>20020920 042113 127.0.0.1 SMTPD (02A60048) [172.20.207.185] MAIL
>From: <[EMAIL PROTECTED]>
>20020920 042114 127.0.0.1 SMTPD (02A60048) [172.20.207.185] RCPT
>To:<[EMAIL PROTECTED]>
>20020920 042114 127.0.0.1 SMTPD (02A60048) [172.20.207.185] RCPT
>To:<[EMAIL PROTECTED]>
>20020920 042115 127.0.0.1 SMTPD (02A60048) [172.20.207.185] RCPT
>To:<[EMAIL PROTECTED]>
>20020920 042116 127.0.0.1 SMTPD (02A60048) [172.20.207.185] RCPT
>To:<[EMAIL PROTECTED]>
>20020920 042117 127.0.0.1 SMTPD (02A60048) [172.20.207.185] max RCPT
>exceeded RCPT To:<[EMAIL PROTECTED]>
>20020920 042117 127.0.0.1 SMTPD (02A60048) [172.20.207.185] max RCPT
>exceeded RCPT To:<[EMAIL PROTECTED]>
We're getting close. :)
These are the log file lines that are for this one transaction (notice the
"02A60048" that is common to them all -- that lets you separate one
connection from another).
The problem here is that the E-mail is coming from 172.20.207.185. I'm
assuming that is one of the IPs you have listed in your "Relay for
Addresses". However, 172.20.207.185 is a local IP address. But, I'm
having a bad case of deja vu:
>Bam. There's your answer. 172.20.207.185 is a local IP. The
spammer is
>sending mail through that server. It's not an IMail issue; your
other
>server was compromised.
Hmmm...That's the IP of our firewall/proxy server. It's not
running SMTP,
but has NAT and packet filters enabled that pass the appropriate
traffic to
the IMAIl server....
That was from a post here in August. The problem is that your firewall is
broken -- it is making it look like all mail is coming from 172.20.207.185,
not the actual spammer's address.
YOU MUST GET RID OF THAT BROKEN FIREWALL. More specifically, you must
either get rid of that broken firewall, or figure out how to fix it. It
sounds like some strange "reverse NAT" system, where it is giving external
IPs an internal IP address, which I've never heard of, and is extremely
dangerous.
Note that IMail is doing exactly what you told it to do -- you said IMail
can relay mail from 172.20.207.185, and the firewall translates that into
"Anyone in the world can relay mail".
You need to get a real firewall. Get rid of the one you have, or determine
why it is broken.
-Scott
---
Declude: Anti-virus, Anti-spam and Anti-hijacking solutions for
IMail. http://www.declude.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
