Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #241129 > unrolled thread

A real bounce between GMX and bendel.debian.org

Back to article view | Back to linux.debian.user

Contents

  A real bounce between GMX and bendel.debian.org "Thomas Schmitt" <scdbackup@gmx.net> - 2021-10-10 22:20 +0200
    Re: A real bounce between GMX and bendel.debian.org "Thomas Schmitt" <scdbackup@gmx.net> - 2021-10-10 22:50 +0200
    Re: A real bounce between GMX and bendel.debian.org Eduardo M KALINOWSKI <eduardo@kalinowski.com.br> - 2021-10-11 03:10 +0200
      Re: A real bounce between GMX and bendel.debian.org "Thomas Schmitt" <scdbackup@gmx.net> - 2021-10-11 10:20 +0200
      Re: A real bounce between GMX and bendel.debian.org Brian <ad44@cityscape.co.uk> - 2021-10-11 14:00 +0200
      Re: A real bounce between GMX and bendel.debian.org Cord Beermann <cord@debian.org> - 2021-10-13 11:20 +0200
    Re: A real bounce between GMX and bendel.debian.org Joe <joe@jretrading.com> - 2021-10-11 09:50 +0200
    Re: A real bounce between GMX and bendel.debian.org Andrei POPESCU <andreimpopescu@gmail.com> - 2021-10-11 12:50 +0200

#241129 — A real bounce between GMX and bendel.debian.org

Hi,

although i seem not to be worth to be targeted by our bounce assassin,
my mail provider and bendel.debian.org are at odds enough to produce
a real bounce message, which then causes a warning mail from
listmaster@lists.debian.org .

I am trying to make sense out of the given bounce report

  https://lists.debian.org/bounces/79gUBBa56gHKY3wtHzNKdg

It is hard to distinguish the hearsay by bendel.debian.org from the
message parts which come from my provider's server mx00.emig.gmx.net.
Especially i wonder from where bendel takes the association to my
mail address (and which mentionings show its conclusions about my
address).

Whatever, the reason for the bounce is that GMX accuses debian-user
of not meeting its requirements
  https://www.gmx.net/mail/senderguidelines
All points there look like they are not volatile problems but rather
persistent ones. But listmaster@lists.debian.org wrote i had
>  1 bounce out of 68 mails in one day (1%, kick-score is 80%)
So why did the other 67 succeed ?


Have a nice day :)

Thomas

[toc] | [next] | [standalone]

#241130

Hi,

complaining towards our saboteur did the trick.

Now i got a mail
  You have been removed from the list
quoting text from my previous mail
  Date: Sun, 10 Oct 2021 22:18:38 +0200
  Message-Id: <21974365322658312150@scdbackup.webframe.org>
and having
  Subject: **stop**
Not much more to learn from that message. It looks like the one reported
by Greg Wooledge when this first occured.

----------------------------------------------------------------------
I Cc listmaster@lists.debian.org to ask:

Does the list server really have to be that vulnerable ?

Was a mail sent to me saying:
  "This is a test mailing, to check if the address ...
   causes bounces, tries to challenge-response or autoresponds
   back to Mailinglists, or Mailinglist-Senders."
and did it bounce ?

What are those rare problems between the list servers and GMX:
>  <scdbackup@gmx.net>: host mx00.emig.gmx.net[212.227.15.9] said:
>  554-Transaction failed 554-Reject due to policy restrictions.
>  554 For explanation visit
>  https://www.gmx.net/mail/senderguidelines?ip=82.195.75.100&c=hi
>  (in reply to end of DATA command)
which were mentioned in the warning about a real bounce ?
  https://lists.debian.org/bounces/79gUBBa56gHKY3wtHzNKdg

Please consider to disable the automatic unsubscription until the bounce
interpretation can stand the world out there.


Have a nice day :)

Thomas

[toc] | [prev] | [next] | [standalone]

#241145

On 10/10/2021 17:18, Thomas Schmitt wrote:
> Hi,
>
> although i seem not to be worth to be targeted by our bounce assassin,
> my mail provider and bendel.debian.org are at odds enough to produce
> a real bounce message, which then causes a warning mail from
> listmaster@lists.debian.org .
>
> I am trying to make sense out of the given bounce report
>
>    https://lists.debian.org/bounces/79gUBBa56gHKY3wtHzNKdg
>
> It is hard to distinguish the hearsay by bendel.debian.org from the
> message parts which come from my provider's server mx00.emig.gmx.net.
> Especially i wonder from where bendel takes the association to my
> mail address (and which mentionings show its conclusions about my
> address).
>
> Whatever, the reason for the bounce is that GMX accuses debian-user
> of not meeting its requirements
>    https://www.gmx.net/mail/senderguidelines
> All points there look like they are not volatile problems but rather
> persistent ones. But listmaster@lists.debian.org wrote i had
>>   1 bounce out of 68 mails in one day (1%, kick-score is 80%)
> So why did the other 67 succeed ?

That seems unrelated to the OVH bounces.

My mailserver bounced the same email (and I got a warning like that). 
Since I run my own mailserver, and can look at the logs and see exactly 
why it has been rejected, and here's what I got:

2021-10-10 16:07:37 1mZeAb-0005Mc-Hn H=bendel.debian.org 
[2001:41b8:202:deb:216:36ff:fe40:4002] 
X=TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256 CV=no 
F=<bounce-debian-user=eduardo=kalinowski.com.br@lists.debian.org> 
rejected after DATA: header syntax (malformed address: >\n may not 
follow Pierre-Elliott =?utf-8?Q?B=C3=A9cue?= <peb@debian.org>: failing 
address in "From:" header is: Pierre-Elliott =?utf-8?Q?B=C3=A9cue?= 
<peb@debian.org>>): malformed address: >\n may not follow Pierre-Elliott 
=?utf-8?Q?B=C3=A9cue?= <peb@debian.org>: failing address in "From:" 
header is: Pierre-Elliott =?utf-8?Q?B=C3=A9cue?= <peb@debian.org>>

And this is From header:

From: Pierre-Elliott =?utf-8?Q?B=C3=A9cue?= <peb@debian.org>>

(There does seem to be an extra > in there.)


In this case, my server bounced a mail, and so the listserver is correct 
in sending me that notification. And since it was just one email, I did 
not get unsubscribed.

However, perhaps the listserver should have not accepted that email with 
the (possibly) invalid From header in the first place.

[toc] | [prev] | [next] | [standalone]

#241154

Hi,

i got unsubscribed a second time:
  Date: Mon, 11 Oct 2021 07:45:53 +0000 (UTC)
  From: debian-user-request@lists.debian.org
  Message-Id: <20211011074553.C8C2820462@bendel.debian.org>

My proposal is to disable the auto unsubscription feature, which is an
unusual behavior of a mailing list. It is just too vulnerable to external
interference.


Dan Ritter wrote:
> The cannon appears to be manually aimed.

I get this impression too. My first unsubscription happened immediately
after i expressed my disappointment about not being targeted.
Further i doubt that any normal mail server can be configured to produce
fake bounces.
I think that we see genuine malware at work.


> Subscribe to debian-user with an alias which goes where you want
> it, and continue posting as scdbackup@gmx.net.
> [...]
> I hope that helps until the listmasters figure out how to avoid
> accepting conunterfeit evidence.

I still riddle whether the test mails have been discontinued after only
one day of use, or whether my test mail fell into the same pit at GMX as
did the (actually unsuspicious) mail
  From: Pierre-Elliott =?utf-8?Q?B=C3=A9cue?= <peb@debian.org>>
  Subject: Re: Then it happened to me...
  Date: Sun, 10 Oct 2021 21:05:44 +0200
  Message-ID: <87lf303dit.fsf@jaatynyt>


Eduardo M KALINOWSKI wrote:
> My mailserver bounced the same email (and I got a warning like that).
> Since I run my own mailserver, and can look at the logs and see exactly
> why it has been rejected, and here's what I got:
> [...] header syntax (malformed address: >\n may not follow
> Pierre-Elliott =?utf-8?Q?B=C3=A9cue?= <peb@debian.org> [...]

So Pierre-Elliot Bécue wrote an accent aigu in his name which the mail
server disliked.
I remember to have had own mails rejected by GMX when i wrote non-ASCII
characters in the Subject: header. But i did not bother to encode them
as quoted printable.

RFC 2047 permits such a From line:
  "5. Use of encoded-words in message headers
   An 'encoded-word' may appear in a message header or body part header
   according to the following rules:
   [...]
   (3) As a replacement for a 'word' entity within a 'phrase', for example,
   one that precedes an address in a From, To, or Cc header. [...]
  "
In "8. Examples" there is no "utf-8" to see, but the examples with
  =?ISO-8859-1?Q? ... ?=
look similar enough.

We cannot deny a list user the right to write his own name into "From:".
And hardly i can influence GMX to accept Q-encoded UTF-8.

Whatever, this cannot be the same reason why GMX would bounce a test mail
from listmaster@lists.debian.org as quited by piorunz in
  https://lists.debian.org/msgid-search/9492fecf-89a8-3932-7740-f437beac5497@gmx.com
  Date: Fri, 8 Oct 2021 19:41:31 +0100

So i assume that such a mail was not sent to me. Pity. It seemed to be a
good idea to reduce the false unsubscriptions.


Have a nice day :)

Thomas

[toc] | [prev] | [next] | [standalone]

#241178

On Sun 10 Oct 2021 at 22:07:28 -0300, Eduardo M KALINOWSKI wrote:

> On 10/10/2021 17:18, Thomas Schmitt wrote:
> > Hi,
> > 
> > although i seem not to be worth to be targeted by our bounce assassin,
> > my mail provider and bendel.debian.org are at odds enough to produce
> > a real bounce message, which then causes a warning mail from
> > listmaster@lists.debian.org .
> > 
> > I am trying to make sense out of the given bounce report
> > 
> >    https://lists.debian.org/bounces/79gUBBa56gHKY3wtHzNKdg
> > 
> > It is hard to distinguish the hearsay by bendel.debian.org from the
> > message parts which come from my provider's server mx00.emig.gmx.net.
> > Especially i wonder from where bendel takes the association to my
> > mail address (and which mentionings show its conclusions about my
> > address).
> > 
> > Whatever, the reason for the bounce is that GMX accuses debian-user
> > of not meeting its requirements
> >    https://www.gmx.net/mail/senderguidelines
> > All points there look like they are not volatile problems but rather
> > persistent ones. But listmaster@lists.debian.org wrote i had
> > >   1 bounce out of 68 mails in one day (1%, kick-score is 80%)
> > So why did the other 67 succeed ?
> 
> That seems unrelated to the OVH bounces.

Agreed.
 
> My mailserver bounced the same email (and I got a warning like that). Since
> I run my own mailserver, and can look at the logs and see exactly why it has
> been rejected, and here's what I got:
> 
> 2021-10-10 16:07:37 1mZeAb-0005Mc-Hn H=bendel.debian.org
> [2001:41b8:202:deb:216:36ff:fe40:4002]
> X=TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256 CV=no
> F=<bounce-debian-user=eduardo=kalinowski.com.br@lists.debian.org> rejected
> after DATA: header syntax (malformed address: >\n may not follow
> Pierre-Elliott =?utf-8?Q?B=C3=A9cue?= <peb@debian.org>: failing address in
> "From:" header is: Pierre-Elliott =?utf-8?Q?B=C3=A9cue?= <peb@debian.org>>):
> malformed address: >\n may not follow Pierre-Elliott =?utf-8?Q?B=C3=A9cue?=
> <peb@debian.org>: failing address in "From:" header is: Pierre-Elliott
> =?utf-8?Q?B=C3=A9cue?= <peb@debian.org>>

Confirmed.
 
> And this is From header:
> 
> From: Pierre-Elliott =?utf-8?Q?B=C3=A9cue?= <peb@debian.org>>
> 
> (There does seem to be an extra > in there.)

It is real enough and can be seen in the list archives at

  https://lists.debian.org/debian-user/2021/10/msg00429.html

The extra > is not evident at

  https://lists.debian.org/debian-devel-announce/2020/04/msg00015.html

It looks like Pierre-Elliott Bécue has some fixing to do. In case he has
ceased to follow this thread, there is a Cc to him.
 
> In this case, my server bounced a mail, and so the listserver is correct in
> sending me that notification. And since it was just one email, I did not get
> unsubscribed.
> 
> However, perhaps the listserver should have not accepted that email with the
> (possibly) invalid From header in the first place.

Postfix is used by bendel. I trust the RFC compliancy of Exim.

-- 
Brian.
> 
> 

[toc] | [prev] | [next] | [standalone]

#241262

Hallo! Du (Eduardo M KALINOWSKI) hast geschrieben:

> My mailserver bounced the same email (and I got a warning like that). Since
> I run my own mailserver, and can look at the logs and see exactly why it has
> been rejected, and here's what I got:
> 
> 2021-10-10 16:07:37 1mZeAb-0005Mc-Hn H=bendel.debian.org
> [2001:41b8:202:deb:216:36ff:fe40:4002]
> X=TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256 CV=no
> F=<bounce-debian-user=eduardo=kalinowski.com.br@lists.debian.org> rejected
> after DATA: header syntax (malformed address: >\n may not follow
> Pierre-Elliott =?utf-8?Q?B=C3=A9cue?= <peb@debian.org>: failing address in
> "From:" header is: Pierre-Elliott =?utf-8?Q?B=C3=A9cue?= <peb@debian.org>>):
> malformed address: >\n may not follow Pierre-Elliott =?utf-8?Q?B=C3=A9cue?=
> <peb@debian.org>: failing address in "From:" header is: Pierre-Elliott
> =?utf-8?Q?B=C3=A9cue?= <peb@debian.org>>
> 
> And this is From header:
> 
> From: Pierre-Elliott =?utf-8?Q?B=C3=A9cue?= <peb@debian.org>>
> 
> (There does seem to be an extra > in there.)
> 
> 
> In this case, my server bounced a mail, and so the listserver is correct in
> sending me that notification. And since it was just one email, I did not get
> unsubscribed.
> 
> However, perhaps the listserver should have not accepted that email with the
> (possibly) invalid From header in the first place.

Thanks for your analysis. The bounces we got (not only from
GMX/Web.de) only complain about RfC-violation, but didn't show why.

We now disabled bounce-detection if it is related to that.

We'll check how to be more strict in accepting these kind of mails
now.

Yours,
        Cord, Debian Listmaster of the day
-- 
https://lists.debian.org

[toc] | [prev] | [next] | [standalone]

#241148

On Sun, 10 Oct 2021 22:18:38 +0200
"Thomas Schmitt" <scdbackup@gmx.net> wrote:


> 
> Whatever, the reason for the bounce is that GMX accuses debian-user
> of not meeting its requirements
>   https://www.gmx.net/mail/senderguidelines
> All points there look like they are not volatile problems but rather
> persistent ones. But listmaster@lists.debian.org wrote i had
> >  1 bounce out of 68 mails in one day (1%, kick-score is 80%)  
> So why did the other 67 succeed ?
> 
>

My mail server has occasionally bounced a debian-user message,
complaining about a lack of DNS response. It only ever happens to one
message, so I've always assumed it was just a temporary delay in DNS
reply.

-- 
Joe

[toc] | [prev] | [next] | [standalone]

#241168

[Multipart message — attachments visible in raw view] — view raw

On Du, 10 oct 21, 22:18:38, Thomas Schmitt wrote:
> Hi,
> 
> although i seem not to be worth to be targeted by our bounce assassin,
> my mail provider and bendel.debian.org are at odds enough to produce
> a real bounce message, which then causes a warning mail from
> listmaster@lists.debian.org .
> 
> I am trying to make sense out of the given bounce report
> 
>   https://lists.debian.org/bounces/79gUBBa56gHKY3wtHzNKdg

Yeah, got the same from listmaster, for the same exact message (I 
receive list mail via GMX too).
 
> It is hard to distinguish the hearsay by bendel.debian.org from the
> message parts which come from my provider's server mx00.emig.gmx.net.
> Especially i wonder from where bendel takes the association to my
> mail address (and which mentionings show its conclusions about my
> address).
> 
> Whatever, the reason for the bounce is that GMX accuses debian-user
> of not meeting its requirements
>   https://www.gmx.net/mail/senderguidelines
> All points there look like they are not volatile problems but rather
> persistent ones. But listmaster@lists.debian.org wrote i had
> >  1 bounce out of 68 mails in one day (1%, kick-score is 80%)
> So why did the other 67 succeed ?

My uneducated guess would be that GMX is applying additional 
undocumented criteria when deciding whether a message is spam or not, 
e.g. it might be that they didn't like the From: or something else 
entirely.

In any case (as far as I understand) bouncing is wrong, because it can 
be abused by real spammers.

Kind regards,
Andrei
-- 
http://wiki.debian.org/FAQsFromDebianUser

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web