I have upgraded several W2K boxes to the latest IE6 packages I downloaded
from Microsoft's website. I am seeing a behavior which appears to be a bug.
It appears to be malicious "malfunctioning" with some sort of deliberate
breakage designed to create incompatibility between Linux and W2K mail
systems. Attempts to relay mail via sendmail/Linux is resulting in the
following message. This message shows up 1 out of 3 times or so relaying
emails from Outlook IE6 through a Linux server:
The connection to the server has failed. Account: 'mail.timpanogas.org',
Server: 'mail.timpanogas.org', Protocol: SMTP, Port: 25, Secure(SSL): No,
Socket Error: 10061, Error Number: 0x800CCC0E
The IE5 clients and earlier IE6 clients do not exhibit this behavior. Does
anyone know if Linux has broken something or can verify this behavior
independent of what we are seeing?
It looks like MS up to their old tricks of creating annoyances for customers
which are designed to look like bugs in our software. When I was at Novell,
I saw these types of things regularly in their software (i.e. DRDOS,
NetWare, etc.) designed to deliberately create incompatibility and breakage
at customer sites. I am not certain this is what is happening here, but if
someone else can verify, then perhaps this is the case, and we should alert
Linux users.
Thanks
Jeff
> The connection to the server has failed. Account: 'mail.timpanogas.org',
> Server: 'mail.timpanogas.org', Protocol: SMTP, Port: 25, Secure(SSL): No,
> Socket Error: 10061, Error Number: 0x800CCC0E
SMTP is a text protocol - tcpdump (-s 1500 -x -a port 25) the
connection, then you can probably see why is complains.
--
Manfred
On Thu, 2001-11-15 at 11:35, Jeff V. Merkey wrote:
>
> I have upgraded several W2K boxes to the latest IE6 packages I downloaded
> from Microsoft's website. I am seeing a behavior which appears to be a bug.
Be a lot more interesting email if you included a dump of the actual
network traffic. -jwb
> The connection to the server has failed. Account: 'mail.timpanogas.org',
> Server: 'mail.timpanogas.org', Protocol: SMTP, Port: 25, Secure(SSL): No,
> Socket Error: 10061, Error Number: 0x800CCC0E
This error is WSACONNREFUSED, (ie connection refused), this is generated by
the target machine. Check to see if you can 'telnet' the into the box,
telnet mail.timpanogas.org 25
see if it connects and gives the '220 identification line' it will look
something like this:
220 firewall0.node0.idium.eu.org ESMTP Exim 3.31 #1 Thu, 15 Nov 2001
20:25:00 +0000
Regards,
Dave
"David Flynn" <[email protected]> wrote:
...
> > The connection to the server has failed. Account: 'mail.timpanogas.org',
> > Server: 'mail.timpanogas.org', Protocol: SMTP, Port: 25, Secure(SSL): No,
> > Socket Error: 10061, Error Number: 0x800CCC0E
>
> This error is WSACONNREFUSED, (ie connection refused), this is generated by
> the target machine. Check to see if you can 'telnet' the into the box,
...
You might want to check to see if TCP_ECN (Explicit Congestion
Notification) is enabled. Many of the later Linux 2.4.x kernels enable
it automatically if it's compiled in (I don't know if this is still the
case or not), and some OSes simply refuse all connections whose SYN
packets are marked this way.
I wouldn't be terribly surprised if the a recent version of IE6 changed
the default TCP settings to make Windows not work with it.
The simple way to check is:
cat /proc/sys/net/ipv4/tcp_ecn
If it's a "1", then it's enabled, if "0" or you get a file not found, that
isn't the problem.
--
Erich Stefan Boleyn <[email protected]> http://www.uruk.org/
"Reality is truly stranger than fiction; Probably why fiction is so popular"
On 2001.11.15 12:54 [email protected] wrote:
>
> "David Flynn" <[email protected]> wrote:
>
> ...
> > > The connection to the server has failed. Account:
> 'mail.timpanogas.org',
> > > Server: 'mail.timpanogas.org', Protocol: SMTP, Port: 25, Secure(SSL):
> No,
> > > Socket Error: 10061, Error Number: 0x800CCC0E
> >
> > This error is WSACONNREFUSED, (ie connection refused), this is
> generated by
> > the target machine. Check to see if you can 'telnet' the into the box,
> ...
>
> You might want to check to see if TCP_ECN (Explicit Congestion
> Notification) is enabled.
you may also note that IE6 is making an SSL SMTP connection "smtps" on
port 25, where it is listed in /etc/services as 465. Maybe this is just
user error (setting SSL and port 25)...
-gordo
Gordon Oliver <[email protected]> wrote:
>
> > > > The connection to the server has failed. Account:
> > > > 'mail.timpanogas.org', Server: 'mail.timpanogas.org', Protocol:
> > > > SMTP, Port: 25, Secure(SSL): No, Socket Error: 10061, Error
> > > > Number: 0x800CCC0E
> you may also note that IE6 is making an SSL SMTP connection "smtps" on
> port 25,
No, it isn't. "Secure(SSL): No" is pretty self-explanatory.
Charles
--
-----------------------------------------------------------------------
Charles Cazabon <[email protected]>
GPL'ed software available at: http://www.qcc.sk.ca/~charlesc/software/
-----------------------------------------------------------------------
On Thu, 15 Nov 2001, Jeff V. Merkey wrote:
> The connection to the server has failed. Account: 'mail.timpanogas.org',
> Server: 'mail.timpanogas.org', Protocol: SMTP, Port: 25, Secure(SSL): No,
> Socket Error: 10061, Error Number: 0x800CCC0E
I can't even verify that mail.timpanogas.org is up. Is it an internal
SMTP server? Can't lookup ip.
--
=====================================================================
Mohammad A. Haque http://www.haque.net/
[email protected]
"Alcohol and calculus don't mix. Developer/Project Lead
Don't drink and derive." --Unknown http://www.themes.org/
[email protected]
=====================================================================
According to some folks who responded to this, IE6 is just plain broken. I
apologize for the lateness of responding, but my Linux server crashed with
sendmail spawing thread after thread and my /var/spool/mqueue directory
filled to bursting with corrupted mail headers. IE6 got into some kind of
braindead loop where it started flooding sendmail with tons of bogus (and
garbage) mail headers.
It's clearly a piece of sh_t browser. This latest release qualifies as a
computer virus. It's much more destructive that lion every dreamed of
being.
Jeff
----- Original Message -----
From: "Jeffrey W. Baker" <[email protected]>
To: "Jeff V. Merkey" <[email protected]>
Cc: <[email protected]>
Sent: Thursday, November 15, 2001 1:07 PM
Subject: Re: Microsoft IE6 is crashing with Linux 2.4.X
> On Thu, 2001-11-15 at 11:35, Jeff V. Merkey wrote:
> >
> > I have upgraded several W2K boxes to the latest IE6 packages I
downloaded
> > from Microsoft's website. I am seeing a behavior which appears to be a
bug.
>
> Be a lot more interesting email if you included a dump of the actual
> network traffic. -jwb
The mail server was down for over 9 hours today. Suffice to say if
you are using RedHat Seawolf with Sendmail 8.11.X you need to upgrade
to 8.12.00 and enable UseMSP=Yes and set up the indirect submission
methods for smmsp:smmsp. I used tcpdump and determined that IE6 will
send "hidden" emails to addresses at msn.com (they appeared random). I
have no idea why it is doing this, but these emails appeared to contain
system level information. There was also obvious (and very nasty) packet
corruption from IE6 that sendmail 8.11.X does not handle very well at all
whe it gets these corrupted packets.
Mail server up. IE6 in the trash can. We'll try this one at a later date.
Need to warn Linux users that IE6 is severely broken and can result in
severe crashes on Linux systems. It also caused a W2K server to crash and
blue screen as well today. My mail server was non-functional for most
of the afternoon due to IE6 mail clients in the building periodically
causing email flood storms on Seawolf with Sendmail 8.11.X and Linux
2.4.14.
Jeff
On Thu, Nov 15, 2001 at 02:45:39PM -0700, Jeff V. Merkey wrote:
> According to some folks who responded to this, IE6 is just plain broken. I
> apologize for the lateness of responding, but my Linux server crashed with
> sendmail spawing thread after thread and my /var/spool/mqueue directory
> filled to bursting with corrupted mail headers. IE6 got into some kind of
> braindead loop where it started flooding sendmail with tons of bogus (and
> garbage) mail headers.
>
> It's clearly a piece of sh_t browser. This latest release qualifies as a
> computer virus. It's much more destructive that lion every dreamed of
> being.
>
> Jeff
>
>
> ----- Original Message -----
> From: "Jeffrey W. Baker" <[email protected]>
> To: "Jeff V. Merkey" <[email protected]>
> Cc: <[email protected]>
> Sent: Thursday, November 15, 2001 1:07 PM
> Subject: Re: Microsoft IE6 is crashing with Linux 2.4.X
>
>
> > On Thu, 2001-11-15 at 11:35, Jeff V. Merkey wrote:
> > >
> > > I have upgraded several W2K boxes to the latest IE6 packages I
> downloaded
> > > from Microsoft's website. I am seeing a behavior which appears to be a
> bug.
> >
> > Be a lot more interesting email if you included a dump of the actual
> > network traffic. -jwb
>
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to [email protected]
> More majordomo info at http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at http://www.tux.org/lkml/
From: "Charles Cazabon" <[email protected]>:
> Gordon Oliver <[email protected]> wrote:
> >
> > > > > The connection to the server has failed. Account:
> > > > > 'mail.timpanogas.org', Server: 'mail.timpanogas.org', Protocol:
> > > > > SMTP, Port: 25, Secure(SSL): No, Socket Error: 10061, Error
> > > > > Number: 0x800CCC0E
>
> > you may also note that IE6 is making an SSL SMTP connection "smtps" on
> > port 25,
>
> No, it isn't. "Secure(SSL): No" is pretty self-explanatory.
Even if it where "Secure(SSL): Yes" it would still be OK, IE is using the
STARTTLS command to initiate SSL connection to the SMTP server (if it
supports it). Using special "SSL-ports" has been depreciated for quite a
while now.
Cheers,
Peter
----------------------------------------------------------------
Peter 'Luna' Runestig (fd. Altberg), Sweden <[email protected]>
PGP Key ID: 0xD07BBE13
Fingerprint: 7B5C 1F48 2997 C061 DE4B 42EA CB99 A35C D07B BE13
AOL Instant Messenger Screenname: PRunestig
Dave,
We got to the bottom of the problem. IE6 is just plain busted and infested
with bugs.
Jeff
----- Original Message -----
From: "David Flynn" <[email protected]>
To: "Jeff V. Merkey" <[email protected]>;
<[email protected]>
Sent: Thursday, November 15, 2001 1:29 PM
Subject: Re: Microsoft IE6 is crashing with Linux 2.4.X
> > The connection to the server has failed. Account: 'mail.timpanogas.org',
> > Server: 'mail.timpanogas.org', Protocol: SMTP, Port: 25, Secure(SSL):
No,
> > Socket Error: 10061, Error Number: 0x800CCC0E
>
> This error is WSACONNREFUSED, (ie connection refused), this is generated
by
> the target machine. Check to see if you can 'telnet' the into the box,
>
> telnet mail.timpanogas.org 25
>
> see if it connects and gives the '220 identification line' it will look
> something like this:
> 220 firewall0.node0.idium.eu.org ESMTP Exim 3.31 #1 Thu, 15 Nov 2001
> 20:25:00 +0000
>
> Regards,
>
> Dave
This is actually terribly OT, but have you tested with a different MTA?
I'm using Postfix in production and most of my clients like running the
latest and "greatest" Microsoft has to offer and so far so good. Regarding
"hidden" emails, i think its called spyware ;) But IMO if your MTA is
spewing chunks under load then its an MTA problem, however if your OS
spews chunks in the process then its obviously an OS problem (e.g. your
W2k box BSODing).
Regards,
Zwane Mwaikambo
I tend to agree, I'm using postfix on a production machine
and it has never failed... sendmail simply cannot compare to
postfix in terms of speed and stability.
Fran?ois
Zwane Mwaikambo wrote:
> This is actually terribly OT, but have you tested with a different MTA?
> I'm using Postfix in production and most of my clients like running the
> latest and "greatest" Microsoft has to offer and so far so good. Regarding
> "hidden" emails, i think its called spyware ;) But IMO if your MTA is
> spewing chunks under load then its an MTA problem, however if your OS
> spews chunks in the process then its obviously an OS problem (e.g. your
> W2k box BSODing).
>
> Regards,
> Zwane Mwaikambo
On Sat, Nov 17, 2001 at 09:50:23AM +0200, Zwane Mwaikambo wrote:
I'm not the one continuing the thread. There have been serious icmp
problems with MS software in the past interacting with Linux, and it's
been kernel related in terms of its affects on people using Linux/W2K
in mixed environments.
Jeff
> This is actually terribly OT, but have you tested with a different MTA?
> I'm using Postfix in production and most of my clients like running the
> latest and "greatest" Microsoft has to offer and so far so good. Regarding
> "hidden" emails, i think its called spyware ;) But IMO if your MTA is
> spewing chunks under load then its an MTA problem, however if your OS
> spews chunks in the process then its obviously an OS problem (e.g. your
> W2k box BSODing).
>
> Regards,
> Zwane Mwaikambo
>
Followup to: <000001c16e6c$c29061d0$f5976dcf@nwfs>
By author: "Jeff V. Merkey" <[email protected]>
In newsgroup: linux.dev.kernel
>
> According to some folks who responded to this, IE6 is just plain broken. I
> apologize for the lateness of responding, but my Linux server crashed with
> sendmail spawing thread after thread and my /var/spool/mqueue directory
> filled to bursting with corrupted mail headers. IE6 got into some kind of
> braindead loop where it started flooding sendmail with tons of bogus (and
> garbage) mail headers.
>
> It's clearly a piece of sh_t browser. This latest release qualifies as a
> computer virus. It's much more destructive that lion every dreamed of
> being.
>
Even so, it's a server problem -- replace your IE6 (l)user with a
malicious hacker, and you still have a problem...
Microsoft likes to discard vulnerabilities by "no standard client
would do this." No, and no "standard visitor" would apply a crowbar
to your patio door, either.
-hpa
--
<[email protected]> at work, <[email protected]> in private!
"Unix gives you enough rope to shoot yourself in the foot."
http://www.zytor.com/~hpa/puzzle.txt <[email protected]>
>
> Microsoft likes to discard vulnerabilities by "no standard client
> would do this." No, and no "standard visitor" would apply a crowbar
> to your patio door, either.
Yep. :-)
>
> -hpa
> --
On Fri, 16 Nov 2001 01:45:28 -0700 "Jeff V. Merkey" <[email protected]> wrote:
JVM> The mail server was down for over 9 hours today. Suffice to say if
JVM> you are using RedHat Seawolf with Sendmail 8.11.X you need to upgrade
JVM> to 8.12.00 and enable UseMSP=Yes and set up the indirect submission
JVM> methods for smmsp:smmsp. I used tcpdump and determined that IE6 will
JVM> send "hidden" emails to addresses at msn.com (they appeared random). I
JVM> have no idea why it is doing this, but these emails appeared to contain
JVM> system level information. There was also obvious (and very nasty) packet
JVM> corruption from IE6 that sendmail 8.11.X does not handle very well at all
JVM> whe it gets these corrupted packets.
Just to be sure - do you have latest antivirus updates?
Regards,
Nerijus
On Sun, Nov 18, 2001 at 12:50:28AM +0200, Nerijus Baliunas wrote:
> On Fri, 16 Nov 2001 01:45:28 -0700 "Jeff V. Merkey" <[email protected]> wrote:
>
> JVM> The mail server was down for over 9 hours today. Suffice to say if
> JVM> you are using RedHat Seawolf with Sendmail 8.11.X you need to upgrade
> JVM> to 8.12.00 and enable UseMSP=Yes and set up the indirect submission
> JVM> methods for smmsp:smmsp. I used tcpdump and determined that IE6 will
> JVM> send "hidden" emails to addresses at msn.com (they appeared random). I
> JVM> have no idea why it is doing this, but these emails appeared to contain
> JVM> system level information. There was also obvious (and very nasty) packet
> JVM> corruption from IE6 that sendmail 8.11.X does not handle very well at all
> JVM> whe it gets these corrupted packets.
>
> Just to be sure - do you have latest antivirus updates?
Snicker, Snicker, Snicker ..... In all the time I've run Linux servers
for my business (about 4 years) I have never once installed a
"Linux anti-virus" update. No, I have not installed any W2K virus
software.
I do, however, use a very powerful piece of Microsoft anti-virus
software on my production servers -- it's called "the Linux
Operating System."
:-)
Jeff
>
> Regards,
> Nerijus
On Sat, 17 Nov 2001 17:04:54 -0700 "Jeff V. Merkey" <[email protected]> wrote:
JVM> > JVM> methods for smmsp:smmsp. I used tcpdump and determined that IE6 will
JVM> > JVM> send "hidden" emails to addresses at msn.com (they appeared random). I
JVM> > JVM> have no idea why it is doing this, but these emails appeared to contain
JVM> > JVM> system level information. There was also obvious (and very nasty) packet
JVM> > JVM> corruption from IE6 that sendmail 8.11.X does not handle very well at all
JVM> > JVM> whe it gets these corrupted packets.
JVM> >
JVM> > Just to be sure - do you have latest antivirus updates?
JVM>
JVM> Snicker, Snicker, Snicker ..... In all the time I've run Linux servers
JVM> for my business (about 4 years) I have never once installed a
JVM> "Linux anti-virus" update. No, I have not installed any W2K virus
JVM> software.
I do not talk about "Linux anti-virus". But Windows viruses (or virii ;) are
known to send emails. So I'd suggest to install some W2K antivirus software.
Anyway, it's becoming OT. It has nothing to do with kernel 2.4.x.
Regards,
Nerijus