Marc,
I could not believe that IMail failed the last test, so tried it on mine and
I confirmed that it would do as you showed, but ONLY if I had a 'nobody'
alias. Once I removed that, the last test returned '550 unknown user
<mail-abuse.org!nobody>', instead of the '250 ok deliver to alternate'.
So this tells me you have a 'nobody' alias. And if you remove it, IMail will
pass the test.
In actuality, IMail did not relay any mail, it accepted it and delivered it
to the destination pointed to by the nobody alias. That tells me the test is
not 'as good as it should be' because it does not look for the delivery of
the email to the destination address. The test looks only at the fact that
IMail accepted it, which is not a true test of 'relaying', IMHO.
Daniel Donnelly
________________________________________________________
----- Original Message -----
From: "Marc Weigert" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, March 22, 2001 10:46 AM
Subject: [IMail Forum] Cant's stop spammers with our RELAY settings !
> Hi,
>
> it appears as this message (attached below) didn't get sent correctly last
> nite, as I could not find it within the list... so please forgive me, if
you
> got it twice ;)
>
> Any help would be more than welcome !! Tnank you in advance.
>
> Cheers,
>
> Marc
>
> ----------
>
> Hello List !!!
>
> We discovered some abuse of our IMail server today, with spammers using
the
> SMTP service for... well, what they use to do ;)
>
> So we checked both, the manual and IPSwitch knowledgebase - and did do
what
> is recommended concerning the Relay settings.
>
> We changed the "Relay Mail Options" from "Relay Mail for anyone" to "Relay
> Mail for [Adress]" and entered the IP values (we tried several different
> settings there for testing).
>
> Also, we ticked this "user authentization" checkbox within our Email
clients
> to use IMail Server SMTP AUTH, as we dial in via different hosts all the
> time. This works fine...
>
> Well, finally we ran a vulnerability scan with Mail-Abuse.org via Telnet :
> # C:\WINNT\system32\mail-abuse.org
>
> As you might already have seen, I copied the protocol in the lower part of
> this Email. Witihn that copy of the protocol I just changed our REAL LIVE
> server values to the following "Aliases" for publishing to this list
(please
> don't take it personal ;) !
>
> # 111.11.11.111
> # Obelix.TheServer.com
> # TheServerStuff.com
>
> We passed 17 tests, until this spam vulnerability checker managed to "get
> in" :
> # "System appeared to accept 1 relay attempts"
>
> I already searched the Usenet for possible answers, but unfortunately I
got
> no suitable answer - maybe because Google limits the research to messages
> not older than of August 2000 right now ?!
>
> It would be very appreciated if you could tell us, what we should/could do
> next, to make our Email Server bulletproof !!
>
> Thanx in advance to all of you !!!
>
> Cheers,
>
> Marc
>
> > > > > > THE PROTOCOL (with DUMMY values) > > > > > >
>
> Connecting to 111.11.11.111 ...
> <<< 220 X1 NT-ESMTP Server Obelix.TheServer
> <<< 220 X1 NT-ESMTP Server Obelix.TheServer.com (IMail 6.04 1-1)
> >>> HELO dante.mail-abuse.org
> <<< 250 hello Obelix.TheServer.com
> :Relay test: #Quote test
> >>> mail from: <[EMAIL PROTECTED]>
> <<< 250 ok
> >>> rcpt to: <"[EMAIL PROTECTED]">
> <<< 550 not local host mail-abuse.org", not a gateway
> >>> rset
> <<< 250 ok its reset
> :Relay test: #Test 1
> >>> mail from: <[EMAIL PROTECTED]>
> <<< 250 ok
> >>> rcpt to: <[EMAIL PROTECTED]>
> <<< 550 not local host mail-abuse.org, not a gateway
> >>> rset
> <<< 250 ok its reset
> :Relay test: #Test 2
> >>> mail from: <[EMAIL PROTECTED]>
> <<< 250 ok
> >>> rcpt to: <[EMAIL PROTECTED]>
> <<< 550 not local host mail-abuse.org, not a gateway
> >>> rset
> <<< 250 ok its reset
> :Relay test: #test 3
> >>> mail from: <spamtest@localhost>
> <<< 250 ok
> >>> rcpt to: <[EMAIL PROTECTED]>
> <<< 550 not local host mail-abuse.org, not a gateway
> >>> rset
> <<< 250 ok its reset
> :Relay test: #Test 4
> >>> mail from: <spamtest>
> <<< 501 unacceptable mail address
> >>> rset
> <<< 250 ok its reset
> :Relay test: #Test 5
> >>> mail from: <>
> <<< 250 ok
> >>> rcpt to: <[EMAIL PROTECTED]>
> <<< 550 not local host mail-abuse.org, not a gateway
> >>> rset
> <<< 250 ok its reset
> :Relay test: #Test 6
> >>> mail from: <[EMAIL PROTECTED]>
> <<< 250 ok
> >>> rcpt to: <[EMAIL PROTECTED]>
> <<< 550 not local host mail-abuse.org, not a gateway
> >>> rset
> <<< 250 ok its reset
> :Relay test: #Test 7
> >>> mail from: <spamtest@[111.11.11.111]>
> <<< 250 ok
> >>> rcpt to: <[EMAIL PROTECTED]>
> <<< 550 not local host mail-abuse.org, not a gateway
> >>> rset
> <<< 250 ok its reset
> :Relay test: #Test 8
> >>> mail from: <[EMAIL PROTECTED]>
> <<< 250 ok
> >>> rcpt to: <[EMAIL PROTECTED]>
> <<< 550 not local host mail-abuse.org, not a gateway
> >>> rset
> <<< 250 ok its reset
> :Relay test: #Test 9
> >>> mail from: <[EMAIL PROTECTED]>
> <<< 250 ok
> >>> rcpt to: <nobody%mail-abuse.org@[111.11.11.111]>
> <<< 550 not local host mail-abuse.org, not a gateway
> >>> rset
> <<< 250 ok its reset
> :Relay test: #Test 10
> >>> mail from: <[EMAIL PROTECTED]>
> <<< 250 ok
> >>> rcpt to: <"[EMAIL PROTECTED]">
> <<< 550 not local host mail-abuse.org", not a gateway
> >>> rset
> <<< 250 ok its reset
> :Relay test: #Test 11
> >>> mail from: <[EMAIL PROTECTED]>
> <<< 250 ok
> >>> rcpt to: <"nobody%mail-abuse.org">
> <<< 550 not local host mail-abuse.org", not a gateway
> >>> rset
> <<< 250 ok its reset
> :Relay test: #Test 12
> >>> mail from: <spamtest@[111.11.11.111]>
> <<< 250 ok
> >>> rcpt to: <"[EMAIL PROTECTED]@TheServerStuff.com">
> <<< 550 not local host TheServerStuff.com", not a gateway
> >>> rset
> <<< 250 ok its reset
> :Relay test: #Test 13
> >>> mail from: <[EMAIL PROTECTED]>
> <<< 250 ok
> >>> rcpt to: <"[EMAIL PROTECTED]"@[111.11.11.111]>
> <<< 550 not local host mail-abuse.org", not a gateway
> >>> rset
> <<< 250 ok its reset
> :Relay test: #Test 14
> >>> mail from: <[EMAIL PROTECTED]>
> <<< 250 ok
> >>> rcpt to: <[EMAIL PROTECTED]@[111.11.11.111]>
> <<< 550 not local host mail-abuse.org, not a gateway
> >>> rset
> <<< 250 ok its reset
> :Relay test: #Test 15
> >>> mail from: <spamtest@[111.11.11.111]>
> <<< 250 ok
> >>> rcpt to: <@TheServerStuff.com:[EMAIL PROTECTED]>
> <<< 550 not local host mail-abuse.org, not a gateway
> >>> rset
> <<< 250 ok its reset
> :Relay test: #Test 16
> >>> mail from: <[EMAIL PROTECTED]>
> <<< 250 ok
> >>> rcpt to: <@[111.11.11.111]:[EMAIL PROTECTED]>
> <<< 550 not local host mail-abuse.org, not a gateway
> >>> rset
> <<< 250 ok its reset
> :Relay test: #Test 17
> >>> mail from: <spamtest@[111.11.11.111]>
> <<< 250 ok
> >>> rcpt to: <mail-abuse.org!nobody>
> <<< 250 ok deliver to alternate
> >>> QUIT
> <<< 221 Goodbye
> Tested host banner: 220 X1 NT-ESMTP Server Obelix.TheServer.com (IMail 6.
> 04 1-1)
> System appeared to accept 1 relay attempts
>
>
> Connection to host lost.
>
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> An Archive of this list is available at:
> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
>
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
