Hi,
it appears as this message (attached below) didn't get sent correctly last
nite, as I could not find it within the list... so please forgive me, if you
got it twice ;)
Any help would be more than welcome !! Tnank you in advance.
Cheers,
Marc
----------
Hello List !!!
We discovered some abuse of our IMail server today, with spammers using the
SMTP service for... well, what they use to do ;)
So we checked both, the manual and IPSwitch knowledgebase - and did do what
is recommended concerning the Relay settings.
We changed the "Relay Mail Options" from "Relay Mail for anyone" to "Relay
Mail for [Adress]" and entered the IP values (we tried several different
settings there for testing).
Also, we ticked this "user authentization" checkbox within our Email clients
to use IMail Server SMTP AUTH, as we dial in via different hosts all the
time. This works fine...
Well, finally we ran a vulnerability scan with Mail-Abuse.org via Telnet :
# C:\WINNT\system32\mail-abuse.org
As you might already have seen, I copied the protocol in the lower part of
this Email. Witihn that copy of the protocol I just changed our REAL LIVE
server values to the following "Aliases" for publishing to this list (please
don't take it personal ;) !
# 111.11.11.111
# Obelix.TheServer.com
# TheServerStuff.com
We passed 17 tests, until this spam vulnerability checker managed to "get
in" :
# "System appeared to accept 1 relay attempts"
I already searched the Usenet for possible answers, but unfortunately I got
no suitable answer - maybe because Google limits the research to messages
not older than of August 2000 right now ?!
It would be very appreciated if you could tell us, what we should/could do
next, to make our Email Server bulletproof !!
Thanx in advance to all of you !!!
Cheers,
Marc
> > > > > THE PROTOCOL (with DUMMY values) > > > > > >
Connecting to 111.11.11.111 ...
<<< 220 X1 NT-ESMTP Server Obelix.TheServer
<<< 220 X1 NT-ESMTP Server Obelix.TheServer.com (IMail 6.04 1-1)
>>> HELO dante.mail-abuse.org
<<< 250 hello Obelix.TheServer.com
:Relay test: #Quote test
>>> mail from: <[EMAIL PROTECTED]>
<<< 250 ok
>>> rcpt to: <"[EMAIL PROTECTED]">
<<< 550 not local host mail-abuse.org", not a gateway
>>> rset
<<< 250 ok its reset
:Relay test: #Test 1
>>> mail from: <[EMAIL PROTECTED]>
<<< 250 ok
>>> rcpt to: <[EMAIL PROTECTED]>
<<< 550 not local host mail-abuse.org, not a gateway
>>> rset
<<< 250 ok its reset
:Relay test: #Test 2
>>> mail from: <[EMAIL PROTECTED]>
<<< 250 ok
>>> rcpt to: <[EMAIL PROTECTED]>
<<< 550 not local host mail-abuse.org, not a gateway
>>> rset
<<< 250 ok its reset
:Relay test: #test 3
>>> mail from: <spamtest@localhost>
<<< 250 ok
>>> rcpt to: <[EMAIL PROTECTED]>
<<< 550 not local host mail-abuse.org, not a gateway
>>> rset
<<< 250 ok its reset
:Relay test: #Test 4
>>> mail from: <spamtest>
<<< 501 unacceptable mail address
>>> rset
<<< 250 ok its reset
:Relay test: #Test 5
>>> mail from: <>
<<< 250 ok
>>> rcpt to: <[EMAIL PROTECTED]>
<<< 550 not local host mail-abuse.org, not a gateway
>>> rset
<<< 250 ok its reset
:Relay test: #Test 6
>>> mail from: <[EMAIL PROTECTED]>
<<< 250 ok
>>> rcpt to: <[EMAIL PROTECTED]>
<<< 550 not local host mail-abuse.org, not a gateway
>>> rset
<<< 250 ok its reset
:Relay test: #Test 7
>>> mail from: <spamtest@[111.11.11.111]>
<<< 250 ok
>>> rcpt to: <[EMAIL PROTECTED]>
<<< 550 not local host mail-abuse.org, not a gateway
>>> rset
<<< 250 ok its reset
:Relay test: #Test 8
>>> mail from: <[EMAIL PROTECTED]>
<<< 250 ok
>>> rcpt to: <[EMAIL PROTECTED]>
<<< 550 not local host mail-abuse.org, not a gateway
>>> rset
<<< 250 ok its reset
:Relay test: #Test 9
>>> mail from: <[EMAIL PROTECTED]>
<<< 250 ok
>>> rcpt to: <nobody%mail-abuse.org@[111.11.11.111]>
<<< 550 not local host mail-abuse.org, not a gateway
>>> rset
<<< 250 ok its reset
:Relay test: #Test 10
>>> mail from: <[EMAIL PROTECTED]>
<<< 250 ok
>>> rcpt to: <"[EMAIL PROTECTED]">
<<< 550 not local host mail-abuse.org", not a gateway
>>> rset
<<< 250 ok its reset
:Relay test: #Test 11
>>> mail from: <[EMAIL PROTECTED]>
<<< 250 ok
>>> rcpt to: <"nobody%mail-abuse.org">
<<< 550 not local host mail-abuse.org", not a gateway
>>> rset
<<< 250 ok its reset
:Relay test: #Test 12
>>> mail from: <spamtest@[111.11.11.111]>
<<< 250 ok
>>> rcpt to: <"[EMAIL PROTECTED]@TheServerStuff.com">
<<< 550 not local host TheServerStuff.com", not a gateway
>>> rset
<<< 250 ok its reset
:Relay test: #Test 13
>>> mail from: <[EMAIL PROTECTED]>
<<< 250 ok
>>> rcpt to: <"[EMAIL PROTECTED]"@[111.11.11.111]>
<<< 550 not local host mail-abuse.org", not a gateway
>>> rset
<<< 250 ok its reset
:Relay test: #Test 14
>>> mail from: <[EMAIL PROTECTED]>
<<< 250 ok
>>> rcpt to: <[EMAIL PROTECTED]@[111.11.11.111]>
<<< 550 not local host mail-abuse.org, not a gateway
>>> rset
<<< 250 ok its reset
:Relay test: #Test 15
>>> mail from: <spamtest@[111.11.11.111]>
<<< 250 ok
>>> rcpt to: <@TheServerStuff.com:[EMAIL PROTECTED]>
<<< 550 not local host mail-abuse.org, not a gateway
>>> rset
<<< 250 ok its reset
:Relay test: #Test 16
>>> mail from: <[EMAIL PROTECTED]>
<<< 250 ok
>>> rcpt to: <@[111.11.11.111]:[EMAIL PROTECTED]>
<<< 550 not local host mail-abuse.org, not a gateway
>>> rset
<<< 250 ok its reset
:Relay test: #Test 17
>>> mail from: <spamtest@[111.11.11.111]>
<<< 250 ok
>>> rcpt to: <mail-abuse.org!nobody>
<<< 250 ok deliver to alternate
>>> QUIT
<<< 221 Goodbye
Tested host banner: 220 X1 NT-ESMTP Server Obelix.TheServer.com (IMail 6.
04 1-1)
System appeared to accept 1 relay attempts
Connection to host lost.
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
