Thanks for the response Len. I looked in the KB and searched the mail
archives, but didn't come up with anything. To answer your post, SMTP AUTH
does not work at all (not getting AUTH Failed) until I stop and restart the
SMTP service. One thing I see in my log is the following type of message
(repeated hundreds of times)
[0.0.0.0] MAIL FROM:<[EMAIL PROTECTED]>
07:30 05:28 SMTPD(7AA101FA) [0.0.0.0] RCPT TO:<[EMAIL PROTECTED]>
07:30 05:28 SMTPD(7AA101FA) [0.0.0.0] ERR mail.someplace.com invalid user
<[EMAIL PROTECTED]
(where 0.0.0.0 is some IP). So I block this IP, but then others show up
later in my log doing the same thing. Is this some sort of attack? Why
would this show up in my log if I'm using SMTP AUTH? This is what I suspect
is crashing SMTP AUTH but also notice SMTP AUTH fail even when this type of
message is not currently in the log. Any suggestions?
thanks,
rob
>From: Len Conrad <[EMAIL PROTECTED]>
>Reply-To: [EMAIL PROTECTED]
>To: [EMAIL PROTECTED]
>Subject: Re: [IMail Forum] smtp auth fails
>Date: Mon, 30 Jul 2001 12:02:28 +0200
>
>
>>I've been running this version for IMail for over year now without this
>>problem occuring until a couple days ago. I have SMTP AUTH set (using
>>relay for addresses). Every few minutes, IMail stops accepting any
>>authentications for SMTP. If i stop and restart the SMTP service, it
>>works fine for another few minutes. Looking in the logs, I noticed a
>>large amount of emails from a particular address, so I blocked their
>>IP. This address no longer shows up in my log, but I'm still experiencing
>>the SMTP problem. I read something about version 6.0 being susceptible to
>>a DoS attack. Does this also affect 5.09? Also, what should I be looking
>>for in the logs to troubleshoot this problem?
>
>I don�t you�ll find the logs will give you any help here, although you
>should be able to see the failed SMTP processes.
>
>>When this problem occurs the SMTP service shows in IMonitor to be up and
>>running, but no SMTP AUTHs can be done. Any ideas are appreciated
>
>check the KB, this is a way too FAQ, although I�m sure there is a sure-fire
>answer.
>
>SMTP processes can continuing running, but it appears that SMTPD AUTH is a
>separate process and it alone can fail to respond. You can check this
>yourself in your imail logs. The SMTPD AUTH process has a different PID.
>
>Now, you have to distinguish between SMTPD AUTH process not working at all,
>which block the parent SMPTD process, and a running SMTPD AUTH process that
>always returns "AUTH failed".
>
>Len
>
>
>http://MenAndMice.com/DNS-training
>http://BIND8NT.MEIway.com : ISC BIND 8.2.4 for NT4 & W2K
>http://IMGate.MEIway.com : Build free, hi-perf, anti-abuse mail gateways
>
>
>Please visit http://www.ipswitch.com/support/mailing-lists.html
>to be removed from this list.
>
>An Archive of this list is available at:
>http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
