I have been told that you can *NEVER* disable SMTP Auth. You can disable the logging for SMTP Auth, but that's it.
Travis > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Keeper > Sent: Monday, March 31, 2003 8:40 AM > To: [EMAIL PROTECTED] > Subject: [IMail Forum] My server got hacked AGAIN!!!!!!!! > > > I just gone through the log and I found another IP address that managed > to relay. I think I found the problem with my server. Apparently they > authenticated with my server. > > Is there a BUG in Imail where it enable SMTP Authentication even though > I have disable the SMTP "AUTH" option. Did I miss anything on disabling > the SMTP AUTH options? > > Can anyone shed any light on this cause this is my third time where > people able to use my server to relay emails. Any help would be greatly > appreciated. > > > Log File > ========= > 03:31 23:38 SMTPD(010700AE) [202.71.162.141] connect 202.2.82.37 port > 3226 > 03:31 23:38 SMTPD(010700AE) [202.2.82.37] EHLO smtp0542.mail.yahoo.com > 03:31 23:38 SMTPD(000003DC) Authenticated > [EMAIL PROTECTED], session treated as local. > 03:31 23:38 SMTPD(010700AE) [202.2.82.37] MAIL > FROM:<[EMAIL PROTECTED]> > > Regards > Bo Wee > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Len Conrad > Sent: Monday, 31 March 2003 7:55 PM > To: [EMAIL PROTECTED] > Subject: RE: [IMail Forum] Please Help !!!!!!!!! It happened Again > > > > >Here are the ip address and netmask on the "relay for address" > > > >Network Netmask > >202.71.163.0 255.255.255.0 > >202.71.164.0 255.255.255.0 > >202.71.165.0 255.255.255.0 > >202.71.166.0 255.255.255.0 > >202.71.168.0 255.255.255.0 > >203.109.174.0 255.255.255.0 > >203.109.175.0 255.255.255.0 > >203.30.19.0 255.255.255.0 > >202.19.12.0 255.255.255.0 > >202.71.174.85 > > That's looks clean, if it really is like that as used by IMail. And none > of > those are from or near the 210 Class A from which you had the attacks. > > So delete all that from Imail, and put it in again, very carefully. > > I doubt that source ip spoofing is the case, but at your edge router, > block > spoofing of your internal IPs. Do you have that already? > > Len > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: > http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
