RE: [IMail Forum] Telnet to port 25

[Karen D. Oland]

since they are sending to you, that is fine (stay at relay for addresses).   we just delete all emails from servers that attempt to pretend to be us (which is what you are seeing) and sending to our server using declude (HELO/EHLO with either our IP, our domain name or 127.0.0.1 -- none of which are valid for a real mail server).    We also drop mail that claims to be from an account on our server that is not sent from our IP's (or add a warning in the subject line, if you have external /remove users -- soon declude will detect auth users and we will be able to block all fake users as you are seeing entirely, without weights). -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of B.H.(pat) Forbes Sent: Monday, August 11, 2003 9:36 PM To: [EMAIL PROTECTED] Subject: Re: [IMail Forum] Telnet to port 25 i tried both "no relay"  and "relay for addresses".  In both cases i was able to telnet to port 25, then "mail from:[EMAIL PROTECTED]" and then send email to anyone at my domain.  Is this the best I can hope for?   Where it can be used maliciously is to telnet to the ip of someone that sent you an email, do a "helo his mail server", a "mail from" as him, and a "rcpt to" as him... then send him a nasty gram.  It will show up as coming from him, and to him... and unless he knows how to read headers, he'll be one confused cookie.   -pat-     ----- Original Message ----- From: John Tolmachoff (Lists) To: [EMAIL PROTECTED] Sent: Monday, August 11, 2003 8:00 PM Subject: RE: [IMail Forum] Telnet to port 25 “Relay for Local Users” is also known as OPEN RELAY.   Only secure settings are no relay or relay for addresses.   That will keep him off the server, unless he knows the password to an e-mail account on your server.   John Tolmachoff MCSE CSSA Engineer/Consultant eServices For You www.eservicesforyou.com   -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of B.H.(pat) Forbes Sent: Monday, August 11, 2003 5:34 PM To: [EMAIL PROTECTED] Subject: [IMail Forum] Telnet to port 25   How do I stop someone from telneting to port 25 and then creating a new email?   I have security set to "relay for local users" but, have tried every possible security option and it still allows jo-blow from anywhwre to login and send mail.  All he has to do is use a valid email address thats on the server (ie.  [EMAIL PROTECTED])   helo mydomainname.com  (any domain name works) mail from:[EMAIL PROTECTED]  (he's now spoofed my email address) rcpt to:[EMAIL PROTECTED] (any email address he wants)   at this point, all he needs to do is the data command, and he's sending email.   surely there is a way to keep him off the server or, a way to keep him from being able to do this??   -pat-