Mark Busby wrote:
Is this an open relay using ipv6? If so how to block the ipv6 relay.
I thought after sendmail v8.9, all relay action was blocked by default.
You haven't given sufficient information to say whether the machine is
an open relay or not. We'd need to see the configuration files (well,
the .mc file that is processed to produce the eventual sendmail.cf)
plus potentially the contents of the access DB. However, you are
correct: nowadays the default sendmail configuration is to block
relaying, and you have to deliberately add configuration settings to
enable any permitted relays. If you're using the default configuration
shipped with FreeBSD, then it is not an open relay.
maillog entry
Nov 10 15:01:11 hostname sm-mta[8989]: mAAL021C008989: from=[EMAIL PROTECTED], size=4825, class=0, nrcpts=0, bodytype=7BIT, proto=ESMTP, daemon=IPv6, relay=localhost [IPv6:::1]
Nov 10 15:01:17 hostname sm-mta[8989]: mAAL021D008989: ruleset=check_mail,
arg1=[EMAIL PROTECTED], relay=localhost [IPv6:::1], reject=451 4.1.8 Domain of sender
address [EMAIL PROTECTED] does not resolve
Nov 10 15:01:17 hostname sm-mta[8989]: mAAL021D008989: from=[EMAIL
PROTECTED], size=3880, class=0, nrcpts=0, bodytype=7BIT, proto=ESMTP, daemon=IPv6,
relay=localhost [IPv6:::1]
This certainly doesn't indicate a message being inappropriately
relayed. The attempt to send the message is rejected with a permanent
error code (ie. tell the sender to bounce the message as undeliverable
and not to re-queue it for another attempt at delivery later). I think
it's also doing the correct thing and rejecting the e-mail during the
SMTP dialog rather than accepting the message for delivery and then
later sending a bounce-o-gram to the listed sender address. Google for
'backscatter spam' in order to understand why the latter course of
action is a bad idea.
sockstat -6
USER COMMANDPID FD PROTO LOCAL ADDRESS FOREIGN ADDRESS
root sendmail 8284 5 tcp6 *:25 *:*
root sshd 1520 3 tcp6 *:5960*:*
root ntpd 1010 5 udp6 *:123 *:*
root ntpd 1010 9 udp6 fe80:6::1:123 *:*
root ntpd 1010 10 udp6 ::1:123 *:*
root syslogd927 6 udp6 *:514 *:*
You've got sendmail listening on all interfaces for IPv6 connections.
This is appropriate if you expect the machine to receive incoming
e-mails. If that's not the case, then set sendmail_enable='NO' in
/etc/rc.conf. This will give you a send-only configuration with a
sendmail listener bound to the loopback address (typically both ::1
and 127.0.0.1)
Cheers,
Matthew
--
Dr Matthew J Seaman MA, D.Phil. 7 Priory Courtyard
Flat 3
PGP: http://www.infracaninophile.co.uk/pgpkey Ramsgate
Kent, CT11 9PW
signature.asc
Description: OpenPGP digital signature
