Re: [cobalt-users] Command stream end of file errors...

[flash22@xxxxxxx]

On Thu, 26 Apr 2001, Steve Werby wrote:

> "Brian M. Rahill" <brian@xxxxxxxxxxxxxxxxxxxxxxx> wrote:
> > I also seem to be getting a fair number of these:
> >
> > Apr 26 16:32:38 admin sendmail[29584]: f3QKWcX29584:
> > <'J.@Z?SK.M!<-?7VQ[@A;J3B&>... Unbalanced '<'
> > Apr 26 16:32:50 admin sendmail[29593]: f3QKWcX29585: f3QKWoX29593:
> > postmaster notify: Host unknown (Name server: ^x: host not found)
> > Apr 26 16:43:37 admin sendmail[30135]: f3QKhbX30135:
> > <Y`X^@K'OXPVN[BQ^6.W(&>... Unbalanced '('
> 
> The "Host unknown" means that Sendmail could not resolve the host of the
> email address that sent to your server and therefore is not going to deliver
> the email.  I have no reliable insight into the rest of those lines.

There are 2 things that will cause this, (ok 3) , if sendmail gets out of
sync receiving mail it may go into command state while the client is still
sending data, and it will see lots of garbage like that, it implies a
broken client.
The second thing is a broken client, as in spam emailer (many of them are
buggy as hell)

The third is that someone tried to run a buffer overflow exploit against
your
mail server and you are really seeing binary machine code...
(there are some for older sendmail's and other servers, i don't think the 
current raq3's sendmail has any serious holes)

try to find a matching relay=IP line, that will give you an idea if it
came from somewhere you expect to get mail from, or somewhere 'weird'

(and if you do find an IP, search other logs for it...)

gsh