Hi list First, thanks to the one who has posted the link to http://www.declude.com/info/logs.htm. I have studied this and still have no clue about what is happening on my server.
In the logs below, you will see that someone was able to: 1) send mail from magnet.at to magnet.at without any smtp auth 2) send mail from magnet.at to magnet.at and_a_third_address without any smtp auth The system is IMail 7.14 with "no mail relay" checked and "disable smtp auth" UNchecked. Testing my mailserver using telnet shows this: 220 cafe.ch (IMail 7.14 1883-1) NT-ESMTP Server X1 ehlo 250-cafe.ch says hello 250-SIZE 28000000 250-8BITMIME 250-DSN 250-ETRN 250-AUTH LOGIN CRAM-MD5 250-AUTH=LOGIN 250 EXPN mail from: [EMAIL PROTECTED] 250 ok rcpt to: [EMAIL PROTECTED] 550 not local host magnet.at, not a gateway What is happening here? Thanks for any hints. Chris The logs: Example #1: magnet.at sending to magnet.at: 20030326 094733 127.0.0.1 SMTPD (01680210) [195.65.117.14] connect My.Fire.Wall.IP port 40916 20030326 094733 127.0.0.1 SMTPD (01680210) [My.Fire.Wall.IP] EHLO namenn6iahca77 20030326 094733 127.0.0.1 SMTPD (01680210) [My.Fire.Wall.IP] MAIL FROM: <[EMAIL PROTECTED]> 20030326 094733 127.0.0.1 SMTPD (01680210) [My.Fire.Wall.IP] RCPT TO: <[EMAIL PROTECTED]> 20030326 094733 127.0.0.1 SMTPD (01680210) [My.Fire.Wall.IP] E:\Spool\D6925016802101ac4.SMD 608 20030326 094734 127.0.0.1 SMTP (409) processing E:\Spool\Q6925016802101ac4.SMD 20030326 094739 127.0.0.1 SMTP (409) finished E:\Spool\Q6925016802101ac4.SMD status=1 20030326 094734 127.0.0.1 SMTP (409) processing E:\Spool\Q6925016802101ac4.SMD 20030326 094734 127.0.0.1 SMTP (409) Trying magnet.at (0) 20030326 094734 127.0.0.1 SMTP (409) Connect magnet.at [195.170.70.86:25] (1) 20030326 094734 127.0.0.1 SMTP (409) 220 mail03.nextra.at ESMTP ready; Wed, 26 Mar 2003 09:47:25 +0100 (MET) 20030326 094734 127.0.0.1 SMTP (409) >EHLO cafe.ch 20030326 094734 127.0.0.1 SMTP (409) 250-mail.nextra.at Hello [195.65.117.14], pleased to meet you 20030326 094734 127.0.0.1 SMTP (409) 250-ENHANCEDSTATUSCODES 20030326 094734 127.0.0.1 SMTP (409) 250-PIPELINING 20030326 094734 127.0.0.1 SMTP (409) 250-8BITMIME 20030326 094734 127.0.0.1 SMTP (409) 250-SIZE 20048000 20030326 094734 127.0.0.1 SMTP (409) 250-DSN 20030326 094734 127.0.0.1 SMTP (409) 250-DELIVERBY 20030326 094734 127.0.0.1 SMTP (409) 250 HELP 20030326 094734 127.0.0.1 SMTP (409) >MAIL FROM:<[EMAIL PROTECTED]> 20030326 094734 127.0.0.1 SMTP (409) 250 2.1.0 <[EMAIL PROTECTED]>... Sender ok 20030326 094734 127.0.0.1 SMTP (409) >RCPT To:<[EMAIL PROTECTED]> 20030326 094739 127.0.0.1 SMTP (409) 250 2.1.5 <[EMAIL PROTECTED]>... Recipient ok 20030326 094739 127.0.0.1 SMTP (409) >DATA 20030326 094739 127.0.0.1 SMTP (409) 354 Enter mail, end with "." on a line by itself 20030326 094739 127.0.0.1 SMTP (409) >. 20030326 094739 127.0.0.1 SMTP (409) 250 2.0.0 h2Q8lPUS029800 Message accepted for delivery 20030326 094739 127.0.0.1 SMTP (409) rdeliver magnet.at [EMAIL PROTECTED] (1) <[EMAIL PROTECTED]> 608 20030326 094739 127.0.0.1 SMTP (409) >QUIT 20030326 094739 127.0.0.1 SMTP (409) 221 2.0.0 mail.nextra.at closing connection 20030326 094739 127.0.0.1 SMTP (409) finished E:\Spool\Q6925016802101ac4.SMD status=1 Example #2: magnet.at sending to magnet.at and hu.inter.net: 20030326 142528 127.0.0.1 SMTPD (5E2B0038) [195.65.117.14] connect My.Fire.Wall.IP port 5502 20030326 142528 127.0.0.1 SMTPD (5E2B0038) [My.Fire.Wall.IP] EHLO namenn6iahca77 20030326 142528 127.0.0.1 SMTPD (5E2B0038) [My.Fire.Wall.IP] MAIL FROM: <[EMAIL PROTECTED]> 20030326 142528 127.0.0.1 SMTPD (5E2B0038) [My.Fire.Wall.IP] RCPT TO: <[EMAIL PROTECTED]> 20030326 142528 127.0.0.1 SMTPD (5E2B0038) [My.Fire.Wall.IP] RCPT TO: <[EMAIL PROTECTED]> 20030326 142528 127.0.0.1 SMTPD (5E2B0038) [My.Fire.Wall.IP] E:\Spool\Daa485e2b00388c2e.SMD 2499 20030326 142529 127.0.0.1 SMTP (379) processing E:\Spool\Qaa485e2b00388c2e.SMD 20030326 142532 127.0.0.1 SMTP (379) finished E:\Spool\Qaa485e2b00388c2e.SMD status=1 20030326 142529 127.0.0.1 SMTP (379) processing E:\Spool\Qaa485e2b00388c2e.SMD 20030326 142529 127.0.0.1 SMTP (379) Trying magnet.at (0) 20030326 142529 127.0.0.1 SMTP (379) Connect magnet.at [195.170.70.50:25] (1) 20030326 142529 127.0.0.1 SMTP (379) 220 mail02.nextra.at ESMTP ready; Wed, 26 Mar 2003 14:25:20 +0100 (MET) 20030326 142529 127.0.0.1 SMTP (379) >EHLO cafe.ch 20030326 142529 127.0.0.1 SMTP (379) 250-mail.nextra.at Hello [195.65.117.14], pleased to meet you 20030326 142529 127.0.0.1 SMTP (379) 250-ENHANCEDSTATUSCODES 20030326 142529 127.0.0.1 SMTP (379) 250-PIPELINING 20030326 142529 127.0.0.1 SMTP (379) 250-8BITMIME 20030326 142529 127.0.0.1 SMTP (379) 250-SIZE 20048000 20030326 142529 127.0.0.1 SMTP (379) 250-DSN 20030326 142529 127.0.0.1 SMTP (379) 250-DELIVERBY 20030326 142529 127.0.0.1 SMTP (379) 250 HELP 20030326 142529 127.0.0.1 SMTP (379) >MAIL FROM:<[EMAIL PROTECTED]> 20030326 142529 127.0.0.1 SMTP (379) 250 2.1.0 <[EMAIL PROTECTED]>... Sender ok 20030326 142529 127.0.0.1 SMTP (379) >RCPT To:<[EMAIL PROTECTED]> 20030326 142530 127.0.0.1 SMTP (379) 250 2.1.5 <[EMAIL PROTECTED]>... Recipient ok 20030326 142530 127.0.0.1 SMTP (379) >DATA 20030326 142530 127.0.0.1 SMTP (379) 354 Enter mail, end with "." on a line by itself 20030326 142530 127.0.0.1 SMTP (379) >. 20030326 142530 127.0.0.1 SMTP (379) 250 2.0.0 h2QDPKLP019444 Message accepted for delivery 20030326 142530 127.0.0.1 SMTP (379) rdeliver magnet.at [EMAIL PROTECTED] (1) <[EMAIL PROTECTED]> 2499 20030326 142530 127.0.0.1 SMTP (379) >QUIT 20030326 142531 127.0.0.1 SMTP (379) 221 2.0.0 mail.nextra.at closing connection 20030326 142531 127.0.0.1 SMTP (379) Trying hu.inter.net (0) 20030326 142531 127.0.0.1 SMTP (379) Connect hu.inter.net [213.73.102.13:25] (1) 20030326 142531 127.0.0.1 SMTP (379) 220 clever.eusc.inter.net ESMTP Exim 3.36 #4 Wed, 26 Mar 2003 14:25:22 +0100 20030326 142531 127.0.0.1 SMTP (379) >EHLO cafe.ch 20030326 142531 127.0.0.1 SMTP (379) 250-clever.eusc.inter.net Hello cafe.ch [195.65.117.14] 20030326 142531 127.0.0.1 SMTP (379) 250-SIZE 26214400 20030326 142531 127.0.0.1 SMTP (379) 250-PIPELINING 20030326 142531 127.0.0.1 SMTP (379) 250-AUTH PLAIN LOGIN CRAM-MD5 20030326 142531 127.0.0.1 SMTP (379) 250 HELP 20030326 142531 127.0.0.1 SMTP (379) >MAIL FROM:<[EMAIL PROTECTED]> 20030326 142531 127.0.0.1 SMTP (379) 250 <[EMAIL PROTECTED]> is syntactically correct 20030326 142531 127.0.0.1 SMTP (379) >RCPT To:<[EMAIL PROTECTED]> 20030326 142531 127.0.0.1 SMTP (379) 250 <[EMAIL PROTECTED]> verified 20030326 142531 127.0.0.1 SMTP (379) >DATA 20030326 142531 127.0.0.1 SMTP (379) 354 Enter message, ending with "." on a line by itself 20030326 142531 127.0.0.1 SMTP (379) >. 20030326 142532 127.0.0.1 SMTP (379) 250 OK id=18yAuB-00056n-00 20030326 142532 127.0.0.1 SMTP (379) rdeliver hu.inter.net [EMAIL PROTECTED] (1) <[EMAIL PROTECTED]> 2499 20030326 142532 127.0.0.1 SMTP (379) >QUIT 20030326 142532 127.0.0.1 SMTP (379) 221 clever.eusc.inter.net closing connection 20030326 142532 127.0.0.1 SMTP (379) finished E:\Spool\Qaa485e2b00388c2e.SMD status=1 To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
