Thanks Tripp, In our case, this user is authenticating with an invalid email address. According to the logs he's authenticating with a netscape address. He must be authenticating using a valid email address and password on our server, but why isn't this being shown in the logs, and his netscape address being shown instead?
The server that is being attacked is a free email service. So its a prime target for spammers, we're looking for a good way to lock it down. Right now we're just adding outbound rules to the address we find are spamming to delete mail. Relaying is only allowed for authenticated users. I've searched through the mail archives but couldn't find any other good methods for stopping spammers who have valid authentication information. Thanks -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Tripp Allen Sent: Friday, April 16, 2004 3:30 PM To: [EMAIL PROTECTED] Subject: Re: [IMail Forum] User authentication messages in log files The Authed User line comes from the Queue manager during delivery of a message, this means the sender of the message was an Authenticated user. The Authenticated Session comes from SMTPD32 when a user Auths in via SMTP AUTH. Tripp ----- Original Message ----- From: "Imail List" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, April 16, 2004 3:20 PM Subject: [IMail Forum] User authentication messages in log files > Hi all, > > I have a question about authentication message in log files. We have two > imail servers. One of them is currently under heavy attack by spammers. > We're looking to block addresses and rectify the problem. In tracking down > one of the spammers address, i come across this message for authentication : > > 04:16 13:32 SMTP-(052002E2) Authed User [EMAIL PROTECTED] > > Whereas are other Imail server has these messages : > > 04:16 09:31 SMTPD(0000044C) Authenticated *email address protected*, session > treated as local. > > What is the difference between Authed User, and Authenticated session? > > Thanks > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
