Hello all,
Yesterday we received a message from ORDB.org that our Backup server an Open
Relay. Our Backup Server is configured only to relay our IP range and
nothing else.
They gave us the following headers :
[Header Start]
Return-Path:
X-Original-To: [EMAIL PROTECTED]
Delivered-To: [EMAIL PROTECTED]
Received: from mail.iway.be (mail.iway.be [194.78.12.12])
by BocksCar.ORDB.org (Postfix) with ESMTP id 09CC65577
for ; Tue, 2 Dec 2003 17:46:49 +0000 (GMT)
Received: from mail.antwerp.iway.be [194.78.12.6] by mail.iway.be with ESMTP
(SMTPD32-8.04) id AE8A349500C6; Tue, 02 Dec 2003 18:40:26 +0100
Received: from ordb.org [62.79.110.122] by mail.antwerp.iway.be with ESMTP
(SMTPD32-8.04) id AFE3B3060056; Tue, 02 Dec 2003 18:46:11 +0100
From: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
X-ORDB-Envelope-From: [EMAIL PROTECTED]
X-ORDB-Envelope-To: @iway.be:[EMAIL PROTECTED]
Subject: ORDB.org check (0.3422127455797650.9665409000) ip=194.78.12.6
Message-Id: <[EMAIL PROTECTED]>
Date: Tue, 2 Dec 2003 17:46:49 +0000 (GMT)
[Header Stop]
We went to look a our log files to see how they did it:
[first attempt:failed]
12:02 18:30 SMTPD(BAF60038) [62.242.0.190] EHLO localhost.localdomain
12:02 18:30 SMTPD(BAF60038) [62.242.0.190] MAIL FROM:<[EMAIL PROTECTED]>
12:02 18:30 SMTPD(BAF60038) [62.242.0.190] RCPT TO:<[EMAIL PROTECTED]>
12:02 18:30 SMTPD(BAF60038) [62.242.0.190] ERR mail.antwerp.iway.be invalid
user <[EMAIL PROTECTED]
[second attempt:failed]
12:02 18:31 SMTPD(BAF80038) [62.242.0.190] EHLO localhost.localdomain
12:02 18:31 SMTPD(BAF80038) [62.242.0.190] MAIL
FROM:<[EMAIL PROTECTED]>
12:02 18:31 SMTPD(BAF80038) [62.242.0.190] RCPT TO:<[EMAIL PROTECTED]>
12:02 18:31 SMTPD(BAF80038) [62.242.0.190] ERR mail.antwerp.iway.be invalid
user <[EMAIL PROTECTED]
[third attempt:failed]
12:02 18:32 SMTPD(7E190032) [62.242.0.190] EHLO localhost.localdomain
12:02 18:32 SMTPD(7E190032) [62.242.0.190] MAIL
FROM:<[EMAIL PROTECTED]>
12:02 18:32 SMTPD(7E190032) [62.242.0.190] RCPT TO:<[EMAIL PROTECTED]>
12:02 18:32 SMTPD(7E190032) [62.242.0.190] ERR mail.antwerp.iway.be invalid
user <[EMAIL PROTECTED]
[four attempt:failed]
12:02 18:33 SMTPD(BAFB0038) [212.242.88.3] EHLO ordb.org
12:02 18:33 SMTPD(BAFB0038) [212.242.88.3] MAIL
FROM:<[EMAIL PROTECTED]>
12:02 18:33 SMTPD(BAFB0038) [212.242.88.3] RCPT
TO:<[EMAIL PROTECTED]>
12:02 18:33 SMTPD(BAFB0038) [212.242.88.3] ERR mail.antwerp.iway.be invalid
user <[EMAIL PROTECTED]
[fith attempt:failed]
12:02 18:34 SMTPD(7E1A0032) [62.242.0.190] EHLO localhost.localdomain
12:02 18:34 SMTPD(7E1A0032) [62.242.0.190] MAIL FROM:<[EMAIL PROTECTED]>
12:02 18:34 SMTPD(7E1A0032) [62.242.0.190] RCPT
TO:<"[EMAIL PROTECTED]"@antwerp.iway.be>
12:02 18:34 SMTPD(7E1A0032) [62.242.0.190] ERR mail.antwerp.iway.be invalid
user <"[EMAIL PROTECTED]"@antwerp.iway.be
[sixth attempt:failed]
12:02 18:35 SMTPD(CF3C0098) [62.242.0.190] EHLO localhost.localdomain
12:02 18:35 SMTPD(CF3C0098) [62.242.0.190] MAIL
FROM:<[EMAIL PROTECTED]>
12:02 18:35 SMTPD(CF3C0098) [62.242.0.190] RCPT TO:<marvin.ordb.org!marvin>
12:02 18:35 SMTPD(CF3C0098) [62.242.0.190] ERR mail.antwerp.iway.be invalid
user <marvin.ordb.org!marvin
[seventh attempt:failed]
12:02 18:37 SMTPD(7E1F0032) [212.242.88.2] EHLO ordb.org
12:02 18:37 SMTPD(7E1F0032) [212.242.88.2] MAIL
FROM:<[EMAIL PROTECTED]>
12:02 18:37 SMTPD(7E1F0032) [212.242.88.2] RCPT
TO:<@[194.78.12.6]:[EMAIL PROTECTED]>
12:02 18:37 SMTPD(7E1F0032) [212.242.88.2] ERR mail.antwerp.iway.be invalid
user <[EMAIL PROTECTED]@[194.78.12.6]
[eight attempt:failed]
12:02 18:38 SMTPD(CACB0062) [212.242.88.3] EHLO ordb.org
12:02 18:38 SMTPD(CACB0062) [212.242.88.3] MAIL FROM:<[EMAIL PROTECTED]>
12:02 18:38 SMTPD(CACB0062) [212.242.88.3] RCPT
TO:<[EMAIL PROTECTED]>
12:02 18:38 SMTPD(CACB0062) [212.242.88.3] ERR mail.antwerp.iway.be invalid
user <[EMAIL PROTECTED]
[nine attempt:failed]
12:02 18:39 SMTPD(7E200032) [212.242.88.2] EHLO ordb.org
12:02 18:39 SMTPD(7E200032) [212.242.88.2] MAIL
FROM:<[EMAIL PROTECTED]>
12:02 18:39 SMTPD(7E200032) [212.242.88.2] RCPT
TO:<"[EMAIL PROTECTED]">
12:02 18:39 SMTPD(7E200032) [212.242.88.2] ERR mail.antwerp.iway.be invalid
user <"[EMAIL PROTECTED]"
[tenth attempt:failed]
12:02 18:40 SMTPD(CACF0062) [62.242.0.190] EHLO localhost.localdomain
12:02 18:40 SMTPD(CACF0062) [62.242.0.190] MAIL
FROM:<[EMAIL PROTECTED]>
12:02 18:40 SMTPD(CACF0062) [62.242.0.190] RCPT
TO:<"[EMAIL PROTECTED]">
12:02 18:40 SMTPD(CACF0062) [62.242.0.190] ERR mail.antwerp.iway.be invalid
user <"[EMAIL PROTECTED]"
[eleven attempt:failed]
12:02 18:43 SMTPD(B3030056) [80.199.176.219] EHLO ordb.org
12:02 18:43 SMTPD(B3030056) [80.199.176.219] MAIL
FROM:<[EMAIL PROTECTED]>
12:02 18:43 SMTPD(B3030056) [80.199.176.219] RCPT
TO:<[EMAIL PROTECTED]>
12:02 18:43 SMTPD(B3030056) [80.199.176.219] ERR mail.antwerp.iway.be
invalid user <[EMAIL PROTECTED]
[twelve attempt:failed]
12:02 18:44 SMTPD(B3040056) [217.157.20.141] EHLO ordb.org
12:02 18:44 SMTPD(B3040056) [217.157.20.141] MAIL
FROM:<[EMAIL PROTECTED]>
12:02 18:44 SMTPD(B3040056) [217.157.20.141] RCPT
TO:<[EMAIL PROTECTED]>
12:02 18:44 SMTPD(B3040056) [217.157.20.141] ERR mail.antwerp.iway.be
invalid user <[EMAIL PROTECTED]
[thirteen attempt:SUCCES!]
12:02 18:46 SMTPD(B3060056) [62.79.110.122] EHLO ordb.org
12:02 18:46 SMTPD(B3060056) [62.79.110.122] MAIL FROM:<[EMAIL PROTECTED]>
12:02 18:46 SMTPD(B3060056) [62.79.110.122] RCPT
TO:<@iway.be:[EMAIL PROTECTED]>
12:02 18:46 SMTPD(B3060056) [62.79.110.122]
f:\IMail\spool\Dcfe3b3060056967a.SMD 899
And since this is our backup server the mail is sent to main server and
relayed because the main trust the backup server!
12:02 18:46 SMTP-(0386000F) processing f:\IMail\spool\Qcfe3b3060056967a.SMD
12:02 18:46 SMTP-(0386000F) Trying iway.be (0)
12:02 18:46 SMTP-(0386000F) Connect iway.be [194.78.12.12:25] (1)
12:02 18:46 SMTP-(0386000F) 220 mail.iway.be (IMail 8.04 214-5) NT-ESMTP
Server X1
12:02 18:46 SMTP-(0386000F) >EHLO mail.antwerp.iway.be
12:02 18:46 SMTP-(0386000F) 250-mail.iway.be says hello
12:02 18:46 SMTP-(0386000F) 250-SIZE 0
12:02 18:46 SMTP-(0386000F) 250-8BITMIME
12:02 18:46 SMTP-(0386000F) 250-DSN
12:02 18:46 SMTP-(0386000F) 250-ETRN
12:02 18:46 SMTP-(0386000F) 250-AUTH LOGIN CRAM-MD5
12:02 18:46 SMTP-(0386000F) 250-AUTH=LOGIN
12:02 18:46 SMTP-(0386000F) 250 EXPN
12:02 18:46 SMTP-(0386000F) >MAIL FROM:<[EMAIL PROTECTED]>
12:02 18:46 SMTP-(0386000F) 250 ok
12:02 18:46 SMTP-(0386000F) >RCPT To:<[EMAIL PROTECTED]>
12:02 18:46 SMTP-(0386000F) 250 ok its for <[EMAIL PROTECTED]>
12:02 18:46 SMTP-(0386000F) >DATA
12:02 18:46 SMTP-(0386000F) 354 ok, send it; end with <CRLF>.<CRLF>
12:02 18:46 SMTP-(0386000F) >.
12:02 18:46 SMTP-(0386000F) 250 Message queued
12:02 18:46 SMTP-(0386000F) rdeliver iway.be [EMAIL PROTECTED]
(1) <[EMAIL PROTECTED]> 933
12:02 18:46 SMTP-(0386000F) >QUIT
12:02 18:46 SMTP-(0386000F) 221 Goodbye
12:02 18:46 SMTP-(0386000F) finished f:\IMail\spool\Qcfe3b3060056967a.SMD
status=1
What to do Here ?????????????????
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
