Topic: Fetchmail and Spam question

[smiit]

After installing and getting reports on Spam Filter Statistics, I see the following line:

Connections from Fetchmail       :        6         

We don't use Fetchmail (that I'm aware of!). 

Are these connections made via Horde Webmail and reported as Fetchmail?  Or do I have some sleuthing to do?

We did have some trouble with a possible local machine infected with a trojan or bot last week - it got us on some blocklists but then cleared up - is it possible something's still lurking on my network?

Thanks.

[cactus]

After installing and getting reports on Spam Filter Statistics, I see the following line:

Connections from Fetchmail       :        6         

We don't use Fetchmail (that I'm aware of!). 

Are these connections made via Horde Webmail and reported as Fetchmail?  Or do I have some sleuthing to do?

We did have some trouble with a possible local machine infected with a trojan or bot last week - it got us on some blocklists but then cleared up - is it possible something's still lurking on my network?

Thanks.

Are you sure you did not install smeserver-fetchmail (Mail Retrieval panel in the server-manager)?

[smiit]

Are you sure you did not install smeserver-fetchmail (Mail Retrieval panel in the server-manager)?

Not manually, no.

Locate fetchmail shows some files related to Horde and some templates but it appears to be disabled:

Code: [Select]

# config show fetchmail
fetchmail=service
    FreqOffice=every15min
    FreqOutside=every15min
    FreqWeekend=every15min
    Method=standard
    SecondaryMailAccount=popaccount
    SecondaryMailPassword=poppassword
    SecondaryMailServer=mail.myisp.xxx
    status=disabled
#

I'll have to check if a user is pulling in an outside account through their Webmail.

[mmccarn]

I think if you search your qpsmtpd log files you'll find 6 entries from hosts that said 'helo localhost' when initiating a spam-delivery session to your server -- at least that's what causes bogus 'fetchmail' entries on my system.

Is this message coming from Brian Read's spamfilter-stats-7.pl script?  If so, make sure you've got the latest version - it was updated on July 12, partially due to this issue.  (I, too, still get 'fetchmail' entries...)

http://wiki.contribs.org/Email_Statistics

[smiit]

I think if you search your qpsmtpd log files you'll find 6 entries from hosts that said 'helo localhost' when initiating a spam-delivery session to your server -- at least that's what causes bogus 'fetchmail' entries on my system.

Is this message coming from Brian Read's spamfilter-stats-7.pl script?  If so, make sure you've got the latest version - it was updated on July 12, partially due to this issue.  (I, too, still get 'fetchmail' entries...)

http://wiki.contribs.org/Email_Statistics

Thanks!  That's indeed what I found.  Updated script.

Appreciate the info.

[MasthaX]

still recieving loads of spam after updating to 7.2. it wont mark it as spam i guess

[cactus]

still recieving loads of spam after updating to 7.2. it wont mark it as spam i guess

It would be nice if you would not hi-jack other people's thread and make a new topic instead. Furthermore it would be really appreciated if you would give more details about your configuration and the problem you are experiencing. That way we can try to help you solve your problem instead of guessing just like you