I will try to explain the whole problem before anyone has a chance to
respond
For about a month now I have seen things like this come through my mail
server...
20001212 082842 127.0.0.1 SMTPD (B48F020E) [63.17.172.68] EHLO laptop3
20001212 082842 127.0.0.1 SMTPD (00000048) Authenticated
[EMAIL PROTECTED], session treated as local.
20001212 082843 127.0.0.1 SMTPD (B48F020E) [63.17.172.68] MAIL FROM:
<[EMAIL PROTECTED]>
20001212 082843 127.0.0.1 SMTPD (B48F020E) [63.17.172.68] RCPT TO:
<[EMAIL PROTECTED]>
20001212 082844 127.0.0.1 SMTPD (B48F020E) [63.17.172.68]
The only conclusion I could come up with is this INAME.com account is using
my domain1.com as a gateway. I had no way of tracing this so I put
iname.com on the kill.lst. Now a member has called us and is complaining
that he cannot send mail.
This (from what I can gather) is his configuration. He has INAME setup to
forward all incoming mail to domain1.com He then checks his domain1.com
email with Outlook. He says he is using a PGP key (probably doesnt matter).
He has his reply-to address set to INAME.com. This is how he says it has
been set up the whole time. Now I see this coming through the logs (just
want to be thorough)...
20001212 082842 127.0.0.1 SMTPD (B48F020E) [63.17.172.68] EHLO laptop3
20001212 082842 127.0.0.1 SMTPD (00000048) Authenticated
[EMAIL PROTECTED], session treated as local.
20001212 082843 127.0.0.1 SMTPD (B48F020E) [63.17.172.68] MAIL FROM:
<[EMAIL PROTECTED]>
20001212 082843 127.0.0.1 SMTPD (B48F020E) [63.17.172.68] RCPT TO:
<[EMAIL PROTECTED]>
20001212 082844 127.0.0.1 SMTPD (B48F020E) [63.17.172.68]
Am I right in saying that he is (whether he knows it or not) is using my
server as a gateway? Whether it is or is not spam or malicious email
sending is not the point. We all have policy and will stick by that policy
if we know something to be a fact or possible security risk.
Please help me...
Michael Varre
goChatPlus.com
Project Engineer
[EMAIL PROTECTED]
315.475.0500
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
