Warning: message 15AXo4-0005W6-00 delayed 60 minutes
Hello all, I got this message from one of our clients. Please help if anybody has any idea on this. Thanks, Harvinder From: Mail Delivery System [mailto:Mailer-Daemon@ Sent: Thursday, June 14, 2001 8:10 AM To: Subject: Warning: message 15AXo4-0005W6-00 delayed 60 minutes This message was created automatically by mail delivery software. A message that you sent has not yet been delivered to all its recipients after more than 60 minutes on the queue on . The message identifier is: 15AXo4-0005W6-00 The date of the message is: Thu, 14 Jun 2001 07:59:57 -0700 The subject of the message is: Re: Pay Period II The address to which the message has not yet been delivered is: No action is required on your part. Delivery attempts will continue for some time, and this warning may be repeated at intervals if the message remains undelivered. Eventually the mail delivery software will give up, and when that happens, the message will be returned to you.
Re: Warning: message 15AXo4-0005W6-00 delayed 60 minutes
On Fri, Jun 15, 2001 at 06:23:55PM -0700, Harry wrote: I got this message from one of our clients. Please help if anybody has any idea on this. From: Mail Delivery System [mailto:Mailer-Daemon@ Sent: Thursday, June 14, 2001 8:10 AM To: Subject: Warning: message 15AXo4-0005W6-00 delayed 60 minutes Whatever it is, it has nothing to do with qmail. Chris PGP signature
Re: warning: trouble opening remote
Russell Nelson [EMAIL PROTECTED] wrote:
If you're running qmail configured as per
http://www.lifewithqmail.org, then the following commands will fix the
problem:
svc -dx /service/qmail
setlock /service/qmail/supervise/lock sh -c
'/var/qmail/queue/*/0/{348381,348335,348013}'
For LWQ, the service is /service/qmail-send, and I think that should
be ... sh -c 'rm /var/
-Dave
warning: trouble opening remote
My qmail log always say: Jun 14 08:24:16 seic8 qmail: 992478256.893320 warning: trouble opening remote/0/348381; will try again later Jun 14 08:24:16 seic8 qmail: 992478256.894017 warning: trouble opening remote/0/348335; will try again later Jun 14 08:24:16 seic8 qmail: 992478256.894706 warning: trouble opening remote/0/348013; will try again later Jun 14 08:28:24 seic8 qmail: 992478504.216842 warning: trouble opening remote/0/348381; will try again later Jun 14 08:28:24 seic8 qmail: 992478504.217542 warning: trouble opening remote/0/348335; will try again later Jun 14 08:28:24 seic8 qmail: 992478504.218230 warning: trouble opening remote/0/348013; will try again later ... When I enter /var/qmail/queue/remote/0/, I con not find file 348381,348335 and 348013, What I showld do to deal with this problem? thx!
Re: warning: trouble opening remote
dgrer writes:
Jun 14 08:28:24 seic8 qmail: 992478504.218230 warning: trouble opening
remote/0/348013; will try again later
...
When I enter /var/qmail/queue/remote/0/, I con not find file 348381,348335 and
348013,
What I showld do to deal with this problem? thx!
This might be a permission problem (except that you say that those
files really *don't* exist), or it might be that somebody deleted
files out of the queue while qmail-send was running. Qmail-send keeps
its own idea of what's in the queue while it's running, so if you
delete files, it gets confused. Stop qmail-send, delete
/var/qmail/queue/*/0/{348381,348335,348013} and restart qmail-send.
If you're running qmail configured as per
http://www.lifewithqmail.org, then the following commands will fix the
problem:
svc -dx /service/qmail
setlock /service/qmail/supervise/lock sh -c
'/var/qmail/queue/*/0/{348381,348335,348013}'
--
-russ nelson [EMAIL PROTECTED] http://russnelson.com
Crynwr sells support for free software | PGPok |
521 Pleasant Valley Rd. | +1 315 268 1925 voice | #exclude windows.h
Potsdam, NY 13676-3213 | +1 315 268 9201 FAX |
Re: Sending a deferral warning back to the sender?
Jack McKinney [EMAIL PROTECTED] writes: nice to be able to specify it on the command line, that way I can run multiple versions in order to generate, for example, a 15m warning, a 4h warning, and a 3d warning. Before I get too far into proving a race condition and writing around this, has this issue come up before? There is an (earlier) alternate implementation in Perl called 'qmail_bounce'. I used it for years without problems (after some small changes to notify only senders from our domains). On qmail.org: * Brian T. Wightman has written a delayed-mail notifier. * Another delayed-mail notifier is available from Matt Ranney. I use the one from Brian. Regards, Frank
Sending a deferral warning back to the sender?
I have been searching the archives for this, but found nothing so far. sendmail would send the sender a warning after 2 hours (actually, this time was configurable) if it has been unable to send the message. Can qmail do this? Currently, if our support staff sends a customer an email, they may not find out for 5 days that the email never reached the customer for whatever reason (badly typed email address, etc.). I have looked through the man pages and done several searches through the archives to no avail. The fact that I did not find a discussion of why qmail does not do this (especially when someone posted a long list of sendmail 'features' that qmail was missing, but did not list this one) gives me hope that it is actually in there somewhere. I also found nothing on the web site or in the FAQ, so now I am tackling source code 8-(. -- There is no parameter that makes it impossibleJack McKinney for you to perform still more excellently. [EMAIL PROTECTED] -Mario Cuomo, on the lack of a clock in baseballhttp://www.lorentz.com 1024D/D68F2C07 4096g/38AEF076 PGP signature
Re: Sending a deferral warning back to the sender?
Jack McKinney [EMAIL PROTECTED] wrote: I have been searching the archives for this, but found nothing so far. See qmail.org. The answer is there. Charles -- --- Charles Cazabon[EMAIL PROTECTED] GPL'ed software available at: http://www.qcc.sk.ca/~charlesc/software/ Any opinions expressed are just that -- my opinions. ---
Re: Sending a deferral warning back to the sender?
* Jack McKinney [EMAIL PROTECTED] [010606 13:54]: I have been searching the archives for this, but found nothing so far. (Hint: try searching the archives on ``notify''.) sendmail would send the sender a warning after 2 hours (actually, this time was configurable) if it has been unable to send the message. Can qmail do this? Currently, if our support staff sends a customer an email, they may not find out for 5 days that the email never reached the customer for whatever reason (badly typed email address, etc.). [http://untroubled.org/qmail-notify/] /pg -- Peter Green : Architekton Internet Services, LLC : [EMAIL PROTECTED] --- All language designers are arrogant. Goes with the territory... (By Larry Wall)
Re: Sending a deferral warning back to the sender?
Big Brother tells me that Charles Cazabon wrote: Jack McKinney [EMAIL PROTECTED] wrote: I have been searching the archives for this, but found nothing so far. See qmail.org. The answer is there. As I indicated, I did search there. I found nothing. Could you be more specific? PGP signature
Re: Sending a deferral warning back to the sender?
Big Brother tells me that peter green wrote: * Jack McKinney [EMAIL PROTECTED] [010606 13:54]: I have been searching the archives for this, but found nothing so far. (Hint: try searching the archives on ``notify''.) [http://untroubled.org/qmail-notify/] Thank you. I'll check this out. PGP signature
Re: Sending a deferral warning back to the sender?
Big Brother tells me that peter green wrote: [http://untroubled.org/qmail-notify/] OK. I installed this and am running it from a cron job, with an expiration of 15 minutes. It seems to work fine. I note two things, though. Firstly, it appears that there might be a race condition in the time checking/saving code that could cause a message to slip through the cracks and not generate a notification. Secondly, there is only one notification timestamp file to record when the last run is. It would be nice to be able to specify it on the command line, that way I can run multiple versions in order to generate, for example, a 15m warning, a 4h warning, and a 3d warning. Before I get too far into proving a race condition and writing around this, has this issue come up before? PGP signature
Re: ezmlm warning
Hi, Can anyone tell me why I'm receiving this message apart from the obvious 99.9% of the Qmail List messages I receive anyway. The bottom of the message says relaying denied. Why on earth would I allow relaying on my server apart for myself and trusted users? Cheers, Kevin snip [EMAIL PROTECTED]: 195.224.255.14 does not like recipient. Remote host said: 571 [EMAIL PROTECTED]... Relaying denied. Giving up on 195.224.255.14. /snip - Original Message - From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, May 02, 2001 3:36 AM Subject: ezmlm warning Hi! This is the ezmlm program. I'm managing the [EMAIL PROTECTED] mailing list. Messages to you seem to have been bouncing. I've attached a copy of the first bounce message I received. If this message bounces too, I will send you a probe. If the probe bounces, I will remove your address from the mailing list, without further notice. I've kept a list of which messages bounced from your address. Copies of these messages may be in the archive. To get message 12345 from the archive, send an empty note to [EMAIL PROTECTED] Here are the message numbers: 66217 66218 --- Below this line is a copy of the bounce message I received. Return-Path: Received: (qmail 18237 invoked for bounce); 20 Apr 2001 12:48:48 - Date: 20 Apr 2001 12:48:48 - From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: failure notice Hi. This is the qmail-send program at muncher.math.uic.edu. I'm afraid I wasn't able to deliver your message to the following addresses. This is a permanent error; I've given up. Sorry it didn't work out. [EMAIL PROTECTED]: 195.224.255.14 does not like recipient. Remote host said: 571 [EMAIL PROTECTED]... Relaying denied. Giving up on 195.224.255.14.
Re: ezmlm warning
On Wed, May 02, 2001 at 07:41:07AM +0100, Kevin Smith wrote: Can anyone tell me why I'm receiving this message apart from the obvious 99.9% of the Qmail List messages I receive anyway. [EMAIL PROTECTED]: 195.224.255.14 does not like recipient. Remote host said: 571 [EMAIL PROTECTED]... Relaying denied. Giving up on 195.224.255.14. 195.224.255.14 - relay1.mail.gxn.net lemonlaineydesign.com. 1D IN MX10 dwshop2.dedic.web.xara.net. lemonlaineydesign.com. 1D IN MX50 relay1.mail.gxn.net. lemonlaineydesign.com. 1D IN MX50 relay2.mail.gxn.net. At least one of your official MX hosts does not relay messages for the domain lemonlaineydesign.com. \Maex
Re: warning: trouble opening remote/4/r
Dear Alex Pennace In that case, send SIGTERM to the qmail-send process. I have tried to do so. But can you tell me where I can find PID of qmail-send process? flint
Re: warning: trouble opening remote/4/r
On Mon, Feb 26, 2001 at 05:11:56PM +0800, flint wrote: Dear Alex Pennace In that case, send SIGTERM to the qmail-send process. I have tried to do so. But can you tell me where I can find PID of qmail-send process? Use ps.
Re: warning: trouble opening remote/4/r
Dear Charles Cazabon I take it that you are not the one that installed qmail on this system. There's a thousand ways to start/stop qmail. You don't have a svc command, so it's probably not running under svscan. If it's installed with a SysV-like startup script, try /etc/rc.d/init.d/qmail sto or /etc/init.d/qmail stop There are no such command. or possibly (some Lwq installs): /usr/local/bin/qmail stop It doesn't work. If none of those work, see if you have /var/qmail/bin/rc -- that tells you how qmail starts, and perhaps then you'll know how to stop it. I have seen the /var/qmail/rc , I still don't know how to stop it. It says: #!/bin/sh # Using splogger to send the log through syslog. # Using qmail-local to deliver messages to ~/Mailbox by default. exec env - PATH="/var/qmail/bin:$PATH" \ qmail-start ./Maildir/ splogger qmail flint
Re: warning: trouble opening remote/4/r
On Mon, Feb 26, 2001 at 01:30:17PM +0800, flint wrote: Dear Charles Cazabon I take it that you are not the one that installed qmail on this system. There's a thousand ways to start/stop qmail. [snip] If none of those work, see if you have /var/qmail/bin/rc -- that tells you how qmail starts, and perhaps then you'll know how to stop it. I have seen the /var/qmail/rc , I still don't know how to stop it. It says: #!/bin/sh # Using splogger to send the log through syslog. # Using qmail-local to deliver messages to ~/Mailbox by default. exec env - PATH="/var/qmail/bin:$PATH" \ qmail-start ./Maildir/ splogger qmail In that case, send SIGTERM to the qmail-send process.
Re: warning: trouble opening remote/4/r
Dear Charles Cazabon Your problem could be ident and DNS lookup timeouts from tcpserver. Investigate the possibility of turning off ident lookups, and either disabling DNS lookups or fixing your DNS resolver/content server. Charles Yes! It's really our DNS problem. Several days ago,we have changed DNS server. Today i check the DNS server carefully, I found it can resolve the names in our domain,but it doen't use it's own data,it always say:"Non-authoritative answer: ..". I have configure the Named again. It's ok now. But I have not fix the queue yet, because I don't know how to Shut down the qmail-send. I know it is really a very stupid question. I have seen many documents,some use "svc" command, there isn't "svc" command in our server, also I cann't find qmail-send.pid file in /var/run like some articles said. How could I do? I'm appreaciate for your warmheartedness and patience. flint
Re: warning: trouble opening remote/4/r
Dear Charles Cazabon Your problem could be ident and DNS lookup timeouts from tcpserver. Investigate the possibility of turning off ident lookups, and either disabling DNS lookups or fixing your DNS resolver/content server. Charles Yes! It's really our DNS problem. Several days ago,we have changed DNS server. Today i check the DNS server carefully, I found it can resolve the names in our domain,but it doen't use it's own data,it always say:"Non-authoritative answer: ..". I have configure the Named again. It's ok now. But I have not fix the queue yet, because I don't know how to Shut down the qmail-send. I know it is really a very stupid question. I have seen many documents,some use "svc" command, there isn't "svc" command in our server, also I cann't find qmail-send.pid file in /var/run like some articles said. How could I do? I'm appreaciate for your warmheartedness and patience. flint
Re: warning: trouble opening remote/4/r
flint [EMAIL PROTECTED] wrote: Your problem could be ident and DNS lookup timeouts from tcpserver. Investigate the possibility of turning off ident lookups, and either disabling DNS lookups or fixing your DNS resolver/content server. Yes! It's really our DNS problem. [...] But I have not fix the queue yet, because I don't know how to Shut down the qmail-send. I have seen many documents,some use "svc" command, there isn't "svc" command in our server, also I cann't find qmail-send.pid file in /var/run like some articles said. How could I do? I take it that you are not the one that installed qmail on this system. There's a thousand ways to start/stop qmail. You don't have a svc command, so it's probably not running under svscan. If it's installed with a SysV-like startup script, try /etc/rc.d/init.d/qmail stop or /etc/init.d/qmail stop or possibly (some Lwq installs): /usr/local/bin/qmail stop If none of those work, see if you have /var/qmail/bin/rc -- that tells you how qmail starts, and perhaps then you'll know how to stop it. Charles -- --- Charles Cazabon[EMAIL PROTECTED] GPL'ed software available at: http://www.qcc.sk.ca/~charlesc/software/ Any opinions expressed are just that -- my opinions. ---
Re: warning: trouble opening remote/4/r
flint [EMAIL PROTECTED] wrote: You can either use queue-fix to replace/fix the (non-existent?) queue, or restore from your backups and THEN use queue-fix to fix the queue. I have fix the queue using queue-fix. It unlinked some file under /var/qmail/queue/remote, but now I still can see the Warning messages in the maillog? Is there something wrong? Did you run queue-fix while qmail was running? That would be bad. Stop qmail, run queuefix, then re-start qmail. I have noticed for days,now it becomes more and more unbearable. That is,it is very slowly when we receive mails through POP3. The strange thing is that when you have received the mails then receive mails again immediately, it is very quickly. This was not a good reason to remove the queue. qmail-pop3d doesn't look for mail in the queue anyways; it looks in the user's mailstore (~/Maildir/ typically). Your problem could be ident and DNS lookup timeouts from tcpserver. Investigate the possibility of turning off ident lookups, and either disabling DNS lookups or fixing your DNS resolver/content server. Charles -- --- Charles Cazabon[EMAIL PROTECTED] GPL'ed software available at: http://www.qcc.sk.ca/~charlesc/software/ Any opinions expressed are just that -- my opinions. ---
Re: Fw: Re: warning: trouble opening remote/4/r
flint [EMAIL PROTECTED] wrote: Today,I saw there were many messages like this in the maillog: 982653149.920320 warning: trouble opening remote/4/r Your queue is corrupt. Did you manually remove any messages from the queue? Get qmail-queuefix from www.qmail.org to fix this. Thank you. I have really removed the queue. But i have backuped them. Now which is better,override the queue with the backed queue or using the queue-fix to fix them. You can either use queue-fix to replace/fix the (non-existent?) queue, or restore from your backups and THEN use queue-fix to fix the queue. You can't just restore from tape; files in the queue are named based on the inodes they reside on. Restoring from tape will completely mess this up. queue-fix will rename all the files to match properly. Charles -- --- Charles Cazabon[EMAIL PROTECTED] GPL'ed software available at: http://www.qcc.sk.ca/~charlesc/software/ Any opinions expressed are just that -- my opinions. ---
Re: warning: trouble opening remote/4/r
Dear Charles Cazabon You can either use queue-fix to replace/fix the (non-existent?) queue, or restore from your backups and THEN use queue-fix to fix the queue. You can't just restore from tape; files in the queue are named based on the inodes they reside on. Restoring from tape will completely mess this up. queue-fix will rename all the files to match properly. Charles I have fix the queue using queue-fix. It unlinked some file under /var/qmail/queue/remote, but now I still can see the Warning messages in the maillog? Is there something wrong? Another question(that is also why I removed the queue), I have noticed for days,now it becomes more and more unbearable. That is,it is very slowly when we receive mails through POP3. The strange thing is that when you have received the mails then receive mails again immediately, it is very quickly. These days this situation is very common. I'm not sure what's the problem. It the problem of our Mail System or the problem of the network. My mail system is: FreeBSD+qmail+vpopmail+sqwebmail.Thank you. flint
Re: warning: trouble opening remote/4/r
flint [EMAIL PROTECTED] wrote: Today,I saw there were many messages like this in the maillog: 982653149.920320 warning: trouble opening remote/4/r Your queue is corrupt. Did you manually remove any messages from the queue? Get qmail-queuefix from www.qmail.org to fix this. Charles -- --- Charles Cazabon[EMAIL PROTECTED] GPL'ed software available at: http://www.qcc.sk.ca/~charlesc/software/ Any opinions expressed are just that -- my opinions. ---
warning: trouble opening remote/4/r
Hi everybody, Today,I saw there were many messages like this in the maillog: 982653149.920320 warning: trouble opening remote/4/r Who can tell me what those mean? Thanks flint [EMAIL PROTECTED]
warning: trouble opening remote/4/r
Hi everybody, Today,I saw there were many messages like this in the maillog: 982653149.920320 warning: trouble opening remote/4/r Who can tell me what those mean? Thanks flint [EMAIL PROTECTED]
Re: WARNING
George Please stop flamming people on the list.. At least have respect for the people on the list to send him a email directly and not start a Flame on the list.. Sean - Original Message - From: "George Patterson" [EMAIL PROTECTED] To: "Dan Egli" [EMAIL PROTECTED] Cc: "Rembrandt Lensink" [EMAIL PROTECTED]; [EMAIL PROTECTED] Sent: Wednesday, February 14, 2001 12:20 AM Subject: Re: WARNING Dan, Why did you need to post that message as html as if the original is *distracting* enough?? plain text would have been sufficent... George Dan Egli wrote: Dude, The person sending the virus likely has no idea he (or she) is sending it. The virus infects your winsock32.dll file, so anyone who sends mail using a win32 client (like me for example) is vulnerable. The virus is sent automatically. They don't see it. Chill out, and warn people you are getting it and ask them to scan their systems for the virus. The latest versions of Mcafee and/or Norton Anti-Virus will find and kill the virus. -- Dan - Original Message - *From:* Rembrandt Lensink mailto:[EMAIL PROTECTED] *To:* [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] *Cc:* [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] *Sent:* Sunday, February 11, 2001 3:37 PM *Subject:* WARNING _Stop sending us your hahaha Snowhite and the 7 Dwarfs E-mail virus or we will chase you and attack your system!!!_
Re: WARNING
Dan, Why did you need to post that message as html as if the original is *distracting* enough?? plain text would have been sufficent... George Dan Egli wrote: Dude, The person sending the virus likely has no idea he (or she) is sending it. The virus infects your winsock32.dll file, so anyone who sends mail using a win32 client (like me for example) is vulnerable. The virus is sent automatically. They don't see it. Chill out, and warn people you are getting it and ask them to scan their systems for the virus. The latest versions of Mcafee and/or Norton Anti-Virus will find and kill the virus. -- Dan - Original Message - *From:* Rembrandt Lensink mailto:[EMAIL PROTECTED] *To:* [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] *Cc:* [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] *Sent:* Sunday, February 11, 2001 3:37 PM *Subject:* WARNING _Stop sending us your hahaha Snowhite and the 7 Dwarfs E-mail virus or we will chase you and attack your system!!!_
Fw: WARNING Snowhite (COPY)
- Original Message - From: Rembrandt Lensink To: Tim Hunter Cc: [EMAIL PROTECTED] Sent: Monday, February 12, 2001 9:44 AM Subject: Re: WARNING Snowhite Dear Tim, Sorry again for the inconvenience. It was some wild shooting into the dark, an impulsive reaction of somebody new on the NET.` I have found some sites on this matter via Yahoo and they literally say; "Dear Friends this is serious shit do not open the "hahahasnowhite exe-file" , my bad experience don`t even read the message. A reply to [EMAIL PROTECTED] is useless.(Has nothing to do with sex). I receive every day 3 e-mails of this scat. Best wishes from Holland! - Original Message - From: Tim Hunter To: Rembrandt Lensink Sent: Monday, February 12, 2001 6:21 AM Subject: Re: WARNING You do realize you sent this to a highly populated mailing list and not just an individual dont you? Not too intellegent. - Original Message - From: Rembrandt Lensink To: [EMAIL PROTECTED] Cc: [EMAIL PROTECTED] Sent: Sunday, February 11, 2001 5:37 PM Subject: WARNING Stop sending us your hahaha Snowhite and the 7 Dwarfs E-mail virus or we will chase you and attack your system!!!
Re: WARNING
Dude, The person sending the virus likely has no idea he (or she) is sending it. The virus infects your winsock32.dll file, so anyone who sends mail using a win32 client (like me for example) is vulnerable. The virus is sent automatically. They don't see it. Chill out, and warn people you are getting it and ask them to scan their systems for the virus. The latest versions of Mcafee and/or Norton Anti-Virus will find and kill the virus. -- Dan - Original Message - From: Rembrandt Lensink To: [EMAIL PROTECTED] Cc: [EMAIL PROTECTED] Sent: Sunday, February 11, 2001 3:37 PM Subject: WARNING Stop sending us your hahaha Snowhite and the 7 Dwarfs E-mail virus or we will chase you and attack your system!!!
Fw: WARNING (Reply )
- Original Message - From: Dan Egli To: Rembrandt Lensink ; [EMAIL PROTECTED] Cc: [EMAIL PROTECTED] Sent: Monday, February 12, 2001 5:40 PM Subject: Re: WARNING Dude, The person sending the virus likely has no idea he (or she) is sending it. The virus infects your winsock32.dll file, so anyone who sends mail using a win32 client (like me for example) is vulnerable. The virus is sent automatically. They don't see it. Chill out, and warn people you are getting it and ask them to scan their systems for the virus. The latest versions of Mcafee and/or Norton Anti-Virus will find and kill the virus. -- Dan Thank you Dan for your kind reaction, I was somehow overheated because of the 8 attempts of Snowhite on my data-system. I`m fully armed now with the latest anti-virus software. Kaspersky Lab has information over "snowhite" and issued a warning over this highly dangerous Hybris worm. (http://www.kaspersky.com) So what do you see in your mailbox wenn it comes; A message from [EMAIL PROTECTED] (has nothing to do with sex, doesn`t even exist) but it starts with "Today, Snowhite was turning 18." all the rest you can imagine. The Dwarfs had a *huge* surprise. Snowhite was anxious etc etc. The real danger has the attachment! So I was really pissed off. Reply to sender is useless (of course) but... if you go to, for example Yahoo USA, and you type [EMAIL PROTECTED] then you will see how many warnings there already are, like Be Careful guys - www.ezboard.com about Snowhite attacks or Columbia Law School Virus Information. Well this was serious shit and I thought it came from the nearfield. (The source is probably in Latin-America). Best wishes from Rembrandt L , Netherlands
WARNING
Stop sending us your hahaha Snowhite and the 7 Dwarfs E-mail virus or we will chase you and attack your system!!!
Re: WARNING
*blink blink* Uhm.. Nevermind.. Rembrandt Lensink wrote: _Stop sending us your hahaha Snowhite and the 7 Dwarfs E-mail virus or we will chase you and attack your system!!!_
WARNING: Worm (?) sending from root@microsoft.com to *@anon.lcs.mit.ed
Anyone else seeing thousands of messages filling up your queue, apparently from "[EMAIL PROTECTED]" to addresses such as: [EMAIL PROTECTED] Looks like this has started within the hour. Looks like one of our clients got hit with about 6000 of them, and they're still coming in. We're currently just trapping them by setting up anon.lcs.mit.edu in virtualdomains and directing that to a maildir: echo anon.lcs.mit.edu:virustrap /var/qmail/control/virtualdomains echo '/path/to/maildir/' ~alias/.qmail-virustrap maildirmake /path/to/maildir killall -HUP qmail-send It seems like putting "[EMAIL PROTECTED]" in badmailfrom may prevent it from hitting your boxes resources, but we have tons of resources and would like to check it out a bit. The message is around 80 lines of 70 column upper-case text, something like: Subject: i_rz [NZM zmPaLazCnSTOnermbGneLqrmDGbenCfWrCrSXSTiI GYEPBZDWDNIOFPKVGXPSHSGSFRBVIUNTEBFSDRKTEVLNGCCUKCKCOTCXZNPBFWGBOZ EZGZMMLYBQGVNQGBGPOXFNONKMDTBMZQHNPVCTLCBTHXGWDSESBWDMZWHOMRNPKUEC FSOVFVZSDRFNOWHYMZFUDZBUJYJVIMNSDVJYGWFSCMGNDUEBPBDCFUZMMZPVCQMOEM [...] Sean -- Tragedy is when I cut my finger. Comedy is when you fall into an open sewer and die. -- Mel Brooks Sean Reifschneider, Inimitably Superfluous [EMAIL PROTECTED] tummy.com - Linux Consulting since 1995. Qmail, KRUD, Firewalls, Python
Re: WARNING: Worm (?) sending from root@microsoft.com to *@anon.lcs.mit.ed
Quoting Sean Reifschneider ([EMAIL PROTECTED]): Anyone else seeing thousands of messages filling up your queue, apparently from "[EMAIL PROTECTED]" to addresses such as: [EMAIL PROTECTED] I'm pretty sure this is the work of the W95.Hybrid email worm (the sexyfun.net one), sending copies of itself to the mail2news gateway for distribution to news servers worldwide, so that other infected computers can download new plugins. That sure is a nasty bugger. One or more of your users is undoubtedly infected with the worm--plenty of ours are, I'm sorry to say. It would seem that when it was discovered that worm authors intended to use them for worm distribution, the administrators of that gateway shut it down. One point to the miscreants. Aaron
Re: WARNING: Worm (?) sending from root@microsoft.com to *@anon.lcs.mit.ed
On Thu, Feb 08, 2001 at 05:51:40PM -0700, Sean Reifschneider wrote: Anyone else seeing thousands of messages filling up your queue, apparently from "[EMAIL PROTECTED]" to addresses such as: [EMAIL PROTECTED] Yeap, I've seen that one, but didn't pay much attention to it... I thought it was some wise-ass customer fooling around. Appearently... it isn't. RC -- +--- | Ricardo Cerqueira | PGP Key fingerprint - B7 05 13 CE 48 0A BF 1E 87 21 83 DB 28 DE 03 42 | Novis Telecom - Engenharia ISP / Rede Tcnica | P. Duque Saldanha, 1, 7 E / 1050-094 Lisboa / Portugal | Tel: +351 2 1010 - Fax: +351 2 1010 4459 PGP signature
Re: WARNING: Worm (?) sending from root@microsoft.com to *@anon.lcs.mit.ed
On Thu, Feb 08, 2001 at 05:02:06PM -0800, Aaron L. Meehan wrote: I'm pretty sure this is the work of the W95.Hybrid email worm (the sexyfun.net one), sending copies of itself to the mail2news gateway What triggered the sudden hit then? sexyfun has been around for quite a while and the mail servers have kept up pretty well. This one is really pounding it though. Sean -- Blaming the software quality on the tool is like saying "I can't pick up chicks because my car isn't cool enough." -- Sean Reifschneider, 1998 Sean Reifschneider, Inimitably Superfluous [EMAIL PROTECTED] tummy.com - Linux Consulting since 1995. Qmail, KRUD, Firewalls, Python
Re: WARNING: Worm (?) sending from root@microsoft.com to *@anon.lcs.mit.ed
On or about 06:18 PM 2/8/01 -0700, Sean Reifschneider was caught in a dark alley speaking these words: On Thu, Feb 08, 2001 at 05:02:06PM -0800, Aaron L. Meehan wrote: I'm pretty sure this is the work of the W95.Hybrid email worm (the sexyfun.net one), sending copies of itself to the mail2news gateway What triggered the sudden hit then? sexyfun has been around for quite a while and the mail servers have kept up pretty well. This one is really pounding it though. I think part of it's ability to download updates makes changes to the worm, to the point where you may be seeing a new variant of it. I've seen *2* variants of this so far - one from "sexyfun" and the badly misspelled story, and one with no story or faked sender - only an empty sender, but otherwise the same virus. This critter hasn't taken down our qmail server (mark 1 for the good guys) despite it's being an antique (relatively speaking) - Cyrix P166(ish) / 4G IDE / 128M RAM, altho I was receiving nearly 1000 double-bounces per day from the damnable thing. Tracking who has it isn't exactly easy, either... however if there are any dial-up sysadmins out there who could use a tip, this has helped me out considerably: In Win9x, under the network control panel, setting the "Host:" setting under DNS to the username of the person, will make that username show up in the (HELO x) string in qmail's main Received: header. We had our customers set this since day 1, and this has helped me immensely in tracking the infected person. That and if you have separate qmail authentication servers, make sure they're both updated at least once per day to an atomic time clock. Servers that are 5 min. off are a real bugger to figure out who was online when... Anywho, I hope this helps someone out there -- it's the least I can do to try to repay the help I've received on this list over the last 6 years... :-) Thanks, Roger "Merch" Merchberger = Roger "Merch" Merchberger -- [EMAIL PROTECTED] SysAdmin - Iceberg Computers = Merch's Wild Wisdom of the Moment: = Sometimes you know, you just don't know sometimes, you know?
Warning Message
Hi, I need to know whay mean the following message: 980850635.808667 warning: trouble opening local/9/41501; will try again later Thanks and regards. begin:vcard n:Ferri Charbone;Antonio x-mozilla-html:TRUE org:Telcel Celular C.A.;Gerencia de Operaciones adr:;; version:2.1 email;internet:[EMAIL PROTECTED] title:Administrador de Sistemas x-mozilla-cpt:;-19088 fn:Antonio Ferri Charbone end:vcard
Re: Warning Message
Antonio Ferri Charbone [EMAIL PROTECTED] wrote: I need to know whay mean the following message: 980850635.808667 warning: trouble opening local/9/41501; will try again later Possibly your queue is corrupted. Did you modify or remove any files from under the /var/qmail/queue hierarchy? Look at www.qmail.org for a link to a program called "queue-fix". Using that program may be easier than trying to manually repair a corrupted queue. Charles -- --- Charles Cazabon[EMAIL PROTECTED] GPL'ed software available at: http://www.qcc.sk.ca/~charlesc/software/ Any opinions expressed are just that -- my opinions. ---
warning: unknown record type in todo/67391
Hello, I see in the log file a strange warning. what does it mean ? # cat /var/log/qmail/current | grep 67391 @40003a72a5f52ec6ad94 new msg 67391 @40003a72a5f52ec6c504 warning: unknown record type in todo/67391 @40003a72a5f53015af4c new msg 67391 @40003a72a5f53015b71c warning: unknown record type in todo/67391 @40003a72a5fb0597adc4 new msg 67391 @40003a72a5fb0597b97c warning: unknown record type in todo/67391 @40003a72a5fb0776260c new msg 67391 @40003a72a5fb07762ddc warning: unknown record type in todo/67391 Octave Illegal division by zero ?!! Aaah ? I'm _root_ !!
Re: warning: unknown record type in todo/67391
On Sat, Jan 27, 2001 at 11:41:34AM +0100, octave klaba wrote: Hello, I see in the log file a strange warning. what does it mean ? # cat /var/log/qmail/current | grep 67391 @40003a72a5f52ec6ad94 new msg 67391 @40003a72a5f52ec6c504 warning: unknown record type in todo/67391 man qmail-log: unknown record type in ... There is a serious bug in either qmail-queue or qmail-send. It could also mean some disk corruption has occurred, or you improperly patched qmail.
RE: warning: unknown record type in todo/67391
Yes i have too this bugs when i try to install a antivirus who use the qmail-queue ! When i have this problem, the problem is from qmail-queue ! All messages are not delivered and are in the queue... I have MRTG graph... My logs is different but it like at your logs ! Nicolas DEFFAYET, NDSoftware http://www.ndsoftware.net - [EMAIL PROTECTED] France: Tel +33 671887502 - Fax N/A UK: Tel +44 8453348750 - Fax +44 8453348751 USA: Tel N/A - Fax N/A -Original Message- From: Alex Pennace [mailto:[EMAIL PROTECTED]] Sent: Saturday, January 27, 2001 12:04 PM To: octave klaba Cc: [EMAIL PROTECTED] Subject: Re: warning: unknown record type in todo/67391 On Sat, Jan 27, 2001 at 11:41:34AM +0100, octave klaba wrote: Hello, I see in the log file a strange warning. what does it mean ? # cat /var/log/qmail/current | grep 67391 @40003a72a5f52ec6ad94 new msg 67391 @40003a72a5f52ec6c504 warning: unknown record type in todo/67391 man qmail-log: unknown record type in ... There is a serious bug in either qmail-queue or qmail-send. It could also mean some disk corruption has occurred, or you improperly patched qmail.
Re: ????Security Warning : Group Unowned files found :
Peter Drahos writes: Hi, Can anybody explain to me what these warnings mean and why do the files(e-mails) with no group appear in a first place and are being deleted??? Tx Peter Jan 17 04:45:14 ebox : Security Warning : Group Unowned files found : Jan 17 04:45:15 ebox : ( theses files now have group "nogroup" as their group owner. ) Well at first glance I am betting that you are using Mandrake Linux? try reading man msec
????Security Warning : Group Unowned files found :
Hi, Can anybody explain to me what these warnings mean and why do the files(e-mails) with no group appear in a first place and are being deleted??? Tx Peter Jan 17 04:45:14 ebox : Security Warning : Group Unowned files found : Jan 17 04:45:15 ebox : ( theses files now have group "nogroup" as their group owner. )
Re: ????Security Warning : Group Unowned files found :
On Wed, Jan 17, 2001 at 11:02:21PM -0500, Peter Drahos wrote: Hi, Can anybody explain to me what these warnings mean and why do the files(e-mails) with no group appear in a first place and are being deleted??? Tx Peter Jan 17 04:45:14 ebox : Security Warning : Group Unowned files found : Jan 17 04:45:15 ebox : ( theses files now have group "nogroup" as their group owner. ) Those aren't messages generated by qmail.
Re: ????Security Warning : Group Unowned files found :
So I guess the question is why is qmail depositing e-mails without the groupid??? At 12:02 AM 1/18/01 -0500, Alex Pennace wrote: On Wed, Jan 17, 2001 at 11:02:21PM -0500, Peter Drahos wrote: Hi, Can anybody explain to me what these warnings mean and why do the files(e-mails) with no group appear in a first place and are being deleted??? Tx Peter Jan 17 04:45:14 ebox : Security Warning : Group Unowned files found : Jan 17 04:45:15 ebox : ( theses files now have group "nogroup" as their group owner. ) Those aren't messages generated by qmail.
Re: ????Security Warning : Group Unowned files found :
On Thu, Jan 18, 2001 at 12:15:33AM -0500, Peter Drahos wrote: At 12:02 AM 1/18/01 -0500, Alex Pennace wrote: On Wed, Jan 17, 2001 at 11:02:21PM -0500, Peter Drahos wrote: Jan 17 04:45:14 ebox : Security Warning : Group Unowned files found : Jan 17 04:45:15 ebox : ( theses files now have group "nogroup" as their group owner. ) Those aren't messages generated by qmail. So I guess the question is why is qmail depositing e-mails without the groupid??? The logs indicate no such thing is occuring. Find out which program is generating those entries and work from there.
warning: unable to unlink local/9/3601004; will try again later mystery solved
There is a lot of email in the archives of this list complaining about things such as warning: unable to unlink local/9/3601004; will try again later I saw this too, (running with the rpms made by Bruce Guenter E[EMAIL PROTECTED]) I investigated what was going on. The key is to look at errno when the unlink fails. (By the way, I suggest that the when printing the warning about the unlink failing, the error code ought to be printed out too.) The unlink returned error code 5 (I/O error) sometimes, but not always. By taking out the syncdir patch, the problem goes away. I mounted the ext2fs filesystem "sync" (it turns out the only thing on that disk is my qmail queue and my alias maildirs, so it is an excellent candidate for being mounted "sync".) Now the system works much better, with none of those "unable to unlink" messages in the logs. A related problem: The "try again later" is 123 seconds later: pe.dt = now() + SLEEP_SYSFAIL; This can cause problem if more than a few hundred messages get into this state (especially when using syslogd). The problem is that qmail spends all its time looking at these messages. Much better would be if the retry were scheduled with a quadratic backoff strategy to avoid swamping qmail with these bad messages. -Bradley
Fw: ezmlm warning
hi, sorry to post this as I am sure this an OT, but I received this and as far as I can tell some messages original addressed to me from the mailing list went to [EMAIL PROTECTED]@iname.com instead of me - and then ezmlm thinks about deleting me from the mailing list - what's going on? any help would be great thanks Neil - Original Message - From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, November 30, 2000 6:56 AM Subject: ezmlm warning Hi! This is the ezmlm program. I'm managing the [EMAIL PROTECTED] mailing list. Messages to you seem to have been bouncing. I've attached a copy of the first bounce message I received. If this message bounces too, I will send you a probe. If the probe bounces, I will remove your address from the mailing list, without further notice. I've kept a list of which messages bounced from your address. Copies of these messages may be in the archive. To get message 12345 from the archive, send an empty note to [EMAIL PROTECTED] Here are the message numbers: 57981 57991 57986 --- Below this line is a copy of the bounce message I received. Return-Path: Received: (qmail 12362 invoked from network); 18 Nov 2000 17:05:20 - Received: from err571-mta.mail.com (165.251.48.66) by muncher.math.uic.edu with SMTP; 18 Nov 2000 17:05:20 - Received: from smv664-leg.mail.com (smv664-leg.pub08.mail.com [165.251.8.75] (may be forged)) by err571-mta.mail.com (8.9.3/8.9.3) with ESMTP id MAA04880 for [EMAIL PROTECTED]; Sat, 18 Nov 2000 12:05:30 -0500 (EST) Received: from localhost (localhost) by smv664-leg.mail.com (8.9.3/8.9.1SMV2) with internal id MAA06872; Sat, 18 Nov 2000 12:05:26 -0500 (EST) Date: Sat, 18 Nov 2000 12:05:26 -0500 (EST) From: Mail Delivery Subsystem [EMAIL PROTECTED] Message-Id: [EMAIL PROTECTED] To: [EMAIL PROTECTED] MIME-Version: 1.0 Content-Type: multipart/report; report-type=delivery-status; boundary="MAA06872.974567126/smv664-leg.mail.com" Subject: Returned mail: User unknown Auto-Submitted: auto-generated (failure) This is a MIME-encapsulated message --MAA06872.974567126/smv664-leg.mail.com The original message was received at Sat, 18 Nov 2000 12:04:49 -0500 (EST) from muncher.math.uic.edu [131.193.178.181] - The following addresses had permanent fatal errors - [EMAIL PROTECTED] - Transcript of session follows - ... while talking to mail-intake-1.iname.net.: RCPT To:[EMAIL PROTECTED]@iname.com 553 [EMAIL PROTECTED]@iname.com... No such user 550 [EMAIL PROTECTED]... User unknown --MAA06872.974567126/smv664-leg.mail.com Content-Type: message/delivery-status Reporting-MTA: dns; smv664-leg.mail.com Received-From-MTA: DNS; muncher.math.uic.edu Arrival-Date: Sat, 18 Nov 2000 12:04:49 -0500 (EST) Final-Recipient: RFC822; [EMAIL PROTECTED]@iname.com Action: failed Status: 5.1.1 Remote-MTA: DNS; mail-intake-1.iname.net Diagnostic-Code: SMTP; 553 [EMAIL PROTECTED]@iname.com... No such user Last-Attempt-Date: Sat, 18 Nov 2000 12:05:26 -0500 (EST) --MAA06872.974567126/smv664-leg.mail.com Content-Type: text/rfc822-headers Return-Path: [EMAIL PROTECTED] Received: from muncher.math.uic.edu (muncher.math.uic.edu [131.193.178.181]) by smv664-leg.mail.com (8.9.3/8.9.1SMV2) with SMTP id MAA06640 for [EMAIL PROTECTED] sent by [EMAIL PROTECTED]; Sat, 18 Nov 2000 12:04:49 -0500 (EST) Received: (qmail 29030 invoked by uid 1002); 18 Nov 2000 17:02:32 - Mailing-List: contact [EMAIL PROTECTED]; run by ezmlm Precedence: bulk Delivered-To: mailing list [EMAIL PROTECTED] Received: (qmail 28549 invoked from network); 18 Nov 2000 17:02:31 - Received: from adsl-perm94-38.adsl.ij.net (HELO ns1.q7.net) ([EMAIL PROTECTED]) by muncher.math.uic.edu with SMTP; 18 Nov 2000 17:02:31 - Received: from DRONE (drone.internal.q7.net [192.168.0.2] (may be forged)) by ns1.q7.net (8.10.1/8.11.0) with SMTP id eAIID0m22367; Sat, 18 Nov 2000 13:13:00 -0500 (EST) Reply-To: [EMAIL PROTECTED] From: "Al" [EMAIL PROTECTED] To: [EMAIL PROTECTED], [EMAIL PROTECTED] Subject: RE: secrets and lies Date: Sat, 18 Nov 2000 12:05:53 -0500 Message-ID: 000101c05181$d030e430$[EMAIL PROTECTED] MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook CWS, Build 9.0.2416 (9.0.2911.0) In-Reply-To: [EMAIL PROTECTED] X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400 Importance: Normal --MAA06872.974567126/smv664-leg.mail.com--
X-Fetchmail-Warning
All mail I retrieve from the pop server come with the following header line: X-Fetchmail-Warning: recipiente address [EMAIL PROTECTED] didn't match any local name Also, I've been playing with the control files and every mail I send to one of my addresses ends up in the spool mail/alias file with the following warnings: From #@[] Sat Oct 14 22:58:53 2000 Return-Path: #@[] Delivered-To: [EMAIL PROTECTED] Received: (qmail 29125 invoked for bounce); 14 Oct 2000 22:58:53 - Date: 14 Oct 2000 22:58:53 - From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: failure notice Hi. This is the qmail-send program at tanit.wanadoo.es. I tried to deliver a bounce message to this address, but the bounce bounced! [EMAIL PROTECTED]: Sorry, no mailbox here by that name. (#5.1.1) --- Below this line is the original bounce. Return-Path: Received: (qmail 32422 invoked for bounce); 14 Oct 2000 22:58:52 - Date: 14 Oct 2000 22:58:52 - From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: failure notice Hi. This is the qmail-send program at tanit.wanadoo.es. I'm afraid I wasn't able to deliver your message to the following addresses. This is a permanent error; I've given up. Sorry it didn't work out. [EMAIL PROTECTED]: Sorry, no mailbox here by that name. (#5.1.1) [EMAIL PROTECTED]: Sorry, no mailbox here by that name. (#5.1.1) [EMAIL PROTECTED]: Sorry, no mailbox here by that name. (#5.1.1) --- Below this line is a copy of the message. [blah... ] ... including the cron messages to root. Thank You.
Muchos warning: trouble opening remote/local...
Hello! Would you please give me advice for some questions? - 1. Now I'm confused with following message in the maillog. "qmail: 962478354.405231 warning: trouble opening local/22/1105816; will try again later" Many massage like this are appearing in the log forever What is occurring and how to eliminate them? (Mail of id "1105816" is of when testing and should have been dead..) - 2. What means (#x.x.x) number in the maillog? I encounter it sometimes like.. "delivery 10: deferral: connected_to_aaa.bbb.ccc.ddd_but_connection_died._(#4.4.2)/" What means "(#4.4.2)" and where can I look up them? - 3. About IDENT processing from smtp I can see following header in a testing mail from my qmail server to another my account. "from host.mydoman (IDENT:[EMAIL PROTECTED] [a.b.c.d]) by host.destination (8.9.3/8.7.1) with SMTP id BAA for [EMAIL PROTECTED]; Wed, 5 Jul 2000 01:44:01 -0600" As shown above, I allow IDENT access to the server now, but I suspect it. because I don't see the header with IDENT in another mail not from my server. Essentially, qmail smtp daemon is necessary (mandatory) for IDENT connection? And if I prohibit it, what would happen? Thank you in advance. Jaime (^o^) -- Hajime Lucky Okada
Re: Muchos warning: trouble opening remote/local...
Hajime Lucky Okada [EMAIL PROTECTED] wrote: "qmail: 962478354.405231 warning: trouble opening local/22/1105816; will try again later" Many massage like this are appearing in the log forever What is occurring and how to eliminate them? Sounds like your queue is corrupt. Try running qmail-qsanity or queuefix from www.qmail.org. - 2. What means (#x.x.x) number in the maillog? I encounter it sometimes like.. "delivery 10: deferral: connected_to_aaa.bbb.ccc.ddd_but_connection_died._(#4.4.2)/" What means "(#4.4.2)" and where can I look up them? From RFC 1893, Enhanced mail system status codes. http://www.ietf.org/rfc/rfc1893.txt: 4.X.X Persistent Transient Failure X.4.X Network and Routing Status X.4.2 Bad connection - 3. About IDENT processing from smtp Essentially, qmail smtp daemon is necessary (mandatory) for IDENT connection? And if I prohibit it, what would happen? No, IDENT isn't mandatory. If you don't run a daemon, that information will be left out of the Received fields of messages that pass through your system. -Dave
Re: Security warning: using linuxconf(RedHat 6.2) and permissions of /usr/sbin/sendmail (fixed)
H, At 13:42 08.06.2000 -0400, Jim Simmons wrote: To stop it from making this change, I believe you can edit /usr/lib/linuxconf/redhat/perm and remove the /usr/sbin/sendmail line. Thanks for the hint, I found the file where linuxconf takes its information. Here a diff for qmail installation: --- /usr/lib/linuxconf/redhat/perm/mail.origSun Jun 11 10:53:34 2000 +++ /usr/lib/linuxconf/redhat/perm/mail Sun Jun 11 10:54:16 2000 @@ -1,5 +1,5 @@ /var/spool/mqueue rootmaild 755 required /var/spool/mailrootmaild 775 required -/usr/sbin/sendmail rootrootf 6755 +/usr/sbin/sendmail rootqmail f 755 /etc/mail rootrootd 755 Peter
Security warning: using linuxconf(RedHat 6.2) and permissions of /usr/sbin/sendmail
Hi, some days ago another guy mentioned that he has detected wrong permissions on his RedHat system using qmail at the wrapper "/usr/sbin/sendmail". I have reproduced this on 2 systems: Scenario: RedHat 6.2 (including linuxconf 1.17r2) sendmail-RPM deinstall qmail-SRPM build and install After original Qmail installation: /usr/sbin/sendmail 0755 root:qmail After adding a user with "linuxconf": /usr/sbin/sendmail 6755 root:root (suid,sgid!) That's really not Qmails intention that the wrapper runs now with suid root... So ***everyone using Qmail (or postfix also) on RedHat systems should do following check***: 1) Test if sendmail-RPM is really not installed: [root@mail /root]# rpm -qi sendmail package sendmail is not installed 2) check permissions of wrapper binary "/usr/sbin/sendmail" [root@mail /root]# ls -al /usr/sbin/sendmail BAD:-rwsr-sr-x1 root root 9748 Apr 27 20:13 /usr/sbin/sendmail GOOD: -rwxr-xr-x1 root mail 9748 Apr 27 20:13 /usr/sbin/sendmail 3) Re-secure, if BAD: [root@mail /root]# chown root:mail /usr/sbin/sendmail 4) Turnarounds to prevent re-insecuring: * do not use "linuxconf" anymore for adding users until RedHat has released a new version which do no longer reset the owner/group/permissions of "/usr/sbin/sendmail" (if it's not from the sendmail-RPM) * setup a cron script with does 3) as often as possible (i.e. all hours or shorter) Peter
RE: Security warning: using linuxconf(RedHat 6.2) and permissions of /usr/sbin/sendmail
Three things: First, linuxconf is NOT owned by RedHat. Therefore, it's not RedHat's problem. (You might want to convey your concerns to the linuxconf maintainers) Second, this is a GREAT example of why one might not want to trust someone else's RPM packages. Third, if installing qmail via LWQ, your /usr/sbin/sendmail might very well be symlinked to /var/qmail/bin/sendmail (I did it that way) Regards, Geordon (who has finally gone back to Slackware from RedHat) -Original Message- From: Peter Bieringer [mailto:[EMAIL PROTECTED]] Sent: Thursday, June 08, 2000 12:17 PM To: [EMAIL PROTECTED] Subject: Security warning: using linuxconf(RedHat 6.2) and permissions of /usr/sbin/sendmail Importance: High Hi, some days ago another guy mentioned that he has detected wrong permissions on his RedHat system using qmail at the wrapper "/usr/sbin/sendmail". I have reproduced this on 2 systems: Scenario: RedHat 6.2 (including linuxconf 1.17r2) sendmail-RPM deinstall qmail-SRPM build and install After original Qmail installation: /usr/sbin/sendmail 0755 root:qmail After adding a user with "linuxconf": /usr/sbin/sendmail 6755 root:root (suid,sgid!) That's really not Qmails intention that the wrapper runs now with suid root... So ***everyone using Qmail (or postfix also) on RedHat systems should do following check***: 1) Test if sendmail-RPM is really not installed: [root@mail /root]# rpm -qi sendmail package sendmail is not installed 2) check permissions of wrapper binary "/usr/sbin/sendmail" [root@mail /root]# ls -al /usr/sbin/sendmail BAD:-rwsr-sr-x1 root root 9748 Apr 27 20:13 /usr/sbin/sendmail GOOD: -rwxr-xr-x1 root mail 9748 Apr 27 20:13 /usr/sbin/sendmail 3) Re-secure, if BAD: [root@mail /root]# chown root:mail /usr/sbin/sendmail 4) Turnarounds to prevent re-insecuring: * do not use "linuxconf" anymore for adding users until RedHat has released a new version which do no longer reset the owner/group/permissions of "/usr/sbin/sendmail" (if it's not from the sendmail-RPM) * setup a cron script with does 3) as often as possible (i.e. all hours or shorter) Peter
Re: Security warning: using linuxconf(RedHat 6.2) and permissions of /usr/sbin/sendmail
It isn't the rpm's fault, it is actually linuxconf. Even if you did a by-the-book (i.e. following Dan's instructions to the letter) qmail install, linuxconf will follow the /usr/sbin/sendmail link and change the permissions on /var/qmail/bin/sendmail for you. It does this even if you don't have the sendmail rpm installed. To stop it from making this change, I believe you can edit /usr/lib/linuxconf/redhat/perm and remove the /usr/sbin/sendmail line. Jim On Thu, Jun 08, 2000 at 01:22:26PM -0400, VANTASSLE, GEORDON M. (AIT) wrote: Three things: First, linuxconf is NOT owned by RedHat. Therefore, it's not RedHat's problem. (You might want to convey your concerns to the linuxconf maintainers) Second, this is a GREAT example of why one might not want to trust someone else's RPM packages. Third, if installing qmail via LWQ, your /usr/sbin/sendmail might very well be symlinked to /var/qmail/bin/sendmail (I did it that way) Regards, Geordon (who has finally gone back to Slackware from RedHat)
Re: Security warning: using linuxconf(RedHat 6.2) and permissionsof /usr/sbin/sendmail
Hi, I think it's also possible to disable the sendmail module in linuxconf. regards christian
Re: VIRUS WARNING!!!!!!!
At 12:07 04/05/00 +0300, R.Ilker Gokhan wrote: SUBJECT: ILOVEYOU YOU MUST DELETE IT BEFORE OPEN, ESPECIALLY IF YOUR OS IS WINDOWS ! http://www.hinterlands.org/iloveyou.html Martin A. Brooks The package said Windows NT 4 or better - I installed Linux.
VIRUS WARNING!!!!!!!
Title: VIRUS WARNING!!! SUBJECT: ILOVEYOU YOU MUST DELETE IT BEFORE OPEN, ESPECIALLY IF YOUR OS IS WINDOWS !
Re: VIRUS WARNING!!!!!!!
Title: VIRUS WARNING!!! LOL, Your a little late on this one! Bryan Hundven - Original Message - From: R.Ilker Gokhan To: [EMAIL PROTECTED] ; '[EMAIL PROTECTED]' Sent: Thursday, May 04, 2000 2:07 AM Subject: VIRUS WARNING!!! SUBJECT: ILOVEYOU YOU MUST DELETE IT BEFORE OPEN, ESPECIALLY IF YOUR OS IS WINDOWS !
RE: VIRUS WARNING!!!!!!!
Considering the recent spate of VB bourne virii, please don't post using active-content-enabled formats, like HTML. -Original Message- From: Bryan Hundven [mailto:[EMAIL PROTECTED]] Sent: Monday, May 08, 2000 12:16 PM To: R.Ilker Gokhan; [EMAIL PROTECTED]; [EMAIL PROTECTED] Subject: Re: VIRUS WARNING!!! LOL, Your a little late on this one! Bryan Hundven - Original Message - From: R.Ilker Gokhan To: [EMAIL PROTECTED] ; '[EMAIL PROTECTED]' Sent: Thursday, May 04, 2000 2:07 AM Subject: VIRUS WARNING!!! SUBJECT: ILOVEYOU YOU MUST DELETE IT BEFORE OPEN, ESPECIALLY IF YOUR OS IS WINDOWS !
RE: VIRUS WARNING!!!!!!!
If you notice.. The date on the mail is Thursday... Some mailer somewhere held it up in transit it would appear.. Matt Soffen Web Intranet Developer http://www.iso-ne.com/ == Boss- "My boss says we need some eunuch programmers." Dilbert - "I think he means UNIX and I already know UNIX." Boss- "Well, if the company nurse comes by, tell her I said never mind." - Dilbert - == -Original Message- From: Alan Day [SMTP:[EMAIL PROTECTED]] Sent: Monday, May 08, 2000 1:55 PM To: [EMAIL PROTECTED]; [EMAIL PROTECTED] Subject: RE: VIRUS WARNING!!! Thanks for the heads up. Any news on the impending release of Windows 3.1 ? -Original Message- From: R.Ilker Gokhan [mailto:[EMAIL PROTECTED]] Sent: Thursday, May 04, 2000 4:07 AM To: [EMAIL PROTECTED]; '[EMAIL PROTECTED]' Subject: VIRUS WARNING!!! SUBJECT: ILOVEYOU YOU MUST DELETE IT BEFORE OPEN, ESPECIALLY IF YOUR OS IS WINDOWS !
RE: VIRUS WARNING!!!!!!!
Title: VIRUS WARNING!!! Thanks for the heads up. Any news on the impending release of Windows 3.1 ? -Original Message-From: R.Ilker Gokhan [mailto:[EMAIL PROTECTED]]Sent: Thursday, May 04, 2000 4:07 AMTo: [EMAIL PROTECTED]; '[EMAIL PROTECTED]'Subject: VIRUS WARNING!!! SUBJECT: ILOVEYOU YOU MUST DELETE IT BEFORE OPEN, ESPECIALLY IF YOUR OS IS WINDOWS !
RE: VIRUS WARNING!!!!!!!
On Mon, 8 May 2000, Soffen, Matthew wrote: If you notice.. The date on the mail is Thursday... Some mailer somewhere held it up in transit it would appear.. Or the date on his computer is wrong... :-) Andy - +- Andy --- [EMAIL PROTECTED] -+ | Great minds discuss ideas;| | Average minds discuss events; | | Small minds discuss people. | +-- http://www.xmission.com/~bradipo -+
Re: temporary failure warning message
Quoting Russell Nelson ([EMAIL PROTECTED]): Chris Hardie writes: Unfortunately, that link appears to be broken. Brian Wightman, please pick up the nearest courtesy phone. It's also temporarily available as http://www.qmail.org/qmail_bounce-0.0alpha6.tar.gz . If Brian doesn't show up too soon, I'll change the link to point to my server. I'm pretty sure I remember seeing a post from Brian some time back where he stated he was no longer working on the notifier. He asked for volunteers to pick up the slack, I think. (ring ring - Uhhh, hello?) My ISP has changed a couple of times since that link was last updated. You can find the software off from my redirector page at http://bwightman.i.am/, but I would prefer if one of the other sites would become the distribution site for this, since I do not see myself maintaining it any more (family constraints, etc). If someone does decide to maintain it, I have a couple of suggestion mail messages from users of the software I could forward. Let me know, Brian
Re: temporary failure warning message
[EMAIL PROTECTED] writes: It's also temporarily available as http://www.qmail.org/qmail_bounce-0.0alpha6.tar.gz . If Brian doesn't show up too soon, I'll change the link to point to my server. (ring ring - Uhhh, hello?) My ISP has changed a couple of times since that link was last updated. You can find the software off from my redirector page at http://bwightman.i.am/, but I would prefer if one of the other sites would become the distribution site for this, since I do not see myself maintaining it any more (family constraints, etc). Okay, I'm now linking to my local copy of that file. If anyone updates it, please publish it and give me a link or give me the file itself to publish. -- -russ nelson [EMAIL PROTECTED] http://russnelson.com Crynwr sells support for free software | PGPok | "Ask not what your country 521 Pleasant Valley Rd. | +1 315 268 1925 voice | can force other people to Potsdam, NY 13676-3213 | +1 315 268 9201 FAX | do for you..." -Perry M.
X-Spam-Warning: header patch
I finally sorted out and fixed my X-Spam-Warning header patch. It adds warning headers for ORBS, RSS, RBL and DUL without the use of any external programs. It's against a Debianized 1.02 source tree, but is fairly trivial so I imagine it'll easily apply to 1.03. Linked off http://www.earth.li/~noodles/programming.html if anyone's interested. J. -- /\ | Ships log... erm... one. | | http://www.blackcatnetworks.co.uk/ | \/
Re: temporary failure warning message
Quoting Russell Nelson ([EMAIL PROTECTED]): Chris Hardie writes: Unfortunately, that link appears to be broken. Brian Wightman, please pick up the nearest courtesy phone. It's also temporarily available as http://www.qmail.org/qmail_bounce-0.0alpha6.tar.gz . If Brian doesn't show up too soon, I'll change the link to point to my server. I'm pretty sure I remember seeing a post from Brian some time back where he stated he was no longer working on the notifier. He asked for volunteers to pick up the slack, I think. Aaron
Re: temporary failure warning message
Kai MacTane [EMAIL PROTECTED] writes: In the case of a failure to deliver, the user will not get *any* warning about it until queuelifetime has passed. I think that the option to have qmail (or a plug-in or add-on program) deliver a message back to the user stating that the message hasn't gone through yet, after an admin-configurable length of time (presumably somewhere from 4-24 hours), would be a useful thing. Our users constantly reply to such messages saying "please stop trying to deliver that message." *sigh* Once we switch away from sendmail, I'm strongly inclined to turn them off. I'd also significantly reduce the queue lifetime; honestly, if the message can't be delivered in two or three days, most e-mail users these days seem to have already concluded it will never get there and get really confused when it comes through. Our mail server that just sends out bounce messages already has a queue lifetime of just one day, but that's a special case (a very large number of those messages will just double-bounce and get silently discarded). -- Russ Allbery ([EMAIL PROTECTED]) http://www.eyrie.org/~eagle/
Re: temporary failure warning message
Racer X [EMAIL PROTECTED] writes: From: "Brian Johnson" [EMAIL PROTECTED] this was my point earlier, you can't always count on getting an error message if there is an error, because there's _always_ a chance that the message will be lost without a trace. so if you do make errors Not if you have a halfway decent MTA. Writing bulletproof software is not impossible. There are only so many states the message can be in. Yeah, but just because a bounce message was generated doesn't mean that the user gets it. I've seen a depressing quantity of users that put all sorts of random trash in their envelope sender and never see any of their bounces. Ideally, I'd track down the double-bounces and get the user to fix their configuration so that they see further bounces, but there really isn't enough time in the day for any significant user base. -- Russ Allbery ([EMAIL PROTECTED]) http://www.eyrie.org/~eagle/
Re: temporary failure warning message
Kai MacTane [EMAIL PROTECTED] wrote: As things stand with qmail right now, a user sending mail through qmail gets one of three things: 1) A successful delivery. 2) A bounce message (liable to happen within a few minutes under most circumstances). 3) An eventual failure (which takes queuelifetime). There are, of course, other failure modes that will not result in a bounce. The SMTP protocol just wasn't designed to be perfectly reliable. We can whine about that, dream up various mechanisms to improve reliability, and write code to implement them, but in the end the situation won't really change. A reliable SMTP would no longer be SMTP. We'd need new MTA's and MUA's supporting the new protocol. It'd take years to define the protocol and develop the first implementations. It'd take more years for every system on the Internet to upgrade to the new protocol. A quick cost/benefit analysis shows that it ain't gonna happen. In the case of a failure to deliver, the user will not get *any* warning about it until queuelifetime has passed. I think that the option to have qmail (or a plug-in or add-on program) deliver a message back to the user stating that the message hasn't gone through yet, after an admin-configurable length of time (presumably somewhere from 4-24 hours), would be a useful thing. There is, as has already been pointed out, a patch that does this. Unfortunately, that patch has been orphaned. I still think that if nondelivery warnings are done at all, they should be generated at the time of the first failed attempt. E.g.,: Hi. This is your friendly neighborhood mailer. I just tried to deliver your message to: [EMAIL PROTECTED] But I was unable to reach example.com. I'll keep trying to delivery the message occasionally for (queuelifetime/(3600*24)) days. If you don't hear from me again before then, your message was delivered. This isn't necessarily a qmail feature request, since I can see a strong case to be made for having this be an add-on. But it is a dissenting view that I thought should be aired, because I'd like to counterbalance the view I see here of "Messages like that are horrible; why would anyone want them?" I think they're annoying but I would never question anyone's right to have the feature. -Dave
Re: temporary failure warning message
On Apr 25 2000, Russ Allbery wrote: I'd also significantly reduce the queue lifetime; honestly, if the message can't be delivered in two or three days, most e-mail users these days seem to have already concluded it will never get there and get really confused when it comes through. If you're considering less than seven days for queuelifetime, do set it to at least four days -- it's frequently the case where a message was not delivered because some computer failed on a Friday afternoon and it can only be replaced/fixed on Monday morning and e-mails can't be delivered in the mean time... :-( So, three days may be a little short. Or should this mean that secondary MXs, once fought against begin to become a necessary condition? []s, Roger... -- =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Rogerio Brito - [EMAIL PROTECTED] - http://www.ime.usp.br/~rbrito/ Nectar homepage: http://www.linux.ime.usp.br/~rbrito/opeth/ =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Re: temporary failure warning message
Rogerio Brito [EMAIL PROTECTED] writes: So, three days may be a little short. Or should this mean that secondary MXs, once fought against begin to become a necessary condition? I use secondary MXes for all of my e-mail precisely because I want control over the queuing if a system goes down. -- Russ Allbery ([EMAIL PROTECTED]) http://www.eyrie.org/~eagle/
Re: temporary failure warning message
On Tue, 25 Apr 2000, Rogerio Brito wrote: If you're considering less than seven days for queuelifetime, do set it to at least four days -- it's frequently the case where a message was not delivered because some computer failed on a Friday afternoon and it can only be replaced/fixed on Monday morning and e-mails can't be delivered in the mean time... :-( So, three days may be a little short. Or should this mean that secondary MXs, once fought against begin to become a necessary condition? Good point. Here in Oz we've just had a 5 day weekend, thanks to Easter falling late and ANZAC day coming straight after Easter. Choose a value appropriate to your environment. Regards Peter -- Peter Samuel[EMAIL PROTECTED] Technical Consultantor at present: eServ. Pty Ltd [EMAIL PROTECTED] Phone: +61 2 9206 3410 Fax: +61 2 9281 1301 "If you kill all your unhappy customers, you'll only have happy ones left"
Re: temporary failure warning message
"J.M. Roth \(iip\)" [EMAIL PROTECTED] wrote:
is it possible to configure qmail to send out a "temporary failure" message
or something if mail can't be delivered rightaway?
No.
One of our users had an important mail in the queue which was returned to
him only 7 days later ('cause of a DNS failure), way too late...
Oh? What would the user have done had he known there was a DNS
failure?
Some
failure messages inbetween would be quite helpful.
That's one of sendmail's more annoying features, if you ask me.
-Dave
Re: temporary failure warning message
Dave Sill [EMAIL PROTECTED] wrote: "J.M. Roth \(iip\)" [EMAIL PROTECTED] wrote: is it possible to configure qmail to send out a "temporary failure" message or something if mail can't be delivered rightaway? No. But if you're desperate, you can create this feature easily. Write a Perl script which either 1) grovels through the queue directories, or 2) runs /var/qmail/bin/qmail-qread, and sends a report to the original sender for messages enqueued longer than X minutes/hours/days. Some failure messages inbetween would be quite helpful. That's one of sendmail's more annoying features, if you ask me. 100% agreed. Don't even consider doing what I described above. If an email is _that_ time-sensitive, follow up using a phone call. Better yet, write ``Let me know AS SOON AS you receive this!'' inside the body of the email. Len. -- I'm more worried about real security problems than theoretical reliability problems. -- Dan Bernstein
Re: temporary failure warning message
At 4/24/2000 10:56 AM -0400, Dave Sill wrote or quoted:
"J.M. Roth \(iip\)" [EMAIL PROTECTED] wrote:
One of our users had an important mail in the queue which was returned to
him only 7 days later ('cause of a DNS failure), way too late...
Oh? What would the user have done had he known there was a DNS
failure?
He might have tried to fax, fed-ex, or otherwise send the information via
another medium.
Anyone who assumes that An Important Mail has been delivered intact
and read by the recipient simply because they didn't receive a warning
or bounce message deserves what they get.
-Dave
Re: temporary failure warning message
Date: Mon, 24 Apr 2000 13:53:46 -0400 (EDT)
From: Dave Sill [EMAIL PROTECTED]
At 4/24/2000 10:56 AM -0400, Dave Sill wrote or quoted:
"J.M. Roth \(iip\)" [EMAIL PROTECTED] wrote:
One of our users had an important mail in the queue which was returned to
him only 7 days later ('cause of a DNS failure), way too late...
Oh? What would the user have done had he known there was a DNS
failure?
He might have tried to fax, fed-ex, or otherwise send the information via
another medium.
Anyone who assumes that An Important Mail has been delivered intact
and read by the recipient simply because they didn't receive a warning
or bounce message deserves what they get.
This is a real indictment of the state of the Internet.
I hope that someday people will trust the Internet the way they trust
the telephone system. How often have you heard somebody say ``You
didn't get my fax? I guess the Telco server was down.''
The Internet can and should be more reliable for this sort of usage.
Ian
Re: temporary failure warning message
Ian Lance Taylor [EMAIL PROTECTED] wrote: This is a real indictment of the state of the Internet. It's more of an example of some of the differences between the ways different communication technologies/protocols work. I hope that someday people will trust the Internet the way they trust the telephone system. I already do, I just have different expectations for the two. How often have you heard somebody say ``You didn't get my fax? I guess the Telco server was down.'' Ever pick up the phone and not get a dialtone? Dial a number and get the "fast busy signal" that means "no circuits available"? Ever try to send someone a fax and get a busy signal, no answer, or a human? I sure have. The Internet can and should be more reliable for this sort of usage. SMTP and existing MUA's and MTA's were not designed for instantaneous delivery. If you want to force it to be more immediate, shorten your queuelifetime. -Dave
Re: temporary failure warning message
the only thing that makes the phone system more reliable than the internet is that you get an instant response, if you don't get a response then you know their's a problem. by the nature of e-mail you do-not get an instant response, so after some time of no response you have to assume the message didn't go through, if you use an instant message program on the other hand then you will get an (almost) instant response (as long as the person is at their desk), and will know your message has gotten through.. JUST as reliably as the phone system. snail mail is the same deal as e-mail (hence the similarity in names)... when you mail a letter you assume it's gotten where it's supposed to go, but sometimes (not often) letters _do_ get lost, and so if iut's something very importaint then you'll usually call in a reasonable amount of time (couple days) to make sure the other person got the letter... it's the nature of communications in general, not of the internet... actually it's more the nature of our existance - nothing can be guaranteed with absolute certainty, so you need to check everything... wow, that's alot longer than I planned - sorry for the rant.. -Brian Ian Lance Taylor wrote: This is a real indictment of the state of the Internet. I hope that someday people will trust the Internet the way they trust the telephone system. How often have you heard somebody say ``You didn't get my fax? I guess the Telco server was down.'' The Internet can and should be more reliable for this sort of usage. Ian
Re: temporary failure warning message
Ian Lance Taylor writes: Sure. You get a rapid indication of an error condition. qmail by default provides an indication of an error condition after 1 week. I would be interesting to see (someone else do :) a study of the time in the queue vs. success in delivery. How profitable is it to leave mail in the queue for seven days versus the four that Tom suggested? -- -russ nelson [EMAIL PROTECTED] http://russnelson.com Crynwr sells support for free software | PGPok | "Ask not what your country 521 Pleasant Valley Rd. | +1 315 268 1925 voice | can force other people to Potsdam, NY 13676-3213 | +1 315 268 9201 FAX | do for you..." -Perry M.
Re: temporary failure warning message
Ian Lance Taylor [EMAIL PROTECTED] wrote: From: Dave Sill [EMAIL PROTECTED] Anyone who assumes that An Important Mail has been delivered intact and read by the recipient simply because they didn't receive a warning or bounce message deserves what they get. This is a real indictment of the state of the Internet. Not at all. Dave said, ``simply because they didn't receive a warning...'' In other words, you can't assume the message was received, simply because you WEREN'T told that it WASN'T received. You can only assume it was received if you HAVE been told it HAS been received. I hope that someday people will trust the Internet the way they trust the telephone system. I know you got my phone call, because I know I heard your voice. I know you got my fax, because fax machines DO acknowledge when a fax has been received. Email has no _general_ confirmation mechanism, except asking the recipient to ``hit reply so I know you got this.'' Len. -- There are two people at fault in every computer security breach: the attacker, and the programmer who let him in. -- Dan Bernstein
Re: temporary failure warning message
Date: Mon, 24 Apr 2000 15:26:00 -0400 From: Brian Johnson [EMAIL PROTECTED] the person could just simply not be checking their e-mail, or you could've mistyped the address, or a million other things, so you just plain can't depend on the system, but the more checks you put in, the more you make the system _look_ perfect, the more easy you make it for users to assume that is _is_ perfect... You seem to be saying that there is no point to improving something unless we can make it perfect. However, I think we can all agree that in this world nothing is ever perfect. Therefore, you seem to be saying that we should never try to improve anything. If that isn't what you mean, then what do you mean? I'm not saying we should make things perfect. I'm saying we should make things better. And the first step is realizing that things are not good enough--or, in other words, that they are not perfect. Ian
Re: temporary failure warning message
From: "Len Budney" [EMAIL PROTECTED] Date: Mon, 24 Apr 2000 15:37:14 -0400 Not at all. Dave said, ``simply because they didn't receive a warning...'' In other words, you can't assume the message was received, simply because you WEREN'T told that it WASN'T received. You can only assume it was received if you HAVE been told it HAS been received. Why bother sending a bounce message at all, then? Ian
Re: temporary failure warning message
Ian Lance Taylor wrote: Why bother sending a bounce message at all, then? to help diagnose the problem? you send an e-mail to the only person who's address you know for sure, the sender, and he can fix the problem if it's on his end, or let the recipient into the problem if it's on their end.. much easier that going to the admin and looking through the logs to figure out the reason behind every failed message..
Re: temporary failure warning message
Russell Nelson [EMAIL PROTECTED] wrote: Ian Lance Taylor writes: Sure. You get a rapid indication of an error condition. qmail by default provides an indication of an error condition after 1 week. I would be interesting to see (someone else do :) a study of the time in the queue vs. success in delivery. How profitable is it to leave mail in the queue for seven days versus the four that Tom suggested? I have three and a half days of old logs I ran through qmailanalog. The zddist script says: Distribution of ddelays for successful deliveries Meaning of each line: The first pct% of successful deliveries all happened within doneby seconds. The average ddelay was avg. doneby avg pct 175.68 72.00 90 185.54 74.41 91 197.96 77.15 92 214.85 80.45 93 229.72 84.12 94 262.56 88.66 95 302.85 94.62 96 1001.79 109.63 97 1275.71 141.99 98 10004.30 605.29 99 173893.00 607.67 100 So 99% of my messages were delivered within 3 hours (10800 s), and all were delivered within about 2 days (172800 s). This was for a chunk of log summarized by zoverall as: Basic statistics qtime is the time spent by a message in the queue. ddelay is the latency for a successful delivery to one recipient---the end of successful delivery, minus the time when the message was queued. xdelay is the latency for a delivery attempt---the time when the attempt finished, minus the time when it started. The average concurrency is the total xdelay for all deliveries divided by the time span; this is a good measure of how busy the mailer is. Completed messages: 15518 Recipients for completed messages: 85595 Total delivery attempts for completed messages: 92071 Average delivery attempts per completed message: 5.93317 Bytes in completed messages: 94519308 Bytes weighted by success: 284405101 Average message qtime (s): 502.863 Total delivery attempts: 175896 success: 162250 failure: 191 deferral: 13455 Total ddelay (s): 54231611.160887 Average ddelay per success (s): 334.247218 Total xdelay (s): 4135746.725588 Average xdelay per delivery attempt (s): 23.512455 Time span (days): 3.50192 Average concurrency: 13.6689 Now, this doesn't exactly measure what you asked for because it just looks at a 3.5 day snapshot: it doesn't follow N messages until they were either delivered or bounced. But, it's interesting that none of the messages in this period took more than two days to be delivered. I think it's clear that very few messages are delivered in the 4th through 7th days. -Dave
Re: temporary failure warning message
On Mon, Apr 24, 2000 at 01:02:53PM -0700, Ian Lance Taylor wrote: I haven't said what I want, beyond something better than the current situation, so this response does not seem to be to the point unless you think the current situation is ideal. I am trying to come up with something myself (http://www.zembu.com/) but Zembu Labs can't do it alone. I want to encourage people to realize that the Internet could stand improvement. Saying people should just accept the way things are, which is how I read Dave Sill's note to which I originally replied, is a hot button for me. Your apparent standpoint in this conversation, up until this paragraph, was that qmail (or internet mail in general) is lacking some feature that you want implemented: Ian I don't see why the current state of affairs is appropriate or even Ian reasonable. Ian You can't check everything, but it doesn't follow that we shouldn't Ian try to check what we can. Ian I'm not saying we should make things perfect. I'm saying we should Ian make things better. And the first step is realizing that things are Ian not good enough--or, in other words, that they are not perfect. You've been answered with (for the most part) "We think things are OK the way they are, use queuelifetime if you want to change qmail's behavior" --Adam
Re: temporary failure warning message
At 4/24/2000 04:17 PM -0400, Adam McKenna wrote or quoted: Your apparent standpoint in this conversation, up until this paragraph, was that qmail (or internet mail in general) is lacking some feature that you want implemented: [snip] You've been answered with (for the most part) "We think things are OK the way they are, use queuelifetime if you want to change qmail's behavior" As a contrasting view, I see things roughly thus: As things stand with qmail right now, a user sending mail through qmail gets one of three things: 1) A successful delivery. 2) A bounce message (liable to happen within a few minutes under most circumstances). 3) An eventual failure (which takes queuelifetime). In the case of a failure to deliver, the user will not get *any* warning about it until queuelifetime has passed. I think that the option to have qmail (or a plug-in or add-on program) deliver a message back to the user stating that the message hasn't gone through yet, after an admin-configurable length of time (presumably somewhere from 4-24 hours), would be a useful thing. This isn't necessarily a qmail feature request, since I can see a strong case to be made for having this be an add-on. But it is a dissenting view that I thought should be aired, because I'd like to counterbalance the view I see here of "Messages like that are horrible; why would anyone want them?" - Kai MacTane System Administrator Online Partners.com, Inc. - From the Jargon File: (v4.0.0, 25 Jul 1996) finger trouble /n./ Mistyping, typos, or generalized keyboard incompetence (this is surprisingly common among hackers, given the amount of time they spend at keyboards). "I keep putting colons at the end of statements instead of semicolons", "Finger trouble again, eh?".
Re: temporary failure warning message
Date: Mon, 24 Apr 2000 16:17:27 -0400 From: Adam McKenna [EMAIL PROTECTED] Your apparent standpoint in this conversation, up until this paragraph, was that qmail (or internet mail in general) is lacking some feature that you want implemented: That feature is reliability from the perspective of the user who knows nothing about how the e-mail system works. That includes comprehensible failure modes. You've been answered with (for the most part) "We think things are OK the way they are, use queuelifetime if you want to change qmail's behavior" If you think that things are OK the way they are, then we simply disagree. First, a minor point. I don't think that changing queuelifetime is good enough. It affects all messages globally. It doesn't let me say ``I need to know about this message, but not about this other message.'' It doesn't tell me ``it's been a hour to deliver this message--I'm still trying, but you might want to think about fixing something.'' Second, my actual point. Internet e-mail is pretty good, but I believe it could be a lot better. I encourage people to think of ways to make it better. If you see something that doesn't work right, don't just say ``well, that's the way it is.'' Instead, say ``we know that sucks, but nobody has fixed it yet.'' OK, I'll try to get off my soapbox now and drop this topic (except to answer any specific questions). Ian
Re: temporary failure warning message
On Mon, Apr 24, 2000 at 01:38:01PM -0700, Kai MacTane wrote: This isn't necessarily a qmail feature request, since I can see a strong case to be made for having this be an add-on. But it is a dissenting view that I thought should be aired, because I'd like to counterbalance the view I see here of "Messages like that are horrible; why would anyone want them?" They're annoying to administrators, and they do little more than confuse users, which makes life even worse for the administrator, who now is getting bombarded with calls from users "why didn't my email go through" --Adam
Re: temporary failure warning message
On Mon, Apr 24, 2000 at 01:31:49PM -0700, Ian Lance Taylor wrote: First, a minor point. I don't think that changing queuelifetime is good enough. It affects all messages globally. It doesn't let me say ``I need to know about this message, but not about this other message.'' It doesn't tell me ``it's been a hour to deliver this message--I'm still trying, but you might want to think about fixing something.'' You're right -- that's what qmail-qstat and qmail-qread are for. --Adam
Re: temporary failure warning message
On 24 Apr 2000, Ian Lance Taylor wrote: First, a minor point. I don't think that changing queuelifetime is good enough. It affects all messages globally. It doesn't let me say ``I need to know about this message, but not about this other message.'' It doesn't tell me ``it's been a hour to deliver this message--I'm still trying, but you might want to think about fixing something.'' There's a link from the qmail website to Brian Wightman's delayed-mail notifier, which serves this purpose quite faithfully (runs on cron, scans the queue and sends a message to the sender letting them know about the delay) and seems to be the piece of software several folks are looking for. Unfortunately, that link appears to be broken. Brian Wightman, please pick up the nearest courtesy phone. I have a copy from Feb 99; it's the one we've been using in production for some time now and it's never let us down. 9K download: http://www.summersault.com/chris/techno/qmail/qmail_bounce-0.0alpha6.tar.gz Note that it's an alpha release, and that I didn't write it, and that I won't support it, and that I probably won't answer questions about it, and that I don't want to be the primary download site for it. I hope this helps. Chris -- Chris Hardie - - mailto:[EMAIL PROTECTED] -- http://www.summersault.com/chris/ --
Re: temporary failure warning message
Kai MacTane wrote: At 4/24/2000 04:17 PM -0400, Adam McKenna wrote or quoted: Your apparent standpoint in this conversation, up until this paragraph, was that qmail (or internet mail in general) is lacking some feature that you want implemented: [snip] You've been answered with (for the most part) "We think things are OK the way they are, use queuelifetime if you want to change qmail's behavior" As a contrasting view, I see things roughly thus: As things stand with qmail right now, a user sending mail through qmail gets one of three things: 1) A successful delivery. 2) A bounce message (liable to happen within a few minutes under most circumstances). 3) An eventual failure (which takes queuelifetime). you forgot the possibility of 4) Message gets totally lost and NO-ONE gets any warning... this can happen for many reasons. from entering the wrong e-mail address accidentally and whoever gets it ignores/deletes it, to the server failing and losing the message. this was my point earlier, you can't always count on getting an error message if there is an error, because there's _always_ a chance that the message will be lost without a trace. so if you do make errors for everything possible, then users who don't know how the system works will assume than _every_ error will return an error message which just can never be the case. the only way to make the system foolproof that I can think of is by implementing some kind of automatic return reciepts built into to the MUA. have it automatically request a reciept whenever a message is sent, and whenever a reciept is recieved flag that message as "recieved" otherwise flag the message as "in transit". the problem with this is both ends have to support it for it to work properly, but this would do 2 things - instantly educate the user that the system's not infallable, and solve your need for error messages. -Brian
Re: temporary failure warning message
Chris Hardie writes: Unfortunately, that link appears to be broken. Brian Wightman, please pick up the nearest courtesy phone. It's also temporarily available as http://www.qmail.org/qmail_bounce-0.0alpha6.tar.gz . If Brian doesn't show up too soon, I'll change the link to point to my server. -- -russ nelson [EMAIL PROTECTED] http://russnelson.com Crynwr sells support for free software | PGPok | "Ask not what your country 521 Pleasant Valley Rd. | +1 315 268 1925 voice | can force other people to Potsdam, NY 13676-3213 | +1 315 268 9201 FAX | do for you..." -Perry M.
Re: temporary failure warning message
On Mon, Apr 24, 2000 at 02:02:13PM -0700, Kai MacTane wrote: Could you elaborate on the part about such messages being annoying to administrators? Administrators use email too. --Adam
Re: temporary failure warning message
- Original Message - From: "Brian Johnson" [EMAIL PROTECTED] To: "Qmail-List" [EMAIL PROTECTED] Sent: Mon 24 Apr 2000 13:47 Subject: Re: temporary failure warning message As things stand with qmail right now, a user sending mail through qmail gets one of three things: 1) A successful delivery. 2) A bounce message (liable to happen within a few minutes under most circumstances). 3) An eventual failure (which takes queuelifetime). you forgot the possibility of 4) Message gets totally lost and NO-ONE gets any warning... this can happen for many reasons. from entering the wrong e-mail address accidentally and whoever gets it ignores/deletes it, to the server failing and That happens to be a case of #1 above. The message was successfully delivered to the address specified by the user. Do you honestly expect any MTA to correct those "errors"? losing the message. this was my point earlier, you can't always count on getting an error message if there is an error, because there's _always_ a chance that the message will be lost without a trace. so if you do make errors Not if you have a halfway decent MTA. Writing bulletproof software is not impossible. There are only so many states the message can be in. Of course, the disk drive could always melt down with messages in queue, in which case you'd be screwed and the message could disappear. But I'd say that recovering from that kind of failure is a little outside the scope of an MTA. shag = Judd Bourgeois | Email: [EMAIL PROTECTED] Senior Software Developer | Phone: 805.520.7170 CNM Network | Mobile: 805.807.1162 or http://www.cnmnetwork.com | [EMAIL PROTECTED]
temporary failure warning message
Hello there,
is it possible to configure qmail to send out a "temporary failure" message
or something if mail can't be delivered rightaway?
One of our users had an important mail in the queue which was returned to
him only 7 days later ('cause of a DNS failure), way too late... Some
failure messages inbetween would be quite helpful.
Regards!
J.M. Roth
Fw: ezmlm warning
Hi all, Has anyone received a message like this recently? muncher.math.uic.edu has nothing to do with us and is definitly not listed as an MX for us! Regards, Marc-Adrian Napoli Connect Infobahn Australia +61 2 92811750 - Original Message - From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Sunday, March 19, 2000 3:02 PM Subject: ezmlm warning Hi! This is the ezmlm program. I'm managing the [EMAIL PROTECTED] mailing list. Messages to you seem to have been bouncing. I've attached a copy of the first bounce message I received. If this message bounces too, I will send you a probe. If the probe bounces, I will remove your address from the mailing list, without further notice. I've kept a list of which messages bounced from your address. Copies of these messages may be in the archive. To get message 12345 from the archive, send an empty note to [EMAIL PROTECTED] Here are the message numbers: 43407 --- Below this line is a copy of the bounce message I received. Return-Path: Received: (qmail 11739 invoked for bounce); 7 Mar 2000 13:42:02 - Date: 7 Mar 2000 13:42:02 - From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: failure notice Hi. This is the qmail-send program at muncher.math.uic.edu. I'm afraid I wasn't able to deliver your message to the following addresses. This is a permanent error; I've given up. Sorry it didn't work out. [EMAIL PROTECTED]: 203.17.36.17 does not like recipient. Remote host said: 553 sorry, that domain isn't in my list of allowed rcpthosts (#5.7.1) Giving up on 203.17.36.17.
