gmane.mail.fetchmail.user

Re: Changing the logging style of fetchmail

Matthias Andree — 2013-05-17T16:56:17

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Am 17.05.2013 14:39, schrieb Jerry:

Jerry,

Next time, please use "example.org", "example.com", or ".invalid" or
".example" TLDs for that so you don't have spammers harrass the innocent.

[...log snipped...]


Yes, that's a sensible suggestion, will put it on my TODO list. It will
probably also be useful to include the "250 Ok" line from the SMTP/LMTP
listener because that can contain the queue ID of the next stage.
Postfix would for instance show "250 2.0.0 Ok: queued as 8770723D2B1".

Thank you for taking the time to write this up.

Best regards
Matthias

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with undefined - http://www.enigmail.net/

iEYEARECAAYFAlGWYSwACgkQvmGDOQUufZVIoACginZvfVrKeN47TiwIc7YMjXoR
WtUAoJa3PU+/RDzgwPuZz9RKibUKFQQq
=oKje
-----END PGP SIGNATURE-----

Changing the logging style of fetchmail

Jerry — 2013-05-17T12:39:13

When using logging with fetchmail, this is the normal output.
Obviously, I have altered the actual names to protect the innocent.

fetchmail: 1 message for user< at >domain.net at imap.gmail.com.
fetchmail: reading message user< at >domain.net< at >gmail-imap.l.google.com:1 of 1 (4365 header octets) (1114 body octets) flushed

That same message when handed over to Postfix produces this logging:

May 17 08:20:32 mypc postfix/smtpd[53591]: connect from localhost[127.0.0.1]
May 17 08:20:32 mypc postfix/smtpd[53591]: 3bBpVm4c5Bz2CG5q: client=localhost[127.0.0.1], sasl_method=CRAM-MD5, sasl_username=secret< at >domain.net
May 17 08:20:32 mypc postfix/cleanup[53597]: 3bBpVm4c5Bz2CG5q: message-id=<20130517131932.03450167< at >sender.domain.com>
May 17 08:20:32 mypc postfix/qmgr[5884]: 3bBpVm4c5Bz2CG5q: from=<mailing_list< at >domain.org>, size=5631, nrcpt=1 (queue active)
May 17 08:20:32 mypc postfix/pipe[53598]: 3bBpVm4c5Bz2CG5q: to=<user< at >domain.net>, relay=dovecot, delay=0.17, delays=0.15/0/0/0.01, dsn=2.0.0, status=sent (delivered via doveco

Re: Getting a certificate's fingerprint

Volker Kuhlmann — 2013-05-05T21:05:06


The easiest way to obtain *a* fingerprint is 

  fetchmail -d0 -c -v gmail.com

from the command line.
Note that this gives you no way of verifying that this fingerprint
displayed by fetchmail actually belongs to gmail.com, so use at your own
risk.

Volker

Re: Getting a certificate's fingerprint

Matthias Andree — 2013-05-04T10:20:44

Am 02.05.2013 23:04, schrieb Jerry:


The FreeBSD .crt file installed by
http://www.freshports.org/security/ca_root_nss/ is a certificate bundle
containing currently 158 certificates in PEM format and is suitable for
fetchmail use, and installs into the default location.

And quite intentionally, the FreeBSD mail/fetchmail port and package
require the former to run (so it will be installed).

Re: Getting a certificate's fingerprint

James Cloos — 2013-05-04T09:39:13

J> I am on FreeBSD. The distro certs file is "ca-root-nss.crt" and
J> fetchmail needs the certificates in PEM format,

A number of distributions use Debian's package.  Try:

git://git.debian.org/git/collab-maint/ca-certificates.git

That includes all of the certs published by mozilla (which matches the
crt file freebsd provides), debian, spi-inc.org and cacert.org.

-JimC

Re: Getting a certificate's fingerprint

Jerry — 2013-05-02T21:12:25

On Thu, 02 May 2013 22:14:48 +0200
Matthias Andree articulated:


I just discovered that this works fine:

fetchmail -d0 -vk imap.gmail.com

Re: Getting a certificate's fingerprint

Jerry — 2013-05-02T21:04:17

On Thu, 02 May 2013 22:14:48 +0200
Matthias Andree articulated:


I am on FreeBSD. The distro certs file is "ca-root-nss.crt" and
fetchmail needs the certificates in PEM format, unless I am mistaken. I
don't know of a way to remove all of the "PEM" certificates in the
"crt" file other than doing each one manually.

Re: Getting a certificate's fingerprint

Matthias Andree — 2013-05-02T20:14:48

Am 02.05.2013 11:37, schrieb Jerry:

Unless you have a reliable way to get them (by fax, from a https website
that uses different certificates that you trust, from a GnuPG-signed
mail with a signature that you trust), it's pointless.

So either ask Google to publish the fingerprints of their server keys or
just go with the distro's certificates.

Re: Getting a certificate's fingerprint

Rob MacGregor — 2013-05-02T18:37:41


It might be easier for you to install your distribution's CA certificate
package so that verification can take place that way (just like it does in
your web browser).

Re: Getting a certificate's fingerprint

grarpamp — 2013-05-02T17:36:53

openssl s_client -connect pop.gmail.com:pop3s </dev/null 2>/dev/null |
openssl x509 -noout -fingerprint

If your point is to avoid being mitm'd, you should use some
other location/means to obtain/verify this data.

Getting a certificate's fingerprint

Jerry — 2013-05-02T09:37:08

I use the option "sslfingerprint" in my config file. Every time GMail
changes its certificate, I have to get a new fingerprint or else
fetchmail refuses to fetch the mail. That is fine. My problem is, how
to get the fingerprint. I have not found an easy method of doing it.
Since I am not an expert with SSL, that is understandable I suppose.

I ws hoping that someone could give me an example of an easy method to
optain the new fingerprint of a GMail certificate that I could use
every time they change theirs.

Thanks!

Fwd: Re: fetchmail doesn't want to connect to my mysql database

Clement BRIZARD — 2013-04-26T18:16:54

Le 23/04/2013 21:52, Robert Dahlem a écrit :

That's it, I changed the fetchmail.pl from

our $db_type = 'Pg';#
my $db_type = 'mysql';

# host name
our $db_host="127.0.0.1";
# database name
our $db_name="postfix";
# database username
our $db_username="postfix";
# database password
our $db_password="my password";


to

#our $db_type = 'Pg';
my $db_type = 'mysql';

# host name
my $db_host="127.0.0.1";
# database name
my $db_name="postfix";
# database username
my $db_username="postfix";
# database password
my $db_password="my password";

I didn't saw that the first time


Thank you very much both of you



_______________________________________________
fetchmail-users mailing list
fetchmail-users< at >lists.berlios.de
https://lists.berlios.de/mailman/listinfo/fetchmail-users

Re: fetchmail doesn't want to connect to my mysql database

Matthias Andree — 2013-04-26T18:01:57

Clement,

you are not having fetchmail troubles, but instead your postfixadmin rig
is incapable of producing its configuration or whatever it is that it is
trying to pull from your SQL server.  It would not seem that your setup
has even tried to start your (outdated) fetchmail version.

This is neither a Postfix nor a Fetchmail problem, but one with
Postfixadmin, or the fetchmail addition for Postfixadmin, which is not
part of fetchmail.

Please try the Postfixadmin support channels, you will morely likely
find people there who can really help.

Once you have reached the point where you can show us the fetchmail
command line and logs, we will probably be able to help from there, but
you are not yet at that point.

Sorry we can't help you now.

Best regards
Matthias

Re: master: TODO.txt

Matthias Andree — 2013-04-25T07:16:09

Am 24.04.2013 10:37, schrieb grarpamp:

Up front, thanks a bunch for the feedback.  We should move to
fetchmail-devel though...

I am wondering - especially about switching SSL library, too, because
OpenSSL requires you to jump quite through a few hoops for even standard
stuff, like CRLs and OCSP.



<http://svnweb.freebsd.org/ports/head/security/ca_root_nss/files/MAca-bundle.pl.in?revision=312617&view=markup>


This line is to be dropped from TODO.txt -- I've seen too many
certification "authorities" that did not deserve this name, and I seem
to have someone willing to tell users in the fetchmail lobby how to make
_good_ use of this feature.

The missing link is that you hardly ever get the certificate
fingerprints on the "how to configure Outlook, blahmail, whatever for
fetching mail from us" on the ISP help pages, or even better, by snail
mail when they send you account data.


Basically we're already quite close, we'd only have to make sure that
adding a poll argument on the command line permits specifyi

Re: master: TODO.txt

grarpamp — 2013-04-24T20:07:13

typo: host BAR1 password is an account option, not a host one.

master: TODO.txt

grarpamp — 2013-04-24T08:37:16

Noted some things

- blacklist DigiNotar/Comodo/T<C3><BC>rktrust hacks/certs, possibly
with Chrome's serial# list?

I would not hardcode this but instead place fingerprints in multiple
global/per_host 'fpdeny' config options. In part because testing
infrastructure with these certs is valuable. And at least that way,
even if they're lazy and only use sslcertck, if some emergency
arises they can add a negative print there affecting global/per_host.
Additionally, point the user to where they can find and then build
their own updated cert store free from all such junk. As well as
point them to some doc about the importance of fingerprint checking.

https://mxr.mozilla.org/mozilla-central/source/security/nss/lib/ckfw/builtins/certdata.txt?raw=1
  ftp://ftp.mozilla.org/pub/security/nss/releases/
https://github.com/agl/extract-nss-root-certs.git

I'll try to remember to add this to the 'cert' ticket when I find
it again.


- CRYPTO: remove sslfingerprint? too easily abused (see NEWS)

I trust this is by now just an

The 6.3.26 release of fetchmail is available

Fetchmail Development Team — 2013-04-23T21:50:21

The 6.3.26 release of fetchmail is now available at the usual locations,
including <http://developer.berlios.de/projects/fetchmail> and
<http://sourceforge.net/projects/fetchmail/>.

The source archive is available at:
<http://prdownload.berlios.de/fetchmail/fetchmail-6.3.26.tar.xz>
<http://sourceforge.net/projects/fetchmail/files/branch_6.3/fetchmail-6.3.26.tar.xz/download>

or in the older bzip2 format:
<http://prdownload.berlios.de/fetchmail/fetchmail-6.3.26.tar.bz2>

Here are the release notes:

fetchmail-6.3.26 (released 2013-04-23, 26180 LoC):

# NOTE THAT FETCHMAIL IS NO LONGER PUBLISHED THROUGH IBIBLIO.
* They have stopped accepting submissions and consider themselves an archive.

# CRITICAL BUG FIX for setups using "mimedecode":
* The mimedecode feature failed to ship the last line of the body if it was
  encoded as quoted-printable and had a MIME soft line break in the very last
  line.  Reported by Lars Hecking in June 2011.

  Bug introduced on 1998-03-20 when the mimedecode support was added by

Re: fetchmail doesn't want to connect to my mysqldatabase

Rob MacGregor — 2013-04-23T19:46:43


Ah, so postfix is presumably generating the fetchmail command line on the
fly? I'm guessing that your problem is that you're not using port 25, which
is the default, but you haven't set anything to tell fetchmail about that.
It may be simpler to use port 25 instead.

It may also be that those errors have nothing to do with fetchmail. It
looks like it may be from postfixadmin trying to connect to the local
database to retrieve the configuration.

Unfortunately without an actual fetchmail config file and actual fetchmail
logs it's going to be hard for me to help you since I've never used postfix
and have never seen an approach such as you're using. It may be you'll get
better support on the postfix mailing lists where people are used to this
rather unusual approach.



You're about 7 point releases out of date - there's at least one security
fix since. If Debian hasn't back-ported those fixes then you'll want to
upgrade.

Re: fetchmail doesn't want to connect to my mysql database

Clement BRIZARD — 2013-04-23T19:24:18

Le 23/04/2013 20:01, Rob MacGregor a écrit :
Here's my /etc/mail/postfixadmin/fetchmail.conf

$db_host="127.0.0.1";
$db_name="postfix";
$db_username="postfix";
$db_password="my_password";



Here's the content of my /var/www/postfixadmin/**ADDITIONS/ fetchmail.pl 
, it's what postfixadmin uses to call fetchmail, the config regarding 
the database is inside. The email address password that I am trying to 
"fetch" is configured inside postfix admin

#!/usr/bin/perl

use DBI;
use MIME::Base64;
# use Data::Dumper;
use File::Temp qw/ mkstemp /;
use Sys::Syslog;
# require liblockfile-simple-perl
use LockFile::Simple qw(lock trylock unlock);

######################################################################
########## Change the following variables to fit your needs ##########

# database settings

# database backend - uncomment one of these
our $db_type = 'Pg';
#my $db_type = 'mysql';

# host name
our $db_host="127.0.0.1";
# database name
our $db_name="postfix";
# database username
our $db_username="postfix"

Re: fetchmail doesn't want to connect to my mysqldatabase

Rob MacGregor — 2013-04-23T18:01:15


Please provide the contents of your fetchmail configuration file, the
command line arguments you're using and the version number of fetchmail
(see the FAQ at http://fetchmail.berlios.de/fetchmail-FAQ.html#G3). It
would also help to have a more complete log so we can see what came before
and after.

Also, I take it you've configured Postfix to use port 5432 and configured
fetchmail to connect to it on that port?

fetchmail doesn't want to connect to my mysqldatabase

Clement BRIZARD — 2013-04-23T15:49:38

Hello everybody,

I configured a postfix mail server on debian, I followed that tutoriel 
https://www.isalo.org/wiki.debian-fr/Fetchmail_sur_postfixadmin

So I have a problem, when I try to lauch fetchmail as root, 
/var/www/postfixadmin/ADDITIONS/fetchmail.pl
I have that

DBI connect('database=postfix;host=127.0.0.1','postfix',...) failed: couldn't connect to the server : Connection refused

     Is the connection active on host 127.0.0.1  and does it accepte connexion

     TCP/IP on port port 5432 ? at /var/www/postfixadmin/ADDITIONS/fetchmail.pl line 81

cannot connect the database at /var/www/postfixadmin/ADDITIONS/fetchmail.pl line 45.

WARNING: releasing 1 pending lock...



I do not understand, my database is postfix, the user is postfix, the 
password is good

in my /etc/init.d/firewall I have

# Mail Fetchmail:5432

iptables -t filter -A INPUT -p tcp --dport 5432 -j ACCEPT

iptables -t filter -A OUTPUT -p tcp --dport 5432 -j ACCEPT


If someone as any idea what I might be missing...

Thank you very