Deadly embrace.

Hi Majordomo users,

My majordomo server (which has been working fine for years) was
in a deadly embrace with a mailer-daemon on the net.  Several
times a minute they errored to each other, here's a sample.

It was presumably caused by a spammer masquerading as the remote
server domain.

[email protected] did not answer this morning (& gone
midnight on a weekday in my TZ when I temprorarily stopped this occurence.

A test mail to [email protected] just gave Russian,
no idea what it means.

Here's what's sent to me as majordomo-owner:
  ----------------------
  From MAILER-DAEMON Wed Jan 26 23:45:20 2011
  Received: from park.js.berklix.net (park.js.berklix.net [192.168.91.31])
  	by fire.js.berklix.net (8.14.3/8.14.3) with ESMTP id p0QMjKO4001025
  	for <[email protected]>; Wed, 26 Jan 2011 23:45:20 +0100 (CET)
  Received: from park.js.berklix.net (localhost.js.berklix.net [127.0.0.1])
  	by park.js.berklix.net (8.13.8/8.13.8) with ESMTP id p0QMj4Fd005355
  	for <jhs@localhost>; Wed, 26 Jan 2011 23:45:20 +0100 (CET)
  Received: from tower.berklix.org [83.236.223.114]
  	by park.js.berklix.net with POP3 (fetchmail-6.3.4)
  	for <jhs@localhost> (single-drop); Wed, 26 Jan 2011 23:45:20 +0100 (CET)
  Received: from te.net.ua (Te.NeT.UA [195.138.80.34])
  	by tower.berklix.org (8.14.2/8.14.2) with ESMTP id p0QMikWE039708
  	for <[email protected]>; Wed, 26 Jan 2011 22:44:47 GMT
  Subject: Undeliverable mail: Majordomo results: Re: Majordomo results: Re: Majordomo res
  From: <[email protected]>
  To: <[email protected]>
  Date: Thu, 27 Jan 2011 00:44:46 +0200
  Message-ID: <[email protected]>
  X-MAPI-Message-Class: REPORT.IPM.Note.NDR
  MIME-Version: 1.0
  Content-Type: multipart/report; report-type="delivery-status"; boundary="_===234350153====te.net.ua===_"
  
  
  --_===234350153====te.net.ua===_
  Content-Type: text/plain; charset="utf-8"
  
  Failed to deliver to '<[email protected]>'
  LOCAL module(account skrudge) reports:
   account is full (quota exceeded)
  
  
  --_===234350153====te.net.ua===_
  Content-Type: message/delivery-status
  
  Reporting-MTA: dns; te.net.ua
  
  Original-Recipient: rfc822;<[email protected]>
  Final-Recipient: LOCAL;<skrudge>
  Action: failed
  Status: 5.0.0
  
  --_===234350153====te.net.ua===_
  Content-Type: text/rfc822-headers
  
  Received: from tower.berklix.org ([83.236.223.114] verified)
    by te.net.ua (CommuniGate Pro SMTP 5.1.16)
    with ESMTPS id 234350199 for [email protected]; Thu, 27 Jan 2011 00:44:43 +0200
  Received-SPF: none
   receiver=te.net.ua; client-ip=83.236.223.114; [email protected]
  Received: from tower.berklix.org (localhost [127.0.0.1])
  	by tower.berklix.org (8.14.2/8.14.2) with ESMTP id p0QMiZai039704
  	for <[email protected]>; Wed, 26 Jan 2011 22:44:35 GMT
  	(envelope-from [email protected])
  Received: (from majordom@localhost)
  	by tower.berklix.org (8.14.2/8.14.2/Submit) id p0QMiZdD039703;
  	Wed, 26 Jan 2011 22:44:35 GMT
  	(envelope-from [email protected])
  Date: Wed, 26 Jan 2011 22:44:35 GMT
  Message-Id: <[email protected]>
  X-Authentication-Warning: tower.berklix.org: majordom set sender to [email protected] using -f
  To: [email protected]
  From: [email protected]
  Subject: Majordomo results: Re: Majordomo results: Re: Majordomo res
  Reply-To: [email protected]
  
  --_===234350153====te.net.ua===_--
  
  ----------------------

Though the above only shows their mailer-daemon talking to my
Majordomo-owner@ I can see from my sendmail /var/log/maillog that 
they are actually also sending to my majordomo@, hence the loop:

  <-- MAIL FROM:<[email protected]> SIZE=448
  --- 250 2.1.0 <[email protected]>... Sender ok
  <-- RCPT TO:<[email protected]> NOTIFY=NEVER
  --- 250 2.1.5 <[email protected]>... Recipient ok
  ....
  p0QNSOcF042427: clone: owner=majordomo-owner

I had in majordomo.cf (for maybe last year or so):

  $majordomo_dont_reply = '(_dhcp|_pflogd|abuse|admin|apache|avahi|bind|bin|copyright|cups|cyrus|daemon|dhcpd|dumper|exmh-bug-master|faxmanager|faxmaster|fetchmail|ftp-admin|ftp-bugs|ftpmaster|ftp|games|haldaemon|hostmaster|kmem|listproc|listserv|mailer-daemon|mailman|mailnull|majordomo-h|majordomo-owner|majordomo1|majordomo2|majordomo3|majordomo|majordom|man|messagebus|msgs|nagios|newsmaster|news|nobody|null-notify|operator|owner-majordomo|polkit|pop|postmaster|proxy|release|root|saned|smmsp|squid|sshd|subscribe|system|toor|tty|usenet|uucp|webmaster|www-test|www|xten)\@';

OK, maybe that was too much for some limit so I reduced to:

  $majordomo_dont_reply = '(abuse|daemon|listproc|listserv|mailer-daemon|mailman|majordomo-h|majordomo-owner|majordomo1|majordomo2|majordomo3|maj
ordomo|majordom|owner-majordomo|postmaster|root|smmsp|system|uucp)\@';

(the 1 2 3 are some multi server (semi) resilience hooks I've had in there
 for years, done no harm till now, if even now )

Even editing majordomo.cf down to default
  $majordomo_dont_reply = '(mailer-daemon|uucp|listserv|majordomo|listproc)\@';
does not stop my majordomo Log keep addding lines:

Jan 27 00:47:23 berklix.org majordomo[47199] {<[email protected]>} help
Jan 27 00:47:38 berklix.org majordomo[47216] {<[email protected]>} help

( It presumably sends help because no recognised commands,
I dont see the word help in what I receive.

Putting
  /failed\s*to\s*deliver\s*to/i
into
  global_taboo_body 
doesnt stop it.

As an emergency fix I just did:
  cd /var/spool/mqueue ; rm -f `grep -l [email protected]`

But that of course does not make our majordomos safe from a repeat
thats bound to occur sometime.

Any ideas ?

Cheers,
Julian
-- 
Julian Stacey, BSD Unix Linux C Sys Eng Consultants Munich http://berklix.com
 Mail plain text;  Not quoted-printable, Not HTML, Not base 64.
 Reply below text sections not at top, to avoid breaking cumulative context.