Re: qmail-scanner qmail-ldap empty mail problem again

["Tomas Kuliavas" <tokul@xxxxxxxxxxxxxxxxxxxxx>]

> Bo Erichsen schrieb:
> 
>> Searched the archive for the problem related to empty mails and found a
>>  thread wich reported the problem. But i didn't find anyone who had
>> found the solution. So is there anyone on the list who found the
>> solution to the empty message problem (seems to be spam mails every
>> time).
>> 
>> End of the thread i found regarding this problem:
>> 
>> 
>> http://qmail-ldap.suares.com/pipermail/qmail-ldap-archive/2004-June/012
>> 569.html
>> 
>> 
>> 
>> I'm running qmail-scanner-1.23 and qmail-ldap-1.03-20040401.patch
>> spamassasin 2.64
>> 
>> Here's an example of an empty mail message - This is the entire message
>>  only headers and no body : [message skipped]
>> 
> 
> Hi,
> 
> 
> We have the same problem, but we don't use qmail-ldap but vpopmail.
> 
> 
> Here one example-mail (it's complete like I posted it here, no body):
...
> 
> 
> That means, it's probably not qmail-ldap or vpopmail causing the
> problem, but the spamassassin or qmail-scanner. I would guess that it's 
> spamassassin, but that's only a guess. I don't have the time to
> investigate that further, I simply delete the mails I get like that - but
> that should be an hint where to look for the problem.

You forgot one more possibly broken part. Virus/trojan distribution engine or software used by spammer. I have seen empty messages in qmail install without spamassassin/qmail-scanner. Qmail 1.03 with untroubled.org patches and procmail sanitizer (impsec.org) filtering.

Regural smtp servers does not use remote ip address in HELO/EHLO. This piece of art uses ip address of remote smtp server in HELO/EHLO. I suspect that it can be stopped by tcpserver. At least the one that is not redirected to provider's smtp server.

http://www.dnsstuff.com/tools/ip4r.ch?ip=221.149.203.7
http://www.dnsstuff.com/tools/ip4r.ch?ip=24.24.102.152

-- 
Tomas