Ian_Zimmerman: > Package: mlmmj > Version: 1.2.19.0-1 > Severity: normal > Tags: upstream > > When mlmmj-send injects mail into the MTA, it uses SMTP to 127.0.0.1 on port > 25.
Those are the defaults, but the "relayhost" and "smtpport" settings are tunable, and there's also a "smtphelo" setting. > Unfortunately, it doesn't correctly implement the SMTP standard: it sends an > EHLO > command immediately after it gets the first line of the greeting, which in my > case > starts with "220-" and is followed by additional lines. The result is that it > interprets these additional lines of the greeting as a response to the EHLO, > which > of course fails. > > I don't know if this wrong behavior is simply because it only waits for one > line > (and, I'd guess, checks that the line starts with "2"), or because it is > confused > by the several seconds the MTA waits before sending its greeting. Both kinds > of > behavior have been observed in many spamming tools which is precisely why I > have > configured a multiline greeting and a delay. > > In my opinion when mlmmj runs on the same host as the MTA, it should be at > least an > option to inject mail directly via a pipe to /usr/sbin/sendmail; but I have > not found > such an option. There is a way of injecting mail directly with a pipe via entries in /etc/alisases such as: example-list: "|/usr/bin/mlmmj-recieve -L /var/spool/mlmmj/example-list/" (where "example-list" is the name of the mailing list) Whether and how a this type of entry will work depends on the specific MTA being used and how the MTA is configured. For instance the provided upstream instructions for Exim4 don't use entries like this in /etc/aliases, but the instructions for Postfix do. The MTA in the bug report shows 'equivs-mta' which I assume means that there's a fake 'equivs-mta' package in use and the real MTA in use for this case is something else. Depending on the MTA you might be able to work around your normal multiline greeting + delay if the originating sender it actually local (as opposed to a remote sender spoofing that the sender is local). I wasn't aware MLMMJ doesn't conform to proper SMTP EHLO, but it also won't surprise me if I test to verify this and find that it's so. -- Chris -- Chris Knadle chris.kna...@coredump.us
