2009/2/1 Tonix (Antonio Nati) > Enrico Matteucci ha scritto: > > 2009/1/31 Tonix (Antonio Nati) > >> Enrico Matteucci ha scritto: >> >> Dear Bill, thanks for your work. >>> I have some qmail server installed buit with your toaster, sometime with >>> simscan, sometime with qmail-scanner. >>> All goes well, qmail works fine like vpopmail, clamav, spamassassin and >>> other software, but sometime I get a strange problem. >>> In particular I cannot receive mail from foreign mail server, but this >>> happen with a very very low percentage, I think 1 on 1000 email or better, >>> from 1 on 1000 SMTP server. >>> Those are logs I got from /var/log/qmail/smtpd/current file >>> >>> @400000004982b95313ffe174 CHKUSER accepted sender: from >>> <u...@domain.fr::> <u...@domain.fr::> remote >>> <smtp-msa-out01.orange.fr:unknown:193.252.23.120> >>> rcpt <> : sender accepted >>> @400000004982b9532af91f1c tcpserver: end 2840 status 0 >>> @400000004982b9532af92ad4 tcpserver: status: 2/20 >>> @400000004982b95d0963cd0c tcpserver: status: 3/20 >>> >>> So E-mail was really started from source mail server. >>> In /var/log/maillog I have a log of all E-mail sent o received from >>> foreign mail server, but this E-mail from this user never was delivered to >>> anyone. >>> I made some googling an I have read there is a patch that correct some >>> wrong interpretation SMTP 5.x.x codes, but this doesn't resolve my problem. >>> I have your toaster in Ubuntu 32 and 64 bit, Debian 4, Slackware 12, but >>> always I get this little problem. >>> >>> Could anyone help me? >>> >>> Thank you. >>> Enrico >>> >> Are chkuser logs enabled also for domains with chkuser not enabled? >> >> Tonino >> >> Yes, logs (but not debug) are enabled like the Bill's toaster patch. > My problem affect only some E-mail, I think only 1/1000 or something like > this. > > Ciao, > Enrico > > > Two questions: > > - do you have last version of chkuser (2.0.9) installed? Version 2.0.9 > logs (if requested) all recipients, also when belonging to domains not > checked by chkuser (like local domains or domains out of rcpthosts). > - Can you understand from the incoming IP if the sender is a spammer > or not? > > Tonino >
Yes Tonino, I have chkuser 2.0.9 installed, like the one included in Bill's toaster. In particular I have a mail server installed that serve only one domain an all goes well. Right log is something about this: @4000000049855e9f0fd3bc24 tcpserver: pid 28014 from 81.x.x.x @4000000049855e9f0fd517cc tcpserver: ok 28014 0:192.168.2.5:25:81.x.x.x::45169 @4000000049855ea00123408c CHKUSER accepted sender: from <enr...@......it::> remote <mail.xxxxxx.it:unknown:81.x.x.x> rcpt <> : sender accepted @4000000049855ea00afef2f4 CHKUSER accepted rcpt: from <enr...@..........it::> remote <mail.xxxxxxx.it:unknown:81.x.x.x> rcpt <enr...@xxxxxx.it<enr...@upper.it>> : found existing recipient @4000000049855ea0279fc6a4 tcpserver: end 28014 status 0 @4000000049855ea0279fd25c tcpserver: status: 1/20 There are "accepted sender" and after "accepted rcpt", but from very few mail server i got only "accepted sender". So E-mail try to start from sender smtp but something happen (or don't happen) before "accepted rcpt" session. For the same dest, all the rest of E-mail works fine. The sender is not considered a spammer because rbl don't intercept their IP and in spamassassin log I don't see nothing relevant like the real spam logged in /var/log/spamd/current Ciao, Enrico
