Koozali.org: home of the SME Server

Obsolete Releases => SME Server 7.x => Topic started by: smiit on August 20, 2007, 03:14:31 PM

Title: Fetchmail and Spam question
Post by: smiit on August 20, 2007, 03:14:31 PM

After installing and getting reports on Spam Filter Statistics, I see the following line:

Connections from Fetchmail       :        6         

We don't use Fetchmail (that I'm aware of!). 

Are these connections made via Horde Webmail and reported as Fetchmail?  Or do I have some sleuthing to do?

We did have some trouble with a possible local machine infected with a trojan or bot last week - it got us on some blocklists but then cleared up - is it possible something's still lurking on my network?

Thanks.

Title: Re: Fetchmail and Spam question
Post by: cactus on August 20, 2007, 07:09:10 PM

Quote from: smiit on August 20, 2007, 03:14:31 PM

After installing and getting reports on Spam Filter Statistics, I see the following line:

Connections from Fetchmail       :        6         

We don't use Fetchmail (that I'm aware of!). 

Are these connections made via Horde Webmail and reported as Fetchmail?  Or do I have some sleuthing to do?

We did have some trouble with a possible local machine infected with a trojan or bot last week - it got us on some blocklists but then cleared up - is it possible something's still lurking on my network?

Thanks.

Are you sure you did not install smeserver-fetchmail (Mail Retrieval panel in the server-manager)?

Title: Re: Fetchmail and Spam question
Post by: smiit on August 20, 2007, 11:08:34 PM

Quote from: cactus on August 20, 2007, 07:09:10 PM

Are you sure you did not install smeserver-fetchmail (Mail Retrieval panel in the server-manager)?

Not manually, no.

Locate fetchmail shows some files related to Horde and some templates but it appears to be disabled:

Code: [Select]

# config show fetchmail
fetchmail=service
    FreqOffice=every15min
    FreqOutside=every15min
    FreqWeekend=every15min
    Method=standard
    SecondaryMailAccount=popaccount
    SecondaryMailPassword=poppassword
    SecondaryMailServer=mail.myisp.xxx
    status=disabled
#

I'll have to check if a user is pulling in an outside account through their Webmail.

Title: Re: Fetchmail and Spam question
Post by: mmccarn on August 21, 2007, 02:10:53 PM

I think if you search your qpsmtpd log files you'll find 6 entries from hosts that said 'helo localhost' when initiating a spam-delivery session to your server -- at least that's what causes bogus 'fetchmail' entries on my system.

Is this message coming from Brian Read's spamfilter-stats-7.pl script?  If so, make sure you've got the latest version - it was updated on July 12, partially due to this issue.  (I, too, still get 'fetchmail' entries...)

http://wiki.contribs.org/Email_Statistics

Title: Re: Fetchmail and Spam question
Post by: smiit on August 21, 2007, 03:37:03 PM

Quote from: mmccarn on August 21, 2007, 02:10:53 PM

I think if you search your qpsmtpd log files you'll find 6 entries from hosts that said 'helo localhost' when initiating a spam-delivery session to your server -- at least that's what causes bogus 'fetchmail' entries on my system.

Is this message coming from Brian Read's spamfilter-stats-7.pl script?  If so, make sure you've got the latest version - it was updated on July 12, partially due to this issue.  (I, too, still get 'fetchmail' entries...)

http://wiki.contribs.org/Email_Statistics

Thanks!  That's indeed what I found.  Updated script.

Appreciate the info.

Title: Re: Fetchmail and Spam question
Post by: MasthaX on August 21, 2007, 04:03:16 PM

still recieving loads of spam after updating to 7.2. it wont mark it as spam i guess

Title: Re: Fetchmail and Spam question
Post by: cactus on August 21, 2007, 04:18:13 PM

Quote from: MasthaX on August 21, 2007, 04:03:16 PM

still recieving loads of spam after updating to 7.2. it wont mark it as spam i guess

It would be nice if you would not hi-jack other people's thread and make a new topic instead. Furthermore it would be really appreciated if you would give more details about your configuration and the problem you are experiencing. That way we can try to help you solve your problem instead of guessing just like you :-)