21.07.2017 20:36, Werner Flamme пишет:

Hi,

this morning, my company's postmaster sent me an excerpt from the mail log stating that there is some software on one of my boxes that doesn't speak proper IMAP.

19-Jul-2017 22:38:33.49 tcp_local BS 0 rfc822; a1 LOGOUT 500 5.5.1 Unknown command "a1 LOGOUT" specified TCP|a.b.c.d|465|a.b.e.f|48270

The thing that I find most interesting is that I do not have any entries in /var/log/mail at this time. Some minutes earlier and some minutes later there are, but not at this time. Both hosts use the same time source.

So I guess that there is a script running on the box that reads the postfix config entry for its relayhost (postconf -h relayhost) and sends a mail all by itself. And doing so, it uses a wrong IMAP command, LOGOUT instead of QUIT.

The only LOGOUT in found outside binary files is in . As far as I understand the code, near line 1200 the command LOGOUT is sent to the mailhost.

How can I find the script that uses this module? The file belongs to ruby2.1-stdlib, and this is required (rpm) by ruby2.1 only. This itself

This is just library; it is the same as looking at libc and asking which program is using it.

is required only by ruby, which in turn ist required by ruby-devel, yast2-services-manager and yast2-ruby-bindings.

Would any of those packages run a script that bypasses my local MTA? None of them has an entry in /etc/cron*. And none of the entries in /etc/cron* is scheduled at this time...

So, how could a find the script that is responsible for the mail log entries that my postmaster showed me?

BTW, just to make sure the ruby library is the right place, I modified the code a bit so that it should send QUIT now. If there are no more log entries from that host on monday, I can be sure to have found the proper place. But I still do not now how to locate the script...

You could add statement that logs program name at this point. I have zero experience with ruby but I'm sure there is standard way to obtain it. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 21/07/17 01:36 PM, Werner Flamme wrote:

Hi,

this morning, my company's postmaster sent me an excerpt from the mail log stating that there is some software on one of my boxes that doesn't speak proper IMAP.

19-Jul-2017 22:38:33.49 tcp_local BS 0 rfc822; a1 LOGOUT 500 5.5.1 Unknown command "a1 LOGOUT" specified TCP|a.b.c.d|465|a.b.e.f|48270

It may be that the Ruby stuff is a sideline, an artefact from interpretation of the logs. It is unclear from the way way you've presented the communication from the Postmaster whether he's telling you that there is an IMAP server running on your machine or if there is an IMAP client. As far as I recall Postfix is only about SMTP. The 'fuser' program (RTFM) can identify what programs are making use of network sockets. There is also 'socklist'. An IMAP server will listen on port 143. An IMAP client, such as Thunderbird in my case, access port 143 on a remote machine # socklist | grep 143 type port inode uid pid fd name tcp 143 27363 0 1478 37 dovecot tcp 143 201937 477 28599 7 imap tcp 40406 204085 501 3794 143 thunderbird-bin tcp 143 203248 477 28609 7 imap tcp 143 201956 477 28602 7 imap # grep 477 /etc/passwd dovenull:x:477:475:User for Dovecot login:/var/run/dovecot:/bin/false # fuser -n tcp -u -v 143 USER PID ACCESS COMMAND 143/tcp: root 1478 F.... (root)dovecot anton 28602 F.... (anton)imap anton 28609 F.... (anton)imap I'm also running Postscript which is listening on port 25 # fuser -n tcp -u -v 25 USER PID ACCESS COMMAND 25/tcp: root 1687 F.... (root)master Once again, please do clarify what your Postmaster actually means. Also, please note that Postfix and Dovecot, and I should think any legitimate mail server, have their own log files. HOWEVER if there is a trojan or a rogue or undocumented or 'custom' service, be it a listener or a client, there is no guarantee that the coder included or activated calls to syslog. That I why I suggest looking at the actual ports in use and other information under /proc rather than the log files. -- A: Yes. > Q: Are you sure? >> A: Because it reverses the logical flow of conversation. >>> Q: Why is top posting frowned upon? -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 2017-07-21 19:36, Werner Flamme wrote:

Hi,

this morning, my company's postmaster sent me an excerpt from the mail log stating that there is some software on one of my boxes that doesn't speak proper IMAP.

19-Jul-2017 22:38:33.49 tcp_local BS 0 rfc822; a1 LOGOUT 500 5.5.1 Unknown command "a1 LOGOUT" specified TCP|a.b.c.d|465|a.b.e.f|48270

The thing that I find most interesting is that I do not have any entries in /var/log/mail at this time. Some minutes earlier and some minutes later there are, but not at this time. Both hosts use the same time source.

So I guess that there is a script running on the box that reads the postfix config entry for its relayhost (postconf -h relayhost) and sends a mail all by itself. And doing so, it uses a wrong IMAP command, LOGOUT instead of QUIT.

This is not consistent. Postfix talks SMTP, not IMAP. You can not send an email using IMAP. If someone is using IMAP, the server component would be dovecot, cyrus, or something else. Not postfix. You have to first identify which mail server component is really affected. Ie, what is "tcp_local"? Google search indicates Oracle and SMTP, so it is impossible this can be an IMAP command. -- Cheers / Saludos, Carlos E. R. (from 42.2 x86_64 "Malachite" at Telcontar)

Carlos E. R. [22.07.2017 14:22]:

On 2017-07-21 19:36, Werner Flamme wrote:

...

Hi,

this morning, my company's postmaster sent me an excerpt from the mail log stating that there is some software on one of my boxes that doesn't speak proper IMAP.

19-Jul-2017 22:38:33.49 tcp_local BS 0 rfc822; a1 LOGOUT 500 5.5.1 Unknown command "a1 LOGOUT" specified TCP|a.b.c.d|465|a.b.e.f|48270

The thing that I find most interesting is that I do not have any entries in /var/log/mail at this time. Some minutes earlier and some minutes later there are, but not at this time. Both hosts use the same time source.

So I guess that there is a script running on the box that reads the postfix config entry for its relayhost (postconf -h relayhost) and sends a mail all by itself. And doing so, it uses a wrong IMAP command, LOGOUT instead of QUIT.

This is not consistent.

Aye.

Postfix talks SMTP, not IMAP. You can not send an email using IMAP.

*I* don't. Something not yet identified on my host tries to do so.

If someone is using IMAP, the server component would be dovecot, cyrus, or something else. Not postfix.

Exactly. Since there are neither dovecot nor cyrus on this host, I'm looking for "something else". This is what I called "mysterious mailer". BTW, I don't believe that dovecot would open an SMTP connection to port 465 and try to end an IMAP conversion here. It was an SMTP dialogue all right up to here, since my Postmaster says due to this false finishing command the sessions keep hanging and the mail is sent later only.

You have to first identify which mail server component is really affected. Ie, what is "tcp_local"?

Google search indicates Oracle and SMTP, so it is impossible this can be an IMAP command.

tcp_local is used on that central internal MX. AFAIK it is running Oracle Communications software. The logs are from the SMTP queues. So I'm looking for something that uses an IMAP command in an SMTP dialogue to end it. Werner -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 2017-07-24 12:09, Werner Flamme wrote:

Carlos E. R. [22.07.2017 14:22]:

...

This is not consistent.

Aye.

...

Postfix talks SMTP, not IMAP. You can not send an email using IMAP.

*I* don't. Something not yet identified on my host tries to do so.

Yes, I see from your other response that this is something very different and strange. ...

tcp_local is used on that central internal MX. AFAIK it is running Oracle Communications software.

The logs are from the SMTP queues. So I'm looking for something that uses an IMAP command in an SMTP dialogue to end it.

I would be considering malware at this point. -- Cheers / Saludos, Carlos E. R. (from 42.2 x86_64 "Malachite" at Telcontar)

Carlos E. R. [24.07.2017 13:38]:

On 2017-07-24 12:09, Werner Flamme wrote:

...

Carlos E. R. [22.07.2017 14:22]:

...

...

This is not consistent.

Aye.

...

Postfix talks SMTP, not IMAP. You can not send an email using IMAP.

*I* don't. Something not yet identified on my host tries to do so.

Yes, I see from your other response that this is something very different and strange.

...

...

tcp_local is used on that central internal MX. AFAIK it is running Oracle Communications software.

The logs are from the SMTP queues. So I'm looking for something that uses an IMAP command in an SMTP dialogue to end it.

I would be considering malware at this point.

I changed the postfix config on the three hosts in question so that they send their mails to a relay host, where I have full access to the mail log. They send a bazillion mails per day, two of them are running SAP systems that spread notification mails. Sigh. I can't simply stop them and install anew before the existence of malware on those is proven. Werner -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 24/07/17 07:48 AM, Werner Flamme wrote:

Of course, nonsense files like mail.err, mail.log, mail.warn are empty. I only look at /var/log/mail - I need to collect all data to a connection, and the mail.prio files do not have those.

Actually /var/log/mail is a mail.prio file as well :-) But that's beside the point. Clearly this isn't a 'conventional' email service. At the extreme, a rogue, or as Carlos mentions, some malware, a trojan or something, isn't going to write to log files. Lsof and fuser will tell you about network connections and their associated processes. if you can't account for them all, be suspicious. There may be some parasite calling home. if you're not running Thunderbird and Firefox, which account for most of the connections my workstation has to all manner of sites, then the deviations from patterns you need to watch out for a re going to be more obvious. A full listing of IP connections with lsof might show up something you can't account for. Please don't expect a single lsof parameter to instantly tell you. You are going to have to do a bit of creative detective work. Yes, there are 'watcher' programs that will look out for the opening or creation of file or a network link. The issue is that you need to know what you are looking for in the first place. Assuming that this really is port 134 or port 25 might be like the drunk looking for his keys under the lamp post. -- A: Yes. > Q: Are you sure? >> A: Because it reverses the logical flow of conversation. >>> Q: Why is top posting frowned upon? -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 07/24/2017 05:33 AM, Anton Aylward wrote:

On 24/07/17 07:48 AM, Werner Flamme wrote:

...

Of course, nonsense files like mail.err, mail.log, mail.warn are empty. I only look at /var/log/mail - I need to collect all data to a connection, and the mail.prio files do not have those. Actually /var/log/mail is a mail.prio file as well :-)

But that's beside the point. Clearly this isn't a 'conventional' email service. At the extreme, a rogue, or as Carlos mentions, some malware, a trojan or something, isn't going to write to log files.

Lsof and fuser will tell you about network connections and their associated processes.

if you can't account for them all, be suspicious. There may be some parasite calling home. if you're not running Thunderbird and Firefox, which account for most of the connections my workstation has to all manner of sites, then the deviations from patterns you need to watch out for a re going to be more obvious. A full listing of IP connections with lsof might show up something you can't account for.

Please don't expect a single lsof parameter to instantly tell you. You are going to have to do a bit of creative detective work.

Yes, there are 'watcher' programs that will look out for the opening or creation of file or a network link. The issue is that you need to know what you are looking for in the first place. Assuming that this really is port 134 or port 25 might be like the drunk looking for his keys under the lamp post.

Of course, if malware is suspected you can't trust anything on the system, including programs like ps, ls, lsof, netstat, etc. Rootkits will modify these binaries and libraries so that they will seem to work, but won't show the malware's presence and activities. Statically linked binaries from DVD should be used for diagnosis if possible. I've been using "aide" to take md5 fingerprints of all important binaries and config files, with the signatures being stored off-machine. I've never caught anything, but it is sound practice and makes me feel a bit better. Regards, Lew -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Dave Howorth [21.07.2017 22:27]:

On Fri, 21 Jul 2017 21:21:06 +0300 Andrei Borzenkov wrote:

...

You could add statement that logs program name at this point. I have zero experience with ruby but I'm sure there is standard way to obtain it.

Me neither, but fortunately some people do: https://stackoverflow.com/questions/4834821/how-can-i-get-the-name-of-the-co...

I did so, and there was no output. Maybe it was a monitoring-plugin. check_tcp checks SMTP, and has "a1 LOGOUT" in its source code, but looking at the code this should show up only when used as check_imap, not as check_smtp (which is a separate plugin, btw, that has no LOGOUT in its source :)). Well, at least, after stopping stunnel, there are no log entries any more. So there was a piece of software using localhost:11125 as communication point and not remoteMX:465. I'll see more soon, curretly I'm happy my Postmaster stops complaining :) Thanks to everyone for input! Werner -- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org