JP,

Thank you for your response.

As you mentioned and explained bellow, [EMAIL PROTECTED] and [EMAIL PROTECTED] are valid adress. But the in my case, those two user are not exist, im my domain there are no such mailbox (danu and sjuliarso). I got this message from my qmail-tap mailbox. But how come my QMT still accepting these two messages if the recipient user is non-exist.

Is this kind of spam ??

Regrads,

David J


----- Original Message ----- From: "Jean-Paul van de Plasse" <[EMAIL PROTECTED]>
To: <[email protected]>
Sent: Friday, February 09, 2007 6:40 PM
Subject: Re: [qmailtoaster] Telnet Port 25 could be relayed without authentication.


Hi David,

This is a bit difficult to read all since we do not know what email addresses are valid and what not.. But as I read your messsages I think [EMAIL PROTECTED] and [EMAIL PROTECTED] are valid addresses. And you look at the To: headers stating <[EMAIL PROTECTED]> and <[EMAIL PROTECTED]>
Wich are not correct right?

Well thats not so difficult, the Headers are not used in deciding who the mail will receive, but the inititial smtp conversation does.
IE :
EHLO m2-vision.com
mail from:[EMAIL PROTECTED]
rcpt to: [EMAIL PROTECTED]
250 ok
data
354 go ahead
To : [EMAIL PROTECTED]

test
.
250 ok

You see this would end up in the danu mailbox, and gets you confuzed since it appears to be for [EMAIL PROTECTED] Nothing to do about it really, this is just how it is, it also is how Bcc'ed email are delivered, you see the To: who is not you and not the bcc headers.

JP

----- Original Message ----- From: "David J." <[EMAIL PROTECTED]>
To: <[email protected]>
Sent: Friday, February 09, 2007 10:07 AM
Subject: Re: [qmailtoaster] Telnet Port 25 could be relayed without authentication.


Dear Eric,

How about this message properties bellow,

It has the same, domainkeys status no signatures and it's SPF Received says, unknown (mail.m2-vision.net: Maximum nesting level exceeded, possible loop)

Both of the recipient of the e-mail is non exist ... How could this happened, and how to stop it. Qmt should only accept recipient which the [EMAIL PROTECTED] are exist, as for the nonexistance user recipient will not be accepted right ..??

Thanks

David J.


Content-Filter: maildrop-toaster
Return-Path: <[EMAIL PROTECTED]>
Delivered-To: [EMAIL PROTECTED]
Received: (qmail 20307 invoked by uid 89); 7 Feb 2007 20:58:18 -0000
DomainKey-Status: no signature
Received: by simscan 1.3.1 ppid: 20287, pid: 20300, t: 12.6377s
        scanners: attach: 1.3.1 clamav: 0.90rc3/m:42 spam: 3.1.7
X-Spam-Checker-Version: SpamAssassin 3.1.7 (2006-10-05) on mail.m2-vision.net
X-Spam-Level: *
X-Spam-Status: No, score=1.1 required=2.2 tests=BAYES_00,DK_POLICY_SIGNSOME,
PYZOR_CHECK autolearn=no version=3.1.7
Received: from unknown (HELO 64dfd368475440f) (151.76.250.50)
 by mail.m2-vision.net with SMTP; 7 Feb 2007 20:58:05 -0000
Received-SPF: unknown (mail.m2-vision.net: Maximum nesting level exceeded, possible loop)
Return-Path: <[EMAIL PROTECTED]>
Received: from MAIL.bioriginal.com (HELO bioriginal.com) ([142.165.166.190])
 by 7fzi.bioriginal.com with ESMTP id ; Wed, 7 Feb 2007 20:58:05 -0060
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: I0N31AEWNXU+QU2KPVUK1A058LOBTKPA4BFBNXVE
X-IronPort-AV: i="4.13,240,4484113986";
  d="scan'208"; a="02832226:QOJZ99701067"
Received: from rxs0nel.webberconsultinginc.com ([32.193.231.16])
by ss1xy.synergy-events.com (Sun Java System Messaging Server 6.1 HotFix 0.07 (built May 25 2007)) with ESMTP id <[EMAIL PROTECTED]> for
[EMAIL PROTECTED]; Wed, 7 Feb 2007 20:58:05 -0060 (IST)
Date: Wed, 7 Feb 2007 20:58:05 -0060
From: "Honorable Gordon Ebach" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Subject: Californiansguiles wrote: Would you ...
Message-ID: <[EMAIL PROTECTED]>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

This one also had the same message but different recipeint address.

Content-Filter: maildrop-toaster
Return-Path: <[EMAIL PROTECTED]>
Delivered-To: [EMAIL PROTECTED]
Received: (qmail 19718 invoked by uid 89); 7 Feb 2007 20:13:58 -0000
DomainKey-Status: no signature
Received: by simscan 1.3.1 ppid: 19710, pid: 19711, t: 16.7949s
        scanners: attach: 1.3.1 clamav: 0.90rc3/m:42 spam: 3.1.7
X-Spam-Checker-Version: SpamAssassin 3.1.7 (2006-10-05) on mail.m2-vision.net
X-Spam-Level:
X-Spam-Status: No, score=-2.6 required=2.2 tests=BAYES_00,DK_POLICY_SIGNSOME
autolearn=ham version=3.1.7
Received: from unknown (HELO ip565a6bb1.direct-adsl.nl) (86.90.107.177)
 by mail.m2-vision.net with SMTP; 7 Feb 2007 20:13:41 -0000
Received-SPF: unknown (mail.m2-vision.net: Maximum nesting level exceeded, possible loop)
Return-Path: <[EMAIL PROTECTED]>
Received: from creon.pl (HELO creon.pl) ([195.149.225.60])
 by fu.creon.pl with ESMTP id ; Wed, 7 Feb 2007 20:13:40 -0060
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: PWB1QSJN33V+FZRJRJH81QVAWHOBDM2MCL85QKT6
X-IronPort-AV: i="4.13,691,8863823376";
  d="scan'208"; a="80733822:J5V205962498"
Received: from 4y.weberdata.de ([54.101.35.98])
by iuvw44.wilkesweb.us (Sun Java System Messaging Server 6.1 HotFix 0.07 (built Jul 2 2005)) with ESMTP id <[EMAIL PROTECTED]> for
[EMAIL PROTECTED]; Wed, 7 Feb 2007 20:13:40 -0060 (IST)
Date: Wed, 7 Feb 2007 20:13:40 -0060
From: "Chevakia Amador" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Subject: penguinsleonine wrote: Did you ...
Message-ID: <[EMAIL PROTECTED]>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable







----- Original Message ----- From: "Eric "Shubes"" <[EMAIL PROTECTED]>
To: <[email protected]>
Sent: Friday, February 09, 2007 2:20 PM
Subject: Re: [qmailtoaster] Telnet Port 25 could be relayed without authentication.


David,
It appears that your email was not technically relayed, as it came into your
domain. A relay is mail that comes into your server and goes out to a
different domain.

Looks to me like the message was scanned for SPF, spam, virus as you want.

I don't see a problem.

If you want authentication, simply have the clients use port 587. Then no rbl or spam checking is done, and relaying is allowed. Authentication there
is enforced.

On port 25, as long as the message is for your domain(s), it'll be checked for rbls, then SPF, then virus, then spam, and if it's still ok, then it'll
be received. If it's not for your domain, it will be rejected.

David J. wrote:
Dear all,

I've try telnet my 25 port, and send mesage from. It sucessfully send.

This is the reason I got some spam loop.
bellow is the message properties;

Content-Filter: maildrop-toaster
Return-Path: <[EMAIL PROTECTED]>
Delivered-To: [EMAIL PROTECTED]
Received: (qmail 21033 invoked by uid 89); 9 Feb 2007 05:57:41 -0000
DomainKey-Status: no signature
Received: by simscan 1.3.1 ppid: 20934, pid: 21027, t: 13.1208s
        scanners: attach: 1.3.1 clamav: 0.90rc3/m:42 spam: 3.1.7
X-Spam-Checker-Version: SpamAssassin 3.1.7 (2006-10-05) on
mail.m2-vision.net
X-Spam-Level:
X-Spam-Status: No, score=-3.4 required=2.2 tests=ALL_TRUSTED,BAYES_00,
DK_POLICY_SIGNALL,NO_REAL_NAME autolearn=ham version=3.1.7
Received: from unknown (HELO ) (192.168.234.99)
 by mail.m2-vision.net with SMTP; 9 Feb 2007 05:57:28 -0000
Received-SPF: unknown (mail.m2-vision.net: Maximum nesting level
exceeded, possible loop)
From: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject: Jgn Internetan mulu !

The above mail got send from my qt through telnet port 25.

How do I activate authentication for smtp , smtp-ssl, imap4, imap4-ssl.
After the authenticatation I also would like to do SPF Checked on them,
than goes to Spam checking and Antivirus checking on the incomming mail.

Is it possible to do..? ofcourse mail from any other mailserver which
have a designated e-mails to my user at my domains are wellcome to be
dilvered.(yahoo, google and etc.)

Bellow are my current supervised run of them.
==========================================
smtp/run :
#!/bin/sh
QMAILDUID=`id -u vpopmail`
NOFILESGID=`id -g vpopmail`
MAXSMTPD=`cat /var/qmail/control/concurrencyincoming`
BLACKLIST=`cat /var/qmail/control/blacklists`
SMTPD="/var/qmail/bin/qmail-smtpd"
TCP_CDB="/etc/tcprules.d/tcp.smtp.cdb"
RBLSMTPD="/usr/bin/rblsmtpd"
HOSTNAME=`hostname`
VCHKPW="/home/vpopmail/bin/vchkpw"
REQUIRE_AUTH=1

exec /usr/bin/softlimit -m 27000000 \
/usr/bin/tcpserver -v -R -H -l $HOSTNAME -x $TCP_CDB -c "$MAXSMTPD" \
    -u "$QMAILDUID" -g "$NOFILESGID" 0 smtp \
    $RBLSMTPD $BLACKLIST $SMTPD $VCHKPW /bin/true 2>&1
============================================
smtp-ssl/run:
#!/bin/sh
QMAILDUID=`id -u vpopmail`
NOFILESGID=`id -g vpopmail`
MAXSMTPD=`cat /var/qmail/control/concurrencyincoming`
BLACKLIST=`cat /var/qmail/control/blacklists`
SMTPD="/var/qmail/bin/qmail-smtpd"
TCP_CDB="/etc/tcprules.d/tcp.smtp.cdb"
RBLSMTPD="/usr/bin/rblsmtpd"
HOSTNAME=`hostname`
VCHKPW="/home/vpopmail/bin/vchkpw"
REQUIRE_AUTH=0
export SMTPS=1

exec /usr/bin/softlimit -m 27000000 \
/usr/bin/tcpserver -v -R -H -l $HOSTNAME -x $TCP_CDB -c "$MAXSMTPD" \
   -u "$QMAILDUID" -g "$NOFILESGID" 0 465 \
   $RBLSMTPD $BLACKLIST $SMTPD $VCHKPW /bin/true 2>&1
============================================
imap4/run:
#!/bin/sh

HOSTNAME=`hostname --fqdn`
rm -rf ./env/*;

cat /etc/courier/imapd | /usr/bin/envconv
exec /usr/bin/envdir ./env/ \
/usr/bin/softlimit -m 24000000 \
/usr/bin/tcpserver -v -R -H -l $HOSTNAME 0 143 \
/usr/sbin/imaplogin \
/usr/bin/imapd Maildir 2>&1
============================================
imap4-ssl/run:
#!/bin/sh

HOSTNAME=`hostname --fqdn`
rm -rf ./env/*;

cat /etc/courier/imapd-ssl | /usr/bin/envconv
exec /usr/bin/envdir ./env/ \
/usr/bin/softlimit -m 24000000 \
/usr/bin/tcpserver -v -R -H -l $HOSTNAME 0 993 \
/usr/bin/couriertls -server -tcpd \
/usr/sbin/imaplogin \
/usr/bin/imapd Maildir 2>&1
============================================
submission/run :
#!/bin/sh
QMAILDUID=`id -u vpopmail`
NOFILESGID=`id -g vpopmail`
MAXSMTPD=`cat /var/qmail/control/concurrencyincoming`
SMTPD="/var/qmail/bin/qmail-smtpd"
TCP_CDB="/etc/tcprules.d/tcp.smtp.cdb"
HOSTNAME=`hostname`
VCHKPW="/home/vpopmail/bin/vchkpw"
export REQUIRE_AUTH=1

exec /usr/bin/softlimit -m 27000000 \
/usr/bin/tcpserver -v -R -H -l $HOSTNAME -x $TCP_CDB -c "$MAXSMTPD" \
   -u "$QMAILDUID" -g "$NOFILESGID" 0 587 \
   $SMTPD $VCHKPW /bin/true 2>&1
============================================
tcp.smtp :
127.:allow,RELAYCLIENT="",DKSIGN="/var/qmail/control/domainkeys/%/private",QMAILQUEUE="/var/qmail/bin/simscan"

:allow,BADMIMETYPE="",BADLOADERTYPE="M",QMAILQUEUE="/var/qmail/bin/simscan",CHKUSER_RCPTLIMIT="15",CHKUSER_WRONGRCPTLIMIT="3",DKSIGN="/var/qmail/control/domainkeys/%/private",DKVERIFY="DEGIJKfh",DKQUEUE="/var/qmail/bin/qmail-queue.orig",NOP0FCHECK="1"

============================================


Highly apreciate your help here,


David J.

---------------------------------------------------------------------
    QmailToaster hosted by: VR Hosted <http://www.vr.org>
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]




--
-Eric 'shubes'

---------------------------------------------------------------------
    QmailToaster hosted by: VR Hosted <http://www.vr.org>
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



---------------------------------------------------------------------
    QmailToaster hosted by: VR Hosted <http://www.vr.org>
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]




---------------------------------------------------------------------
    QmailToaster hosted by: VR Hosted <http://www.vr.org>
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



---------------------------------------------------------------------
    QmailToaster hosted by: VR Hosted <http://www.vr.org>
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Reply via email to