Hello Hanno, *** Hanno Böck <ha...@hboeck.de> wrote:
> I get the warning below on some of my servers. Which MTA(s) are you running on these servers? Qmail? > Do I get something wrong here or is this test totally bogus? At first glance i can't see a problem in smtp_relay2.nasl. > Obviously, my server accepts mails to it's own host. It's not > relaying them anywhere. > > If the test wants to check for open relays (which is a good idea), it should > try to deliver a mail to another host (or some bogus host like > hsajdkahsda.com). If that is accepted, then there's a problem. Accepting mail > for it's own host is the purpose of an smtp server. > > I assume the intention is to send to nob...@example.com, though the check > seems to get something wrong here. > > ----------- > Reported by NVT "Mail relaying (thorough test)" (1.3.6.1.4.1.25623.1.0.11852): [...] > OpenVAS was able to relay mails by sending those sequences: > MAIL FROM: <open...@[host]> > RCPT TO: <nobody%example....@[host]> ,---[ http://www.remote.org/jochen/mail/info/address.html ] | The percent hack | | The so called percent hack is another form of source route. Here an address | lookes like this: | | peter%hotmail.com%mail.mit....@donald.mit.edu | | The mail is sent to the host donald.mit.edu, which will strip off the domain | and change the rightmost percent sign (%) into an At sign (@), which will | result in the following address: | | peter%hotmail....@mail.mit.edu | | So it sends the mail on to mail.mit.edu and so on. This use of the percent sign | is deprecated because of the associated risk of spam relaying. (See above.) | | Note that there is no official document, that makes the percent sign special. | It is strictly up to the receiving host, whether it will interpret the percent | sign in this special way. `---| Please do the following Test: ,---| | telnet MTA 25 | HELO domain.tld | MAIL FROM: <m...@domain.tld> | RCPT TO: <hanno%hboeck...@domain.tld> | DATA | From: <m...@domain.tld> | To: <hanno%hboeck...@domain.tld> | Subject: test | | test | . | QUIT `---| What's the status code the server(s) responds atfter the "RCPT" command? 250/251? ,---[ smtp_relay2.nasl ] | rt = strcat('RCPT TO: <', to_l[i], '>\r\n'); | send(socket: soc, data: rt); | l = smtp_recv_line(socket: soc); | if (l =~ '^2[0-9][0-9]') | { `---| What's the status code the server(s) responds atfter the "QUIT" command? What you see in the MTA(s) Logfile(s)? Micha _______________________________________________ Openvas-devel mailing list Openvas-devel@wald.intevation.org http://lists.wald.intevation.org/mailman/listinfo/openvas-devel
