Sorry for the long and tedious post, but I've tried to be as 'complete'
and thorough as I can.
Just recently, I've been getting the following messages in root
account mailbox . . . but no message appears in the listowner mailbox...
---------- Forwarded message ----------
From: "L-Soft list server at National Association of Colleges and Employers
(1.8b)" <[log in to unmask]>
To: [log in to unmask]
Subject: Your message to [log in to unmask]
Tue, 11 Jul 1995 10:29:29
Your message to [log in to unmask] has been forwarded to
the "list owners" (the people who manage the JOBPLACE list). If you
wanted to reach a human being, you used the correct procedure and you can
ignore the remainder of this message. If you were trying to send a
command for the computer to execute, please read on.
8< SNIP >8
-------- End of Forwarded message --------
If you want the rest of the message, I'll mail it to ya, but its 4K!
I notice that I get this message when the list has a new post, so
tracing what is actually going on can be difficult.
Included are excerpts from my mailer logs. If I read the logs correctly,
the mail seems to originate from <vtbit.cc.vt.edu [198.82.160.247]>, and
there is no "from" field. Is it possible that the mail is being spoofed,
or is something misconfigured (I haven't changed the config in a week)
Pointers anyone?
Here are excerpts from my sendmail logs, (unedited)
The Message IDs of importance, I believe, are:
excerpt 1: KAA20704 -> KAA20707
excerpt 2: KAA20879 -> KAA20882
-- excerpt 1 --
Jul 11 10:29:29 news sendmail[20705]: KAA20704: from=<>, size=3616, class=0, pri
=33616, nrcpts=1, msgid=<[log in to unmask]>, proto=SMTP, rel
ay=vtbit.cc.vt.edu [198.82.160.247]
Jul 11 10:29:29 news LSV:lsv_amin[20706]: Mail for jobplace-request (from 1/510)
delivered to LISTSERV.
Jul 11 10:29:29 news sendmail[20705]: KAA20704: to="|/usr/local/bin/lsv_amin -t
JOBPLACE-request", delay=00:00:03, mailer=prog, stat=Sent
Jul 11 10:29:30 news sendmail[20708]: KAA20707: from=<[log in to unmask]
.ORG>, size=3416, class=0, pri=33416, nrcpts=1, msgid=<199507111429.KAA20707@new
s.jobweb.org>, proto=SMTP, relay=news.jobweb.org [199.234.255.6]
Jul 11 10:29:30 news sendmail[19905]: JAA19904: to=<[log in to unmask]>, del
ay=00:57:52, mailer=smtp, relay=gatekeeper.mcimail.com. [192.147.45.5], stat=Sen
t (OAA31048 Message accepted for delivery)
Jul 11 10:29:31 news sendmail[20711]: KAA20709: from=<[log in to unmask]
ORG>, size=3616, class=0, pri=33616, nrcpts=1, msgid=<199507111429.KAA20704@news
.jobweb.org>, proto=SMTP, relay=news.jobweb.org [199.234.255.6]
Jul 11 10:29:31 news sendmail[20708]: KAA20707: to=root, delay=00:00:01, mailer=
local, stat=Sent
Jul 11 10:29:31 news LSV:lsv_amin[20712]: Mail for jobplace (from 1/510) deliver
ed to LISTSERV.
Jul 11 10:29:31 news sendmail[20711]: KAA20709: to="|/usr/local/bin/lsv_amin -t
JOBPLACE", delay=00:00:01, mailer=prog, stat=Sent
-- excerpt 2 --
Jul 11 10:41:42 news sendmail[20880]: KAA20879: from=<>, size=3616, class=0, pri
=33616, nrcpts=1, msgid=<[log in to unmask]>, proto=SMTP, rel
ay=vtbit.cc.vt.edu [198.82.160.247]
Jul 11 10:41:42 news LSV:lsv_amin[20881]: Mail for jobplace-request (from 1/510)
delivered to LISTSERV.
Jul 11 10:41:42 news sendmail[20880]: KAA20879: to="|/usr/local/bin/lsv_amin -t
JOBPLACE-request", delay=00:00:01, mailer=prog, stat=Sent
Jul 11 10:41:44 news sendmail[20883]: KAA20882: from=<[log in to unmask]
.ORG>, size=3416, class=0, pri=33416, nrcpts=1, msgid=<199507111441.KAA20882@new
s.jobweb.org>, proto=SMTP, relay=news.jobweb.org [199.234.255.6]
Jul 11 10:41:44 news sendmail[20886]: KAA20884: from=<[log in to unmask]
ORG>, size=3616, class=0, pri=33616, nrcpts=1, msgid=<199507111441.KAA20879@news
.jobweb.org>, proto=SMTP, relay=news.jobweb.org [199.234.255.6]
Jul 11 10:41:44 news sendmail[20883]: KAA20882: to=root, delay=00:00:01, mailer=
local, stat=Sent
-- end of excerpts --
---
[the opinions expressed herein are not necessarily those of my employer]
Daniel Dewey | "The purpose of education is not to
Systems Administrator (Unix) | answer the questions, but rather
[log in to unmask] | question the answers." -- Anon
http://www.ot.com/~sidewin |
The National Association of Colleges and Employers
610-868-1421, x15
|
