I just gone through the log and I found another IP address that managed to relay. I think I found the problem with my server. Apparently they authenticated with my server.
Is there a BUG in Imail where it enable SMTP Authentication even though I have disable the SMTP "AUTH" option. Did I miss anything on disabling the SMTP AUTH options? Can anyone shed any light on this cause this is my third time where people able to use my server to relay emails. Any help would be greatly appreciated. Log File ========= 03:31 23:38 SMTPD(010700AE) [202.71.162.141] connect 202.2.82.37 port 3226 03:31 23:38 SMTPD(010700AE) [202.2.82.37] EHLO smtp0542.mail.yahoo.com 03:31 23:38 SMTPD(000003DC) Authenticated [EMAIL PROTECTED], session treated as local. 03:31 23:38 SMTPD(010700AE) [202.2.82.37] MAIL FROM:<[EMAIL PROTECTED]> Regards Bo Wee -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Len Conrad Sent: Monday, 31 March 2003 7:55 PM To: [EMAIL PROTECTED] Subject: RE: [IMail Forum] Please Help !!!!!!!!! It happened Again >Here are the ip address and netmask on the "relay for address" > >Network Netmask >202.71.163.0 255.255.255.0 >202.71.164.0 255.255.255.0 >202.71.165.0 255.255.255.0 >202.71.166.0 255.255.255.0 >202.71.168.0 255.255.255.0 >203.109.174.0 255.255.255.0 >203.109.175.0 255.255.255.0 >203.30.19.0 255.255.255.0 >202.19.12.0 255.255.255.0 >202.71.174.85 That's looks clean, if it really is like that as used by IMail. And none of those are from or near the 210 Class A from which you had the attacks. So delete all that from Imail, and put it in again, very carefully. I doubt that source ip spoofing is the case, but at your edge router, block spoofing of your internal IPs. Do you have that already? Len To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
