Rod Collen writes: > This might be a tad off topic, but I got a few strange lines in the maillog > and I wanted another opinion and could think of no better place to ask. > > Does this look like an attack or a probe looking for an open relay... or do > you think its just badly formatted mail? I find it strange and a little > amusing. > > courieresmtpd: error,relay=::ffff:66.169.236.188,msg="554 Syntax error - > your mail software violates RFC 821.",cmd: MAIL FROM: [EMAIL PROTECTED] > courieresmtpd: error,relay=::ffff:66.169.236.188,msg="502 ESMTP command > error",cmd: RCPT TO: [EMAIL PROTECTED] > courieresmtpd: error,relay=::ffff:66.169.236.188,msg="502 ESMTP command > error",cmd: DATA > courieresmtpd: error,relay=::ffff:66.169.236.188,msg="502 ESMTP command > error",cmd: SUBJECT: Anti-Relay Notification. > courieresmtpd: error,relay=::ffff:66.169.236.188,msg="502 ESMTP command > error",cmd: ATTENTION OWNER OF MAIL SERVER:. > courieresmtpd: writev: Connection reset by peer > > Before you ask, no, this machine is not an open relay and never has been :)
You'll see crap like that in the mail logs from an attempted spam run through an open HTTP proxy. This is where you've got an open HTTP proxy, and you send it a GET http://destination:25, followed by a one-sided SMTP convestion: HELO/MAIL FROM/RCPT TO/DATA. The proxy establishes a connection, and then blindly transmits the SMTP command sequence (obviously without waiting for each command to complete and return its status). There are several reasons why this won't work when the proxy connects to a Courier box. Of course, a syntactically invalid MAIL FROM is one of them. Even if the MAIL FROM: was well formed, there would be a few other reasons why it won't go through. -- Sam ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek No, I will not fix your computer. http://thinkgeek.com/sf _______________________________________________ courier-users mailing list [EMAIL PROTECTED] Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users
