Re: ssl with dslextreme.com attempts to send a spurious email

Hi Joanne,

Copying back in the list, and quoting verbosely...

> > I think it would be worthing checking in Centos's package-upgrade
> > log to see what packages upgraded around 2019-Apr-04 when the
> > symptom appeared.
>
> I started to do that but checked back in logs first. The issue
> happened intermittently well before it went bad. Clamav was updated on
> that date. It is used in the spamassassin processing using spamd. So
> if it was a spamassassin thing spamd would be opening the port or
> procmail would be opening the port.  Auditd showed it was fetchmail
> that opened the port.

I don't think that's true.  I think Clamav/Spamassassin can feed back
the status to fetchmail that then sends the bounce.

> > > > JkiO@JkiO----------------------.{MUNG]us-west-2.compute.amazonaws.com.
> > 
> > That looks like an address in an incoming email that's being
> > processed?
>
> That has occurred to me. However there are two SSL accounts with DSL
> Extreme and if either one of them is disabled the emails continue.
> Furthermore, if both are enabled I do not get pairs of emails. So I am
> scratching my head furiously.
>
> > > > set no bouncemail
> > > > set no spambounce
>
> Ayup. And I had been using ONE of the ssl usernames for years with
> only very sporadic events until it became a regular thing about April
> 4th this year. I enabled the second account, though, the better part
> of a year ago.
>
> I played some testing games. The specific address for the email
> bounces. So at least for now it is safe. I think I shall see what
> happens refreshing the install for fetchmail in a day or two.

-- 
Cheers, Ralph.