[plug] Email problem

Wed Mar 10 16:23:30 WST 2004

Hello, everyone. 

We have a LAN, with a mail server/gateway, using dialup.  

The mail server uses postfix. 

The ISP is WASP. 

We received the following email. 

........................................................... 
From: support at wasp.net.au 

Subject: INFO: Maintenance, Wednesday Afternoon 

Dear Valued Customer 

We will be conducting a migration of our mail system from 
the current 
system to a new system during the following times: 

Date: Wednesday, March 10th, 2004  
Time: Between 1pm & 3pm 
Duration: Brief Outages 

You may notice some email related problems during these 
times, checking 
email may be effected for brief periods. 

This change will allow existing domain holders to 
edit/delete/create their 
domain email addresses themselves from within the members 
section. 

We apologise for any inconvenience this may cause. 
........................................................... 

>From about 2pm today, in the middle of WASP's 
"Maintenance", all of our incoming email started being 
bounced. 

An example of a bounce message, is below. 

........................................................... 
Date: Wed, 10 Mar 2004 14:13:48 +0800 (WST) 
From: Mail Delivery System <MAILER-DAEMON at busby.net> 
To: postmaster at busby.net 
Subject: Postmaster Copy: Undelivered Mail 

<anne at busby.net>: mail forwarding loop for anne at busby.net 

    [ Part 2: "Undelivered Message" ] 

Received: by linux.busby.net (Postfix, from userid 504) 
	id BB6CC2677D; Wed, 10 Mar 2004 14:13:24 +0800 
(WST) 
Delivered-To: clearsol at busby.net 
Received: from localhost (unknown [127.0.0.1]) 
	by linux.busby.net (Postfix) with ESMTP id 
0E78226784 
	for <clearsol at localhost>; Wed, 10 Mar 2004 
14:13:03 +0800 (WST) 
Delivered-To: busby at wasp.net.au 
Received: from mail.wasp.net.au 
	by localhost with POP3 (fetchmail-5.3.1) 
	for clearsol at localhost (single-drop); Wed, 10 Mar 
2004 14:13:03 +0800 (WST) 
Received: from localhost (localhost [127.0.0.1]) 
  (forwarded by anne at busby.net) 
  by wasp.net.au with local; Wed, 10 Mar 2004 14:32:33 
+0800 
Delivered-To: anne at busby.net 
Received: from murphy.debian.org (murphy.debian.org 
[::ffff:146.82.138.6]) 
  by wasp.net.au with esmtp; Wed, 10 Mar 2004 14:32:28 
+0800 
Received: from localhost (localhost [127.0.0.1]) 
	by murphy.debian.org (Postfix) with QMQP 
	id 07214EE2A; Wed, 10 Mar 2004 00:29:49 -0600 
(CST) 
Old-Return-Path: <mdz at alcor.net> 
X-Original-To: debian-security-announce at lists.debian.org 
Received: from mta11.adelphia.net (mta11.adelphia.net 
[68.168.78.205]) 
	by murphy.debian.org (Postfix) with ESMTP id 
91F3FEA45 
	for <debian-security-announce at lists.debian.org>; 
Wed, 10 Mar 2004 00:29:43 -0600 (CST) 
Received: from mizar.alcor.net ([68.64.159.24]) by 
mta11.adelphia.net 
          (InterMail vM.5.01.06.05 
201-253-122-130-105-20030824) with ESMTP 
          id 
<20040310062942.DRPH27343.mta11.adelphia.net at mizar.alcor.net> 
          for <debian-security-announce at lists.debian.org>; 
          Wed, 10 Mar 2004 01:29:42 -0500 
Received: from mdz by mizar.alcor.net with local (Exim 
4.30) 
	id 1B0xDq-0002gc-BJ 
	for debian-security-announce at lists.debian.org; 
Tue, 09 Mar 2004 22:29:42 -0800 
Date: Tue, 9 Mar 2004 22:29:42 -0800 
From: Matt Zimmerman <mdz at debian.org> 
To: debian-security-announce at lists.debian.org 
Message-ID: <20040310062942.GN28592 at alcor.net> 
Mail-Followup-To: Matt Zimmerman <mdz at debian.org>, 
	debian-security-announce at lists.debian.org 
Mime-Version: 1.0 
Content-Type: text/plain; charset=us-ascii 
Content-Transfer-Encoding: 7bit 
Content-Disposition: inline 
User-Agent: Mutt/1.5.5.1+cvs20040105i 
Sender: Matt Zimmerman <mdz at alcor.net> 
X-Debian: PGP check passed for security officers 
Subject: [SECURITY] [DSA 458-1] New python2.2 packages fix 
buffer overflow 
Priority: urgent 
Reply-To: security at debian.org 
Resent-Message-ID: <nCzOQ.A.TmH.cXrTAB at murphy> 
Resent-From: debian-security-announce at lists.debian.org 
X-Mailing-List: 
<debian-security-announce at lists.debian.org> 
X-Loop: debian-security-announce at lists.debian.org 
List-Id: <debian-security-announce.lists.debian.org> 
List-Post: 
<mailto:debian-security-announce at lists.debian.org> 
List-Help: 
<mailto:debian-security-announce-request at lists.debian.org?subject=help> 
List-Subscribe: 
<mailto:debian-security-announce-request at lists.debian.org?subject=subscribe> 
List-Unsubscribe: 
<mailto:debian-security-announce-request at lists.debian.org?subject=unsubscribe> 
List-Archive: 
<http://lists.debian.org/debian-security-announce/> 
Precedence: list 
Resent-Sender: 
debian-security-announce-request at lists.debian.org 
Resent-Date: Wed, 10 Mar 2004 00:29:49 -0600 (CST) 
X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on 
wasp.net.au 
X-Spam-Status: No, hits=0.0 required=200.0 tests=none 
autolearn=no 
	version=2.63 
X-Spam-Level: 

........................................................... 

>From the above, I believe that whatever WASP did, has 
implemented a change that caused all of our incoming email 
to be sent into an endless forwarding loop, where the 
addressee apparently forwards all email addressed to the 
addressee, to the addressee, causing an infinite loop, 
causing the bounces. I could be wrong in my belief, but 
the timing is significant. 

Support at WASP, told me that we need to check our postfix 
settings. The settings have not been changed in over a 
year, and, we have not seen anything like this, occurring 
with our email before. The mail server has not crashed, so 
no files on the mail server, would have been corrupted by 
crashing. I have since disconnected fetchmail, as we had 
already lost about 30-50 messages, when the support person 
from WASP told me that the problem is at our end. 

We do not have automated forwarding, that we have set, 
that would have caused all of this to happen. 

In looking at the full header of the first message above, 
the version of SpamAssassin, used by WASP, appears to be 
the same as before 

Can someone please enlighten us, as to what is happening 
with our email, and what is the likely cause, and, how to 
fix it? 

Thanks in anticipation. 

Bret Busby 
........................................................... 
-- 
_____________________________________________________________
Web-based SMS services available at http://www.operamail.com.
>From your mailbox to local or overseas cell phones.

Powered by Outblaze