This same line (Authed user) can be created when delivering a message that was generated via a logged in user in web messaging. In that case, the Authed user line contains their "mail from" address.
Tripp ----- Original Message ----- From: "Imail List" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, April 16, 2004 3:34 PM Subject: RE: [IMail Forum] User authentication messages in log files > Thanks Tripp, > > In our case, this user is authenticating with an invalid email address. > According to the logs he's authenticating with a netscape address. He must > be authenticating using a valid email address and password on our server, > but why isn't this being shown in the logs, and his netscape address being > shown instead? > > The server that is being attacked is a free email service. So its a prime > target for spammers, we're looking for a good way to lock it down. Right > now we're just adding outbound rules to the address we find are spamming to > delete mail. Relaying is only allowed for authenticated users. I've > searched through the mail archives but couldn't find any other good methods > for stopping spammers who have valid authentication information. > > Thanks > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Tripp Allen > Sent: Friday, April 16, 2004 3:30 PM > To: [EMAIL PROTECTED] > Subject: Re: [IMail Forum] User authentication messages in log files > > > The Authed User line comes from the Queue manager during delivery of a > message, this means the sender of the message was an Authenticated user. > The Authenticated Session comes from SMTPD32 when a user Auths in via SMTP > AUTH. > > Tripp > > ----- Original Message ----- > From: "Imail List" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Friday, April 16, 2004 3:20 PM > Subject: [IMail Forum] User authentication messages in log files > > > > Hi all, > > > > I have a question about authentication message in log files. We have two > > imail servers. One of them is currently under heavy attack by spammers. > > We're looking to block addresses and rectify the problem. In tracking > down > > one of the spammers address, i come across this message for authentication > : > > > > 04:16 13:32 SMTP-(052002E2) Authed User [EMAIL PROTECTED] > > > > Whereas are other Imail server has these messages : > > > > 04:16 09:31 SMTPD(0000044C) Authenticated *email address protected*, > session > > treated as local. > > > > What is the difference between Authed User, and Authenticated session? > > > > Thanks > > > > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > > > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
