Re: [exim] CVE-2021-38371 (was: CVE-2022-37452)

2023-03-16 Thread Andreas Metzler via Exim-users
Thanks to all the involved parties for clearing this up (and obviously for handling the whole thing in the first place)! cu Andreas -- `What a good friend you are to him, Dr. Maturin. His other friends are so grateful to you.' `I sew his ears on from time to time, sure' -- ## List details at

[exim] CVE-2021-38371 (was: CVE-2022-37452)

2023-03-15 Thread Andreas Metzler via Exim-users
On 2022-08-24 17:49, Andrew C Aitchison wrote: [...] > www.exim.org/static/doc/security/CVE-2021-38371.txt > is advertised on a couple of CVE sites but does not exist. > Like CVE-2022-37452, CVE-2021-38371 was fixed in 4.95 (the fix in git > actually predates the NO STARTTLS announcement). > I

Re: [exim] expansion error in OAuth2 client authenticator

2023-03-11 Thread Andreas Metzler via Exim-users
On 2023-03-11 Victor Ustugov via Exim-users wrote: [...] > client_send = ${lookup{$host<@>$sender_address<@>oauth2}\ >lsearch*{CONFDIR/smtpauthdb}{${expand:$value}}fail} [...] Hello, | |client_send|Use: plaintext|Type: string*|Default: unset| |

Re: [exim] A study of failing tls certs, with valid certificate files

2023-02-25 Thread Andreas Metzler via Exim-users
On 2023-01-09 Jeremy Harris via Exim-users wrote: > On 09/01/2023 17:39, Andreas Metzler via Exim-users wrote: [...] >>> something changed how exim or openssl3  is handling the underlying >>> certificate switch detection. As Exim had only a tiny minor switch, OpenSSL3 >>

Re: [exim] Exim 4.96 on Devuan 4.0 build problem with PCRE2

2023-02-06 Thread Andreas Metzler via Exim-users
On 2023-02-06 Mike Tubby via Exim-users wrote: [...] > I come to migrate to Exim 4.96 which is usually: > * download the latest version > * unpack it next to the previous version > * copy over Local/Makefile > and type 'make' and sit back and watch a perfect compile ... [... and if anything

Re: [exim] New install EXIM + Dovecot - auth permission error

2023-02-01 Thread Andreas Metzler via Exim-users
On 2023-02-01 Gary Stainburn via Exim-users wrote: > Hi folks. > I'm setting up Dovecot and local user accounts on an existing Centos 7 + > EXIM install. [...] > However, when I try authenticate as a user, the following errors get logged: > 2023-02-01 12:50:11 dovecot_login authenticator failed

Re: [exim] A study of failing tls certs, with valid certificate files

2023-01-09 Thread Andreas Metzler via Exim-users
On 2023-01-09 Cyborg via Exim-users wrote: > please take this text as it is, a study for a fail you could avoid, no > fingerpointing, no flaming, only suggestions what to look for/change in your > toolchains. > In early December 2022 the server in question switched his os release and > was

Re: [exim] bad memory reference; pool not found, at gstring_grow 1124

2022-12-20 Thread Andreas Metzler via Exim-users
On 2022-12-19 Jeremy Harris via Exim-users wrote: > On 19/12/2022 06:32, Jasen Betts via Exim-users wrote: > >logwrite = > > ${sg{${sg{${sg{aaa}{a}{bbb}}}{b}{c}}}{c}{ddd}}zz > Thanks for locating this so precisely. > Fix pushed: 1ed24e36e279 Hello, Is

Re: [exim] FTP access to exim.org not working?

2022-12-17 Thread Andreas Metzler via Exim-users
On 2022-12-17 Mike Tubby via Exim-users wrote: > > BTW: Does it still make sense to offer ftp access in addition to > > http(s)? Are there still systems that can do the former but not the > > latter? > For me with headless, remote, Debian/Devuan servers CLI based FTP still > makes sense as I can

Re: [exim] FTP access to exim.org not working?

2022-12-17 Thread Andreas Metzler via Exim-users
On 2022-12-17 Mike Tubby via Exim-users wrote: > Hi All, > Has something changed w.r.t. FTP access to exim.org? > I have downloaded new versions of Exim for years using FTP CLI but now I > can't files from two different hosts and with 'active' or 'passive' modes. > My end are Devuan 4.0 (like

Re: [exim] failed to expand ACL string after upgrade

2022-12-03 Thread Andreas Metzler via Exim-users
On 2022-12-03 exim-users--- via Exim-users wrote: > Hi, > after updating to Ubuntu 22.10 (upgrading exim from 4.95-4ubuntu2.2 to > 4.96-3ubuntu1.1), SPF checks (via spf-tools-perl) are failing with "failed > to expand ACL string" (which leads to a temp reject): [...] Hello, I could not quickly

Re: [exim] licensing and SPDX

2022-11-05 Thread Andreas Metzler via Exim-users
On 2022-10-31 Jeremy Harris via Exim-users wrote: > On 30/10/2022 15:37, Andreas Metzler via Exim-users wrote: > > a) Yes, but. It would be very nice if the whole exim distribution had > > correct per-file attribution/copyright/license. However it is going to > > b

Re: [exim] licensing and SPDX

2022-10-30 Thread Andreas Metzler via Exim-users
On 2022-10-30 Jeremy Harris via Exim-users wrote: [...] > Now, along comes SPDX: a standard for labelling files with > the license that applies. Yup, we're late as usual... > a) Do we care? Should we label every text file in sight? >Or not take any action? > b) Do existing licence

Re: [exim] licensing and SPDX

2022-10-30 Thread Andreas Metzler via Exim-users
On 2022-10-30 Jeremy Harris via Exim-users wrote: > Does anyone have opinions on the licensing of Exim? > The project front-page ( https://exim.org/index.html ) > says "under the terms of the GNU General Public Licence", > and links to the GPL page (which primarily promotes GPLv3, > though older

Re: [exim] GnuTTS woes

2022-09-24 Thread Andreas Metzler via Exim-users
On 2022-09-23 Jasen Betts via Exim-users wrote: > upgrading from 4.94 to 4.96 seems to have dramatically reduced the TLS > connectivity (as a server). > I'm using libgnutls3.7.1 on debian 11 and the Exim package from backports > customers are complaining about TLS not not working > my testing

Re: [exim] SMTP transport interface IPv4/IPv6

2022-09-06 Thread Andreas Metzler via Exim-users
On 2022-09-06 Kai Bojens via Exim-users wrote: > I have a question about the "interface" option and which IP protocol it > chooses as I obviously don't understand it fully. [...] > Host A: Has a transport with an explicit "interface = 1.2.3.4" IPv4 > Host A now sends mail to Host B and uses

Re: [exim] dkim fail on forwarded messages

2022-06-29 Thread Andreas Metzler via Exim-users
On 2022-06-26 ozzloy via Exim-users wrote: > i'm having trouble with dkim on mail sent to a mailing list that gets > forwarded. [...] > if i send an email to linux-ker...@vger.kernel.org that email gets > forwarded and fails spf and dkim. >

Re: [exim] 4.95-RC0 - SIGSEGV (maybe attempt to write to immutable memory) & other oddities

2022-05-21 Thread Andreas Metzler via Exim-users
On 2021-07-23 Matthew Frost via Exim-users wrote: > Hello, odd (perhaps) one coming up… > I'm still diagnosing what might be wrong here, but I wanted to bring > it to your attention as it's stopped me testing the RC0 (and is hard > to debug because it takes hours/days to appear). > Jailed

Re: [exim] 4.95 failed to stat log directory /var/spool/exim/log:

2022-05-21 Thread Andreas Metzler via Exim-users
On 2022-05-21 Axel Rau via Exim-users wrote: > Hi all, > Recently my mailman 3 servers began spamming with tons of such log messages: > cannot accept message: failed to stat log directory /var/spool/exim/log: > Permission denied > root@lists5:/var/spool/exim # ls -ld . > drwxrwx--- 5 mailnull

Re: [exim] The No Certificate Warning and the Right Way to Stop it

2022-05-15 Thread Andreas Metzler via Exim-users
On 2022-05-14 Martin McCormick via Exim-users wrote: [...] > I created > -rw-r- 1 root Debian-exim 1245 May 8 21:43 /etc/exim4/exim.crt > with no change in behavior. Where is the key? file:///usr/share/doc/exim4-base/README.Debian.html#TLS says "install the key in /etc/exim4/exim.key

Re: [exim] The No Certificate Warning and the Right Way to Stop it

2022-05-14 Thread Andreas Metzler via Exim-users
On 2022-05-14 Martin McCormick via Exim-users wrote: > After reconfiguring exim4 to correct for an unannounced change > courtesy of my ISP, I got outbound mail humming along once again > but also revived an old issue which several people may recognize: > 2022-05-14 00:22:37 Warning: No server

Re: [exim] exim-4.96rc0 Tainted arg

2022-05-01 Thread Andreas Metzler via Exim-users
On 2022-05-01 Odhiambo Washington via Exim-users wrote: > Hi, > This transport survived 4.95, but not anymore with 4.96rc0 as this error > shows: > 2022-05-01 11:19:58 1nl4o7-0006GQ-10 ** /var/spool/virtual/ > mydomain.org/johndoe/Maildir R=virtual_domains > T=dovecot_virtual_delivery: Tainted

Re: [exim] Taint checking and exim 4.96rc0

2022-05-01 Thread Andreas Metzler via Exim-users
On 2022-04-30 James via Exim-users wrote: > On 29/04/2022 20:07, Heiko Schlittermann via Exim-users wrote: > > Do we have *new* taintchecks that break > > configurations that were considered secure with 4.95? > I has a hash_32_64 of data, accepted in 4.95, requires quote_pgsql with > 4.96. >

Re: [exim] Exim 4.96-RC0 released

2022-04-25 Thread Andreas Metzler via Exim-users
On 2022-04-23 Jeremy Harris via Exim-users wrote: > Hi all, > Enough changes have accumulated since 4.95 for it to be worth > spinning another release. The first Release Candidate is available > - as tarball:https://ftp.exim.org/pub/exim/exim4/test > - directly from Git:

Re: [exim] default certificate file /etc/exim4/exim.crt

2022-03-22 Thread Andreas Metzler via Exim-users
On 2022-03-22 Cyborg via Exim-users wrote: [...] > Honestly, I think that today, not enabling TLS as default in a mailserver, > is a complete no-go and should be changed ASAP by the distro maintainer. [...] You are misparsing the original question. It was on how to get exim to use a user

Re: [exim] converting from debian package to source

2022-01-09 Thread Andreas Metzler via Exim-users
On 2022-01-09 Zakaria via Exim-users wrote: >> On 9 Jan 2022, at 11:44, Jeremy Harris via Exim-users >> wrote: >> On 08/01/2022 18:30, Edwin Balani via Exim-users wrote: >>> Can't you rely on OPENDMARC_LIB_VERSION? It's defined in dmarc.h: >> Quite possibly. Now, is the changed API

Re: [exim] Certificate validation failed

2021-10-30 Thread Andreas Metzler via Exim-users
On 2021-10-30 Viktor Dukhovni via Exim-users wrote: [...] > Is it really true that for lack of valid certificate there's a way to > get Exim to fall back to cleartext instead??? Good morning, If a host is in tls_verify_hosts and hosts_try_tls but not in hosts_require_tls exim will fall back to

Re: [exim] Tainted spoolfile?

2021-10-26 Thread Andreas Metzler via Exim-users
On 2021-10-26 Dominik Vogt via Exim-users wrote: > After upgrading from Devuan 3 (~= Debian 10) to Devuan-4 > (~=Debian-11), not changing the exim config file the new Exim > version is 4.94.2. > Running "sendmail -qf" emits error messages like this one: > 2021-10-25 23:00:12.776 [7584]

Re: [exim] Difficulty compiling 4.95 on Debian 11

2021-10-23 Thread Andreas Metzler via Exim-users
On 2021-10-22 Joseph Kezar via Exim-users wrote: > I'm trying to compile with OpenSSL and am getting this error. > /usr/bin/ld: hash.o: in function `exim_sha_init': > hash.c:(.text+0x32): undefined reference to `SHA1_Init' > /usr/bin/ld: hash.c:(.text+0x4e): undefined reference to `SHA256_Init'

Re: [exim] Relayed Message: problems sending to list

2021-10-13 Thread Andreas Metzler via Exim-users
On 2021-10-13 Heiko Schlittermann wrote: > Andreas Metzler via Exim-users (Di 12 Okt 2021 18:24:02 > CEST): >> thank you, afaict MTA-STS is fine now. Could you also fix the TLS >> certificate? The MX record points to hummus.exim.org but the >> certificate is only for

Re: [exim] Relayed Message: problems sending to list

2021-10-12 Thread Andreas Metzler via Exim-users
On 2021-10-12 Heiko Schlittermann via Exim-users wrote: >> I'm working on it, it may be caused by the migration of the Exim main >> site to another (physical and network) location. > The relevant files are updated now, please retry. (I suppose there is a > cache time, so you may need to force

Re: [exim] GnuTLS vs OpenSSL

2021-09-18 Thread Andreas Metzler via Exim-users
On 2021-09-18 Sabahattin Gucukoglu via Exim-users wrote: > Debian always builds Exim against GnuTLS, in its “heavy” variation, > but I’ve always resisted by building against OpenSSL (and, > incidentally, taken the time to tweak it for me). On the face of it > that’s fine, except … > Is there

Re: [exim] Exim 4.95-RC2 released

2021-09-11 Thread Andreas Metzler via Exim-users
On 2021-09-06 jgh--- via Exim-users wrote: > On 06/09/2021 08:27, Evgeniy Berdnikov via Exim-users wrote: > > Several happened last night, 1st coredump is below. [...] > Can you get the actual pointer, by dumping the disassembly > and registers? We're hitting the limits of my gdb here, > but

Re: [exim] Exim 4.95-RC2 released

2021-09-07 Thread Andreas Metzler via Exim-users
On 2021-09-06 Evgeniy Berdnikov via Exim-users wrote: [...] > #1 0xf71d5be6 in gnutls_x509_trust_list_get_issuer () >from /usr/lib/i386-linux-gnu/libgnutls.so.30 > No symbol table info available. > #2 0xf71d6613 in gnutls_x509_trust_list_verify_crt2 () >from

Re: [exim] 4.95 RC0 - gnutls outgoing TLS cert verification broken

2021-07-23 Thread Andreas Metzler via Exim-users
On 2021-07-22 Jeremy Harris via Exim-users wrote: > On 19/07/2021 07:29, Andreas Metzler via Exim-users wrote: [...] >> SUPPORT_SYSDEFAULT_CABUNDLE is #defined in src/tls-gnu.c >> #if GNUTLS_VERSION_NUMBER >= 0x030014 >> # define SUPPORT_SYSDEFAULT_CABUNDLE

Re: [exim] Exim 4.95-RC0 released

2021-07-19 Thread Andreas Metzler via Exim-users
On 2021-07-15 Heiko Schlittermann via Exim-announce wrote: > Hi * > Too much time has gone since 4.94, we released 4.94.2, supported several > fixes for the unofficial 4.94.2+fixes release, fixed the "21 nails" CVEs > and now it is time to prepare Exim 4.95. > As usual we'll publish several

Re: [exim] 4.95 RC0 - gnutls outgoing TLS cert verification broken

2021-07-19 Thread Andreas Metzler via Exim-users
On 2021-07-19 Andreas Metzler wrote: [...] > with 4.92.2 > tls_verify_certificates = system > and 4.95 rc0 > tls_verify_certificates = Hello, SUPPORT_SYSDEFAULT_CABUNDLE is #defined in src/tls-gnu.c #if GNUTLS_VERSION_NUMBER >= 0x030014 # define SUPPORT_SYSDEFAULT_CABUNDLE #endif but checked

Re: [exim] 4.95 RC0 - gnutls outgoing TLS cert verification broken

2021-07-19 Thread Andreas Metzler via Exim-users
On 2021-07-18 Andreas Metzler wrote: > Hello, > there seems to be some breakage in 4.95 RC0 with outgoing TLS, it fails > to verify the peer certificate: > > initialising GnuTLS as a client on fd 7 > GnuTLS global init required > initialising GnuTLS client session >

Re: [exim] 4.95 RC0 - gnutls outgoing TLS cert verification broken

2021-07-18 Thread Andreas Metzler via Exim-users
On 2021-07-18 15:47, Jeremy Harris wrote: > On 18/07/2021 15:50, Andreas Metzler via Exim-users wrote: >> I am attaching both server and client logs. (Timezones are different, >> UTC vs. CEST). > Looks like it was an EC connection. The server seems to have had a pair > o

Re: [exim] 4.95 RC0 - gnutls outgoing TLS cert verification broken

2021-07-18 Thread Andreas Metzler via Exim-users
On 2021-07-18 Jeremy Harris via Exim-users wrote: > On 18/07/2021 14:09, Andreas Metzler via Exim-users wrote: >> there seems to be some breakage in 4.95 RC0 with outgoing TLS, it fails >> to verify the peer certificate: > Since we're happily running the test-suite t

[exim] 4.95 RC0 - gnutls outgoing TLS cert verification broken

2021-07-18 Thread Andreas Metzler via Exim-users
Hello, there seems to be some breakage in 4.95 RC0 with outgoing TLS, it fails to verify the peer certificate: initialising GnuTLS as a client on fd 7 GnuTLS global init required initialising GnuTLS client session Expanding various TLS configuration options for session

Re: [exim] deny senders in RCPT ACL regular expression and wildcards won't match for some reason

2021-06-05 Thread Andreas Metzler via Exim-users
On 2021-06-01 slp tees via Exim-users wrote: [...] > acl_check_rcpt: > ### Deny if sender explicitly in blacklist > # $recipients is not available until DATA command > deny senders = ${if exists{CONFDIR/sender-blacklist-envelope-from}\ >

Re: [exim] TLS error no shared cipher with SSL_accept: error in error

2021-06-01 Thread Andreas Metzler via Exim-users
On 2021-06-01 Marcin Gryszkalis via Exim-users wrote: [...] > so I checked what is the difference between these two boxes - and finally > found it - problematic exim uses EC certificate, while mail.fuze.pl uses (as > you could see) RSA. The change was caused by > switch of defaults in deydrated

Re: [exim] IRC channel for Exim

2021-05-26 Thread Andreas Metzler via Exim-users
On 2021-05-26 Jeremy Harris via Exim-users wrote: > Hi All, > We have used Freenode for an IRC channel (#exim) for many years. > Recent developments are making me consider a move, possibly > to irc.libera.chat (port 6697 for SSL; #exim). The channel > exists but I've not yet gotten it confirmed

Re: [exim] "allow_insecure_tainted_data = yes" - was: tainted data issues

2021-04-25 Thread Andreas Metzler via Exim-users
On 2021-04-25 Andreas Metzler wrote: > On 2021-04-24 Heiko Schlittermann wrote: > > I believe, the issue is fixed now. I'd be happy, if you **or anybody > > else** can give it a try. To avoid cluttering the official Exim repo, > > this branch is still only in my private but public repositories:

Re: [exim] "allow_insecure_tainted_data = yes" - was: tainted data issues

2021-04-25 Thread Andreas Metzler via Exim-users
On 2021-04-24 Heiko Schlittermann wrote: > I believe, the issue is fixed now. I'd be happy, if you **or anybody > else** can give it a try. To avoid cluttering the official Exim repo, > this branch is still only in my private but public repositories: [...] Good morning Heiko, thank you. Will

Re: [exim] 'failed to lock' delivery deferral breaks system filter for me

2021-04-23 Thread Andreas Metzler via Exim-users
On 2021-04-23 Ken via Exim-users wrote: [...] > I manage the email server for a small company in the US. Less than 1000 > received messages per day. A month or two ago I put in place a simple exim > system filter that removes the 'Friendly Name' from the From: header. > headers add

Re: [exim] "allow_insecure_tainted_data = yes" - was: tainted data issues

2021-04-11 Thread Andreas Metzler via Exim-users
On 2021-04-06 Heiko Schlittermann via Exim-users wrote: [...] > .ifdef _OPT_MAIN_ALLOW_INSECURE_TAINTED_DATA > allow_insecure_tainted_data = yes > .endif Hello, I just did a test build on the fixes branch, added the allow_insecure_tainted_data setting and changed the

Re: [exim] "allow_insecure_tainted_data = yes" - was: tainted data issues

2021-04-10 Thread Andreas Metzler via Exim-users
On 2021-04-06 Heiko Schlittermann via Exim-users wrote: [...] > .ifdef _OPT_MAIN_ALLOW_INSECURE_TAINTED_DATA > allow_insecure_tainted_data = yes > .endif [...] > Suggestions, question, remarks are welcome. Nitpicks: * The changes to doc/NewStuff should not be on +fixes. *

Re: [exim] "allow_insecure_tainted_data = yes" - was: tainted data issues

2021-04-10 Thread Andreas Metzler via Exim-users
On 2021-04-06 Heiko Schlittermann via Exim-users wrote: [...] > .ifdef _OPT_MAIN_ALLOW_INSECURE_TAINTED_DATA > allow_insecure_tainted_data = yes > .endif [...] > But as soon as the work stabilizes, it will be merged into the upstream > source. (For now, please expect

Re: [exim] Unable to read domainkey file

2021-03-20 Thread Andreas Metzler via Exim-users
On 2021-03-20 Luca Bertoncello via Exim-users wrote: > Am 20.03.2021 um 09:43 schrieb Andrew C Aitchison via Exim-users: > > The message says "Tainted filename" > > recent versions of exim refuse to open files with names derived from the > > incoming message unless they have been "sanitised" eg

Re: [exim] T=remote_smtp: message is too big (transport limit = 1)

2021-03-03 Thread Andreas Metzler via Exim-users
On 2021-03-02 Heiko Schlittermann via Exim-users wrote: > Hi Rainer, > Rainer Dorsch via Exim-users (Di 02 Mär 2021 22:24:16 > CET): [...] > > 2021-03-02 22:18:06 1lHCP8-0004Ow-5K ** xyz...@googlemail.com R=dnslookup > > T=remote_smtp: message is too big (transport limit = 1) > I think, it

Re: [exim] 4.94: _gnutls_sort_clist: Assertion `k == clist_size' failed

2021-02-17 Thread Andreas Metzler via Exim-users
On 2021-02-17 Evgeniy Berdnikov via Exim-users wrote: > Hello! > I have Exim 4.94 from Debian (packages 4.94-15 for i386 inside LXC > container). [...] > exim4: ../../../lib/x509/common.c:1794: _gnutls_sort_clist: Assertion `k == > clist_size' failed. > 11:27:59.115 LOG: MAIN PANIC >

Re: [exim] Taint mismatch, Ustrncpy: retry_update 826 ?

2021-01-25 Thread Andreas Metzler via Exim-users
On 2021-01-25 Mike Tubby via Exim-users wrote: > On closer inspection, I think I am generating one per message stuck on the > queue - each time Exim runs the queue - hence this may relate to > 'retry_update'? > Exim 4.93 built from source, 64-bit Devuan 3.0 Beowulf (similar to Debian 10 > but

Re: [exim] Virus/Malware errors

2021-01-18 Thread Andreas Metzler via Exim-users
On 2021-01-19 Dan Egli via Exim-users wrote: > I was looking at a message that had somehow gotten through my spam filters > to see if I could figure out why, when I discovered a line in the header > that said the message had not been virus scanned by exim. THAT was a > surprise. I have clamd

Re: [exim] Problem with filter on Base64-encoded subject field

2020-12-15 Thread Andreas Metzler via Exim-users
On 2020-12-15 Kirill Sluchanko via Exim-users wrote: [...]   >     Subject: > =?UTF-8?B?UmU6IFtFWFRFUk5BTF0gUmU6IFJlOiBSZTog0JzQsNGA0YjRgNGD0YLQuNC30LDRhtC4?= > я почты [...]   >     echo   > UmU6IFtFWFRFUk5BTF0gUmU6IFJlOiBSZTog0JzQsNGA0YjRgNGD0YLQuNC30LDRhtC4 | base64 > -d >   > and it

Re: [exim] Trying to understand when $local_part_data is set in ACLs

2020-11-10 Thread Andreas Metzler via Exim-users
On 2020-11-09 Chris Siebenmann via Exim-users wrote: [...] > This is all on Ubuntu 20.04 with Ubuntu's version of 4.93. I would suggest to upgrade to 4.94 + fixes and would keep away from anything > 4.92 and < 4.94+fixes. A quick tests on Debian testing works as expected: warn local_parts

Re: [exim] TLS connection with Microsoft server stalls

2020-11-01 Thread Andreas Metzler via Exim-users
On 2020-09-26 Heiko Schlittermann via Exim-users wrote: > Heiko Schlittermann via Exim-users (Sa 26 Sep 2020 > 14:44:56 CEST): >> Jeremy Harris via Exim-users (Sa 26 Sep 2020 14:17:45 >> CEST): >> I'm Working on a backport right now. > Please check >

Re: [exim] TLS connection with Microsoft server stalls

2020-09-25 Thread Andreas Metzler via Exim-users
On 2020-09-25 Heiko Schlittermann via Exim-users wrote: > Jeremy Harris via Exim-users (Fr 25 Sep 2020 14:12:31 > CEST): > > Debian Sid has a 4.94-related looking package version for Exim; > > I don't know if the 4.92-based one in Buster picks up this > > sort of change from the project. > I

Re: [exim] Exim 4.94 Taint issues

2020-07-19 Thread Andreas Metzler via Exim-users
On 2020-07-18 Eduardo M KALINOWSKI via Exim-users wrote: > On 18/07/2020 02:22, Andreas Metzler via Exim-users wrote: [...] > > Exim specification, concept index, de-tainting. > Except that there isn't such a section. > There's "tainted data" and inside it "de-t

Re: [exim] Exim 4.94 Taint issues

2020-07-17 Thread Andreas Metzler via Exim-users
On 2020-07-18 The Doctor via freebsd-ports wrote: > Trying Exim 4.94 and I am getting > 2020-07-17 19:28:04.818 [8344] 1jwbdQ-00023D-Cx == doc...@nk.ca R=localuser > T=local_delivery defer (-1) DT=0.001s: Tainted '/var/mail/doctor' (file or > directory name for local_delivery transport) not

Re: [exim] de-taint a file string

2020-07-13 Thread Andreas Metzler via Exim-users
On 2020-07-13 Jeremy Harris via Exim-users wrote: [...] > There's two ways. Well, three. > - For ACL stuff, use the debug facilities and actual test messages. > This can, depending on the test message source (smtp vs. non-) > require running the daemon with debug. [...] swaks can safe some

Re: [exim] Condition fail out of verify...

2020-07-04 Thread Andreas Metzler via Exim-users
On 2020-07-04 Marco Gaiarin via Exim-users wrote: > Mandi! Andreas Metzler via Exim-users [...] > > BTW it is not a good idea to specify log_message before doing the actual > > testing, you will log a message for every message not just the delayed > > ones. > ?! Looki

Re: [exim] DKIM and debian buster...

2020-07-03 Thread Andreas Metzler via Exim-users
On 2020-07-03 Jeremy Harris via Exim-users wrote: > On 02/07/2020 23:11, Marco Gaiarin via Exim-users wrote: [...] > > I've done the same on buster (exim 4.92-8+deb10u4) [...] > You didn't mention what, if any errors were logged. > I'm guessing you're trying to use a tainted string as a

Re: [exim] DKIM and debian buster...

2020-07-03 Thread Andreas Metzler via Exim-users
On 2020-07-03 Marco Gaiarin via Exim-users wrote: > I'm used, in exim on debian stretch (4.89-2+deb9u7) add something like: > DKIM_CANON = relaxed > DKIM_SELECTOR = 2020 > DKIM_DOMAIN = ${lc:${domain:$h_from:}} > DKIM_PRIVATE_KEY = ${if >

Re: [exim] Condition fail out of verify...

2020-07-02 Thread Andreas Metzler via Exim-users
On 2020-07-03 Marco Gaiarin via Exim-users wrote: > really i don't remember exactly how, but i've added to my boilerplate exim > config file an ACL, near the end of acl_check_rcpt ACL, that sounds like: [...] > require > message = ${if >{$rcpt_fail_count}{0} {unrouteable address}{unknown

Re: [exim] de-tainting

2020-06-25 Thread Andreas Metzler via Exim-users
On 2020-06-25 Evgeniy Berdnikov via Exim-users wrote: [...] > I run "Exim version 4.94 #2 built 19-Jun-2020 08:31:26" from Debian. Hello, Judging from the build date this should be 4.94-3, which is exim-4.94+fixes up to and including ecf1e77accda6355ebb745a0a03e97ba7eb298b2 [Taint: fix verify.

Re: [exim] mail stuck in /var/spool/exim4/input

2020-06-04 Thread Andreas Metzler via Exim-users
On 2020-06-04 Jeremy Harris via Exim-users wrote: > On 04/06/2020 16:38, Andreas Metzler via Exim-users wrote: > > You are running 4.94-1 configuration with 4.92.3-1 binaries. > I'm starting to wonder if these sorts of checks need support > from Exim predefined macros. [...

Re: [exim] mail stuck in /var/spool/exim4/input

2020-06-04 Thread Andreas Metzler via Exim-users
On 2020-06-02 m s via Exim-users wrote: > I'm running Debian sid and after upgrading packages today, exim stopped > working. It's keeping all my local mail in /var/spool/exim4/input and > not delivering it, and even when I type "runq" it won't deliver the > mail. > # exim4 -qff -v [...] > T:

Re: [exim] exim 4.94 RC1 published

2020-05-14 Thread Andreas Metzler via Exim-users
Hello, thanks for driving this. Debian/experimental update will probably take until weekend, but we are almost at RC1 anyway (8ca559c846f149eda900c581cc4c0ce0cacb89c2). On 2020-05-14 Jeremy Harris via Exim-dev wrote: > I have built, and placed on the FTP site, Release Candidate 1 for > exim

Re: [exim] Next release starting; will be 4.94; RC 0 published

2020-05-01 Thread Andreas Metzler via Exim-users
On 2020-04-30 Jeremy Harris via Exim-users wrote: [...] > The ftp site, at ftp://ftp.exim.org/pub/exim/exim4/test/ > now has the RC0 release candidate. Uploaded to Debian/experimental. cu Andreas -- ## List details at https://lists.exim.org/mailman/listinfo/exim-users ## Exim details at

Re: [exim] [taint] $local_part in require files

2020-05-01 Thread Andreas Metzler via Exim-users
On 2020-05-01 Jeremy Harris via Exim-users wrote: > On 01/05/2020 07:01, Andreas Metzler via Exim-users wrote: [...] > > > > "require_files = $local_part_verified:$home/.procmailrc" > > > > for consistency's sake. (To get in the right mindset and avoid

[exim] [taint] $local_part in require files

2020-05-01 Thread Andreas Metzler via Exim-users
Hello, 4.94rc0 spect.txt has the following in the section about require_files: During delivery, the stat() function is run as root, but there is a facility for some checking of the accessibility of a file by another user. This is not a proper permissions check, but just a "rough" check

Re: [Exim-users-de] Mail aus Listen an bestimmte Adressen ablehnen

2020-04-26 Thread Andreas Metzler via Exim-users-de
On 2020-04-26 Jutta Wrage wrote: > Ich habe folgendes Problem zu lösen: > Seit einigen Tagen bekommt der Vorstand des Vereins massenhaft > Bulk-Mails. > Nun möchte ich diese Mails möglichst früh ablehnen, bevor sie an die > Vorstandsliste verteilt werden. > Meine Idee: > Bei allen Mails gibt

Re: [exim] Exim4 keeps mails with multiple recipients infinitely in queue

2020-03-20 Thread Andreas Metzler via Exim-users
On 2020-03-17 Lukas Haase via Exim-users wrote: > Hi, > I am running Debian + exim + dkimproxy for more than 10 years without [...] > This setup worked flawlessly since 2009 (and was upgraded over > multiple Debian versions). Recently I upgraded to Debian 10 (buster; > exim 4.89, dkimproxy

Re: [Exim-users-de] TLS in gesplitteter Debian-Config

2020-01-25 Thread Andreas Metzler via Exim-users-de
On 2020-01-25 Jutta Wrage via Exim-users-de wrote: [...] > Auf der Serverseite starte das ganze mit: > SNMP connect from [...] > SMTP protocol error in "STARTTLS" H=CLIENTHOST (mail.example.com) [My_IP] > I=[Server_IP]:587 STARTTLS command used when not advertised [...] > Für mich ist das en

Re: [exim] Tainting & rewrite rules

2020-01-16 Thread Andreas Metzler via Exim-users
Jeremy Harris via Exim-users wrote: > On 13/01/2020 14:02, Evgeniy Berdnikov via Exim-users wrote: >> debian package exim4-daemon-heavy_4.93-5_i386. > ooh - 32-bit? I wonder if the address-space layout is > different enough to invalidate the assumptions made by > the Linux makefiles, for

Re: [exim] Tainting & rewrite rules

2020-01-13 Thread Andreas Metzler via Exim-users
On 2020-01-13 Jeremy Harris via Exim-users wrote: > On 13/01/2020 14:02, Evgeniy Berdnikov via Exim-users wrote: > > debian package exim4-daemon-heavy_4.93-5_i386. > ooh - 32-bit? I wonder if the address-space layout is > different enough to invalidate the assumptions made by > the Linux

Re: [exim] Exim maintenance release 4.93.0.3 | branch exim-4.93+fixes

2019-12-13 Thread Andreas Metzler via Exim-users
On 2019-12-13 Heiko Schlittermann via Exim-announce wrote: > Hi, > today we published a maintenance release 4.93.0.3. > A short list of changes since 4.93 please is attached. [...] Thank you. When I tried regenerating the docs from GIT website/script/gen did not like[1] the 4-part version

Re: [exim] Exim 4.93 published.

2019-12-10 Thread Andreas Metzler via Exim-users
On 2019-12-10 Ian Zimmerman via Exim-users wrote: [...] > Practically, how many extensions are there _not_ using store_get() ? Hello, Afaict sa-exim does not, which probably is still the most popular extension. cu Andreas -- ## List details at

Re: [exim] Don't verify specific sending domain

2019-11-20 Thread Andreas Metzler via Exim-users
On 2019-11-20 Joseph Kezar via Exim-users wrote: [...] > acl_smtp_mail: > accept hosts = : > accept hosts = +relay_from_hosts > accept senders = +unverified_senders > accept domains = +unverified_domains > require verify=

Re: [exim] Release candidate 4.93 RC2 published.

2019-11-10 Thread Andreas Metzler via Exim-users
On 2019-11-10 Heiko Schlittermann via Exim-announce wrote: > today we released 4.93 RC2. > Compared with RC1 it contains mainly minor fixes to improve the > "buildabilty" across different environments. Thanks to the reporters of > the build issues. [...] > Note: Some runtime config defaults

Re: [exim] dkim_private_key and file permissions

2019-11-01 Thread Andreas Metzler via Exim-users
On 2019-11-02 Mark Hills via Exim-users wrote: > I use Exim on FreeBSD which runs as (mailnull, mail) > I have a private SSL key for this host, protected by a group. > # ls -l /etc/ssl/local.key > -rw-r- 1 root ssl 1679 Oct 14 2018 /etc/ssl/local.key [...] > But now I am enabling

Re: [exim] Pulling out my hair!

2019-11-01 Thread Andreas Metzler via Exim-users
On 2019-10-31 Mark Elkins via Exim-users wrote: > Hi folks, > I'm pulling out my hair... I have a strange e-mail problem. I'm hoping this > community can help. > I run an ISP in South Africa. Servers are all Linux Gentoo. I use EXIM and > Courier-IMAP/POP to deliver emails to about 3000 users

Re: [exim] Release candidate 4.93 RC1 published.

2019-10-31 Thread Andreas Metzler via Exim-users
On 2019-10-28 Heiko Schlittermann via Exim-announce wrote: > today we released 4.93 RC1. > Compared with RC0 it contains mainly minor fixes to improve the > "buildabilty" across different environments. Thanks to the reporters of > the build issues. [...] Hello, Binary packages for Debian are

Re: [exim] Exim usage numbers?

2019-09-07 Thread Andreas Metzler via Exim-users
On 2019-09-07 Cyborg via Exim-users wrote: > several press publications about the exim exploit give different exim > installation numbers. > The Hacker News: "...which runs almost 60% of the internet's email > servers today..." >     "...leaving at least over half a

[exim] testsuite - lxc?

2019-07-21 Thread Andreas Metzler via Exim-users
Hello, does the exim testsuite work in a lxc container? cu Andreas -- `What a good friend you are to him, Dr. Maturin. His other friends are so grateful to you.' `I sew his ears on from time to time, sure' -- ## List details at https://lists.exim.org/mailman/listinfo/exim-users ## Exim

Re: [exim] Available ciphers with stock Debian (gnutls) exim

2019-07-13 Thread Andreas Metzler via Exim-users
Russell King via Exim-users wrote: > On Sat, Jul 13, 2019 at 01:19:29PM +0200, Andreas Metzler via Exim-users > wrote: [...] >> Running the old exim version (4.89) in a stretch (Debian 9.9) chroot >> without setting tls_require_ciphers I get this when connecting with >&

Re: [exim] Available ciphers with stock Debian (gnutls) exim

2019-07-13 Thread Andreas Metzler via Exim-users
Russell King via Exim-users wrote: > I've been noticing a difference in behaviour between debian systems > (using gnutls) and rpm-based systems (using openssl) when it comes to > the ciphers used to transport mail using exim - and it appears to be > specific to whether the gnutls end is the

Re: [exim] exim4 smarthost out, fetchmail in conf

2019-07-10 Thread Andreas Metzler via Exim-users
Martin McCormick via Exim-users wrote: > Heiko Schlittermann via Exim-users writes: >> Whenever a recent Exim is configured to advertise TLS >> (tls_advertise_hosts), it tries to create a self-signed certificate >> until you point Exim to the certificate file. >> Exim's hard wired default for

Re: [exim] Failure to deliver to Gmail

2019-06-28 Thread Andreas Metzler via Exim-users
Viktor Dukhovni via Exim-users wrote: >> On Jun 27, 2019, at 5:58 AM, Richard Jones via Exim-users >> wrote: >> There have been a few mails about this recently, but I don't think they >> cover my case (nor is this about my previous mail about retry times) > There was a recent thread that's an

Re: [exim] ATTN: Re: CVE-2019-10149: already vulnerable ?

2019-06-25 Thread Andreas Metzler via Exim-users
Cyborg via Exim-users wrote: > Am 24.06.19 um 20:31 schrieb Andreas Metzler via Exim-users: [...] >> M OTOH does not match everything but is much to broad since it does >> not match on the backslash at all. Also I do not see how "jeremy's >> version will reject any x24

Re: [exim] ATTN: Re: CVE-2019-10149: already vulnerable ?

2019-06-24 Thread Andreas Metzler via Exim-users
Cyborg via Exim-users wrote: > Am 23.06.19 um 21:02 schrieb Jeremy Harris via Exim-users: >> deny local_parts = \N ^.*$ : ^.*\\x24 : ^.*\\0?44 \N >> message = no mate [...] > Anyone who used this restricted chars patch: [...] > should update to this ruleset : [...] >  

Re: [exim] geximon leaving tail processes sucking up cpu

2019-06-16 Thread Andreas Metzler via Exim-users
Calum Mackay via Exim-users wrote: [...] > Or do people not use geximon these days? It seems to be dead upstream, no changes since 2008. https://github.com/dwatson/geximon/commits/master cu Andreas -- ## List details at https://lists.exim.org/mailman/listinfo/exim-users ## Exim details at

Re: [exim] The most used Exim version is the vulnerable one

2019-06-12 Thread Andreas Metzler via Exim-users
Dave Howe via Exim-users wrote: > On 12/06/2019 12:01, Gary Stainburn via Exim-users wrote: >> I have just done a "yum update" on my C7 system and there was no EXIM update >> included. Hopefully this will be resolved soon. > Was under the impression this was already resolved in 4.92 so

Re: [exim] TLS with gmail started failing

2019-06-07 Thread Andreas Metzler via Exim-users
Marc MERLIN via Exim-users wrote: >> On 07/06/2019 17:16, Marc MERLIN via Exim-users wrote: >> > Is my cipher list unsuitable? cipher: >> > TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256 [...] > Sorry, I totally failed to give a required bit of info, which exim I have. > debian exim4 4.87-3+b1 > I

Re: [exim] TLS with gmail started failing

2019-06-07 Thread Andreas Metzler via Exim-users
Viktor Dukhovni via Exim-users wrote: >> On Jun 7, 2019, at 1:37 PM, Viktor Dukhovni via Exim-users >> wrote: >> Actually, that did not work, I must have botched the command-line >> arguments. The "STARTTLS" never happened, as can be seen from the >> fact that the EHLO response still contains

Re: [exim] TLS key file

2019-04-28 Thread Andreas Metzler via Exim-users
Ian Zimmerman via Exim-users wrote: > When is the file specified by tls_privatekey read, in a daemon exim? > Once at startup, or every time a TLS connection is made? The latter. (Which needs to be that way since tls_privatekey/tls_certificate are expanded and might point to different files

Re: [exim] Matching RFC 2047 encoded text

2019-04-17 Thread Andreas Metzler via Exim-users
Ian Zimmerman via Exim-users wrote: [...] > My problem was - and is - that the filter rule > didn't match, despite one of the alternatives in the regexp being > "money[[:space:]]+laundry". I think Lena's reply explains this. cu Andreas -- `What a good friend you are to him, Dr. Maturin. His

Re: [exim] local_scan_path change ?

2019-03-30 Thread Andreas Metzler via Exim-users
On 2019-03-30 Thomas Krichel wrote: > Andreas Metzler via Exim-users writes > > sa-exim probably has reached EOL. > But is there a pure-exim way to save all the incoming mails that > are rejected? That's what the main advantage is. I think this should work: [

  1   2   >