Koozali.org: home of the SME Server

3 Questions/issues about mail server

Offline leonp

  • **
  • 43
  • +0/-0
3 Questions/issues about mail server
« on: May 21, 2018, 11:17:40 AM »
Hello, all.
I have the following questions about the mail server:

1. ok_languages.  I set this variable in /etc/mail/spamassassin as:
ok_languages en he ru
and expected to see only these 3 languages, but still I receive 2-3 mails a day in Chinese, not to mention Turkish and Portugal...
When I open the mail headers I can see the UTF-8 encoding used.

2. There is one mail address that sends unwanted mails that I put into black list. checked spelling 10 times, tried it with <> brackets, without brackets, but nothing helps - it appears in my inbox day after day and I don't know what to do to block it.

3. Everything else in the server works fine, I can send/receive mails from withing the local network, I can receive mails from outside and send mails from inside to outside. But trying to send mails from outside using my kmail client fails - kmail says "server error" without any explanation. Again, sending mails with the same kmail from inside works fine. Is there some known issue with kmail?

Thanks a lot ahead for your comments...

Offline Stefano

  • *
  • 10,836
  • +2/-0
Re: 3 Questions/issues about mail server
« Reply #1 on: May 21, 2018, 12:25:09 PM »
Hello, all.
I have the following questions about the mail server:

1. ok_languages.  I set this variable in /etc/mail/spamassassin as:
ok_languages en he ru
and expected to see only these 3 languages, but still I receive 2-3 mails a day in Chinese, not to mention Turkish and Portugal...
When I open the mail headers I can see the UTF-8 encoding used.

take a look at these emails' headers and at the logs (qpsmtpd, spamd)

Quote
2. There is one mail address that sends unwanted mails that I put into black list. checked spelling 10 times, tried it with <> brackets, without brackets, but nothing helps - it appears in my inbox day after day and I don't know what to do to block it.

again, check email headers and your logs.. maybe you're trying to block the wrong address/ip/server

Quote
3. Everything else in the server works fine, I can send/receive mails from withing the local network, I can receive mails from outside and send mails from inside to outside. But trying to send mails from outside using my kmail client fails - kmail says "server error" without any explanation. Again, sending mails with the same kmail from inside works fine. Is there some known issue with kmail?

Thanks a lot ahead for your comments...

we can't help you with your last issue without any kind of log/error message.. again, check your log (sqpsmtpd)

Offline leonp

  • **
  • 43
  • +0/-0
Re: 3 Questions/issues about mail server
« Reply #2 on: May 23, 2018, 11:10:54 AM »
Thank you for the reply.
The first 2 issues require some time to reproduce/catch. But the 3-rd is simple.
So, looking into the sqpsmtpd as you said, I can see the following:

2018-05-22 22:05:46.141887500 20683 Accepted connection 0/10 from 192.168.255.2 / Unknown
2018-05-22 22:05:46.142222500 20683 Connection from Unknown [192.168.255.2]
2018-05-22 22:05:46.537767500 20683 (connect) tls: pass, connect via SMTPS
2018-05-22 22:05:46.572545500 20683 (connect) earlytalker: karma -1 (-1)
2018-05-22 22:05:46.572678500 20683 (connect) earlytalker: fail, remote started talking before we said hello
2018-05-22 22:05:46.573069500 20683 (deny) logging::logterse: ` 192.168.255.2   Unknown            earlytalker   901   Connecting host started transmitting before SMTP greeting   msg denied before queued
2018-05-22 22:05:46.573264500 20683 550 Connecting host started transmitting before SMTP greeting
2018-05-22 22:05:46.575005500 20683 click, disconnecting
2018-05-22 22:05:47.129568500 1896 cleaning up after 20683

Just to underline, that  exactly the same laptop sending mail from within the local network works fine.
Thank you!

Offline Stefano

  • *
  • 10,836
  • +2/-0
Re: 3 Questions/issues about mail server
« Reply #3 on: May 23, 2018, 11:43:28 AM »
Code: [Select]
2018-05-22 22:05:46.572678500 20683 (connect) earlytalker: fail, remote started talking before we said hello
2018-05-22 22:05:46.573069500 20683 (deny) logging::logterse: ` 192.168.255.2   Unknown            earlytalker   901   Connecting host started transmitting before SMTP greeting   msg denied before queued
2018-05-22 22:05:46.573264500 20683 550 Connecting host started transmitting before SMTP greeting

looks like your client is not compliant

Offline leonp

  • **
  • 43
  • +0/-0
Re: 3 Questions/issues about mail server
« Reply #4 on: May 23, 2018, 11:59:30 AM »
Quote
looks like your client is not compliant

Hmmm.... Hard to believe - it is kmail 5.7.3 from KDE Frameworks 5.44.0
Qt 5.9.4 (built against 5.9.4)

And how does it know that it is working from outside?
From inside it works fine...

Offline Stefano

  • *
  • 10,836
  • +2/-0
Re: 3 Questions/issues about mail server
« Reply #5 on: May 23, 2018, 12:06:17 PM »
Quote
And how does it know that it is working from outside?

well.. the incoming connection from an external IP? :-)

just for a test, try using a different email client from the outside on the same machine

BTW, are you using a custom built kmail or does it comes from the packages for your distro?

Offline leonp

  • **
  • 43
  • +0/-0
Re: 3 Questions/issues about mail server
« Reply #6 on: May 23, 2018, 12:50:40 PM »
Quote
well.. the incoming connection from an external IP? 
How does the kmail client controls this? And for what purpose?
Doesn't it simply opens socket to the IP address after DNS resolves what is written in the setup as SMTP server name?

Quote
just for a test, try using a different email client from the outside on the same machine
Via GMAIL works, but... I know :-)
Will try to install "evolution" from Gnome.
An attempt to send mail with telnet failed after the TSL... :-)

Quote
BTW, are you using a custom built kmail or does it comes from the packages for your distro?
It is an ordinary Fedora26...:-)

Offline leonp

  • **
  • 43
  • +0/-0
Re: 3 Questions/issues about mail server
« Reply #7 on: May 24, 2018, 01:13:50 PM »
Quote
Quote
Quote from: leonp on May 21, 2018, 11:17:40 AM
1. ok_languages.  I set this variable in /etc/mail/spamassassin as:
ok_languages en he ru
and expected to see only these 3 languages, but still I receive 2-3 mails a day in Chinese, not to mention Turkish and Portugal...
When I open the mail headers I can see the UTF-8 encoding used.
Take a look at these emails' headers and at the logs (qpsmtpd, spamd)
[/quote]

Thank you for your reply.
Here is the mail in Chinese.
I don't see any criminals in the logs, but...

Here are the message headers:
X-Spam-Status: No, score=3.5 required=5.0 autolearn=disabled
X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on extern.plris.com
X-Spam-Details: *  0.0 HTML_OBFUSCATE_05_10 BODY: Message is 5% to 10% HTML obfuscation
      *  0.0 HTML_MESSAGE BODY: HTML included in message
      *  0.3 HTML_FONT_FACE_BAD BODY: HTML font face is not a word
      *  2.0 PYZOR_CHECK Listed in Pyzor (http://pyzor.sf.net/)
      *  1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
X-Spam-Level: ***
X-HELO: myql.com.cn

And here is the qpsmtpd log:
2018-05-24 13:22:28.148280500 7744 Accepted connection 0/40 from 192.168.255.2 / Unknown
2018-05-24 13:22:28.148808500 7744 Connection from Unknown [192.168.255.2]
2018-05-24 13:22:29.666510500 7744 (connect) earlytalker: pass, not spontaneous
2018-05-24 13:22:29.668089500 7744 (connect) relay: skip, no match
2018-05-24 13:22:29.668943500 7744 220 extern.plris.com ESMTP
2018-05-24 13:22:29.958136500 7744 dispatching EHLO myql.com.cn
2018-05-24 13:22:29.959641500 7744 (ehlo) helo: pass
2018-05-24 13:22:29.960658500 7744 250-plris.com Hi Unknown [192.168.255.2]
2018-05-24 13:22:29.960723500 7744 250-PIPELINING
2018-05-24 13:22:29.960778500 7744 250-8BITMIME
2018-05-24 13:22:29.960840500 7744 250-SIZE 15000000
2018-05-24 13:22:29.960899500 7744 250 STARTTLS
2018-05-24 13:22:30.245168500 7744 dispatching MAIL FROM: <luznednvv@myql.com.cn>
2018-05-24 13:22:44.263275500 7744 (mail) resolvable_fromhost: pass, myql.com.cn has MX at mail.myql.com.cn
2018-05-24 13:22:45.270253500 7744 (mail) sender_permitted_from: skip, tolerated, none, myql.com.cn: No applicable sender policy available
2018-05-24 13:22:45.270479500 7744 (mail) naughty: pass
2018-05-24 13:22:45.271068500 7744 (mail) badmailfrom: pass
2018-05-24 13:22:45.271443500 7744 250 <luznednvv@myql.com.cn>, sender OK - how exciting to get mail from you!
2018-05-24 13:22:45.555421500 7744 dispatching RCPT TO: <leonp@plris.com>
2018-05-24 13:22:45.557149500 7744 (rcpt) badrcptto: pass
2018-05-24 13:22:45.557327500 7744 (rcpt) check_goodrcptto: stripping '-' extensions
2018-05-24 13:22:45.559450500 7744 (rcpt) rcpt_ok: pass: plris.com in rcpthosts
2018-05-24 13:22:45.559681500 7744 250 <leonp@plris.com>, recipient ok
2018-05-24 13:22:45.843338500 7744 dispatching DATA
2018-05-24 13:22:45.843910500 7744 354 go ahead
2018-05-24 13:22:46.156190500 7744 spooling message to disk
2018-05-24 13:22:50.643701500 7749 Accepted connection 1/40 from 192.168.255.2 / Unknown
2018-05-24 13:23:21.661600500 7744 (data_post_headers) dkim: pass, no signature, neutral policy
2018-05-24 13:23:22.001237500 7744 (data_post_headers) dmarc: skip, no policy
2018-05-24 13:23:22.002529500 7744 (data_post) bogus_bounce: pass, not a null sender
2018-05-24 13:23:22.003548500 7744 (data_post) headers: pass
2018-05-24 13:23:22.003745500 7744 (data_post) naughty: pass
2018-05-24 13:23:26.970336500 7744 (data_post) spamassassin: error, reject disabled (Ham, 3.5, learn=disabled)
2018-05-24 13:23:28.435059500 7744 (data_post) virus::clamdscan: pass, clean
2018-05-24 13:23:28.435061500 7744 (queue) logging::logterse: ` 192.168.255.2   Unknown   myql.com.cn   <luznednvv@myql.com.cn>   <leonp@plris.com>   queued      <20180524182248103136@myql.com.cn>   No, score=3.5 required=5.0 autolearn=disable
2018-05-24 13:23:28.441339500 7757 (queue) queue::qmail_2dqueue: (for 7744) Queuing to /var/qmail/bin/qmail-queue
2018-05-24 13:23:28.632819500 7744 250 Queued! 1527157408 qp 7757 <20180524182248103136@myql.com.cn>
2018-05-24 13:23:28.931403500 7744 dispatching QUIT
2018-05-24 13:23:28.931406500 7744 221 plris.com closing connection. Have a wonderful day.
2018-05-24 13:23:28.931409500 7744 click, disconnecting
2018-05-24 13:23:29.690700500 1882 cleaning up after 7744

And here is spamd log:
2018-05-24 13:23:22.037043500 May 24 13:23:22.037 [22370] info: spamd: connection from 127.0.0.1 [127.0.0.1]:41142 to port 783, fd 4
2018-05-24 13:23:22.126186500 May 24 13:23:22.126 [22370] info: spamd: checking message <20180524182248103136@myql.com.cn> for qpsmtpd:1005
2018-05-24 13:23:26.965591500 May 24 13:23:26.965 [22370] info: spamd: clean message (3.5/5.0) for qpsmtpd:1005 in 4.9 seconds, 449063 bytes.
2018-05-24 13:23:26.965989500 May 24 13:23:26.966 [22370] info: spamd: result: . 3 - HTML_FONT_FACE_BAD,HTML_MESSAGE,HTML_OBFUSCATE_05_10,PYZOR_CHECK,RDNS_NONE scantime=4.9,size=449063,user=qpsmtpd,uid=1005,required_score=5.0,rhost=127.0.0.1,raddr=127.0.0.1,rport=41142,mid=<20180524182248103136@myql.com.cn>,autolearn=disabled
2018-05-24 13:23:27.057440500 May 24 13:23:27.057 [2048] info: prefork: child states: II