On Saturday 18 June 2005 00:10, Greg Wallace wrote: <snip>

...

Maybe mailmarshal@standardbank.co.za is used by SuSE to scan incoming mail. Sounds like it's saying that it will give SuSE the opportunity to decide whether to accept your encrypted message, even though it can't scan it. Did

you just (maybe inadvertently) start encrypting your email messages, either

...

for the first time or via some different encrypting method?

No sir, it's been the same gpg signed for a while now, nothing changed that I know of.

...

Greg Wallace

Or maybe there was something unusual in the content of that message.

Shouldn't have been anything strange, it was just a simple text message with my glib question. What's weird is now I have 4 of those mails and 3 different e-mails from someone(?) or SuSE or Novell...I guess. Look here: Message status - undeliverable From: Mailer-Daemon@mcclure To: yonaton@tds.net Date: 17 June 2005 22:20 The message that you sent was undeliverable to the following: mtgordon@ximian.com (504 <mcclure>: Helo command rejected: need fully-qualified hostname) Possibly truncated original message follows: Received: from WALTHAM-MTA by mcclure with Novell_GroupWise; Fri, 17 Jun 2005 23:20:50 -0400 Return-path: Received: from minotaur.novell.com (IST_21_1.sjf.Novell.COM [130.57.21.1]) by mcclure with ESMTP; Fri, 17 Jun 2005 23:20:40 -0400 Received: from lists.suse.com (unverified [195.135.221.131]) by minotaur.novell.com (Vircom SMTPRS 4.0.346.0) with SMTP id for ; Fri, 17 Jun 2005 23:27:42 -0400 Received: (qmail 3118 invoked by alias); 18 Jun 2005 03:20:36 -0000 Mailing-List: contact suse-linux-e-help@suse.com; run by ezmlm Precedence: bulk list-help: mailto:suse-linux-e-help@suse.com list-unsubscribe: mailto:suse-linux-e-unsubscribe-mtgordon=novell.com@suse.com list-post: mailto:suse-linux-e@suse.com X-MIME-Notice: attachments may have been removed from this message X-Mailinglist: suse-linux-e X-Message-Number-for-archive: 239608 Delivered-To: mailing list suse-linux-e@suse.com Received: (qmail 3105 invoked from network); 18 Jun 2005 03:20:36 -0000 From: JB To: suse-linux-e@suse.com Date: Fri, 17 Jun 2005 22:09:29 -0500 User-Agent: KMail/1.8 References: <200506171455.22675.yonaton@tds.net> <20050617203154.GU6309@wahoo.no-ip.org> In-Reply-To: <20050617203154.GU6309@wahoo.no-ip.org> X-Face: /fk$:)B^2_i.l+R_DXVqCn)K7vLyL6i7Z3M0cRZ#*n_/]:>PG| L3_uuh.@=?utf-8?q?Dn=5B0kOR=0A=09pSM=3Byn=23V=5D=7C=5Fi=5E=24W?=@>6>goQ*JtPr:l0~x!l3^Es&Uh@S|d| 9kT`@Is#~BJr+tygfP*w=_B4$+Ml0t3oP>=?utf-8?q?Oow=0A=09w=7CnM?="pCxebmpz@U}V}}_[e{MjEPh0nb2MZ'*[GK@}"=?utf-8?q?=60=5B!q*O0=3A=27y=5Fhoey+=23=5C=23M-Utnh=7D=5EG=0A=09W=263c?=)'e| DN4"l%hgZI$( MIME-Version: 1.0 Content-Type: multipart/signed; boundary="nextPart2143786.W77KP8uM2d"; protocol="application/pgp-signature"; micalg=pgp-sha1 Content-Transfer-Encoding: 7bit Message-Id: <200506172209.37253.yonaton@tds.net> X-Virus-Scanned: by amavisd-new at Relay1.suse.de Scott says it's nothing to worry about, but I'm hoping that I'm not going to start getting 7 or 8 of these weird things for every 1 e-mail I send to the list, heh. JB

JB (yonaton@tds.net) wrote something I wish to comment : (news:<200506180104.49556.yonaton@tds.net> posted on 18-juin-05 07:04:40)

...

...

Maybe mailmarshal@standardbank.co.za is used by SuSE to scan incoming mail. Sounds like it's saying that it will give SuSE the opportunity to decide whether to accept your encrypted message, even though it can't scan it. Did

you just (maybe inadvertently) start encrypting your email messages, either

...

for the first time or via some different encrypting method?

No sir, it's been the same gpg signed for a while now, nothing changed that I know of.

...

Or maybe there was something unusual in the content of that message.

Shouldn't have been anything strange, it was just a simple text message with my glib question. What's weird is now I have 4 of those mails and 3 different e-mails from someone(?) or SuSE or Novell...I guess. Look here:

I received one of such "delivery failure" message too, but my mail was distributed on the list anyway. IIRC, it gave about the same reason: "Helo command rejected: need fully-qualified hostname" ... (Cannot check as I already deleted the message.) Maybe the list-maintainer is tweaking a virus/spam filter for the list, and caused some unexpected bounced messages ? Maybe an invalid email address has somehow entered the subscriber list (like @mcclure which is not a fully qualified hostname) ? This, from the FAQ, might help too: (For more FAQ, send a mail to ) Q10. I'm getting weird bounces/autoreplies/vacation messages from someone else everytime I post to the list. Should I ask the list if anyone else is getting them and what I should do about it? A10. No. The other subscribers can't do anything about it and posting to the list expecting that the list owner will see it, especially on a list this size, is unwise. Instead, contact ml-admin@suse.com and explain what you did in order to receive the bounce/autoresponse/ vacation message making sure to include the full, unedited headers.

Message status - undeliverable From: Mailer-Daemon@mcclure To: yonaton@tds.net Date: 17 June 2005 22:20

The message that you sent was undeliverable to the following:

mtgordon@ximian.com (504 <mcclure>: Helo command rejected: need fully-qualified hostname)

[...] AmigaPhil, world citizen. /No MS-HTML mail please/ PGP key: 0x9C07F6C1 -----BEGIN ECHELON TEASER----- The following garbage may or may not contain crypted message. At least you now know I'm an advocate for the respect of privacy. pEzzSMFOEv3oLPApOSyvnbRHpSFtqVcUOFVS02ACIkBtIJV1DxItWyvydlvWVpItEzjTMFVM WKHVVLvHlldFOz6tRJtHc5zIREDvzlVBF1npUDaSMnRylyjFIHaOhUMHEJvyIxAyIO0OrGO5 EylRHLFzppHtGfHDKqIxJIFUxt5MaMYDWJ5ORVtOHVtODApqtEvTqqlVObyaN3vuRVMPGt== -----END ECHELON TEASER----- 1200 bps used to seem so fast

On Saturday 18 June 2005 05:02, Louis Richards wrote:

On Friday 17 June 2005 11:13 pm, JB wrote:

...

I sent a question about glib earlier, and opened up my mail some time later and got this:

From: mailmarshal@standardbank.co.za To: yonaton@tds.net Date: 17 June 2005 15:06

From the above we see that this email was sent from Standard Bank and has nothing to do with the SuSE list server.

...

Standard Bank's Mail Gateway has quarantined an e-mail message sent by you for the following reason:

This e-mail is encrypted and could be infected with a virus. As Anti-virus software does not have the capability to effectively scan encrypted mail, the message has been automatically quarantined.

A bank that does not accept encrypted/signed emails.

...

The recipient has been notified of this and can request the message to be released from quarantine if it is safe to do so.

The details of the message are as follows:

Message: B42b32d270000.000000000001.0001.mml From: yonaton@tds.net To: gerard.ceruti@standardbank.co.za Subject: [SLE] How do I set glib in PREFIX?

Someone with the above email address joined the SuSE list.

Whenever you send a message to the list, the SuSE list server then sends a copy of it to everyone who has subscribed. One of those subscribers is using a mail server that is configured to reject encrypted/signed mail.

As this message is not signed, the person with the above address should receive it. Hopefully, he will become aware of the problem now and either correct the settings on the mail server, be removed, or unsubscribe.

-- Louis Richards

Good clarification Louis, thanks. (Sorry I didn't snip anything, but it all seemed very relevant in Louis's post to keep it all) JB

2005/6/18, Carlos E. R. :

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

The Saturday 2005-06-18 at 06:02 -0400, Louis Richards wrote:

...

...

This e-mail is encrypted and could be infected with a virus. As Anti-virus software does not have the capability to effectively scan encrypted mail, the message has been automatically quarantined.

A bank that does not accept encrypted/signed emails.

It does not mention "signed" emails, just enrypted; thus it is not doing its job correctly, as a signed email can be scanned by antivirus software. A badly configured/programmed filter.

...

As this message is not signed, the person with the above address should receive it. Hopefully, he will become aware of the problem now and either correct the settings on the mail server, be removed, or unsubscribe.

I hope he does :-}

(I'm also receving those bounces, of course. Not a big worry, but I might end rejecting them in the end).

- -- Cheers, Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) Comment: Made with pgp4pine 1.76

iD8DBQFCtHkCtTMYHG2NR9URAiopAJ9JQhgX2SQEYAcxUcjdz9586TPu5wCfXcU1 5soFOvwEEXGGOe5z74PnLm8= =F4As -----END PGP SIGNATURE-----

-- Check the headers for your unsubscription address For additional commands send e-mail to suse-linux-e-help@suse.com Also check the archives at http://lists.suse.com Please read the FAQs: suse-linux-e-faq@suse.com

I received something similar (?!) ----------------------------------------------------- Deutsche Bank a mí Dear Deutsche Bank Customer, This email was sent by the Deutsche Bank server to verify your e-mail address. You must complete this process by clicking on the link below and entering in the small window your Deutsche Bank online access details. This is done for your protection - because some of our members no longer have access to their email addresses and we must verify it. To verify your e-mail address, click on the link below: http://www.deutsche-bank.de/the_id_goes_here ------------------------------------------------------- And i have nothing to do with that bank.... CI.-

2005/6/18, Ciro Iriarte :

2005/6/18, Carlos E. R. :

...

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

The Saturday 2005-06-18 at 06:02 -0400, Louis Richards wrote:

...

...

This e-mail is encrypted and could be infected with a virus. As Anti-virus software does not have the capability to effectively scan encrypted mail, the message has been automatically quarantined.

A bank that does not accept encrypted/signed emails.

It does not mention "signed" emails, just enrypted; thus it is not doing its job correctly, as a signed email can be scanned by antivirus software. A badly configured/programmed filter.

...

As this message is not signed, the person with the above address should receive it. Hopefully, he will become aware of the problem now and either correct the settings on the mail server, be removed, or unsubscribe.

I hope he does :-}

(I'm also receving those bounces, of course. Not a big worry, but I might end rejecting them in the end).

- -- Cheers, Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) Comment: Made with pgp4pine 1.76

iD8DBQFCtHkCtTMYHG2NR9URAiopAJ9JQhgX2SQEYAcxUcjdz9586TPu5wCfXcU1 5soFOvwEEXGGOe5z74PnLm8= =F4As -----END PGP SIGNATURE-----

-- Check the headers for your unsubscription address For additional commands send e-mail to suse-linux-e-help@suse.com Also check the archives at http://lists.suse.com Please read the FAQs: suse-linux-e-faq@suse.com

I received something similar (?!) ----------------------------------------------------- Deutsche Bank a mí Dear Deutsche Bank Customer,

This email was sent by the Deutsche Bank server to verify your e-mail address. You must complete this process by clicking on the link below and entering in the small window your Deutsche Bank online access details. This is done for your protection - because some of our members no longer have access to their email addresses and we must verify it. To verify your e-mail address, click on the link below:

http://www.deutsche-bank.de/the_id_goes_here -------------------------------------------------------

And i have nothing to do with that bank....

CI.-

Forgot to say that i use this account exclusively for mail lists...... CI.-

2005/6/18, Richard Atcheson :

...

2005/6/18, Ciro Iriarte :

...

2005/6/18, Carlos E. R. :

...

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

The Saturday 2005-06-18 at 06:02 -0400, Louis Richards wrote:

...

...

This e-mail is encrypted and could be infected with a virus. As Anti-virus software does not have the capability to effectively scan encrypted mail, the message has been automatically quarantined.

A bank that does not accept encrypted/signed emails.

It does not mention "signed" emails, just enrypted; thus it is not doing its job correctly, as a signed email can be scanned by antivirus software. A badly configured/programmed filter.

...

As this message is not signed, the person with the above address should receive it. Hopefully, he will become aware of the problem now and either correct the settings on the mail server, be removed, or unsubscribe.

I hope he does :-}

(I'm also receving those bounces, of course. Not a big worry, but I might end rejecting them in the end).

- -- Cheers, Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) Comment: Made with pgp4pine 1.76

iD8DBQFCtHkCtTMYHG2NR9URAiopAJ9JQhgX2SQEYAcxUcjdz9586TPu5wCfXcU1 5soFOvwEEXGGOe5z74PnLm8= =F4As -----END PGP SIGNATURE-----

-- Check the headers for your unsubscription address For additional commands send e-mail to suse-linux-e-help@suse.com Also check the archives at http://lists.suse.com Please read the FAQs: suse-linux-e-faq@suse.com

I received something similar (?!) ----------------------------------------------------- Deutsche Bank a mí Dear Deutsche Bank Customer,

This email was sent by the Deutsche Bank server to verify your e-mail address. You must complete this process by clicking on the link below and entering in the small window your Deutsche Bank online access details. This is done for your protection - because some of our members no longer have access to their email addresses and we must verify it. To verify your e-mail address, click on the link below:

http://www.deutsche-bank.de/the_id_goes_here -------------------------------------------------------

It's one of the most popular scams on the net, called phishing. They try to get you to go to their site, a fake one made to look like the real thing,

On Saturday 18 June 2005 11:40 pm, Ciro Iriarte wrote: then get you to give them your account numbers and passwords so they can drain your account or charge up your credit card. Ignore them or forward it, along with full headers, to the REAL site, usually at abuse@nameofsite.com.

Never, ever, respond by clicking on anything in the email. Legitimate sites never send such a message to customers.

RA

-- Check the headers for your unsubscription address For additional commands send e-mail to suse-linux-e-help@suse.com Also check the archives at http://lists.suse.com Please read the FAQs: suse-linux-e-faq@suse.com

I know, just mentioned it because Greg said something about scanning mails ("Maybe mailmarshal@standardbank.co.za is used by SuSE to scan incoming mail."), and thought i could be some kind of white list. Anyway, didn't click on the link, and already reported it as phishing with the gmail tool...... CI.-

On Sat, 18 Jun 2005, Richard Atcheson wrote:-

...

2005/6/18, Ciro Iriarte :

...

...

I received something similar (?!) ----------------------------------------------------- Deutsche Bank a mí Dear Deutsche Bank Customer,

This email was sent by the Deutsche Bank server to verify your e-mail address. You must complete this process by clicking on the link below and entering in the small window your Deutsche Bank online access details. This is done for your protection - because some of our members no longer have access to their email addresses and we must verify it. To verify your e-mail address, click on the link below:

http://www.deutsche-bank.de/the_id_goes_here -------------------------------------------------------

It's one of the most popular scams on the net, called phishing. They try to get you to go to their site, a fake one made to look like the real thing, then get you to give them your account numbers and passwords so they can drain your account or charge up your credit card. Ignore them or forward it, along with full headers, to the REAL site, usually at abuse@nameofsite.com.

Never, ever, respond by clicking on anything in the email. Legitimate sites never send such a message to customers.

It could be someone using a Challenge-Response system and has forgotten that joining a mailing list sends challenges to anyone that sends to the list. Regards, David Bolt -- Member of Team Acorn checking nodes at 63 Mnodes/s: http://www.distributed.net/ AMD 1800 1Gb WinXP/SuSE 9.3 | AMD 2400 160Mb SuSE 8.1 | AMD 2400 256Mb SuSE 9.0 AMD 1300 512Mb SuSE 9.0 | Falcon 14Mb TOS 4.02 | STE 4Mb TOS 1.62 RPC600 129Mb RISCOS 3.6 | A3010 4Mb RISCOS 3.11 | A4000 4Mb RISCOS 3.11