On Sun, Jun 30, 2002 at 12:24:37AM -0400, Sam Varshavchik wrote: > >courieresmtpd: error,relay=::ffff:66.169.236.188,msg="554 Syntax error - > >your mail software violates RFC 821.",cmd: MAIL FROM: [EMAIL PROTECTED] > > You'll see crap like that in the mail logs from an attempted spam run > through an open HTTP proxy. This is where you've got an open HTTP proxy, > and you send it a GET http://destination:25, followed by a one-sided SMTP > convestion: HELO/MAIL FROM/RCPT TO/DATA. The proxy establishes a > connection, and then blindly transmits the SMTP command sequence (obviously > without waiting for each command to complete and return its status).
Better spell it out Sam. "You don't have an open-relay SMTP server, but you *probably* have an open PROXY server". That is *majorly* worse than an open-relay as it means people can - say - gateway access to your internal servers via it (that's ANY internal server - telnet, smtp, web, etc) The content of that message looks like something by an ORBS-like creature - so it's found an open proxy on your network, and is trying to relay a mail message out via it. Fix that proxy server :-) -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek No, I will not fix your computer. http://thinkgeek.com/sf _______________________________________________ courier-users mailing list [EMAIL PROTECTED] Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users
