Re: [IMail Forum] Wierd entries in sys.log

[Eric Shanbrom [Ipswitch]]

The following is a message where send "couldn't" authenticate...Notice the HELO instead of the EHLO..EHLO is required to enable Extended SMTP to allow for SMTP Authentication. J+I have to assume that theglobe.com is a remote mail system and not hosted on your server. The interesting thing here is why the sender used the HELO instead of the EHLO..Causes of this can be in intervening firewall that won't allow the command. I would telnet to the SMTP port of your mail server and issue the EHLO command and look at the return...are there AUTH lines in the capabilities reported? You could also have disabled the SMTP Auth Reporting in your IMail administrator but I do not believe this is the issue here.   Your log lines: 20041031 011734 127.0.0.1       SMTPD (9f9e003a00328fed) [127.0.0.2] connect 127.0.0.2 port 3987 20041031 011734 127.0.0.1       SMTPD (9f9e003a00328fed) [127.0.0.2] HELO net.com 20041031 011734 127.0.0.1       SMTPD (9f9e003a00328fed) [127.0.0.2] MAIL FROM: <[EMAIL PROTECTED]> 20041031 011734 127.0.0.1       SMTPD (9f9e003a00328fed) [127.0.0.2] RCPT TO: <[EMAIL PROTECTED]> 20041031 011734 127.0.0.1       SMTPD (9f9e003a00328fed) [127.0.0.2] ERR net.com invalid user <[EMAIL PROTECTED]   The balance of the logs show a successful delivery to a local user hence no SMTP Auth is required...It was caught by the spam trap and redirected via the rule to the spam user's main mailbox.   Hope this helps Eric S   ----- Original Message ----- From: Kevin Brennan To: [EMAIL PROTECTED] Sent: Monday, November 01, 2004 7:32 PM Subject: [IMail Forum] Wierd entries in sys.log I have been reading through the list, I would like to see if anyone can tell me why once in a while this happens.   I enclosed a part of the log to show the behavior.     20041031 011726 127.0.0.1       SMTPD (9f96003900328feb) [66.14.210.201] connect 209.250.15.73 port 1345 20041031 011726 127.0.0.1       SMTPD (9f96003900328feb) [209.250.15.73] HELO 209-250-15-73.convergentaz.net 20041031 011727 127.0.0.1       SMTPD (9f96003900328feb) [209.250.15.73] MAIL FROM: <[EMAIL PROTECTED]> 20041031 011728 127.0.0.1       SMTPD (9f96003900328feb) [209.250.15.73] RCPT TO: <[EMAIL PROTECTED]> 20041031 011730 127.0.0.1       SMTPD (9f96003900328feb) [209.250.15.73] f:\IMail\spool\D9f96003900328feb.SMD 1676 20041031 011730 127.0.0.1       SMTPD (9f96003900328feb) performing antispam checks 20041031 011734 127.0.0.1       SMTPD (9f9e003a00328fed) [127.0.0.2] connect 127.0.0.2 port 3987 20041031 011734 127.0.0.1       SMTPD (9f9e003a00328fed) [127.0.0.2] HELO net.com 20041031 011734 127.0.0.1       SMTPD (9f9e003a00328fed) [127.0.0.2] MAIL FROM: <[EMAIL PROTECTED]> 20041031 011734 127.0.0.1       SMTPD (9f9e003a00328fed) [127.0.0.2] RCPT TO: <[EMAIL PROTECTED]> 20041031 011734 127.0.0.1       SMTPD (9f9e003a00328fed) [127.0.0.2] ERR net.com invalid user <[EMAIL PROTECTED] 20041031 011734 127.0.0.1       SMTP (9f96003900328feb) processing f:\IMail\spool\Q9f96003900328feb.SMD 20041031 011734 127.0.0.1       SMTP (9f96003900328feb) Inbound X-IMail-Rule: S~X-IMail:[EMAIL PROTECTED] Data- X-IMAIL-SPAM-STATISTICAL  X-IM 20041031 011734 127.0.0.1       SMTP (9f96003900328feb) ldeliver net.com spam-main (1) [EMAIL PROTECTED] 1822 20041031 011734 127.0.0.1       SMTP (9f96003900328feb) finished f:\IMail\spool\Q9f96003900328feb.SMD status=1