Topic: check_earlytalker dropping connections even though remote has not talked?

[Michail Pappas]

Hello all,

I've got a relay server from ISP backing up and relaying to my own mail server (SME box). However, the server starts comms too early, resulting the messages being blocked:

Code: [Select]

@4000000050b7515206bf033c 20583 Accepted connection 0/40 from X.Y.Z.W / the.relay
@4000000050b7515206da8a1c 20583 Connection from the.relay [X.Y.Z.W]
@4000000050b7515208622fd4 20583 tls plugin (init): ciphers: ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM
@4000000050b751520a9c87a4 20583 tls plugin (init): ciphers: ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM
@4000000050b7515211071f8c 20583 tls plugin (init): ciphers: ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM
@4000000050b75152144b55dc 20583 check_earlytalker plugin (connect): remote host started talking before we said hello [X.Y.Z.W]
@4000000050b75152146daaec 20583 logging::logterse plugin (deny): ` X.Y.Z.W the.relay                         check_earlytalker       902     Connecting host started transmitting before SMTP greeting    msg denied before queued
@4000000050b7515214813abc 20583 450 Connecting host started transmitting before SMTP greeting
@4000000050b7515214935f44 20583 click, disconnecting
@4000000050b751522cb941c4 3534 cleaning up after 20583

This server is legit, and according to the ISP support it seems that they are reluctant to fix their issue. Furthermore, there is no option for me to change ISP; they provide the entire WAN intranet.

One option would be then to drop that server as a relay. Are there any alternatives, like having the specific the.relay system not checked by check_earlytalker at all? I have found http://wiki.contribs.org/Qpsmtpd_check_earlytalker, but if I understand that article correctly it effectively increases the delay in order (I presume) to block more spamming SMTP software.

I definitely would not like losing check_earlytalker; it has proved invaluable in blocking incoming spam.

Any ideas will be appreciated, thanks in advance.

[Michail Pappas]

And some more info on the matter: I've been informed by the ISP techs that their relay system is postfix and they have no record/known issues with "systems that utilize greet pauses".

[Michail Pappas]

Checking the logs, this does not always happen:

Code: [Select]

@4000000050b829c20332b7cc 23570 Accepted connection 0/40 from X.Y.Z.W / the.relay
@4000000050b829c30de0ecd4 23570 check_earlytalker plugin (connect): remote host said nothing spontaneous, proceeding
...
@4000000050b82c7a0222e1f4 23585 Accepted connection 0/40 from X.Y.Z.W / the.relay
@4000000050b82c7b1259614c 23585 check_earlytalker plugin (connect): remote host said nothing spontaneous, proceeding
[code]

Same day, another moment

[code]@4000000050b8406214a97784 23702 Accepted connection 0/40 from X.Y.Z.W / the.relay
@4000000050b840623807dd4c 23702 check_earlytalker plugin (connect): remote host started talking before we said hello [X.Y.Z.W]
@4000000050b84062393eb76c 23702 logging::logterse plugin (deny): ` X.Y.Z.W the.relay                         check_earlytalker       902     Connecting host started transmitting before SMTP greeting       msg denied before queued
It could still be an issue of postfix talking early, but AFAIK postfix respects the standard, waiting for the 220 greeting before sending. Buffled...

[mmccarn]

I have a vague memory of check_earlytalker errors that I fixed by disabling TLS.

You might try:

Code: [Select]

config setprop qpsmtpd TlsBeforeAuth 0
signal-event email-update


If this doesn't  help, you can undo it using:

Code: [Select]

config setprop qpsmtpd TlsBeforeAuth 1
signal-event email-update


[CharlieBrady]

It could still be an issue of postfix talking early, but AFAIK postfix respects the standard, waiting for the 220 greeting before sending. Buffled...

I'd be very, very surprised if postfix had such a problem.

I'd recommend you use tcpdump to generate a packet capture file, and open a bug report.

[Michail Pappas]

I've already made some tcpdump captures, from the looks of it it a bug report will definitely be needed. Will get on it on Monday.

[Michail Pappas]

I have a vague memory of check_earlytalker errors that I fixed by disabling TLS.

You might try:

Code: [Select]

config setprop qpsmtpd TlsBeforeAuth 0
signal-event email-update


Forgot to mention that my system was already configured to have TlsBeforeAuth set to 0:

Code: [Select]

# config getprop qpsmtpd TlsBeforeAuth
0

Opened bug# 7181 for this case.