Makes sense to us here but we have triple checked our allowed IP's and we do not even have one that starts with 210.x.x.x
On that first line of our log...am I right in thinking that the 'suspect" IP is sending though our server but our server sees it as a "good" address?? the 207 IP is an IP assigned to a domain on our server. We are very suspect to this as our issue. There has got to be a missing link. i need a drink. -----Original Message----- From: R. Scott Perry [mailto:[EMAIL PROTECTED]] Sent: Friday, January 17, 2003 2:18 PM To: [EMAIL PROTECTED] Subject: RE: [IMail Forum] Dictionary Attack? >Ok the Ip is not listed in our Allowed addresses Are you positive -- for example, if you have "210.112.191.114 255.0.0.0", it would allow 210.21.108.189 to relay. >and Imail is set to Relay fo Adresses. In that case IMail should only allow someone to send outgoing E-mail if either [1] They are coming from an IP that you authorize, or [2] They are authenticating. Nobody else should be allowed to send outgoing E-mail (everyone will be able to send mail to your users, though). >We looked over the logs for the Ip and found this, could the problem be that >the are possible going though one of our users systems so that when it >communicates with our server it lets the mail go since it is an Ip that is >allowed?? If a spammer uses an IP address you allow, they can send their spam. :) >Here is a log snip from last night: > >01:16 20:59 SMTPD(009F013C) [207.51.128.113] connect 210.21.108.189 port 51894 >01:16 20:59 SMTPD(009F013C) [210.21.108.189] EHLO Enderby >01:16 20:59 SMTPD(009F013C) [210.21.108.189] MAIL FROM:<[EMAIL PROTECTED]> >01:16 20:59 SMTPD(009F013C) [210.21.108.189] RCPT TO:<[EMAIL PROTECTED]> This shows that IMail did not require authentication, so either [1] 210.21.108.189 is an IP that is allowed to relay mail, or [2] Your IMail relay settings are not set to "Relay for Addresses." I can't send mail through your mailserver, so it looks like you are using "Relay for Addresses", but 210.21.108.189 is allowed to relay. I would suggest you carefully look over the IP ranges that are allowed. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches both viruses and vulnerabilities in E-mail, with no annual licensing fees. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
