<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Vu chez moi, et risque d'amuser la galerie...</p>
<p>Email auto de facebook déclanché par la procédure "lost
password", avec un security code envoyé par mail... non reçu. Les
logs d'exim :</p>
<p><tt>2019-09-25 17:31:59 1iDB8x-0003xX-O5 DKIM: d=facebookmail.com
s=s1024-2013-q3 c=relaxed/simple a=rsa-sha256 b=1024
t=1569432717 [verification succeeded]<br>
2019-09-25 17:31:59 1iDB8x-0003xX-O5
H=66-220-155-156.mail-mail.facebook.com (mx-out.facebook.com)
[66.220.155.156] X=TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128 CV=no
F=<a class="moz-txt-link-rfc2396E" href="mailto:security@facebookmail.com"><security@facebookmail.com></a> rejected after DATA: missing
or malformed local part: failing address in "To:" header is:
Ludovic Pouzenc <><br>
</tt></p>
J'ai une conf qui me parait être celle par défaut debian par rapport
à ces aspects là (j'ai custom pour brancher rspamd et pour livrer
dans du maildir, mais sans plus...). Le rejectlog : <tt><br>
</tt>
<p><tt><b>Envelope-to: <a class="moz-txt-link-rfc2396E" href="mailto:ludovic@pouzenc.fr"><ludovic@pouzenc.fr></a></b><br>
P Received: from 66-220-155-152.mail-mail.facebook.com
([66.220.155.152] helo=mx-out.facebook.com)<br>
by pouzenc.fr with esmtps
(TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)<br>
(Exim 4.89)<br>
(envelope-from <a class="moz-txt-link-rfc2396E" href="mailto:security@facebookmail.com"><security@facebookmail.com></a>)<br>
id 1iDBHw-0004Ct-32<br>
for <a class="moz-txt-link-abbreviated" href="mailto:ludovic@pouzenc.fr">ludovic@pouzenc.fr</a>; Wed, 25 Sep 2019 17:41:16 +0000<br>
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple;
d=facebookmail.com;<br>
s=s1024-2013-q3; t=1569433273;<br>
bh=ve7tDBKleNnjzyMR747PfW7LcNBlwksSgkm4Fg89G1U=;<br>
h=Date:To:Subject:From:MIME-Version:Content-Type;<br>
b=o6NnaYmgw65nRdOigEKxMAHZ2IyERqykt87f6eF5KMMzBaJZ0KmLFjC53SyymS3If<br>
GitKPpVoGd1Msib/afhLCTNNZHl6NDNWgGlV5OJ7Lz372p3wiDAmULZRmKokdjibvp<br>
EX+7y4Xo1n0CniKMKNonfkuqL5lw3NTyT5b1xfK8=<br>
P Received: from facebook.com
(07FQ+glUmlAtXCXSMxwGnFYGQcauAs6eZ8zg3UrrFL9iGLCYYvd6PhG/lNvKCtV+
2401:db00:2120:827a:face:0000:0011:0000)<br>
by facebook.com with Thrift id
ab1b92acdfbb11e9854bec0d9aceb5f2-a54349e0;<br>
Wed, 25 Sep 2019 10:41:13 -0700<br>
X-Facebook: from 2401:db00:1310:304e:face:0:25:0
([MTI3LjAuMC4x]) <br>
by graph.facebook.com with HTTPS (ZuckMail);<br>
Date: Wed, 25 Sep 2019 10:41:13 -0700<br>
<b>T To: Ludovic Pouzenc <></b><br>
Subject: =?UTF-8?B?NzcxODA1IGVzdCB2b3Ry?=<br>
=?UTF-8?B?ZSBjb2RlIHBvdXIgcsOpYw==?=<br>
=?UTF-8?B?dXDDqXJlciBs4oCZYWNjw6hzIA==?=<br>
=?UTF-8?B?w6Agdm90cmUgY29tcHRlIA==?=<br>
=?UTF-8?B?RmFjZWJvb2s=?=<br>
X-Priority: 3<br>
X-Mailer: ZuckMail [version 1.00]<br>
* Return-Path: <a class="moz-txt-link-abbreviated" href="mailto:security@facebookmail.com">security@facebookmail.com</a><br>
F From: "Facebook" <a class="moz-txt-link-rfc2396E" href="mailto:security@facebookmail.com"><security@facebookmail.com></a><br>
R Reply-to: noreply <a class="moz-txt-link-rfc2396E" href="mailto:noreply@facebookmail.com"><noreply@facebookmail.com></a><br>
Errors-To: <a class="moz-txt-link-abbreviated" href="mailto:security@facebookmail.com">security@facebookmail.com</a><br>
X-Facebook-Notify: password_reset:first_send;
mailid=59363df253c37G400bae5aG5936428bb3f09G178<br>
Feedback-ID: 0:password_reset:Facebook<br>
X-FACEBOOK-PRIORITY: 1<br>
X-Auto-Response-Suppress: All<br>
Require-Recipient-Valid-Since: <a class="moz-txt-link-abbreviated" href="mailto:ludovic@pouzenc.fr">ludovic@pouzenc.fr</a>; Monday, 4
Aug 2014 20:07:43 +0000<br>
I Message-ID:
<0b804e5218fad4c1d28bffaabc78455d@c2eca9eea82fcb8a76fe1f543047de03dca48bdb9d61d2a196fb14e344d2a155><br>
MIME-Version: 1.0<br>
Content-Type: multipart/alternative;<br>
boundary="b1_0b804e5218fad4c1d28bffaabc78455d"<br>
</tt><br>
</p>
<p>Chance, le code de sécurité (que j'ai cramé avant d'envoyer ce
mail) est présent dans les headers du mail (car le rejectlog ne
garde pas le corps du mail).</p>
<p><tt>$ base64 -d <<< NzcxODA1IGVzdCB2b3Ry<br>
771805 est votr<br>
</tt></p>
<pre class="moz-signature" cols="72">--
Ludovic Pouzenc
<a class="moz-txt-link-abbreviated" href="http://www.pouzenc.fr">www.pouzenc.fr</a>
This is GNU/Linux land. In silent nights you can hear the Windows machines rebooting.
</pre>
</body>
</html>