Did you restart SMTP service on your server after making the changes?
----- Original Message -----
From: "Marc Weigert" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, March 22, 2001 10:46 AM
Subject: [IMail Forum] Cant's stop spammers with our RELAY settings !
> Hi,
>
> it appears as this message (attached below) didn't get sent correctly last
> nite, as I could not find it within the list... so please forgive me, if
you
> got it twice ;)
>
> Any help would be more than welcome !! Tnank you in advance.
>
> Cheers,
>
> Marc
>
> ----------
>
> Hello List !!!
>
> We discovered some abuse of our IMail server today, with spammers using
the
> SMTP service for... well, what they use to do ;)
>
> So we checked both, the manual and IPSwitch knowledgebase - and did do
what
> is recommended concerning the Relay settings.
>
> We changed the "Relay Mail Options" from "Relay Mail for anyone" to "Relay
> Mail for [Adress]" and entered the IP values (we tried several different
> settings there for testing).
>
> Also, we ticked this "user authentization" checkbox within our Email
clients
> to use IMail Server SMTP AUTH, as we dial in via different hosts all the
> time. This works fine...
>
> Well, finally we ran a vulnerability scan with Mail-Abuse.org via Telnet :
> # C:\WINNT\system32\mail-abuse.org
>
> As you might already have seen, I copied the protocol in the lower part of
> this Email. Witihn that copy of the protocol I just changed our REAL LIVE
> server values to the following "Aliases" for publishing to this list
(please
> don't take it personal ;) !
>
> # 111.11.11.111
> # Obelix.TheServer.com
> # TheServerStuff.com
>
> We passed 17 tests, until this spam vulnerability checker managed to "get
> in" :
> # "System appeared to accept 1 relay attempts"
>
> I already searched the Usenet for possible answers, but unfortunately I
got
> no suitable answer - maybe because Google limits the research to messages
> not older than of August 2000 right now ?!
>
> It would be very appreciated if you could tell us, what we should/could do
> next, to make our Email Server bulletproof !!
>
> Thanx in advance to all of you !!!
>
> Cheers,
>
> Marc
>
> > > > > > THE PROTOCOL (with DUMMY values) > > > > > >
>
> Connecting to 111.11.11.111 ...
> <<< 220 X1 NT-ESMTP Server Obelix.TheServer
> <<< 220 X1 NT-ESMTP Server Obelix.TheServer.com (IMail 6.04 1-1)
> >>> HELO dante.mail-abuse.org
> <<< 250 hello Obelix.TheServer.com
> :Relay test: #Quote test
> >>> mail from: <[EMAIL PROTECTED]>
> <<< 250 ok
> >>> rcpt to: <"[EMAIL PROTECTED]">
> <<< 550 not local host mail-abuse.org", not a gateway
> >>> rset
> <<< 250 ok its reset
> :Relay test: #Test 1
> >>> mail from: <[EMAIL PROTECTED]>
> <<< 250 ok
> >>> rcpt to: <[EMAIL PROTECTED]>
> <<< 550 not local host mail-abuse.org, not a gateway
> >>> rset
> <<< 250 ok its reset
> :Relay test: #Test 2
> >>> mail from: <[EMAIL PROTECTED]>
> <<< 250 ok
> >>> rcpt to: <[EMAIL PROTECTED]>
> <<< 550 not local host mail-abuse.org, not a gateway
> >>> rset
> <<< 250 ok its reset
> :Relay test: #test 3
> >>> mail from: <spamtest@localhost>
> <<< 250 ok
> >>> rcpt to: <[EMAIL PROTECTED]>
> <<< 550 not local host mail-abuse.org, not a gateway
> >>> rset
> <<< 250 ok its reset
> :Relay test: #Test 4
> >>> mail from: <spamtest>
> <<< 501 unacceptable mail address
> >>> rset
> <<< 250 ok its reset
> :Relay test: #Test 5
> >>> mail from: <>
> <<< 250 ok
> >>> rcpt to: <[EMAIL PROTECTED]>
> <<< 550 not local host mail-abuse.org, not a gateway
> >>> rset
> <<< 250 ok its reset
> :Relay test: #Test 6
> >>> mail from: <[EMAIL PROTECTED]>
> <<< 250 ok
> >>> rcpt to: <[EMAIL PROTECTED]>
> <<< 550 not local host mail-abuse.org, not a gateway
> >>> rset
> <<< 250 ok its reset
> :Relay test: #Test 7
> >>> mail from: <spamtest@[111.11.11.111]>
> <<< 250 ok
> >>> rcpt to: <[EMAIL PROTECTED]>
> <<< 550 not local host mail-abuse.org, not a gateway
> >>> rset
> <<< 250 ok its reset
> :Relay test: #Test 8
> >>> mail from: <[EMAIL PROTECTED]>
> <<< 250 ok
> >>> rcpt to: <[EMAIL PROTECTED]>
> <<< 550 not local host mail-abuse.org, not a gateway
> >>> rset
> <<< 250 ok its reset
> :Relay test: #Test 9
> >>> mail from: <[EMAIL PROTECTED]>
> <<< 250 ok
> >>> rcpt to: <nobody%mail-abuse.org@[111.11.11.111]>
> <<< 550 not local host mail-abuse.org, not a gateway
> >>> rset
> <<< 250 ok its reset
> :Relay test: #Test 10
> >>> mail from: <[EMAIL PROTECTED]>
> <<< 250 ok
> >>> rcpt to: <"[EMAIL PROTECTED]">
> <<< 550 not local host mail-abuse.org", not a gateway
> >>> rset
> <<< 250 ok its reset
> :Relay test: #Test 11
> >>> mail from: <[EMAIL PROTECTED]>
> <<< 250 ok
> >>> rcpt to: <"nobody%mail-abuse.org">
> <<< 550 not local host mail-abuse.org", not a gateway
> >>> rset
> <<< 250 ok its reset
> :Relay test: #Test 12
> >>> mail from: <spamtest@[111.11.11.111]>
> <<< 250 ok
> >>> rcpt to: <"[EMAIL PROTECTED]@TheServerStuff.com">
> <<< 550 not local host TheServerStuff.com", not a gateway
> >>> rset
> <<< 250 ok its reset
> :Relay test: #Test 13
> >>> mail from: <[EMAIL PROTECTED]>
> <<< 250 ok
> >>> rcpt to: <"[EMAIL PROTECTED]"@[111.11.11.111]>
> <<< 550 not local host mail-abuse.org", not a gateway
> >>> rset
> <<< 250 ok its reset
> :Relay test: #Test 14
> >>> mail from: <[EMAIL PROTECTED]>
> <<< 250 ok
> >>> rcpt to: <[EMAIL PROTECTED]@[111.11.11.111]>
> <<< 550 not local host mail-abuse.org, not a gateway
> >>> rset
> <<< 250 ok its reset
> :Relay test: #Test 15
> >>> mail from: <spamtest@[111.11.11.111]>
> <<< 250 ok
> >>> rcpt to: <@TheServerStuff.com:[EMAIL PROTECTED]>
> <<< 550 not local host mail-abuse.org, not a gateway
> >>> rset
> <<< 250 ok its reset
> :Relay test: #Test 16
> >>> mail from: <[EMAIL PROTECTED]>
> <<< 250 ok
> >>> rcpt to: <@[111.11.11.111]:[EMAIL PROTECTED]>
> <<< 550 not local host mail-abuse.org, not a gateway
> >>> rset
> <<< 250 ok its reset
> :Relay test: #Test 17
> >>> mail from: <spamtest@[111.11.11.111]>
> <<< 250 ok
> >>> rcpt to: <mail-abuse.org!nobody>
> <<< 250 ok deliver to alternate
> >>> QUIT
> <<< 221 Goodbye
> Tested host banner: 220 X1 NT-ESMTP Server Obelix.TheServer.com (IMail 6.
> 04 1-1)
> System appeared to accept 1 relay attempts
>
>
> Connection to host lost.
>
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> An Archive of this list is available at:
> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
>
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
