On Sunday, December 7, 2003, at 11:22 AM, Bill Cole wrote:
These are looking suspiciously like relay probes which are getting some sort of locally generated auto-reply, perhaps a bounce. That's a symptom of SIMS with an 'Unknown' account configured. Some of the ways that spammers use the more arcane forms of email addressing result in addresses that SIMS properly interprets as local account names and will accept if you have an Unknown account configured. The solution is to not have any config for unknown local addresses. It is an approach to MTA management whose time has past, along with open relay and accepting mail from unresolvable domains. Even without the particularly quirky (and technically correct!) way that SIMS handles quoted local part relay attempts, accepting mail for local users that you know do not exist is simply untenable in a world where spammers regularly run dictionary attacks as their primary means of delivery.
Ok. You're going to have to explain the "Unknown account" thing for me. I only have the accounts I created and Postmaster in the accounts list and I still had this problem.
Also, it's hard to snip a section of the log when it's 85meg in size.
Mike Hebel
############################################################# This message is sent to you because you are subscribed to the mailing list <[EMAIL PROTECTED]>. To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send administrative queries to <[EMAIL PROTECTED]>
