthew Walker wrote:
>> The issue is /specifically/ when sending mail from the machine that hosts
>> kydance.net to the machine that hosts forgeglobal.com. I've now discovered
>> that any mail sent from any domain on the kydance.net machine destined for
>> the forgeglobal.com machine gets it's domain rewritted to kydance.net by the
>> forgeglobal.com machine, and sent back.
>
> Log into machine X, the one hosting kydance.net.
>
> Telnet to port 25 of machine Y, the one hosting forgegobal.com.
>
> Type 'HELP' and hit return.  Is it qmail?

Yep. Tested it to be sure, but I installed the toaster on it myself.

>
> Try an SMTP test message:
>
> --
> MAIL FROM:<[EMAIL PROTECTED]>
> RCPT TO:<[EMAIL PROTECTED]>
> DATA
> To: [EMAIL PROTECTED]
> From: [EMAIL PROTECTED]
> Subject: Test
>
> This is a test.
> .
> --
>
> What do you see in the logs on machine Y?

It works perfectly when I do it by hand. Correctly delivered to the virtual
domain on forgeglobal.com.

>
> On machine Y, what happens if you `grep kydance.net
> /var/qmail/control/*`?  On machine X, what if you `grep forgeglobal.com
/var/qmail/control/*`?  Maybe an odd entry in smtproutes?

Nothing found. I've scoured these files for any sign of a problem, and
everything is kosher..

>
> What does /var/vpopmail/domains/forgeglobal.com/.qmail-default look like?

| /var/vpopmail/bin/vdelivermail '' bounce-no-mailbox

>
> --
> Tom Collins
> [EMAIL PROTECTED]
>
>


The fact that doing it by hand works is making me suspicious. How do I turn
on full debug logging of the communication between the two machines? I'll go
searching, but if anyone can provide the answer quickly, it'd be
appreciated.

Matthew



-- 
 Was I helpful?  Let others know:
 http://svcs.affero.net/rm.php?r=utoxin&p=main


Re: [toaster] Odd Delivery Problems...

2003-05-30 Thread Matthew Walker
Well, I got recordio working only to discover that the servers talk to
eachother using STARTTLS, so I can't tell what's being transmitted. Anyone
know how to turn it off so I can get a cleartext message?


Re: [toaster] Odd Delivery Problems...

2003-05-30 Thread Matthew Walker
Matthew Walker said:
> Well, I got recordio working only to discover that the servers talk to
> eachother using STARTTLS, so I can't tell what's being transmitted. Anyone
> know how to turn it off so I can get a cleartext message?
>

*scratches head*

I haven't changed any configurations, and it just started sending messages
properly.

I was doing more tests to see if I could figure anything out from headers
and qmail-send logs, and now I can't duplicate the problem. despite the fact
that it happened just earlier today.

Well... Until further notice, the problem is solved.


Re: [toaster] Odd Delivery Problems...

2003-05-30 Thread Matthew Walker
*tears hair out* Another test message just pulled the old trick again.
Nothing different from any of the other tests.

Matthew Walker said:
> Matthew Walker said:
>> Well, I got recordio working only to discover that the servers talk to
>> eachother using STARTTLS, so I can't tell what's being transmitted. Anyone
>> know how to turn it off so I can get a cleartext message?
>>
>
> *scratches head*
>
> I haven't changed any configurations, and it just started sending messages
> properly.
>
> I was doing more tests to see if I could figure anything out from headers
> and qmail-send logs, and now I can't duplicate the problem. despite the fact
> that it happened just earlier today.
>
> Well... Until further notice, the problem is solved.
>



RE: [toaster] Disturbing Logs

2003-05-30 Thread Peter Maag








    Tom,

 
Looking through my logs it seems that a number of domains are doing what
the original domain address is doing.  In
every case the from address(that claims to be from my
server) is not a valid address on my server. 
It seems that someone has found a way to compromise the catchall setting
in vpopmail, as the domains in question all have a
catchall mail account.

 

 
Does anyone have any idea how this can be stopped while still having catch
all support?

 

    Peter

 

-Original Message-
From: Tom Collins
[mailto:[EMAIL PROTECTED]] 
Sent: Thursday, May 29, 2003 6:02 PM
To: [EMAIL PROTECTED]
Subject: Re: [toaster] Disturbing
Logs

 

On Thursday, May 29, 2003, at 05:05
 PM, Peter Maag wrote:

The message
appears to be coming from my server and is being delivered to an external
server that is not being hosted by my server. The local account that QMail is claiming the mail is being sent from is not even a
valid POP3 account.




Try `grep -ri "email.domain.com"
/home/vpopmail/domains` (where the address in your
log that the message went to is [EMAIL PROTECTED]) to see if the address in
question is a forwarding address on any account you host. It is possible that
it's a remote catchall, and could get listed in the log that way.

--
Tom Collins
[EMAIL PROTECTED]

 








RE: [toaster] Disturbing Logs

2003-05-30 Thread Peter Maag








    Also,
if it helps I am using vpopmail 5.3.6 and
Bill’s Toaster with the .5 patch applied, as well as: qmailadmin
1.0.4

 

    Peter

 

-Original Message-
From: Tom Collins
[mailto:[EMAIL PROTECTED]] 
Sent: Thursday, May 29, 2003 6:02 PM
To: [EMAIL PROTECTED]
Subject: Re: [toaster] Disturbing
Logs

 

On Thursday, May 29, 2003, at 05:05
 PM, Peter Maag wrote:

The message
appears to be coming from my server and is being delivered to an external
server that is not being hosted by my server. The local account that QMail is claiming the mail is being sent from is not even a
valid POP3 account.




Try `grep -ri
"email.domain.com" /home/vpopmail/domains`
(where the address in your log that the message went to is [EMAIL PROTECTED]) to
see if the address in question is a forwarding address on any account you host.
It is possible that it's a remote catchall, and could get listed in the log
that way.

--
Tom Collins
[EMAIL PROTECTED]

 








Re: [toaster] Disturbing Logs

2003-05-30 Thread Tom Collins
On Thursday, May 29, 2003, at 07:06  PM, Peter Maag wrote:
 Looking through my logs it seems that a number of domains are doing what the original domain address is doing. In every case the from address(that claims to be from my server) is not a valid address on my server. It seems that someone has found a way to compromise the catchall setting in vpopmail, as the domains in question all have a catchall mail account.

If someone is forging a return address, but sending to some random address for that domain, there's not much you can do (other than turning off the catchall).

--
Tom Collins
[EMAIL PROTECTED]



Re: [toaster] Odd Delivery Problems...

2003-05-30 Thread Jason 'XenoPhage' Frisvold
On Thu, 2003-05-29 at 22:06, Matthew Walker wrote:
> *tears hair out* Another test message just pulled the old trick again.
> Nothing different from any of the other tests.

Are kydance and forgeglobal 2 separate servers?  I get this :

[EMAIL PROTECTED] friz]$ telnet kydance.net 25
Trying 216.190.203.133...
Connected to kydance.net.
Escape character is '^]'.
220 arsenic.mthmarketing.com ESMTP
help
214 qmail home page: http://pobox.com/~djb/qmail.html
quit
221 arsenic.mthmarketing.com
Connection closed by foreign host.
[EMAIL PROTECTED] friz]$ telnet forgeglobal.com 25
Trying 216.190.203.152...
Connected to forgeglobal.com.
Escape character is '^]'.
220 lanparty.mthmarketing.com ESMTP
help
214 qmail home page: http://pobox.com/~djb/qmail.html
quit
221 lanparty.mthmarketing.com
Connection closed by foreign host.
[EMAIL PROTECTED] friz]$ host lanparty.mthmarketing.com
lanparty.mthmarketing.com has address 216.190.203.151
[EMAIL PROTECTED] friz]$ host arsenic.mthmarketing.com
arsenic.mthmarketing.com is an alias for kydance.net.
kydance.net has address 216.190.203.133

Note that according to my testing, I'm seeing 2 separate servers... 
arsenic and lanparty...  Is lanparty forwarding everything to arsenic
for some reason?

-- 
---
Jason 'XenoPhage' Frisvold
Engine / Technology Programmer
[EMAIL PROTECTED]
RedHat Certified - RHCE # 807302349405893
MySQL Core Certified - ID# 205982910
---
"Something mysterious is formed, born in the silent void. Waiting alone
and unmoving, it is at once still and yet in constant motion. It is the
source of all programs. I do not know its name, so I will call it the
Tao of Programming."


signature.asc
Description: This is a digitally signed message part