RE: [IMail Forum] ARGHHHH my server is under attack again@#$@%%^%#

Sun, 19 Jan 2003 07:30:35 -0800 



What can I do to stop dictionary attack?




You'll need to review the archives of this forum for ideas.



If it is coming from a single IP or set of IPs, you can use the IMail SMTP 
Control Access file to stop them (unless they find a new IP).




Here is a snippet of the log file

01:16 00:05 SMTPD(1B1B0134) [210.21.10.158] MAIL FROM:<[EMAIL PROTECTED]>
01:16 00:05 SMTPD(1B1B0134) [210.21.10.158] RCPT TO:<[EMAIL PROTECTED]>
01:16 00:05 SMTPD(1B1B0134) [210.21.10.158] D:\IMAIL\spool\D86e0134.SMD 3352
01:16 00:05 SMTPD(1B1B0134) [210.21.10.158] MAIL FROM:<[EMAIL PROTECTED]>
01:16 00:05 SMTPD(1B1B0134) [210.21.10.158] RCPT TO:<[EMAIL PROTECTED]>




You may want to go to http://www.declude.com/info/logs.htm to get an idea 
of how to read the logs.  This does not provide enough information about 
the problem.  This shows the middle of a transaction, not a full transaction.



What version of IMail are you running?



The log file snippet that is provided shows that you aren't using the 
(BAD!) "Relay for users" or (BAD!) "Relay for hosts" settings (as they are 
not using local E-mail addresses to send from).  The only possibilities 
that comes to mind are that [1] Your relay settings are "Relay for Anyone" 
(which could happen if it was set that way recently, and you didn't 
stop/restart the SMTP service after changing it), or [2] There is mixed up 
information here (such as you have 2 IMail servers, and are providing 
information about both of them rather than just one).




One strange things is my other log file on 19-01-2003 doesn't contain
many SMTPD entries but yet I got thousands of mail in the spool.
Shouldn't there be entries in the log file?? I can only detect the Ip
from the .GSE file



Could those spool files be from a previous day?




D:\IMail\spool2> type d658d533.gse | more
Date:     Sat, 18 Jan 2003 19:57:04 +0800
Message-Id: <[EMAIL PROTECTED]>
From:     "Postmaster" <[EMAIL PROTECTED]>
Sender:   <[EMAIL PROTECTED]>
To:       <[EMAIL PROTECTED]>
Subject:  Undeliverable Mail
X-Mailer: <SMTP32 v20010131>

Unknown user: [EMAIL PROTECTED]




Ah, this is IMail bouncing one of the relayed messages.  The spammer sent 
the E-mail on 18 Jan 2003 (where the SMTPD entries would occur), but the 
bounce message is still in the spool on 19 Jan 2003.



                                                   -Scott

---

Declude JunkMail: The advanced anti-spam solution for IMail mailservers.

Declude Virus: Catches both viruses and vulnerabilities in E-mail, with no 
annual licensing fees.



---

[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]





To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html

List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/

Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/























					Reply via email to