Hello Scott,
After reading your mail (thanx for that!), we updated to 6.06 (we thought we
were running it, but were still 6.04) - unfortunately we got the same
problem again !!!
Hello Dave,
You're my man for today !!
That trick you told me was the solution !! We removed the NOBODY account and
now we get a "System appeared to reject relay attempts" line, after running
the Telnet test. You did make our headaches stop - thanx alot for that !!
Now maybe you could also tell me, if we can run the NOBODY alias, or should
let it removed as it is in the moment??? Does it pose any spam risk?? As you
say "This does not make you an open relay but that is what they failed you
for", I assume we could leave the NOBODY account working, without working as
a relay for spammers - thus being not open to Email abuse ?! Did I get you
right ??
Thank you so much for you contribution Yuri, Scott & Dave !!!
Have a great day,
Marc
> -----Ursprungliche Nachricht-----
> Von: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED]]Im Auftrag von Dave
> MacMillan
> Gesendet: Donnerstag, 22. Marz 2001 19:44
> An: [EMAIL PROTECTED]
> Betreff: Re: [IMail Forum] Cant's stop spammers with our RELAY settings
> !
>
>
> This: 250 ok deliver to alternate
>
> Shows that you have the nobody alias set, meaning that you will accept
> mail for nonexistent usernames.
>
> This does not make you an open relay but that is what they failed you
> for.
>
> Dave
>
>
> In reply to 22 Mar message from [EMAIL PROTECTED]:
>
> >Did you restart SMTP service on your server after making the
> >changes?
>
>
> >----- Original Message -----
> >From: "Marc Weigert" <[EMAIL PROTECTED]>
> >To: <[EMAIL PROTECTED]>
> >Sent: Thursday, March 22, 2001 10:46 AM
> >Subject: [IMail Forum] Cant's stop spammers with our RELAY
> >settings !
>
>
> >> Hi,
> >>
> >> it appears as this message (attached below) didn't get sent correctly
> last
> >> nite, as I could not find it within the list... so please forgive me,
> if
> >you
> >> got it twice ;)
> >>
> >> Any help would be more than welcome !! Tnank you in advance.
> >>
> >> Cheers,
> >>
> >> Marc
> >>
> >> ----------
> >>
> >> Hello List !!!
> >>
> >> We discovered some abuse of our IMail server today, with spammers
> using
> >the
> >> SMTP service for... well, what they use to do ;)
> >>
> >> So we checked both, the manual and IPSwitch knowledgebase - and did
> do
> >what
> >> is recommended concerning the Relay settings.
> >>
> >> We changed the "Relay Mail Options" from "Relay Mail for anyone" to
> "Relay
> >> Mail for [Adress]" and entered the IP values (we tried several
> different
> >> settings there for testing).
> >>
> >> Also, we ticked this "user authentization" checkbox within our Email
> >clients
> >> to use IMail Server SMTP AUTH, as we dial in via different hosts all
> the
> >> time. This works fine...
> >>
> >> Well, finally we ran a vulnerability scan with Mail-Abuse.org via
> Telnet :
> >> # C:\WINNT\system32\mail-abuse.org
> >>
> >> As you might already have seen, I copied the protocol in the lower
> part of
> >> this Email. Witihn that copy of the protocol I just changed our REAL
> LIVE
> >> server values to the following "Aliases" for publishing to this list
> >(please
> >> don't take it personal ;) !
> >>
> >> # 111.11.11.111
> >> # Obelix.TheServer.com
> >> # TheServerStuff.com
> >>
> >> We passed 17 tests, until this spam vulnerability checker managed to
> "get
> >> in" :
> >> # "System appeared to accept 1 relay attempts"
> >>
> >> I already searched the Usenet for possible answers, but unfortunately
> I
> >got
> >> no suitable answer - maybe because Google limits the research to
> messages
> >> not older than of August 2000 right now ?!
> >>
> >> It would be very appreciated if you could tell us, what we
> should/could do
> >> next, to make our Email Server bulletproof !!
> >>
> >> Thanx in advance to all of you !!!
> >>
> >> Cheers,
> >>
> >> Marc
> >>
> >> > > > > > THE PROTOCOL (with DUMMY values) > > > > > >
> >>
> >> Connecting to 111.11.11.111 ...
> >> <<< 220 X1 NT-ESMTP Server
> Obelix.TheServer
> >> <<< 220 X1 NT-ESMTP Server Obelix.TheServer.com (IMail 6.04 1-1)
> >> >>> HELO dante.mail-abuse.org
> >> <<< 250 hello Obelix.TheServer.com
> >> :Relay test: #Quote test
> >> >>> mail from: <[EMAIL PROTECTED]>
> >> <<< 250 ok
> >> >>> rcpt to: <"[EMAIL PROTECTED]">
> >> <<< 550 not local host mail-abuse.org", not a gateway
> >> >>> rset
> >> <<< 250 ok its reset
> >> :Relay test: #Test 1
> >> >>> mail from: <[EMAIL PROTECTED]>
> >> <<< 250 ok
> >> >>> rcpt to: <[EMAIL PROTECTED]>
> >> <<< 550 not local host mail-abuse.org, not a gateway
> >> >>> rset
> >> <<< 250 ok its reset
> >> :Relay test: #Test 2
> >> >>> mail from: <[EMAIL PROTECTED]>
> >> <<< 250 ok
> >> >>> rcpt to: <[EMAIL PROTECTED]>
> >> <<< 550 not local host mail-abuse.org, not a gateway
> >> >>> rset
> >> <<< 250 ok its reset
> >> :Relay test: #test 3
> >> >>> mail from: <spamtest@localhost>
> >> <<< 250 ok
> >> >>> rcpt to: <[EMAIL PROTECTED]>
> >> <<< 550 not local host mail-abuse.org, not a gateway
> >> >>> rset
> >> <<< 250 ok its reset
> >> :Relay test: #Test 4
> >> >>> mail from: <spamtest>
> >> <<< 501 unacceptable mail address
> >> >>> rset
> >> <<< 250 ok its reset
> >> :Relay test: #Test 5
> >> >>> mail from: <>
> >> <<< 250 ok
> >> >>> rcpt to: <[EMAIL PROTECTED]>
> >> <<< 550 not local host mail-abuse.org, not a gateway
> >> >>> rset
> >> <<< 250 ok its reset
> >> :Relay test: #Test 6
> >> >>> mail from: <[EMAIL PROTECTED]>
> >> <<< 250 ok
> >> >>> rcpt to: <[EMAIL PROTECTED]>
> >> <<< 550 not local host mail-abuse.org, not a gateway
> >> >>> rset
> >> <<< 250 ok its reset
> >> :Relay test: #Test 7
> >> >>> mail from: <spamtest@[111.11.11.111]>
> >> <<< 250 ok
> >> >>> rcpt to: <[EMAIL PROTECTED]>
> >> <<< 550 not local host mail-abuse.org, not a gateway
> >> >>> rset
> >> <<< 250 ok its reset
> >> :Relay test: #Test 8
> >> >>> mail from: <[EMAIL PROTECTED]>
> >> <<< 250 ok
> >> >>> rcpt to: <[EMAIL PROTECTED]>
> >> <<< 550 not local host mail-abuse.org, not a gateway
> >> >>> rset
> >> <<< 250 ok its reset
> >> :Relay test: #Test 9
> >> >>> mail from: <[EMAIL PROTECTED]>
> >> <<< 250 ok
> >> >>> rcpt to: <nobody%mail-abuse.org@[111.11.11.111]>
> >> <<< 550 not local host mail-abuse.org, not a gateway
> >> >>> rset
> >> <<< 250 ok its reset
> >> :Relay test: #Test 10
> >> >>> mail from: <[EMAIL PROTECTED]>
> >> <<< 250 ok
> >> >>> rcpt to: <"[EMAIL PROTECTED]">
> >> <<< 550 not local host mail-abuse.org", not a gateway
> >> >>> rset
> >> <<< 250 ok its reset
> >> :Relay test: #Test 11
> >> >>> mail from: <[EMAIL PROTECTED]>
> >> <<< 250 ok
> >> >>> rcpt to: <"nobody%mail-abuse.org">
> >> <<< 550 not local host mail-abuse.org", not a gateway
> >> >>> rset
> >> <<< 250 ok its reset
> >> :Relay test: #Test 12
> >> >>> mail from: <spamtest@[111.11.11.111]>
> >> <<< 250 ok
> >> >>> rcpt to: <"[EMAIL PROTECTED]@TheServerStuff.com">
> >> <<< 550 not local host TheServerStuff.com", not a gateway
> >> >>> rset
> >> <<< 250 ok its reset
> >> :Relay test: #Test 13
> >> >>> mail from: <[EMAIL PROTECTED]>
> >> <<< 250 ok
> >> >>> rcpt to: <"[EMAIL PROTECTED]"@[111.11.11.111]>
> >> <<< 550 not local host mail-abuse.org", not a gateway
> >> >>> rset
> >> <<< 250 ok its reset
> >> :Relay test: #Test 14
> >> >>> mail from: <[EMAIL PROTECTED]>
> >> <<< 250 ok
> >> >>> rcpt to: <[EMAIL PROTECTED]@[111.11.11.111]>
> >> <<< 550 not local host mail-abuse.org, not a gateway
> >> >>> rset
> >> <<< 250 ok its reset
> >> :Relay test: #Test 15
> >> >>> mail from: <spamtest@[111.11.11.111]>
> >> <<< 250 ok
> >> >>> rcpt to: <@TheServerStuff.com:[EMAIL PROTECTED]>
> >> <<< 550 not local host mail-abuse.org, not a gateway
> >> >>> rset
> >> <<< 250 ok its reset
> >> :Relay test: #Test 16
> >> >>> mail from: <[EMAIL PROTECTED]>
> >> <<< 250 ok
> >> >>> rcpt to: <@[111.11.11.111]:[EMAIL PROTECTED]>
> >> <<< 550 not local host mail-abuse.org, not a gateway
> >> >>> rset
> >> <<< 250 ok its reset
> >> :Relay test: #Test 17
> >> >>> mail from: <spamtest@[111.11.11.111]>
> >> <<< 250 ok
> >> >>> rcpt to: <mail-abuse.org!nobody>
> >> <<< 250 ok deliver to alternate
> >> >>> QUIT
> >> <<< 221 Goodbye
> >> Tested host banner: 220 X1 NT-ESMTP Server Obelix.TheServer.com
> (IMail 6.
> >> 04 1-1)
> >> System appeared to accept 1 relay attempts
> >>
> >>
> >> Connection to host lost.
> >>
> >>
> >> Please visit http://www.ipswitch.com/support/mailing-lists.html
> >> to be removed from this list.
> >>
> >> An Archive of this list is available at:
> >> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
> >>
>
>
> >Please visit
> >http://www.ipswitch.com/support/mailing-lists.html to be
> >removed from this list.
>
> >An Archive of this list is available at:
> >http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
>
>
>
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> An Archive of this list is available at:
> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
>
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
