It seems that very common inbound mail is creating all sorts of problems for Astaro.
Cause: a single email from a Yahoo group
Result: dozens of IPS alerts
Snort Rule: "SMTP MAIL FROM overflow attempt - ID 2590 "
This appears to be a problem in how the SMTP Proxy handles the connection but I'm not sure.
Please note in the logs below that the mail at 21:17:59 creates 7 astaro alerts.
Then the SMTP connection times out.
Then the error "retry not reached for any host"
Then the whole process starts anew... oh joy.
Here are the logs on this issue:
SMTP proxy
2005:07:10-21:11:46 (none) exim[2555]: 2005-07-10 21:11:46 Start queue run: pid=2555
2005:07:10-21:11:46 (none) exim[2555]: 2005-07-10 21:11:46 End queue run: pid=2555
2005:07:10-21:17:39 (none) exim[2611]: 2005-07-10 21:17:39 1Drpjf-0000g7-AZ demime extension: txt
2005:07:10-21:17:39 (none) exim[2611]: 2005-07-10 21:17:39 1Drpjf-0000g7-AZ demime extension: html
2005:07:10-21:17:39 (none) exim[2611]: 2005-07-10 21:17:39 1Drpjf-0000g7-AZ demime extension: htm
2005:07:10-21:17:39 (none) exim[2611]: 2005-07-10 21:17:39 1Drpjf-0000g7-AZ demime extension: asc
2005:07:10-21:17:39 (none) exim[2611]: 2005-07-10 21:17:39 1Drpjf-0000g7-AZ demime extension: txt
2005:07:10-21:17:39 (none) exim[2611]: 2005-07-10 21:17:39 1Drpjf-0000g7-AZ demime extension: html
2005:07:10-21:17:39 (none) exim[2611]: 2005-07-10 21:17:39 1Drpjf-0000g7-AZ demime extension: htm
2005:07:10-21:17:39 (none) exim[2611]: 2005-07-10 21:17:39 1Drpjf-0000g7-AZ demime extension: asc
2005:07:10-21:17:39 (none) exim[2611]: 2005-07-10 21:17:39 1Drpjf-0000g7-AZ demime extension: txt
2005:07:10-21:17:39 (none) exim[2611]: 2005-07-10 21:17:39 1Drpjf-0000g7-AZ demime extension: html
2005:07:10-21:17:39 (none) exim[2611]: 2005-07-10 21:17:39 1Drpjf-0000g7-AZ demime extension: htm
2005:07:10-21:17:39 (none) exim[2611]: 2005-07-10 21:17:39 1Drpjf-0000g7-AZ demime extension: asc
2005:07:10-21:17:39 (none) exim[2611]: 2005-07-10 21:17:39 1Drpjf-0000g7-AZ demime extension: txt
2005:07:10-21:17:39 (none) exim[2611]: 2005-07-10 21:17:39 1Drpjf-0000g7-AZ demime extension: html
2005:07:10-21:17:39 (none) exim[2611]: 2005-07-10 21:17:39 1Drpjf-0000g7-AZ demime extension: htm
2005:07:10-21:17:39 (none) exim[2611]: 2005-07-10 21:17:39 1Drpjf-0000g7-AZ demime extension: asc
2005:07:10-21:17:39 (none) exim[2611]: 2005-07-10 21:17:39 1Drpjf-0000g7-AZ demime extension: txt
2005:07:10-21:17:39 (none) exim[2611]: 2005-07-10 21:17:39 1Drpjf-0000g7-AZ demime extension: html
2005:07:10-21:17:39 (none) exim[2611]: 2005-07-10 21:17:39 1Drpjf-0000g7-AZ demime extension: htm
2005:07:10-21:17:39 (none) exim[2611]: 2005-07-10 21:17:39 1Drpjf-0000g7-AZ demime extension: asc
2005:07:10-21:17:59 (none) exim[2611]: 2005-07-10 21:17:59 1Drpjf-0000g7-AZ H=web30811.mail.mud.yahoo.com [68.142.201.254] Warning: spam_score:2.3
2005:07:10-21:17:59 (none) exim[2611]: 2005-07-10 21:17:59 1Drpjf-0000g7-AZ H=web30811.mail.mud.yahoo.com [68.142.201.254] Warning: spam_threshold1 triggered
2005:07:10-21:17:59 (none) exim[2611]: 2005-07-10 21:17:59 1Drpjf-0000g7-AZ warmsunblueskies@yahoo.com H=web30811.mail.mud.yahoo.com [68.142.201.254] P=smtp S=7054 id=20050711041737.4993.qmail@web30811.mail.mud.yahoo.com
2005:07:10-21:18:02 (none) exim[2620]: 2005-07-10 21:18:02 1Drpk2-0000gG-Gx do-not-reply@fw-notify.net H=localhost (localhost.localdomain) [127.0.0.1] P=esmtp S=2082 id=6291-15852-1121055482@astaro.mydomain.com
2005:07:10-21:18:03 (none) exim[2621]: 2005-07-10 21:18:03 1Drpk2-0000gG-Gx => me@mydomain.com R=static_route T=static_smtp H=smtpsrvaddr [smtpsrvaddr]
2005:07:10-21:18:03 (none) exim[2621]: 2005-07-10 21:18:03 1Drpk2-0000gG-Gx Completed
2005:07:10-21:18:03 (none) exim[2625]: 2005-07-10 21:18:03 1Drpk3-0000gL-Qu do-not-reply@fw-notify.net H=localhost (localhost.localdomain) [127.0.0.1] P=esmtp S=2082 id=4386-15852-1121055483@astaro.mydomain.com
2005:07:10-21:18:04 (none) exim[2626]: 2005-07-10 21:18:04 1Drpk3-0000gL-Qu => me@mydomain.com R=static_route T=static_smtp H=smtpsrvaddr [smtpsrvaddr]
2005:07:10-21:18:04 (none) exim[2626]: 2005-07-10 21:18:04 1Drpk3-0000gL-Qu Completed
2005:07:10-21:18:05 (none) exim[2630]: 2005-07-10 21:18:05 1Drpk5-0000gQ-3D do-not-reply@fw-notify.net H=localhost (localhost.localdomain) [127.0.0.1] P=esmtp S=2082 id=6215-15852-1121055484@astaro.mydomain.com
2005:07:10-21:18:05 (none) exim[2631]: 2005-07-10 21:18:05 1Drpk5-0000gQ-3D => me@mydomain.com R=static_route T=static_smtp H=smtpsrvaddr [smtpsrvaddr]
2005:07:10-21:18:05 (none) exim[2631]: 2005-07-10 21:18:05 1Drpk5-0000gQ-3D Completed
2005:07:10-21:18:06 (none) exim[2635]: 2005-07-10 21:18:06 1Drpk6-0000gV-DA do-not-reply@fw-notify.net H=localhost (localhost.localdomain) [127.0.0.1] P=esmtp S=2310 id=1565-15852-1121055486@astaro.mydomain.com
2005:07:10-21:18:06 (none) exim[2636]: 2005-07-10 21:18:06 1Drpk6-0000gV-DA => me@mydomain.com R=static_route T=static_smtp H=smtpsrvaddr [smtpsrvaddr]
2005:07:10-21:18:06 (none) exim[2636]: 2005-07-10 21:18:06 1Drpk6-0000gV-DA Completed
2005:07:10-21:20:02 (none) exim[2671]: 2005-07-10 21:20:02 1Drply-0000h5-69 do-not-reply@fw-notify.net H=localhost (localhost.localdomain) [127.0.0.1] P=esmtp S=3002 id=0485-15852-1121055602@astaro.mydomain.com
2005:07:10-21:20:04 (none) exim[2682]: 2005-07-10 21:20:04 1Drpm0-0000hG-BU do-not-reply@fw-notify.net H=localhost (localhost.localdomain) [127.0.0.1] P=esmtp S=2082 id=8719-15852-1121055604@astaro.mydomain.com
2005:07:10-21:20:04 (none) exim[2683]: 2005-07-10 21:20:04 1Drpm0-0000hG-BU => me@mydomain.com R=static_route T=static_smtp H=smtpsrvaddr [smtpsrvaddr]
2005:07:10-21:20:04 (none) exim[2683]: 2005-07-10 21:20:04 1Drpm0-0000hG-BU Completed
2005:07:10-21:20:05 (none) exim[2688]: 2005-07-10 21:20:05 1Drpm1-0000hM-Pr do-not-reply@fw-notify.net H=localhost (localhost.localdomain) [127.0.0.1] P=esmtp S=2082 id=0282-15852-1121055605@astaro.mydomain.com
2005:07:10-21:20:06 (none) exim[2689]: 2005-07-10 21:20:06 1Drpm1-0000hM-Pr => me@mydomain.com R=static_route T=static_smtp H=smtpsrvaddr [smtpsrvaddr]
2005:07:10-21:20:06 (none) exim[2689]: 2005-07-10 21:20:06 1Drpm1-0000hM-Pr Completed
2005:07:10-21:20:07 (none) exim[2695]: 2005-07-10 21:20:07 1Drpm3-0000hT-GJ do-not-reply@fw-notify.net H=localhost (localhost.localdomain) [127.0.0.1] P=esmtp S=2082 id=8482-15852-1121055607@astaro.mydomain.com
2005:07:10-21:20:08 (none) exim[2696]: 2005-07-10 21:20:08 1Drpm3-0000hT-GJ => me@mydomain.com R=static_route T=static_smtp H=smtpsrvaddr [smtpsrvaddr]
2005:07:10-21:20:08 (none) exim[2696]: 2005-07-10 21:20:08 1Drpm3-0000hT-GJ Completed
2005:07:10-21:20:09 (none) exim[2701]: 2005-07-10 21:20:09 1Drpm5-0000hZ-Bl do-not-reply@fw-notify.net H=localhost (localhost.localdomain) [127.0.0.1] P=esmtp S=2310 id=8538-15852-1121055609@astaro.mydomain.com
2005:07:10-21:20:09 (none) exim[2702]: 2005-07-10 21:20:09 1Drpm5-0000hZ-Bl => me@mydomain.com R=static_route T=static_smtp H=smtpsrvaddr [smtpsrvaddr]
2005:07:10-21:20:09 (none) exim[2702]: 2005-07-10 21:20:09 1Drpm5-0000hZ-Bl Completed
2005:07:10-21:27:59 (none) exim[2614]: 2005-07-10 21:27:59 1Drpjf-0000g7-AZ == doug@mydomain.com R=static_route T=static_smtp defer (110): Connection timed out: SMTP timeout while connected to smtpsrvaddr [smtpsrvaddr] after end of data (7138 bytes written)
2005:07:10-21:30:02 (none) exim[2672]: 2005-07-10 21:30:02 1Drply-0000h5-69 == me@mydomain.com R=static_route T=static_smtp defer (110): Connection timed out: SMTP timeout while connected to smtpsrvaddr [smtpsrvaddr] after end of data (2962 bytes written)
2005:07:10-21:30:03 (none) exim[2804]: 2005-07-10 21:30:03 1Drpvf-0000jE-74 do-not-reply@fw-notify.net H=localhost (localhost.localdomain) [127.0.0.1] P=esmtp S=2703 id=3154-15852-1121056202@astaro.mydomain.com
2005:07:10-21:30:03 (none) exim[2807]: 2005-07-10 21:30:03 1Drpvf-0000jE-74 => me@mydomain.com R=static_route T=static_smtp H=smtpsrvaddr [smtpsrvaddr]
2005:07:10-21:30:03 (none) exim[2807]: 2005-07-10 21:30:03 1Drpvf-0000jE-74 Completed
2005:07:10-21:31:46 (none) exim[2824]: 2005-07-10 21:31:46 Start queue run: pid=2824
2005:07:10-21:31:46 (none) exim[2825]: 2005-07-10 21:31:46 1Drply-0000h5-69 == me@mydomain.com R=static_route T=static_smtp defer (-53): retry time not reached for any host
2005:07:10-21:31:46 (none) exim[2827]: 2005-07-10 21:31:46 1Drpjf-0000g7-AZ == doug@mydomain.com R=static_route T=static_smtp defer (-53): retry time not reached for any host
2005:07:10-21:31:46 (none) exim[2824]: 2005-07-10 21:31:46 End queue run: pid=2824
2005:07:10-21:42:31 (none) exim[2946]: 2005-07-10 21:42:31 1Drq7i-0000lW-Pr demime extension: txt
2005:07:10-21:42:31 (none) exim[2946]: 2005-07-10 21:42:31 1Drq7i-0000lW-Pr demime extension: asc
2005:07:10-21:42:31 (none) exim[2946]: 2005-07-10 21:42:31 1Drq7i-0000lW-Pr demime extension: txt
2005:07:10-21:42:31 (none) exim[2946]: 2005-07-10 21:42:31 1Drq7i-0000lW-Pr demime extension: asc
2005:07:10-21:42:31 (none) exim[2946]: 2005-07-10 21:42:31 1Drq7i-0000lW-Pr demime extension: txt
2005:07:10-21:42:31 (none) exim[2946]: 2005-07-10 21:42:31 1Drq7i-0000lW-Pr demime extension: asc
2005:07:10-21:42:31 (none) exim[2946]: 2005-07-10 21:42:31 1Drq7i-0000lW-Pr demime extension: txt
2005:07:10-21:42:31 (none) exim[2946]: 2005-07-10 21:42:31 1Drq7i-0000lW-Pr demime extension: asc
2005:07:10-21:42:31 (none) exim[2946]: 2005-07-10 21:42:31 1Drq7i-0000lW-Pr demime extension: txt
2005:07:10-21:42:31 (none) exim[2946]: 2005-07-10 21:42:31 1Drq7i-0000lW-Pr demime extension: asc
2005:07:10-21:42:37 (none) exim[2946]: 2005-07-10 21:42:37 1Drq7i-0000lW-Pr H=n21a.bulk.scd.yahoo.com [66.94.237.50] Warning: spam_score:0.0
2005:07:10-21:42:37 (none) exim[2946]: 2005-07-10 21:42:37 1Drq7i-0000lW-Pr doug@mydomain.com R=static_route T=static_smtp H=smtpsrvaddr [smtpsrvaddr]
2005:07:10-21:42:38 (none) exim[2949]: 2005-07-10 21:42:38 1Drq7i-0000lW-Pr Completed
2005:07:10-21:51:46 (none) exim[3051]: 2005-07-10 21:51:46 Start queue run: pid=3051
2005:07:10-21:51:48 (none) exim[3056]: 2005-07-10 21:51:48 1DrqGi-0000nI-9D do-not-reply@fw-notify.net H=localhost (localhost.localdomain) [127.0.0.1] P=esmtp S=2082 id=2349-15852-1121057508@astaro.mydomain.com
2005:07:10-21:51:48 (none) exim[3057]: 2005-07-10 21:51:48 1DrqGi-0000nI-9D => me@mydomain.com R=static_route T=static_smtp H=smtpsrvaddr [smtpsrvaddr]
2005:07:10-21:51:48 (none) exim[3057]: 2005-07-10 21:51:48 1DrqGi-0000nI-9D Completed
2005:07:10-21:51:49 (none) exim[3061]: 2005-07-10 21:51:49 1DrqGj-0000nN-Hj do-not-reply@fw-notify.net H=localhost (localhost.localdomain) [127.0.0.1] P=esmtp S=2082 id=1604-15852-1121057509@astaro.mydomain.com
2005:07:10-21:51:50 (none) exim[3062]: 2005-07-10 21:51:50 1DrqGj-0000nN-Hj => me@mydomain.com R=static_route T=static_smtp H=smtpsrvaddr [smtpsrvaddr]
2005:07:10-21:51:50 (none) exim[3062]: 2005-07-10 21:51:50 1DrqGj-0000nN-Hj Completed
2005:07:10-21:51:50 (none) exim[3066]: 2005-07-10 21:51:50 1DrqGk-0000nS-Sz do-not-reply@fw-notify.net H=localhost (localhost.localdomain) [127.0.0.1] P=esmtp S=2082 id=8830-15852-1121057510@astaro.mydomain.com
2005:07:10-21:51:51 (none) exim[3067]: 2005-07-10 21:51:51 1DrqGk-0000nS-Sz => me@mydomain.com R=static_route T=static_smtp H=smtpsrvaddr [smtpsrvaddr]
2005:07:10-21:51:51 (none) exim[3067]: 2005-07-10 21:51:51 1DrqGk-0000nS-Sz Completed
2005:07:10-21:51:52 (none) exim[3071]: 2005-07-10 21:51:52 1DrqGm-0000nX-Bq do-not-reply@fw-notify.net H=localhost (localhost.localdomain) [127.0.0.1] P=esmtp S=2310 id=8358-15852-1121057512@astaro.mydomain.com
2005:07:10-21:51:52 (none) exim[3072]: 2005-07-10 21:51:52 1DrqGm-0000nX-Bq => me@mydomain.com R=static_route T=static_smtp H=smtpsrvaddr [smtpsrvaddr]
2005:07:10-21:51:52 (none) exim[3072]: 2005-07-10 21:51:52 1DrqGm-0000nX-Bq Completed
2005:07:10-21:55:03 (none) exim[3111]: 2005-07-10 21:55:03 1DrqJq-0000oB-Vg do-not-reply@fw-notify.net H=localhost (localhost.localdomain) [127.0.0.1] P=esmtp S=2853 id=4814-15852-1121057702@astaro.mydomain.com
2005:07:10-21:55:03 (none) exim[3114]: 2005-07-10 21:55:03 1DrqJq-0000oB-Vg => me@mydomain.com R=static_route T=static_smtp H=smtpsrvaddr [smtpsrvaddr]
2005:07:10-21:55:03 (none) exim[3114]: 2005-07-10 21:55:03 1DrqJq-0000oB-Vg Completed
This thread was automatically locked due to age.
