Mark Busby wrote:
Is this an open relay using ipv6? If so how to block the ipv6 relay. I thought after sendmail v8.9, all relay action was blocked by default.
You haven't given sufficient information to say whether the machine is an open relay or not. We'd need to see the configuration files (well,the .mc file that is processed to produce the eventual sendmail.cf) plus potentially the contents of the access DB. However, you are correct: nowadays the default sendmail configuration is to block relaying, and you have to deliberately add configuration settings to enable any permitted relays. If you're using the default configuration shipped with FreeBSD, then it is not an open relay.
maillog entry Nov 10 15:01:11 "hostname" sm-mta: mAAL021C008989: from=<[EMAIL PROTECTED]>, size=4825, class=0, nrcpts=0, bodytype=7BIT, proto=ESMTP, daemon=IPv6, relay=localhost [IPv6:::1]Nov 10 15:01:17 "hostname" sm-mta: mAAL021D008989: ruleset=check_mail, arg1=<[EMAIL PROTECTED]>, relay=localhost [IPv6:::1], reject=451 4.1.8 Domain of sender address [EMAIL PROTECTED] does not resolve Nov 10 15:01:17 "hostname" sm-mta: mAAL021D008989: from=<[EMAIL PROTECTED]>, size=3880, class=0, nrcpts=0, bodytype=7BIT, proto=ESMTP, daemon=IPv6, relay=localhost [IPv6:::1]
This certainly doesn't indicate a message being inappropriately relayed. The attempt to send the message is rejected with a permanent error code (ie. tell the sender to bounce the message as undeliverable and not to re-queue it for another attempt at delivery later). I think it's also doing the correct thing and rejecting the e-mail during the SMTP dialog rather than accepting the message for delivery and then later sending a bounce-o-gram to the listed sender address. Google for 'backscatter spam' in order to understand why the latter course of action is a bad idea.
sockstat -6USER COMMAND PID FD PROTO LOCAL ADDRESS FOREIGN ADDRESS root sendmail 8284 5 tcp6 *:25 *:* root sshd 1520 3 tcp6 *:5960 *:* root ntpd 1010 5 udp6 *:123 *:* root ntpd 1010 9 udp6 fe80:6::1:123 *:* root ntpd 1010 10 udp6 ::1:123 *:* root syslogd 927 6 udp6 *:514 *:*
You've got sendmail listening on all interfaces for IPv6 connections. This is appropriate if you expect the machine to receive incoming e-mails. If that's not the case, then set "sendmail_enable='NO'" in /etc/rc.conf. This will give you a send-only configuration with a sendmail listener bound to the loopback address (typically both ::1
and 127.0.0.1) Cheers, Matthew -- Dr Matthew J Seaman MA, D.Phil. 7 Priory Courtyard Flat 3 PGP: http://www.infracaninophile.co.uk/pgpkey Ramsgate Kent, CT11 9PW
Description: OpenPGP digital signature