MAIL ADMINISTRATIVE SERVICE CENTER

[Yuri Pankov]

Dave Horsfall wrote:
> On Tue, 16 Feb 2021, Yuri Pankov wrote:
> 
>>> As this came from freebsd.org, were they trying to shout something or
>>> do they have a compromised server?
>>
>> It's obvious it did NOT come from freebsd.org once you check the headers:
> 
> Really?  Here are my headers:

Really.

> Return-Path: <owner-freebsd-ports at freebsd.org>
> Received: from mx2.freebsd.org (mx2.freebsd.org [96.47.72.81])
>     by aneurin.horsfall.org (8.15.2/8.15.2) with ESMTP id 11FFDtmL039444
>     for <dave at horsfall.org>; Tue, 16 Feb 2021 02:14:09 +1100 (EST)
>     (envelope-from owner-freebsd-ports at freebsd.org)
> Received: from mx1.freebsd.org (mx1.freebsd.org
> [IPv6:2610:1c1:1:606c::19:1])
>     (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
>      key-exchange X25519 server-signature RSA-PSS (4096 bits)
>      client-signature RSA-PSS (4096 bits))
>     (Client CN "mx1.freebsd.org", Issuer "R3" (verified OK))
>     by mx2.freebsd.org (Postfix) with ESMTPS id EE5DF95ED7;
>     Mon, 15 Feb 2021 15:13:53 +0000 (UTC)
>     (envelope-from owner-freebsd-ports at freebsd.org)
> Received: from mailman.nyi.freebsd.org (mailman.nyi.freebsd.org
>     [IPv6:2610:1c1:1:606c::50:13])
>     by mx1.freebsd.org (Postfix) with ESMTP id 4DfSL95Fdgz4gt0;
>     Mon, 15 Feb 2021 15:13:53 +0000 (UTC)
>     (envelope-from owner-freebsd-ports at freebsd.org)
> 
> Sure looks like freebsd.org to me, hence my comment about a compromised
> server...

Are you really surprised list mail comes from freebsd.org servers
because that's what your excerpt shows?  Real question is where the list
software received it from, and my excerpt had that, coming from
somewhere unknown with forged From header.