W B Hacker wrote:
> Keefe John wrote:
>> Bill,
>>
>> Thanks for the response.
>
> Apparently my encoding (force UTF-8 in your MUA if it doesn't display as
> Chinese) went through OK then?
>
>> Here are some of them that are sitting in my queue:
>>
>> 056F From: =?koi8-r?B?7sHUwczY0Q==?= <fomuconyferi@???>
>> 064F From: "=?windows-1254?Q?Evg=F6r_Mobilya?=" <evgormob@???>
>> 074F From: "=?iso-8859-9?B?S2FodmFsdP0gTWVrYW79?=" <kahvalti@???>
>> 058F From: =?koi8-r?B?8MXU0Q==?= <fekonyjatuwarygesa@???>
>> 077F From: =?windows-1251?B?7C7W4uXy7e7pIOHz6/zi4PA=?= <yaomin3534wojtek@???>
>> 067F From: =?windows-1251?B?8eDp8g==?= <sivakumataylor@???>
>>
>> It also happens when the subject is funky, like this example:
>>
>> 052F From: Mrs Rosemary Collins <mrs_rosemary12@???>
>> 187 Subject: =?windows-1256?Q?DEAR_FRIEN?= =?windows-1256?Q?D_PLEASE_R?=
>>
>> Thanks again,
>>
>> Keefe
BTW - checking something else - I suspect (at least) msn and gmail among those
are forged, and that ALL may indeed be spam/malware.
Have a look at whatever else your logs tell you about those messages.
You might want 'log_selector = +all' temporarily.
Bill
>>
>
> Not sure at this point if those are 'otherwise' valid messages, or soem for of
> malware.
>
> BUT -- all of those carry intial strings that are indicative of use of non-ASCII
> character sets. The smtp standard very much prefers 7-bit ASCII in the
> 'envelope' & headers, and even in 'content' (body and attachments) *unless*
> identified as recognized MIME type encodings.
>
> Exim is more forgiving - it is inherently '8-bit clean', ordinarily just ignores
> those *unless* it cannot use them at all.
>
> You mentioned Debian, so if you are using the common Debian-specific
> configuration tools, we may have pinned-down 'a' cause, but I am out of
> suggestions as to where to look for a solution.
>
> A long shot - but given where it is crashing, it might even be related to the
> underlying OS or file system in use.
>
> There is a specialized support mailing list for Debian-Exim, and there should be
> more expert solutions there somewhere, as the author's native code-set is not
> ASCII, either, and he is for-sure a Debian user as well as developer.
>
> Wander over there and see what an archive search turns up. URI is in your docs.
>
> Best,
>
> Bill
>
>
>
>> -----Original Message-----
>> From: 韓家標 Bill Hacker [mailto:askbill@conducive.net]
>> Sent: Sunday, May 17, 2009 10:47 PM
>> To: Keefe John
>> Subject: Re: [exim] queue run: process crashed with signal 11 while delivering
>>
>>
>>
>> John,
>>
>> OFF LIST
>>
>> To try to track down those odd 'From:' headers.
>>
>> This account has Chinese characters in the longname - but not windows-1254 encoded.
>>
>> I'll post more on-list once we see what this does.
>>
>> .. I'm suspecting the messages you mention are coming off PDA's..
>>
>> Best,
>>
>> Bill Hacker
>>
>> wbh@???
>>
>>
>>
>> Keefe John wrote:
>>> Hello,
>>>
>>> Recently I've been having a problem with exim and I've been pulling out my
>>> hair trying to figure it out. Basically what is happening is that when
>>> people send my server mail with strange From: headers the system has
>>> problems. Here's an example of a From: field that would cause a problem:
>>> From: "=?windows-1254?Q?Evg=F6r_Mobilya?=" evgormob@???. It seems to
>>> be related to From fields that have =? in them.
>>>
>>> When these emails come in, which happens to be all the time, a number of
>>> things happen. Firstly, the exim queue freaks out:
>>>
>>> 2009-05-17 12:33:27 queue run: process 351 crashed with signal 11 while
>>> delivering 1M4MG2-0002y4-5z
>>> 2009-05-17 12:33:27 queue run: process 353 crashed with signal 11 while
>>> delivering 1M1omA-0002WY-3M
>>> 2009-05-17 12:33:27 queue run: process 354 crashed with signal 11 while
>>> delivering 1M1flT-0005z1-J4
>>> 2009-05-17 12:33:27 queue run: process 355 crashed with signal 11 while
>>> delivering 1M5IZ7-0003Pd-K5
>>> 2009-05-17 12:33:27 queue run: process 360 crashed with signal 11 while
>>> delivering 1M1ZXv-00007r-29
>>> 2009-05-17 12:33:27 queue run: process 369 crashed with signal 11 while
>>> delivering 1M52Vd-00085s-FE
>>>
>>> I'll also see a number errors like this:
>>>
>>> 2009-05-17 21:14:31 1M5qbz-00082q-1M internal problem in domain_filter
>>> router (recipient is info@???): failure to transfer data from
>>> subprocess: status=000b readerror='Success'
>>>
>>> I'm running Exim 4.69 on Debian 5.
>>>
>>> How do I fix this?
>>>
>>> Keefe John
>>> Techware
>>>
>>>
>>>
>>
>
>
