Re: [exim] smarthost Outsmarting me so Far

2022-05-10 Thread Jeremy Harris via Exim-users
On 10/05/2022 14:34, Martin McCormick via Exim-users wrote: It could be that smtp.suddenlink.net tightened their authentication requirements in an upgrade recently and this is what changed. Have you asked them? -- Cheers, Jeremy -- ## List details at

Re: [exim] Spurious "BDAT command used when CHUNKING not advertised"?

2022-05-09 Thread Jeremy Harris via Exim-users
On 09/05/2022 22:44, Jesse Hathaway via Exim-users wrote: Just recently, starting on May 4th, we began bouncing some messages from Gmail with the following error: 2022-05-09 15:32:48 H=mail-lj1-x234.google.com [2a00:1450:4864:20::234]:46864 I=[2620:0:861:3:208:80:154:76]:25

Re: [exim] multiple cc: headers

2022-05-09 Thread Jeremy Harris via Exim-users
On 09/05/2022 09:53, Julian Bradfield via Exim-users wrote: Coming to the point: is the bounce message coming from some (hopefully experimental) part of Exim, or must it have been maliciously hand-crafted in a config file by the solardns administrators? I can't find anything relevant in the

Re: [exim] exim-4.96RC0 - broken Mailman (2.x)

2022-05-07 Thread Jeremy Harris via Exim-users
On 06/05/2022 18:05, Andrew C Aitchison via Exim-users wrote: Does this help ?     {${sg{$local_part_suffix}{-(bounces|confirm|join|leave|owner|request|admin)(\\+.*)?}{\$1}}}  \ ${sg } is not clever enough to realise that the RE and substring are, in this case, selecting a list of

Re: [exim] exim-4.96rc0 Tainted arg

2022-05-03 Thread Jeremy Harris via Exim-users
On 03/05/2022 13:22, Odhiambo Washington via Exim-users wrote: Question is whether I am creating a security loophole by doing the above. So long as the selection parameter "username" is a plain-old column in your DB (and not some magic way of cooking the "where" selectors) that looks fine. I

Re: [exim] Callout defer (was: Taint checking and exim 4.96rc0)

2022-05-01 Thread Jeremy Harris via Exim-users
On 01/05/2022 15:16, Slavko via Exim-users wrote: will be appropriate $*_data variables filled on defer result with defer_ok option? I mean in case, when callout do not fail due network errors. No. + without defer_ok, on any defer reason the ACL immediately returns defer result and one

Re: [exim] Taint checking and exim 4.96rc0

2022-05-01 Thread Jeremy Harris via Exim-users
On 30/04/2022 12:04, Slavko via Exim-users wrote: That's worthy of consideration; thank you for the idea. Essentially, it would be treating a backend MTA as a trusted DB for lookup. Committed at 7bdf04110b. can you consider in that "trusted DB" something, which can interpret deffer

Re: [exim] Taint checking and exim 4.96rc0

2022-05-01 Thread Jeremy Harris via Exim-users
On 01/05/2022 10:58, James via Exim-users wrote:     set acl_m_greyhash = ${hash_32_62:$sender_helo_name$sender_address$local_part$domain} If that subject string for the hash operator was less than 33 chars long, the operator returns it unchanged. If an attacker slipped some SQL syntax in

Re: [exim] exim-4.96rc0 Tainted arg

2022-05-01 Thread Jeremy Harris via Exim-users
On 01/05/2022 09:55, Odhiambo Washington via Exim-users wrote: dovecot_virtual_delivery: driver = pipe return_output command = /usr/local/libexec/dovecot/deliver -d $local_part@$domain -f $sender_address message_prefix = How do I need to de-taint the arg 2? The same way as you

Re: [exim] Google SMTP Timeouts on large mails

2022-04-30 Thread Jeremy Harris via Exim-users
On 30/04/2022 17:43, Adam D. Barratt via Exim-users wrote: This is likely to be the result of a known issue with Google's TCP Fast Open setup - see e.g. https://blog.apnic.net/2021/07/05/tcp-fast-open-not-so-fast/ Always worth a try, but that blog description doesn't match what the packet

Re: [exim] Google SMTP Timeouts on large mails

2022-04-30 Thread Jeremy Harris via Exim-users
On 29/04/2022 10:56, Graeme Coates via Exim-users wrote: a pointer as to where I need to formally raise a bug, and I'll be happy to do so! I forgot to answer this point. You could open one at bugs.exim.org just so the info doesn't get lost. But, currently, I don't think it's likely a bug in

Re: [exim] Google SMTP Timeouts on large mails

2022-04-30 Thread Jeremy Harris via Exim-users
On 29/04/2022 10:56, Graeme Coates via Exim-users wrote: I have a packet capture which is available here: https://tinyurl.com/742s855d Thank you so much for gathering this. It seems to show buggy behaviour in your Debian TCP implementation; (or possibly software-firewall) I don't see any

Re: [exim] Taint checking and exim 4.96rc0

2022-04-30 Thread Jeremy Harris via Exim-users
On 30/04/2022 00:54, Slavko (tblt) via Exim-users wrote: Yes, as i wrote the same already some time ago, some generic ${detaint:...} expansion is missing. That would be instantly abused. verify recipients from my MX to my other MTA (where local DB are stored) by callout. But that doey not

Re: [exim] Taint checking and exim 4.96rc0

2022-04-29 Thread Jeremy Harris via Exim-users
On 29/04/2022 22:41, Kirill Miazine via Exim-users wrote: I'd welcome some generic way to untaint data. If you know of one which does not require a list of known-good values, and is not trivially abusable by blind copy-pasting of recipes found on random blogs - I'm all ears. -- Cheers,

Re: [exim] Exim 4.96-RC0 released

2022-04-27 Thread Jeremy Harris via Exim-users
On 27/04/2022 13:25, Lena--- via Exim-users wrote: I'm concerned with the "EXPIRATION_DATE=2022-06-30" TDB and GDBM are possible alternates to BDB; GDBM having two separately supported APIs. -- Cheers, Jeremy -- ## List details at https://lists.exim.org/mailman/listinfo/exim-users ## Exim

Re: [exim] Making a router look at the From: value

2022-04-26 Thread Jeremy Harris via Exim-users
On 26/04/2022 22:05, Johnnie W Adams via Exim-users wrote: I'm now trying to figure out what condition on the router is appropriate. I can't verify, because I don't have LDAP lookup on this machine. It appears senders only explicitly allowlists by enumerated name--or can I put a wildcard like

Re: [exim] Making a router look at the From: value

2022-04-26 Thread Jeremy Harris via Exim-users
On 26/04/2022 21:35, Johnnie W Adams via Exim-users wrote: What's happening is Google seems to have cranked up their spam filters, and I'm getting a lot of false positives in my quarantine box. It's a long story to explain why, but the best solution I've got to it is to make my quarantine

Re: [exim] SSL verify error: An error I thought harmless

2022-04-26 Thread Jeremy Harris via Exim-users
On 26/04/2022 17:44, Johnnie W Adams via Exim-users wrote: So the question is better asked, "Why is that x-gm-spam header being inserted?" Which points me back upstream, true? Upstream of that router, at least. It still could be within the same MTA. -- Cheers, Jeremy -- ## List details at

Re: [exim] SSL verify error: An error I thought harmless

2022-04-26 Thread Jeremy Harris via Exim-users
On 26/04/2022 16:36, Johnnie W Adams via Exim-users wrote: That's helpful! Let me ask a more focused question: Does this mean my cert/key combo on this node is bad? That's the path I'm going down right now. It says there's a certs issue between this MTA and your quarantine node. That's

Re: [exim] SSL verify error: An error I thought harmless

2022-04-26 Thread Jeremy Harris via Exim-users
On 26/04/2022 15:47, Johnnie W Adams via Exim-users wrote: What exactly is triggering the R=quarantine flag? That is the router that accepted the message and handed it to a transport. Why that one? This depends on the definition of your chain of routers, in your configuration. -- Cheers,

Re: [exim] Exim 4.96-RC0 released

2022-04-26 Thread Jeremy Harris via Exim-users
On 26/04/2022 08:07, Lena--- via Exim-users wrote: - Query-style lookups are now checked for quoting, if the query string is built using untrusted data ("tainted"). For now lack of quoting is merely logged; a future release will upgrade this to an error. Does it apply to dnsdb?

Re: [exim] [exim-announce] Exim 4.96-RC0 released

2022-04-26 Thread Jeremy Harris via Exim-users
On 26/04/2022 07:22, Odhiambo Washington via Exim-users wrote: I am a bit confused about this. Does it refer to "The Oracle Berkeley DB"? Yes. If that is the case, my server has "The Oracle Berkeley DB, revision 5.3" The db.h your compile is picking up is for version 1. Perhaps you have

Re: [exim] [exim-announce] Exim 4.96-RC0 released

2022-04-25 Thread Jeremy Harris via Exim-users
On 25/04/2022 20:14, Odhiambo Washington via Exim-users wrote: Trying to compile on FreeBSD-13-amd64: root@gw:/usr/local/SRC/Exim/exim-4.96-RC0 # make /bin/sh scripts/source_checks `Makefile' is up to date. clang -g -DMACRO_PREDEF macro_predef.c In file included from macro_predef.c:12: In

Re: [exim] Exim 4.96-RC0 released

2022-04-25 Thread Jeremy Harris via Exim-users
On 25/04/2022 15:03, Frank Elsner via Exim-users wrote: tls-openssl.c:3344:14: warning: implicit declaration of function ‘event_raise’ [-Wimplicit-function-declaration] 3344 | (void) event_raise(event_action, US"tls:fail:connect", *errstr, NULL); What now? Probably a missing guard

[exim] Exim 4.96-RC0 released

2022-04-25 Thread Jeremy Harris via Exim-users
Hi all, Enough changes have accumulated since 4.95 for it to be worth spinning another release. The first Release Candidate is available - as tarball:https://ftp.exim.org/pub/exim/exim4/test - directly from Git: https://git.exim.org tag exim-4.96-RC0 The

Re: [exim] catching brute foce smtp auth - what condition?

2022-04-12 Thread Jeremy Harris via Exim-users
On 12/04/2022 08:24, Arkadiusz Miśkiewicz via Exim-users wrote: How to catch brute foce smtp auth attempts only? (== bad login or password provided) Ideas? server_condition = ${acl {auth_check} {$auth2}{$auth3}} -- Cheers, Jeremy -- ## List details at

Re: [exim] $domain_data not populated, caching problem?

2022-04-09 Thread Jeremy Harris via Exim-users
On 09/04/2022 22:42, Jesse Hathaway via Exim-users wrote: Ah, that makes sense, and was part of my confusion, local_domains is defined as: domainlist system_domains = @ domainlist local_domains = +system_domains : +wikimedia_domains : +legacy_mailman_domains : +verp_domains domainlist

Re: [exim] $domain_data not populated, caching problem?

2022-04-09 Thread Jeremy Harris via Exim-users
On 09/04/2022 22:14, Jesse Hathaway via Exim-users wrote: On Sat, Apr 9, 2022 at 8:03 AM Jeremy Harris via Exim-users wrote: On thinking more - it's far more likely that the lookup never returned any data (so that's what was cached). hmm, I'm a bit confused, I thought it wouldn't proceed

Re: [exim] $domain_data not populated, caching problem?

2022-04-09 Thread Jeremy Harris via Exim-users
On 09/04/2022 10:33, Jeremy Harris via Exim-users wrote: On 08/04/2022 17:33, Jesse Hathaway via Exim-users wrote: Or is there something silly that I am missing? Telling us what version of Exim. On thinking more - it's far more likely that the lookup never returned any data (so that's what

Re: [exim] $domain_data not populated, caching problem?

2022-04-09 Thread Jeremy Harris via Exim-users
On 08/04/2022 17:33, Jesse Hathaway via Exim-users wrote: Or is there something silly that I am missing? Telling us what version of Exim. -- Cheers, Jeremy -- ## List details at https://lists.exim.org/mailman/listinfo/exim-users ## Exim details at http://www.exim.org/ ## Please use the Wiki

Re: [exim] Enabling SPF check for incoming emails in Exim

2022-04-08 Thread Jeremy Harris via Exim-users
On 08/04/2022 03:37, Mohammad Ishtiaq Ashiq Khan via Exim-users wrote: The doc says SPF verification support is built into Exim if SUPPORT_SPF=yes is set in Local/Makefile. Run "exim-bV" on your existing exim before building a custom one. Look at the "Supports" line. If it mentions SPF, it's

Re: [exim] 2 hours delay (gnutls_handshake): timed out: delivering unencrypted to

2022-04-07 Thread Jeremy Harris via Exim-users
On 07/04/2022 15:16, tt-admin via Exim-users wrote: Here ist he complete strace of the hanging process: https://pastebin.com/wPPGab1K 31032 10:47:07 wait4(-1, 0x7fff70a35a0c, WNOHANG, NULL) = 0 31032 10:47:07 select(8, [7], NULL, NULL, {tv_sec=60, tv_usec=0}) = 0 (Timeout) This looks like

Re: [exim] Trigger a spam/malware scan within a router, outside the smtp_data ACL

2022-04-01 Thread Jeremy Harris via Exim-users
On 01/04/2022 06:12, Christian Balzer via Exim-users wrote: Any suggestions Exim with debug mode, for more info. -- Cheers, Jeremy -- ## List details at https://lists.exim.org/mailman/listinfo/exim-users ## Exim details at http://www.exim.org/ ## Please use the Wiki with this list -

Re: [exim] Exim Input Spool Header Format?

2022-03-30 Thread Jeremy Harris via Exim-users
On 29/03/2022 18:05, Mark Murawski via Exim-users wrote: What's the issue with the file? Editing spool files is a... brave... activity. Without knowing what you changed? Possibly the character count associated with a header line. -- Cheers, Jeremy -- ## List details at

Re: [exim] Trigger a spam/malware scan within a router, outside the smtp_data ACL

2022-03-30 Thread Jeremy Harris via Exim-users
On 30/03/2022 08:44, Christian Balzer via Exim-users wrote: Can the not_smtp ACL be abused for that with a pipe transport or similar? Possibly, but rather unclean. Slightly less so would be using a ${acl (my_scanner_acl}} from a suitable option on the router, to call a custom (neither smtp or

Re: [exim] 2 hours delay (gnutls_handshake): timed out: delivering unencrypted to

2022-03-30 Thread Jeremy Harris via Exim-users
On 30/03/2022 09:53, tt-admin via Exim-users wrote: I wonder what 1758 and 1762 were doing all that time - I presume there is no other mention of 1762 in the log ? No, they are not mentioned besides the exigrep output. Additional useful info might be given by "exiwhat". Run that; anything for

Re: [exim] Why do we seem(!) to have a FD leak in the daemon?

2022-03-27 Thread Jeremy Harris via Exim-users
On 26/03/2022 13:37, Larry Rosenman via Exim-users wrote: All of a sudden, I'm seeing Exim keep my home directory open a NUMBER of times. It caused me a Too Many Files open and a DOS. This is on FreeBSD: FreeBSD thebighonker.lerctr.org 13.1-STABLE FreeBSD 13.1-STABLE #23

Re: [exim] stuck exim processes

2022-03-25 Thread Jeremy Harris via Exim-users
On 25/03/2022 08:30, Patrik Peng via Exim-users wrote: Yes, it was "büro". After a little struggle, that u-umlaut seems to be the byte sequence 0xC3 0xBC, at least as my email has it. Feeding that "büro" to the testsuite under linux shows it successfully translated to "xn--bro-hoa" which

Re: [exim] 2 hours delay (gnutls_handshake): timed out: delivering unencrypted to

2022-03-25 Thread Jeremy Harris via Exim-users
On 25/03/2022 07:22, tt-admin via Exim-users wrote: So your suggestion would be to try another exim version or to file a bug with the Ubuntu 18.04 package? Yes. The machine was not suspended. So, it might not be that one then. Were there any other operations that might have stepped the

Re: [exim] stuck exim processes

2022-03-24 Thread Jeremy Harris via Exim-users
On 24/03/2022 15:35, Patrik Peng via Exim-users wrote: On 22.03.22 17:25, Jeremy Harris via Exim-users wrote: Try pulling in commit d2f99aad04, which was made following similar issues (since 4.95). Still experiencing segfaults, I take it that this is after doing the above? So we move forward

Re: [exim] 2 hours delay (gnutls_handshake): timed out: delivering unencrypted to

2022-03-23 Thread Jeremy Harris via Exim-users
On 22/03/2022 11:00, tt-admin via Exim-users wrote: Exim version 4.90_1 #4 built 30-Apr-2021 14:15:04 Mmmm, an ancient Exim release number but a build "only" 11 months old. That's what you get for running an LTS distro, I suppose. Difficult to guess exactly what fixes from the original 4.90

Re: [exim] Multiple domains using certificates and keys

2022-03-23 Thread Jeremy Harris via Exim-users
On 23/03/2022 17:50, The Doctor via Exim-users wrote: Am I missing something? You didn't say what you are trying to do. -- Cheers, Jeremy -- ## List details at https://lists.exim.org/mailman/listinfo/exim-users ## Exim details at http://www.exim.org/ ## Please use the Wiki with this list -

Re: [exim] stuck exim processes

2022-03-22 Thread Jeremy Harris via Exim-users
On 22/03/2022 20:44, Kurt Jaeger via Exim-users wrote: diff --git a/src/src/transports/smtp.c b/src/src/transports/smtp.c index 6a979a243..f97b0c625 100644 --- a/src/src/transports/smtp.c +++ b/src/src/transports/smtp.c @@ -4800,7 +4800,11 @@ if (sx->send_quit || tcw_done && !tcw) # ifdef

Re: [exim] stuck exim processes

2022-03-22 Thread Jeremy Harris via Exim-users
On 22/03/2022 13:02, Patrik Peng via Exim-users wrote: LOG: MAIN PANIC DIE   bad memory allocation requested (-83643 bytes) at  string_localpart_utf8_to_alabel 146 LOG: MAIN PANIC   Delivery status for ��@somehost.net: got 0 of 7 bytes (pipeheader) from  transport process 108 for transport 

Re: [exim] Redirect with mysql

2022-03-22 Thread Jeremy Harris via Exim-users
On 22/03/2022 12:56, Luciano InfoCultura via Exim-users wrote: Hi, I'm doing an exim install to replace a legacy email system where all subscribers are doing an external redirectI used the following rule as conf.d/router/120_CPD_client_aliases client_aliases:    debug_print = "R:

Re: [exim] Failing for DNSSEC lookup

2022-03-20 Thread Jeremy Harris via Exim-users
On 20/03/2022 19:35, Christian Eyrich via Exim-users wrote: my exim installation is failing when I try forcing DNSSEC for DANE using "dnssec_require_domains" for any domain. > dnslookup_secure router < local_part=dnssectest1 domain=mailbox.org checking domains R: 

Re: [exim] stuck exim processes

2022-03-19 Thread Jeremy Harris via Exim-users
On 18/03/2022 17:56, Patrik Peng via Exim-users wrote: But here is a backtrace that hopefully is of any use: It tells me that setting utf8_downconvert=0 on the transport would be an avoidance. To work towards a fix will however need better info. A first cut would be just a "-ggdb -O0" build,

Re: [exim] stuck exim processes

2022-03-17 Thread Jeremy Harris via Exim-users
On 17/03/2022 16:41, Patrik Peng via Exim-users wrote: Afaik yes. Being certain would be better. Can you get a corefile? -- Cheers, Jeremy -- ## List details at https://lists.exim.org/mailman/listinfo/exim-users ## Exim details at http://www.exim.org/ ## Please use the Wiki with this list -

Re: [exim] stuck exim processes

2022-03-17 Thread Jeremy Harris via Exim-users
On 17/03/2022 11:07, Patrik Peng via Exim-users wrote: We tried your patch on one of our hosts and the processes stopped getting stuck. But soon we noticed an increased amount of SIGSEGVs: Do you have the other patches mentioned in this thread? Because that is a different symptom to the one

Re: [exim] Expired tls certificate

2022-03-17 Thread Jeremy Harris via Exim-users
On 16/03/2022 21:01, Mike Diehl via Exim-users wrote: depth=3 O = Digital Signature Trust Co., CN = DST Root CA X3 verify error:num=10:certificate has expired notAfter=Sep 30 14:01:15 2021 GMT What am I missing? Ah, the "depth=3" is the clue. This is not talking about your leaf cert being

Re: [exim] Expired tls certificate

2022-03-17 Thread Jeremy Harris via Exim-users
On 16/03/2022 21:01, Mike Diehl via Exim-users wrote: Hi all, I'm finding that my tls certificate is expired: openssl s_client -connect mail.diehlnet.com:25 -starttls smtp depth=3 O = Digital Signature Trust Co., CN = DST Root CA X3 verify error:num=10:certificate has expired notAfter=Sep 30

Re: [exim] SMTP timeouts

2022-03-13 Thread Jeremy Harris via Exim-users
On 13/03/2022 20:06, Mike Tubby via Exim-users wrote: 2022-03-13 19:47:53 1nTTGO-0001Jw-Tr H=alt2.gmail-smtp-in.l.google.com [2a00:1450:4025:c03::1a]: SMTP timeout after sending data block (476909 bytes written): Connection timed out Google doesn't want to talk to you, at least on that IP.

Re: [exim] Limiting outside world to ports 465 and 587

2022-03-12 Thread Jeremy Harris via Exim-users
On 13/03/2022 01:00, The Doctor via Exim-users wrote: I was wonder if it is doable that the outside world can only see ports 587 and 465 while limiting port 25 to localhost only. You can do tests on those combinations in the connect ACL, from which a deny will mean the connection is not

Re: [exim] Taint checker confusing error (blaming file but caused by later ldap lookup)

2022-03-12 Thread Jeremy Harris via Exim-users
On 22/12/2021 15:41, Michael Haardt via Exim-users wrote: I agree I never thought about this when taint-tracking was introduced, but the current state is a serious security problem to me, and one I somehow expected to be solved by taint-tracking. Yes, for the ldap lookup here, quoting should

Re: [exim] bypassing the bogofilter check

2022-03-11 Thread Jeremy Harris via Exim-users
On 11/03/2022 19:24, Sławomir Dworaczek via Exim-users wrote: Anyone know how to get a message delivered before bogofilter classifies it as spam? Your "bogofilter" is external to exim. Your exim config decides when to call it. Probably you need to understand how your config's routing chain

Re: [exim] DNS lookups for inactive domain during SMTP message receipt

2022-03-11 Thread Jeremy Harris via Exim-users
On 11/03/2022 14:11, lists.exim.org--- via Exim-users wrote: I've had no success in trying to find out why the following is occurring during every SMTP message delivery - extract from Exim log: 2022-03-11 12:58:02 no IP address found for host permission.impactdatastamp.com (during SMTP

Re: [exim] Staying in the queue taints data ?

2022-03-11 Thread Jeremy Harris via Exim-users
On 11/03/2022 10:44, Olaf Hopp (SCC) via Exim-users wrote: Do you still want me to debug the asymmetric behaviour wether the mail was in the queue or not ? If you have the time, yes. The first part is "why didn't nonqueued fail for you, when it does for me?) -- Cheers, Jeremy -- ## List

Re: [exim] stuck exim processes

2022-03-10 Thread Jeremy Harris via Exim-users
On 09/03/2022 21:22, Michael Tratz via Exim-users wrote: I have added the following patch: diff --git a/src/src/transports/smtp.c b/src/src/transports/smtp.c index 6a979a243..f97b0c625 100644 --- a/src/src/transports/smtp.c +++ b/src/src/transports/smtp.c @@ -4800,7 +4800,11 @@ if

Re: [exim] stuck exim processes

2022-03-10 Thread Jeremy Harris via Exim-users
On 09/03/2022 17:13, Martin Waschbüsch via Exim-users wrote: Any news on the occurrence with a periodic restart? Restarting made no difference at all (I sent a HUP every 15 minutes). Still getting hang, or segv, or both? -- Cheers, Jeremy -- ## List details at

Re: [exim] Staying in the queue taints data ?

2022-03-09 Thread Jeremy Harris via Exim-users
On 09/03/2022 13:49, Jeremy Harris via Exim-users wrote: I agree that queued and non-queued should behave the same. In my tests, the non-queued operation also traps if the pipe command line is supplied by a router. Since your router uses $domain for that, I'm not seeing how it can possibly

Re: [exim] stuck exim processes

2022-03-09 Thread Jeremy Harris via Exim-users
On 17/02/2022 06:48, Martin Waschbüsch via Exim-users wrote: Am 17.02.22 um 00:38 schrieb Michael Tratz via Exim-users: No restarting the daemon doesn’t do anything. The only solution which works is to kill all exim processes and then restart the daemon. exim will run through the queue and try

Re: [exim] stuck exim processes

2022-03-09 Thread Jeremy Harris via Exim-users
On 09/03/2022 09:10, Patrik Peng via Exim-users wrote: You mean the one i just replied? You replied to the start of the thread, so I couldn't tell if you'd read the followups. Yes I did follow it, but apart from the solution with `hosts_avoid_tls` I didn't see any conclusion, or did I miss

Re: [exim] Staying in the queue taints data ?

2022-03-09 Thread Jeremy Harris via Exim-users
I agree that queued and non-queued should behave the same. Intriguing that you have the command specified in both router and transport. Is this tpt run in any other way? If not, the command spec in it could be removed (and should, to remove confusion). Further, the commands are not

Re: [exim] stuck exim processes

2022-03-08 Thread Jeremy Harris via Exim-users
On 08/03/2022 13:17, Patrik Peng via Exim-users wrote: Are there any updates regarding this issue? There was an entire thread in the mailing list. -- Cheers, Jeremy -- ## List details at https://lists.exim.org/mailman/listinfo/exim-users ## Exim details at http://www.exim.org/ ## Please use

Re: [exim] spf lookup requires untained values / detaint a header

2022-03-08 Thread Jeremy Harris via Exim-users
On 08/03/2022 11:18, Peter Wullinger via Exim-users wrote: Is there a way to make this work besides a custom lookup, e.g. a local daemon that just echos back the address once validating it is a properly formatted IP address? A file with the list of acceptable IP addresses (or CIDRs) and an

Re: [exim] Controlling SA-exim logging

2022-03-03 Thread Jeremy Harris via Exim-users
On 03/03/2022 22:20, Ken via Exim-users wrote: I get six lines from spamd in mail.log for each message processed. Only two are interesting to me, the line identifying the message, and the line with the result. The prefork, connection, and setuid lines would be interesting if those steps

Re: [exim] Help needed with tainting

2022-03-02 Thread Jeremy Harris via Exim-users
On 02/03/2022 22:37, Alain D D Williams via Exim-users wrote: The transport works by running a command of which an argument is extracted (the line starting .dir) from a file /etc/exim/file_domains/$local_part That's a valid case for using dsearch, as you're looking into, so long as the

Re: [exim] help with syntax to disable AUTH on port 25

2022-02-26 Thread Jeremy Harris via Exim-users
On 26/02/2022 23:40, v via Exim-users wrote: I'm still having trouble with the if/then/and/or syntax. There are two ways I make dealing with complex conditionals less hard: - Split the line (with backslash, newline) and indent so that syntactic chunks line up vertically. For the example

Re: [exim] Hit with some kind of hidden multiple recipients relay hack?

2022-02-24 Thread Jeremy Harris via Exim-users
On 22/02/2022 18:39, Henry S. Thompson via Exim-users wrote: I came back from a few days out of town to find 1000s of frozen queue entries and my server blacklisted by gmail. Here's a sample: : mailq | head -20 6d 1.3K 1nKNYR-000bDv-0w *** frozen *** D 0002a...@gmail.com

Re: [exim] Intermittent gmail SMTP failures: "Authentication Required"

2022-02-23 Thread Jeremy Harris via Exim-users
On 22/02/2022 20:20, Bill Brelsford via Exim-users wrote: It gets a different IP address (.109 vs .108) when looking up hosts in hosts_require_auth, so fails. Why does it do a second DNS lookup for the target host? What is your hosts_require_auth option set to? hosts_require_auth takes a

Re: [exim] Intermittent gmail SMTP failures: "Authentication Required"

2022-02-22 Thread Jeremy Harris via Exim-users
On 21/02/2022 21:18, Bill Brelsford via Exim-users wrote: I get a significant number of failed SMTP sessions at gmail (smtp.gmail.com::587). Connections start the same, but fail when exim appears to not send an AUTH LOGIN command: Suggestions? Thanks. Get a debug run of a fail. Work out

Re: [exim] (re)solve retrydb issues

2022-02-21 Thread Jeremy Harris via Exim-users
On 21/02/2022 09:56, Brent Clark via Exim-users wrote: we keep getting the following message "retry time not reached for any host". To resolve, we [ wipe the retry hints ] Your help / feedback would be appreciated. You are deliberately defeating the retry rules that you have configured.

Re: [exim] stuck exim processes

2022-02-18 Thread Jeremy Harris via Exim-users
On 18/02/2022 03:36, Michael Tratz via Exim-users wrote: looking if I add certain servers to hosts_avoid_tls You could also check hosts_avoid_pipelining; if that helps for these problem cases I'd call it slightly less suboptimal than using cleartext. -- Cheers, Jeremy -- ## List details

Re: [exim] Truncated warning messages (again)

2022-02-17 Thread Jeremy Harris via Exim-users
On 17/02/2022 05:04, Christian Balzer via Exim-users wrote: Maybe phrasing here, but clearly the previous behavior of displaying the full response of the remote SMTP server is more "beautiful" than the truncated to the point of unreadable one with current Exim versions? Oh, you are comparing

Re: [exim] Google/gmail timeouts, IPv6 conntrack issue?

2022-02-17 Thread Jeremy Harris via Exim-users
On 17/02/2022 05:01, Christian Balzer via Exim-users wrote: If found it excruciatingly hard to correlate tcpdump and nf_conntrack flows, but those ICMP6 destination unreachable packets are the result of the local iptables rejecting a connection to port 43922 (the originating outbound SMTP

Re: [exim] stuck exim processes

2022-02-16 Thread Jeremy Harris via Exim-users
(taking the 2xx variant) I tried truss to trace the system calls of both processes. 77631 is not printing anything. You don't even get a single line from truss as it attaches? I wonder if the process is spinning in userland? Does "top" or similar show it? If it is, I guess the next step

Re: [exim] bypassing the bogofilter check

2022-02-16 Thread Jeremy Harris via Exim-users
On 16/02/2022 21:12, Sławomir Dworaczek via Exim-users wrote: How to deliver message before bogofilter check it. Guessing somewhat, as we don't know what this "bogofilter" does. Presumably you didn't write this bit of config yourself... From the condition on the router and the diversion to a

Re: [exim] stuck exim processes

2022-02-16 Thread Jeremy Harris via Exim-users
On 16/02/2022 20:42, Michael Tratz via Exim-users wrote: I usually can find a few messages per day on a server so if you need me to test a patch, please let me know. Useful to know. I assume that since you're running with those patches, the periodic daemon restart wworkaround has no effect?

Re: [exim] Google/gmail timeouts, IPv6 conntrack issue?

2022-02-16 Thread Jeremy Harris via Exim-users
On 16/02/2022 07:17, Christian Balzer via Exim-users wrote: Now the reason this happens is that the local iptables (Established, Related is set) is starting to reject packets coming back from google to here after about 2 seconds. (dump attached) That's... cute. I take it the sample packet

Re: [exim] stuck exim processes

2022-02-16 Thread Jeremy Harris via Exim-users
On 16/02/2022 08:08, Martin Waschbüsch via Exim-users wrote: 07:45:34.638 57451 sync_responses expect rcpt for recipi...@recipientdomain.tld 07:45:34.638 57451   SMTP<< 550 5.1.1 : Recipient address rejected: User unknown far end rejected RCPT. We had pipelined MAIL, RCPT, BDAT, on a TLS

Re: [exim] Truncated warning messages (again)

2022-02-16 Thread Jeremy Harris via Exim-users
On 16/02/2022 12:36, Christian Balzer via Exim-users wrote: If you'd be so kind to have a look at what I quoted, as in this 2yo thread: https://www.mail-archive.com/exim-users@exim.org/msg54030.html I did, and didn't see a "working beautifully" in the three messages presented. -- Cheers,

Re: [exim] Truncated warning messages (again)

2022-02-16 Thread Jeremy Harris via Exim-users
On 16/02/2022 05:49, Christian Balzer via Exim-users wrote: any comment, even a "too hard to go back to what was working beautifully, won't fix." would be really appreciated. What was the "working beautifully" situation? -- Cheers, Jeremy -- ## List details at

Re: [exim] stuck exim processes

2022-02-14 Thread Jeremy Harris via Exim-users
On 10/02/2022 15:24, Martin Waschbüsch via Exim-users wrote: If I interpret this correctly, the message was delivered and then the process got stuck. Which is why no additional action but cleanup was needed? I think it says that a journal file was found, which said that the apparently

Re: [exim] Stuck processes trying to deliver message

2022-02-14 Thread Jeremy Harris via Exim-users
On 14/02/2022 14:53, Patrik Peng via Exim-users wrote: The problem appears with different remote MX hosts as well as with IPv4 and IPv6 and is immediately resolved by downgrading back to 4.94.2. Maybe this issue is related to the previous thread on this list. Yup (which was also FreeBSD).

Re: [exim] message has lines too long for transport

2022-02-13 Thread Jeremy Harris via Exim-users
On 13/02/2022 17:48, Evgeniy Berdnikov via Exim-users wrote: Yes, my experiments confirm it: add_header option in ACLs produces a single-line header, and attempt to split it artificially by "\n" results in stripping the tail of line (after "\n") into X-ACL-Warn: header. That was asking

Re: [exim] Understanding of smtp_load_reserve

2022-02-11 Thread Jeremy Harris via Exim-users
On 11/02/2022 12:27, Patrik Peng via Exim-users wrote: What time span does Exim use for the average load calculation? For a FreeBSD build the value used is that returned from a call to the C-library getloadavg() routine with an array size of 1. I've not checked, but I'd expect that to be a

Re: [exim] Unable to send or receive mails, Tainted not permitted

2022-02-11 Thread Jeremy Harris via Exim-users
On 11/02/2022 05:57, necktwi via Exim-users wrote: When I try to send a mail I get the following message in exim log and the mail is not received by the receiver. 2022-02-11 11:21:03 1nEVHn-00011P-At == neck...@somedomain.com R=localuser T=local_delivery defer (-1): Tainted

Re: [exim] system_filter_pipe_transport

2022-02-10 Thread Jeremy Harris via Exim-users
On 09/02/2022 18:47, Edward Sandberg via Exim-users wrote: but where do I set them They are both main-config options, indexed by the options index in the documentation. what do I set them to? "the name of the transport driver" -- Cheers, Jeremy -- ## List details at

Re: [exim] exim maildirsize quota calculation in the face of symlinks

2022-02-10 Thread Jeremy Harris via Exim-users
On 10/02/2022 11:48, Cyborg via Exim-users wrote: You will be much more puzzled, when dovecot starts to make hardlinks for your  emailfiles and exim starts to count the quota differently than i.e. "du" does. Again, what damnfool software thought doing that was a good notion? In a shared-use

Re: [exim] exim maildirsize quota calculation in the face of symlinks

2022-02-10 Thread Jeremy Harris via Exim-users
On 10/02/2022 10:55, Maarten van Baarsel via Exim-users wrote: I was surprised by the symlink behaviour so I'm reconsidering the use of the dovecot plugin, but I still wanted to ask whether this behaviour is considered OK. I've read the appendfile docs and I could find anything explicit about 

Re: [exim] Running our own email server on GCP

2022-02-07 Thread Jeremy Harris via Exim-users
For submission (since you were talking of 465 and 587) they are essentially equivalent - so long as you don't transfer messages on an in-clear channel. Enforcing that is trivial. For MTA-MTA traffic on 25 you need to support in-clear, or you'll fail to receive quite a large percentage of mail.

Re: [exim] Running our own email server on GCP

2022-02-07 Thread Jeremy Harris via Exim-users
On 07/02/2022 22:15, Zakaria via Exim-users wrote: it seems STARTTLS is prune to some attack vectors, refer tohttps://nostarttls.secvuln.info/ The report there is bogus with respect to Exim. -- Cheers, Jeremy -- ## List details at https://lists.exim.org/mailman/listinfo/exim-users

Re: [exim] stuck exim processes

2022-02-07 Thread Jeremy Harris via Exim-users
On 07/02/2022 10:21, Martin Waschbüsch via Exim-users wrote: root@relay01:~# ps ax | grep exim   807  -  Ss   0:07.01 /usr/local/sbin/exim -bd -q30m 35680  -  S    0:00.01 /usr/local/sbin/exim -Mc 1nGzzC-0009HT-3F 35685  -  I    0:00.03 /usr/local/sbin/exim -Mc 1nGzzC-0009HT-3F

Re: [exim] stuck exim processes

2022-02-04 Thread Jeremy Harris via Exim-users
On 04/02/2022 09:53, Martin Waschbüsch via Exim-users wrote: this process is stuck Any and all hints are appreciated! Strace the process. Is it doing anything? Waiting on network i/o? Spinning? What does "mailq" say (after you kill the process) - is the problem message still on the

Re: [exim] Retry Timeout query...

2022-02-02 Thread Jeremy Harris via Exim-users
On 31/01/2022 12:38, James Elstone via Exim-users wrote: host 2.3.4.5 issues a [...] 5XX error, That's definitive, if it is a response to RCPT. If you are wanting your first system to spool even so, I think you are trying to operate outside the spirit of SMTP. But you didn't say what this

Re: [exim] Working around “exim: ?=permission =?utf-8?Q?denied”

2022-01-27 Thread Jeremy Harris via Exim-users
On 27/01/2022 20:01, Jeremy Harris via Exim-users wrote: You can also start/stop debug on an individual message basis from ACL (but in current releases, only for ACL processing; extension to delivery phases was only added recently). Addendum: this debug goes to a named file rather than stderr

Re: [exim] Working around “exim: ?=permission =?utf-8?Q?denied”

2022-01-27 Thread Jeremy Harris via Exim-users
On 27/01/2022 18:16, Michael Steigman via Exim-users wrote: I checked out Chapter 56, section 3 of the docs Yup, that's the one I was recalling. and don’t see any advice about running without setuid to either root or exim. Nor me. Exim was developed wayyy before containers. That said,

Re: [exim] [Transport error]: message has lines too long for transport

2022-01-27 Thread Jeremy Harris via Exim-users
On 27/01/2022 19:31, Andrew C Aitchison via Exim-users wrote: - What do you think about implementing re-folding headers to make mail RFC-compliant again (ie. fix what outlook spolied)? Unfortunately that can break DKIM signatures. Obviously it would have to be optional, and with

Re: [exim] [Transport error]: message has lines too long for transport

2022-01-27 Thread Jeremy Harris via Exim-users
On 27/01/2022 18:41, Marcin Gryszkalis via Exim-users wrote: On 18.11.2021 21:00, Jeremy Harris via Exim-users wrote:> On 18/11/2021 10:35, Andrea Biscuola via Exim-users wrote: >> is. From what I was able to understand, we should modify the >&

Re: [exim] Working around “exim: permission denied”

2022-01-26 Thread Jeremy Harris via Exim-users
On 25/01/2022 21:05, Michael Steigman via Exim-users wrote: With OpenShift, however, all containers are run by a user with an arbitrary ID. That ID is linked to the project you are running the image in. It’s usually something like 100136. OpenShift adds the user to the image and makes it a

<    1   2   3   4   5   6   7   8   9   10   >