This: 250 ok deliver to alternate
Shows that you have the nobody alias set, meaning that you will accept
mail for nonexistent usernames.
This does not make you an open relay but that is what they failed you
for.
Dave
In reply to 22 Mar message from [EMAIL PROTECTED]:
>Did you restart SMTP service on your server after making the
>changes?
>----- Original Message -----
>From: "Marc Weigert" <[EMAIL PROTECTED]>
>To: <[EMAIL PROTECTED]>
>Sent: Thursday, March 22, 2001 10:46 AM
>Subject: [IMail Forum] Cant's stop spammers with our RELAY
>settings !
>> Hi,
>>
>> it appears as this message (attached below) didn't get sent correctly
last
>> nite, as I could not find it within the list... so please forgive me,
if
>you
>> got it twice ;)
>>
>> Any help would be more than welcome !! Tnank you in advance.
>>
>> Cheers,
>>
>> Marc
>>
>> ----------
>>
>> Hello List !!!
>>
>> We discovered some abuse of our IMail server today, with spammers
using
>the
>> SMTP service for... well, what they use to do ;)
>>
>> So we checked both, the manual and IPSwitch knowledgebase - and did
do
>what
>> is recommended concerning the Relay settings.
>>
>> We changed the "Relay Mail Options" from "Relay Mail for anyone" to
"Relay
>> Mail for [Adress]" and entered the IP values (we tried several
different
>> settings there for testing).
>>
>> Also, we ticked this "user authentization" checkbox within our Email
>clients
>> to use IMail Server SMTP AUTH, as we dial in via different hosts all
the
>> time. This works fine...
>>
>> Well, finally we ran a vulnerability scan with Mail-Abuse.org via
Telnet :
>> # C:\WINNT\system32\mail-abuse.org
>>
>> As you might already have seen, I copied the protocol in the lower
part of
>> this Email. Witihn that copy of the protocol I just changed our REAL
LIVE
>> server values to the following "Aliases" for publishing to this list
>(please
>> don't take it personal ;) !
>>
>> # 111.11.11.111
>> # Obelix.TheServer.com
>> # TheServerStuff.com
>>
>> We passed 17 tests, until this spam vulnerability checker managed to
"get
>> in" :
>> # "System appeared to accept 1 relay attempts"
>>
>> I already searched the Usenet for possible answers, but unfortunately
I
>got
>> no suitable answer - maybe because Google limits the research to
messages
>> not older than of August 2000 right now ?!
>>
>> It would be very appreciated if you could tell us, what we
should/could do
>> next, to make our Email Server bulletproof !!
>>
>> Thanx in advance to all of you !!!
>>
>> Cheers,
>>
>> Marc
>>
>> > > > > > THE PROTOCOL (with DUMMY values) > > > > > >
>>
>> Connecting to 111.11.11.111 ...
>> <<< 220 X1 NT-ESMTP Server
Obelix.TheServer
>> <<< 220 X1 NT-ESMTP Server Obelix.TheServer.com (IMail 6.04 1-1)
>> >>> HELO dante.mail-abuse.org
>> <<< 250 hello Obelix.TheServer.com
>> :Relay test: #Quote test
>> >>> mail from: <[EMAIL PROTECTED]>
>> <<< 250 ok
>> >>> rcpt to: <"[EMAIL PROTECTED]">
>> <<< 550 not local host mail-abuse.org", not a gateway
>> >>> rset
>> <<< 250 ok its reset
>> :Relay test: #Test 1
>> >>> mail from: <[EMAIL PROTECTED]>
>> <<< 250 ok
>> >>> rcpt to: <[EMAIL PROTECTED]>
>> <<< 550 not local host mail-abuse.org, not a gateway
>> >>> rset
>> <<< 250 ok its reset
>> :Relay test: #Test 2
>> >>> mail from: <[EMAIL PROTECTED]>
>> <<< 250 ok
>> >>> rcpt to: <[EMAIL PROTECTED]>
>> <<< 550 not local host mail-abuse.org, not a gateway
>> >>> rset
>> <<< 250 ok its reset
>> :Relay test: #test 3
>> >>> mail from: <spamtest@localhost>
>> <<< 250 ok
>> >>> rcpt to: <[EMAIL PROTECTED]>
>> <<< 550 not local host mail-abuse.org, not a gateway
>> >>> rset
>> <<< 250 ok its reset
>> :Relay test: #Test 4
>> >>> mail from: <spamtest>
>> <<< 501 unacceptable mail address
>> >>> rset
>> <<< 250 ok its reset
>> :Relay test: #Test 5
>> >>> mail from: <>
>> <<< 250 ok
>> >>> rcpt to: <[EMAIL PROTECTED]>
>> <<< 550 not local host mail-abuse.org, not a gateway
>> >>> rset
>> <<< 250 ok its reset
>> :Relay test: #Test 6
>> >>> mail from: <[EMAIL PROTECTED]>
>> <<< 250 ok
>> >>> rcpt to: <[EMAIL PROTECTED]>
>> <<< 550 not local host mail-abuse.org, not a gateway
>> >>> rset
>> <<< 250 ok its reset
>> :Relay test: #Test 7
>> >>> mail from: <spamtest@[111.11.11.111]>
>> <<< 250 ok
>> >>> rcpt to: <[EMAIL PROTECTED]>
>> <<< 550 not local host mail-abuse.org, not a gateway
>> >>> rset
>> <<< 250 ok its reset
>> :Relay test: #Test 8
>> >>> mail from: <[EMAIL PROTECTED]>
>> <<< 250 ok
>> >>> rcpt to: <[EMAIL PROTECTED]>
>> <<< 550 not local host mail-abuse.org, not a gateway
>> >>> rset
>> <<< 250 ok its reset
>> :Relay test: #Test 9
>> >>> mail from: <[EMAIL PROTECTED]>
>> <<< 250 ok
>> >>> rcpt to: <nobody%mail-abuse.org@[111.11.11.111]>
>> <<< 550 not local host mail-abuse.org, not a gateway
>> >>> rset
>> <<< 250 ok its reset
>> :Relay test: #Test 10
>> >>> mail from: <[EMAIL PROTECTED]>
>> <<< 250 ok
>> >>> rcpt to: <"[EMAIL PROTECTED]">
>> <<< 550 not local host mail-abuse.org", not a gateway
>> >>> rset
>> <<< 250 ok its reset
>> :Relay test: #Test 11
>> >>> mail from: <[EMAIL PROTECTED]>
>> <<< 250 ok
>> >>> rcpt to: <"nobody%mail-abuse.org">
>> <<< 550 not local host mail-abuse.org", not a gateway
>> >>> rset
>> <<< 250 ok its reset
>> :Relay test: #Test 12
>> >>> mail from: <spamtest@[111.11.11.111]>
>> <<< 250 ok
>> >>> rcpt to: <"[EMAIL PROTECTED]@TheServerStuff.com">
>> <<< 550 not local host TheServerStuff.com", not a gateway
>> >>> rset
>> <<< 250 ok its reset
>> :Relay test: #Test 13
>> >>> mail from: <[EMAIL PROTECTED]>
>> <<< 250 ok
>> >>> rcpt to: <"[EMAIL PROTECTED]"@[111.11.11.111]>
>> <<< 550 not local host mail-abuse.org", not a gateway
>> >>> rset
>> <<< 250 ok its reset
>> :Relay test: #Test 14
>> >>> mail from: <[EMAIL PROTECTED]>
>> <<< 250 ok
>> >>> rcpt to: <[EMAIL PROTECTED]@[111.11.11.111]>
>> <<< 550 not local host mail-abuse.org, not a gateway
>> >>> rset
>> <<< 250 ok its reset
>> :Relay test: #Test 15
>> >>> mail from: <spamtest@[111.11.11.111]>
>> <<< 250 ok
>> >>> rcpt to: <@TheServerStuff.com:[EMAIL PROTECTED]>
>> <<< 550 not local host mail-abuse.org, not a gateway
>> >>> rset
>> <<< 250 ok its reset
>> :Relay test: #Test 16
>> >>> mail from: <[EMAIL PROTECTED]>
>> <<< 250 ok
>> >>> rcpt to: <@[111.11.11.111]:[EMAIL PROTECTED]>
>> <<< 550 not local host mail-abuse.org, not a gateway
>> >>> rset
>> <<< 250 ok its reset
>> :Relay test: #Test 17
>> >>> mail from: <spamtest@[111.11.11.111]>
>> <<< 250 ok
>> >>> rcpt to: <mail-abuse.org!nobody>
>> <<< 250 ok deliver to alternate
>> >>> QUIT
>> <<< 221 Goodbye
>> Tested host banner: 220 X1 NT-ESMTP Server Obelix.TheServer.com
(IMail 6.
>> 04 1-1)
>> System appeared to accept 1 relay attempts
>>
>>
>> Connection to host lost.
>>
>>
>> Please visit http://www.ipswitch.com/support/mailing-lists.html
>> to be removed from this list.
>>
>> An Archive of this list is available at:
>> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
>>
>Please visit
>http://www.ipswitch.com/support/mailing-lists.html to be
>removed from this list.
>An Archive of this list is available at:
>http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
