Rob:
The entries are probably a spam attack or a dictionary attack - doubt if
those are causing this problem.
1) Have you rebooted the server?
2) Have you installed the latest patches for IIS (if you are running that on
your server)? The red code worm causes services to stop. Seemed to get
really bad about 10 days ago.
3) What type of database are you using (IMail, SQL, other) to authenicate
users?
4) Do you have multiple domains on the server and if so do they each have
their own IP or are they IPless domains?
5) Have you checked the event log on NT?
Chuck Schick
Warp 8, Inc.
www.warp8.com
303-421-5140
----- Original Message -----
From: "Rob A" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, July 30, 2001 9:00 AM
Subject: Re: [IMail Forum] smtp auth fails
: Thanks for the response Len. I looked in the KB and searched the mail
: archives, but didn't come up with anything. To answer your post, SMTP
AUTH
: does not work at all (not getting AUTH Failed) until I stop and restart
the
: SMTP service. One thing I see in my log is the following type of message
: (repeated hundreds of times)
:
: [0.0.0.0] MAIL FROM:<[EMAIL PROTECTED]>
: 07:30 05:28 SMTPD(7AA101FA) [0.0.0.0] RCPT TO:<[EMAIL PROTECTED]>
: 07:30 05:28 SMTPD(7AA101FA) [0.0.0.0] ERR mail.someplace.com invalid user
: <[EMAIL PROTECTED]
:
: (where 0.0.0.0 is some IP). So I block this IP, but then others show up
: later in my log doing the same thing. Is this some sort of attack? Why
: would this show up in my log if I'm using SMTP AUTH? This is what I
suspect
: is crashing SMTP AUTH but also notice SMTP AUTH fail even when this type
of
: message is not currently in the log. Any suggestions?
:
: thanks,
: rob
:
:
:
: >From: Len Conrad <[EMAIL PROTECTED]>
: >Reply-To: [EMAIL PROTECTED]
: >To: [EMAIL PROTECTED]
: >Subject: Re: [IMail Forum] smtp auth fails
: >Date: Mon, 30 Jul 2001 12:02:28 +0200
: >
: >
: >>I've been running this version for IMail for over year now without this
: >>problem occuring until a couple days ago. I have SMTP AUTH set (using
: >>relay for addresses). Every few minutes, IMail stops accepting any
: >>authentications for SMTP. If i stop and restart the SMTP service, it
: >>works fine for another few minutes. Looking in the logs, I noticed a
: >>large amount of emails from a particular address, so I blocked their
: >>IP. This address no longer shows up in my log, but I'm still
experiencing
: >>the SMTP problem. I read something about version 6.0 being susceptible
to
: >>a DoS attack. Does this also affect 5.09? Also, what should I be
looking
: >>for in the logs to troubleshoot this problem?
: >
: >I don�t you�ll find the logs will give you any help here, although you
: >should be able to see the failed SMTP processes.
: >
: >>When this problem occurs the SMTP service shows in IMonitor to be up and
: >>running, but no SMTP AUTHs can be done. Any ideas are appreciated
: >
: >check the KB, this is a way too FAQ, although I�m sure there is a
sure-fire
: >answer.
: >
: >SMTP processes can continuing running, but it appears that SMTPD AUTH is
a
: >separate process and it alone can fail to respond. You can check this
: >yourself in your imail logs. The SMTPD AUTH process has a different PID.
: >
: >Now, you have to distinguish between SMTPD AUTH process not working at
all,
: >which block the parent SMPTD process, and a running SMTPD AUTH process
that
: >always returns "AUTH failed".
: >
: >Len
: >
: >
: >http://MenAndMice.com/DNS-training
: >http://BIND8NT.MEIway.com : ISC BIND 8.2.4 for NT4 & W2K
: >http://IMGate.MEIway.com : Build free, hi-perf, anti-abuse mail gateways
: >
: >
: >Please visit http://www.ipswitch.com/support/mailing-lists.html
: >to be removed from this list.
: >
: >An Archive of this list is available at:
: >http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
:
:
: _________________________________________________________________
: Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp
:
:
: Please visit http://www.ipswitch.com/support/mailing-lists.html
: to be removed from this list.
:
: An Archive of this list is available at:
: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
:
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
