[opendmarc-users] opendmarc not detecting SMTP auth
Dan Mahoney, System Admin
danm at prime.gushi.org
Tue Sep 2 16:57:44 PDT 2014
On Tue, 2 Sep 2014, Dan Mahoney, System Admin wrote:
Also, meta: Are question like this better asked on -DEV?
-Dan
> Hey all,
>
> Opendmarc 1.3.0 from ports with builtin libspf. Sendmail 8.14.5.
>
> What I believe I have happening is a user talking directly to port 25 on my
> system. They're doing SMTP auth, so this is valid, per the spec (i.e. they
> should not have to be forced to switch to port 587). Because it's the MTA, I
> can't take opendmarc out of the path like I'd be able to do with the MSA.
>
> Their mail gets detected and signed by domainkeys/opendkim. Other milters
> (like milter-greylist) seem to have been able to detect that this user did
> SMTP auth.
>
> Naturally, I have set:
>
> ## IgnoreAuthenticatedClients { true | false }
> ## default "false"
> ##
> ## If set, causes mail from authenticated clients (i.e., those that used
> ## SMTP AUTH) to be ignored by the filter.
> #
> IgnoreAuthenticatedClients true
>
> But OpenDMARC seems to not be ignoring. (I don't know the semantics of how
> this works -- if the mta passes the authenticated bit along as part of the
> milter interface, or if opendmarc just scans the header).
>
> I'll note as well that it would be nice if the milter could include the
> "Received" headers, if it has access to them.
>
> %grep 96339 /var/log/maillog
> Sep 2 12:25:56 <mail.info> prime sm-mta[96339]: AUTH=server,
> relay=cpe-70-117-105-120.austin.res.rr.com [70.117.105.120], authid=arania,
> mech=PLAIN, bits=0
> Sep 2 12:25:59 <mail.info> prime sm-mta[96339]: s82JPtsR096339:
> from=<arania at kamiki.net>, size=2352500, class=0, nrcpts=1,
> msgid=<540619B4.4080307 at kamiki.net>, proto=ESMTP, daemon=MTA,
> relay=cpe-70-117-105-120.austin.res.rr.com [70.117.105.120]
> Sep 2 12:25:59 <mail.info> prime sm-mta[96339]: s82JPtsR096339: Milter
> insert (1): header: DomainKey-Signature: a=rsa-sha1; s=primegushiorg;
> d=kamiki.net; c=nofws;
> q=dns;\n\th=message-id:date:from:user-agent:mime-version:to:subject:\n\treferences:in-reply-to:content-type;\n\tb=DCJtBQGxyp4yCMC52BeK5Q+cFELeQIgLJaq/VjqTK2pb/nwo4wmX1941fMKjKdzUN\n\tQ9bz8A5sSH8hBil2ex64g==
> Sep 2 12:26:00 <mail.info> prime sm-mta[96339]: s82JPtsR096339: Milter
> insert (1): header: X-DomainKeys: Sendmail DomainKeys Filter v1.0.2
> prime.gushi.org s82JPtsR096339
> Sep 2 12:26:00 <mail.info> prime sm-mta[96339]: s82JPtsR096339: Milter
> insert (1): header: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
> d=kamiki.net;\n\ts=prime2014;
> t=1409685838;\n\tbh=pmw/OSTQ1NrqXrE44BZGduuztBu5xegscmRz7lqgFko=;\n\th=Date:From:To:Subject:References:In-Reply-To;\n\tz=Date:=20Tue,=2002=20Sep=202014=2014:25:40=20-0500|From:=20Art=20b\n\t
> y=20Arania=20<arania at kamiki.net>|To:=20thomas.l.jennings at gmail.com\n\t
> |Subject:=20Arania=20July=202012=20Donation=20Art|References:=20<1\n\t
> 409685493.31173 at paypal.com>|In-Reply-To:=20<1409685493.31173 at paypa\n\t
> l.com>;\n\tb=scH2v2XWI/0TbzFwNCLOUYmhIIUkf/c+LiHUlBtqbIltCq272Yxg84rG3D+OZ20Dg\n\t
> eEMk6S5VKXBKC4FIAW2XLtEdJfzImhO/DJi1wvgRT6xv8zKjtqVkWagKLrTJaQf4WN\n\t
> FZqrkH94zXnZwKGRyBCowhTu6+yrkiLrkhvID0QCiApc1WceDuSKUp/jS4tDu2Ib1b\n\t
> 0oLFBOTbFrW7j4TwG0ahvMOMV+7zFLVtKiJdYO/Abuwc2umIg+nPqT0jUuREdvZFW1\n\t
> 4mSqgTOupFrnbGC8qgulBMSAMdN6Zjp4BmBoYomsX1j0D9kB1qOgGmw9MO77utpCkc\n\t
> AuIPPupyHBrCQ==
> Sep 2 12:26:00 <mail.info> prime sm-mta[96339]: s82JPtsR096339: Milter
> insert (1): header: DKIM-Filter: OpenDKIM Filter v2.9.2 prime.gushi.org
> s82JPtsR096339
> Sep 2 12:26:00 <mail.info> prime sm-mta[96339]: s82JPtsR096339: Milter
> insert (1): header: Authentication-Results: prime.gushi.org; spf=pass
> smtp.mailfrom=arania at kamiki.net
> Sep 2 12:26:00 <mail.info> prime sm-mta[96339]: s82JPtsR096339: Milter
> insert (1): header: Authentication-Results: prime.gushi.org; dmarc=fail
> header.from=kamiki.net
> Sep 2 12:26:00 <mail.info> prime sm-mta[96339]: s82JPtsR096339: Milter
> insert (1): header: DMARC-Filter: OpenDMARC Filter v1.3.0 prime.gushi.org
> s82JPtsR096339
> Sep 2 12:26:01 <mail.info> prime sm-mta[96339]: s82JPtsR096339: Milter add:
> header: X-Greylist: Sender succeeded SMTP AUTH, not delayed by
> milter-greylist-4.4.3 (prime.gushi.org [149.20.61.42]); Tue, 02 Sep 2014
> 19:23:59 +0000 (UTC)
> Sep 2 12:26:08 <mail.info> prime sm-mta[96342]: s82JPtsR096339:
> to=<thomas.l.jennings at gmail.com>, ctladdr=<arania at kamiki.net> (6912/6914),
> delay=00:00:11, xdelay=00:00:07, mailer=esmtp, pri=2382500,
> relay=gmail-smtp-in.l.google.com. [IPv6:2a00:1450:400c:c00::1b], dsn=2.0.0,
> stat=Sent (OK 1409685968 k19si2464007wic.39 - gsmtp)
>
> And then, one report, generated by my own opendmarc (for the same message)
>
> Feedback-Type: auth-failure
> Version: 1
> User-Agent: OpenDMARC-Filter/1.3.0
> Auth-Failure: dmarc
> Authentication-Results: prime.gushi.org; dmarc=fail header.from=kamiki.net
> Original-Envelope-Id: s82JPtsR096339
> Original-Mail-From: arania at kamiki.net
> Source-IP: 70.117.105.120
> Reported-Domain: kamiki.net
>
> DKIM-Filter: OpenDKIM Filter v2.9.2 prime.gushi.org s82JPtsR096339
> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kamiki.net;
> s=prime2014; t=1409685838;
> bh=pmw/OSTQ1NrqXrE44BZGduuztBu5xegscmRz7lqgFko=;
> h=Date:From:To:Subject:References:In-Reply-To;
> z=Date:=20Tue,=2002=20Sep=202014=2014:25:40=20-0500|From:=20Art=20b
> y=20Arania=20<arania at kamiki.net>|To:=20thomas.l.jennings at gmail.com
> |Subject:=20Arania=20July=202012=20Donation=20Art|References:=20<1
> 409685493.31173 at paypal.com>|In-Reply-To:=20<1409685493.31173 at paypa
> l.com>;
> b=scH2v2XWI/0TbzFwNCLOUYmhIIUkf/c+LiHUlBtqbIltCq272Yxg84rG3D+OZ20Dg
> eEMk6S5VKXBKC4FIAW2XLtEdJfzImhO/DJi1wvgRT6xv8zKjtqVkWagKLrTJaQf4WN
> FZqrkH94zXnZwKGRyBCowhTu6+yrkiLrkhvID0QCiApc1WceDuSKUp/jS4tDu2Ib1b
> 0oLFBOTbFrW7j4TwG0ahvMOMV+7zFLVtKiJdYO/Abuwc2umIg+nPqT0jUuREdvZFW1
> 4mSqgTOupFrnbGC8qgulBMSAMdN6Zjp4BmBoYomsX1j0D9kB1qOgGmw9MO77utpCkc
> AuIPPupyHBrCQ==
> X-DomainKeys: Sendmail DomainKeys Filter v1.0.2 prime.gushi.org
> s82JPtsR096339
> DomainKey-Signature: a=rsa-sha1; s=primegushiorg; d=kamiki.net; c=nofws;
> q=dns;
> h=message-id:date:from:user-agent:mime-version:to:subject:
> references:in-reply-to:content-type;
> b=DCJtBQGxyp4yCMC52BeK5Q+cFELeQIgLJaq/VjqTK2pb/nwo4wmX1941fMKjKdzUN
> Q9bz8A5sSH8hBil2ex64g==
> Message-ID: <540619B4.4080307 at kamiki.net>
> Date: Tue, 02 Sep 2014 14:25:40 -0500
> From: Art by Arania <arania at kamiki.net>
> User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101
> Thunderbird/24.6.0
> MIME-Version: 1.0
> To: thomas.l.jennings at gmail.com
> Subject: Arania July 2012 Donation Art
> References: <1409685493.31173 at paypal.com>
> In-Reply-To: <1409685493.31173 at paypal.com>
> Content-Type: multipart/mixed;
> boundary="------------040002030005000206050509"
>
>
--
"If you need web space, give him a hard drive. If you need to do something really heavy, build him a computer."
-Ilzarion, late friday night
--------Dan Mahoney--------
Techie, Sysadmin, WebGeek
Gushi on efnet/undernet IRC
ICQ: 13735144 AIM: LarpGM
Site: http://www.gushi.org
---------------------------
More information about the opendmarc-users
mailing list