Milter-greylist

On Fri, 27 Oct 2006, An.H.Nguyen wrote:

> Both of my Solaris sendmail gateways started to have some problems since 
> Oct.14 when the "Possible SMTP attack: command=HELO/EHLO, count=3" 
> appeared.
>
> - Sendmail stops repsonding for a short time then came back, this 
> happens several times a day
>
> - milter-greylist process died, then it came back on by itself in about 
> 5 minutes, this also happens serveral times a day
>
> - I can't fine /var/milter-greylist/milter-greylist.sock on one of my 
> two servers, should I copy this file over? (It's size is zero and has a 
> special permission settings srwxr-xr-x)

No, you should not copy it over.  It's a socket (hence the leading "s" in 
the permissions) and even if you could find a way to copy it, it wouldn't 
be connected to the milter-greylist process in a meaningful way.

Stop and re-start the milter-greylst daemon/process to recreate the 
socket.

> Some error messages (random picks, not in any orders):
>    milter-greylist: [ID 552762 mail.error] greylist: accept() returned invalid socket (Too many open files)

You need to find out if the number of files open is reasonable for your 
system load, and if so, increase the MAXFILES for the system, or find out 
what has gone wrong so that MAXFILES has been reached.

Help with that is somewhat outside of the scope of this mailing list, I 
would guess.

>    milter-greylist: [ID 879519 mail.warning] greylist: setsockopt() failed
>    Milter (greylist): timeout before data read
>    Milter (greylist): init failed to open
>    Milter (greylist): error connecting to filter: Connection refused by /var/milter-greylist/milter-greylist.sock
>    mimedefang-multiplexor[12219]: [ID 260045 mail.error] Reap: Idle slave 9 (pid 25739) exited normally with status 255 (SLAVE DIED UNEXPECTEDLY)
>    mimedefang-multiplexor[12219]: [ID 389462 mail.error] Slave 6 died prematurely -- check your filter rules
>    mimedefang[12232]: [ID 847421 mail.error] Error from multiplexor: ERR No response from slave
>    mimedefang[27731]: [ID 758488 mail.warning] mfconnect: Error communicating with multiplexor
>    mimedefang-multiplexor[27727]: [ID 980602 mail.info] Slave 5 stderr: getservbyname failed for tcp at /usr/local/bin/mimedefang.pl line 529
>    sendmail[18155]: [ID 801593 mail.warning] k9RFFCUM018155: collect: premature EOM: unexpected close
>    sendmail[26774]: [ID 801593 mail.info] k9RHumxI026774: Milter (greylist): to error state
>
> SW Versions:
> Sendmail 8.12.10
> mimedefang version 2.51
> SpamAssassin version 3.0.3
>  running on Perl version 5.8.0
> milter-greylist: I'm not sure what version it is, help!..

I believe you can run "milter-greylist -r" to get its version.

> I'm new to this environment, I take over from a previous sysadmin who 
> left so I am desperate here... I think about upgrading, but affraid to 
> break things up. I have clone one of the gateways to a 3rd server and 
> able to do testings on it. Please help! An Nguyen



-- 
		"A witty saying proves nothing."
				-- Voltaire

finger://bigby@...
http://www.ephemeron.org/~bigby/
irc://irc.ephemeron.org/#the_pub
news://news.ephemeron.org/alt.lemurs