----- Original Message ----- From: "Marc Weigert" <mail@marceting.de> To: <IMail_Forum@list.ipswitch.com> Sent: Thursday, March 22, 2001 11:15 AM Subject: AW: [IMail Forum] Cant's stop spammers with our RELAY settings !

> Hello Yuri, > > thanx for your imediate reply !!!! > > Yes, we hit "Apply", then "Stop" and "Start" the service !!! It is really > weired, I know !!! > > Do you know of any other possible causes for this problem??? > > Cheers, > > Marc > > > -----Ursprüngliche Nachricht----- > > Von: IMail_Forum-owner@list.ipswitch.com > > [mailto:IMail_Forum-owner@list.ipswitch.com]Im Auftrag von Yuri > > Levenfeld > > Gesendet: Donnerstag, 22. März 2001 17:05 > > An: IMail_Forum@list.ipswitch.com > > Betreff: Re: [IMail Forum] Cant's stop spammers with our RELAY settings > > ! > > > > > > Did you restart SMTP service on your server after making the changes? > > > > > > ----- Original Message ----- > > From: "Marc Weigert" <mail@marceting.de> > > To: <IMail_Forum@list.ipswitch.com> > > Sent: Thursday, March 22, 2001 10:46 AM > > Subject: [IMail Forum] Cant's stop spammers with our RELAY settings ! > > > > > > > Hi, > > > > > > it appears as this message (attached below) didn't get sent > > correctly last > > > nite, as I could not find it within the list... so please forgive me, if > > you > > > got it twice ;) > > > > > > Any help would be more than welcome !! Tnank you in advance. > > > > > > Cheers, > > > > > > Marc > > > > > > ---------- > > > > > > Hello List !!! > > > > > > We discovered some abuse of our IMail server today, with spammers using > > the > > > SMTP service for... well, what they use to do ;) > > > > > > So we checked both, the manual and IPSwitch knowledgebase - and did do > > what > > > is recommended concerning the Relay settings. > > > > > > We changed the "Relay Mail Options" from "Relay Mail for > > anyone" to "Relay > > > Mail for [Adress]" and entered the IP values (we tried several different > > > settings there for testing). > > > > > > Also, we ticked this "user authentization" checkbox within our Email > > clients > > > to use IMail Server SMTP AUTH, as we dial in via different hosts all the > > > time. This works fine... > > > > > > Well, finally we ran a vulnerability scan with Mail-Abuse.org > > via Telnet : > > > # C:\WINNT\system32\mail-abuse.org > > > > > > As you might already have seen, I copied the protocol in the > > lower part of > > > this Email. Witihn that copy of the protocol I just changed our > > REAL LIVE > > > server values to the following "Aliases" for publishing to this list > > (please > > > don't take it personal ;) ! > > > > > > # 111.11.11.111 > > > # Obelix.TheServer.com > > > # TheServerStuff.com > > > > > > We passed 17 tests, until this spam vulnerability checker > > managed to "get > > > in" : > > > # "System appeared to accept 1 relay attempts" > > > > > > I already searched the Usenet for possible answers, but unfortunately I > > got > > > no suitable answer - maybe because Google limits the research > > to messages > > > not older than of August 2000 right now ?! > > > > > > It would be very appreciated if you could tell us, what we > > should/could do > > > next, to make our Email Server bulletproof !! > > > > > > Thanx in advance to all of you !!! > > > > > > Cheers, > > > > > > Marc > > > THE PROTOCOL (with DUMMY values) > > > > > > > > Connecting to 111.11.11.111 ... > > > <<< 220 X1 NT-ESMTP Server > > Obelix.TheServer > > > <<< 220 X1 NT-ESMTP Server Obelix.TheServer.com (IMail 6.04 1-1) > > > >>> HELO dante.mail-abuse.org > > > <<< 250 hello Obelix.TheServer.com > > > :Relay test: #Quote test > > > >>> mail from: <spamtest@TheServerStuff.com> > > > <<< 250 ok > > > >>> rcpt to: <"nobody@mail-abuse.org"> > > > <<< 550 not local host mail-abuse.org", not a gateway > > > >>> rset > > > <<< 250 ok its reset > > > :Relay test: #Test 1 > > > >>> mail from: <nobody@mail-abuse.org> > > > <<< 250 ok > > > >>> rcpt to: <nobody@mail-abuse.org> > > > <<< 550 not local host mail-abuse.org, not a gateway > > > >>> rset > > > <<< 250 ok its reset > > > :Relay test: #Test 2 > > > >>> mail from: <spamtest@maps1.pa.vix.com> > > > <<< 250 ok > > > >>> rcpt to: <nobody@mail-abuse.org> > > > <<< 550 not local host mail-abuse.org, not a gateway > > > >>> rset > > > <<< 250 ok its reset > > > :Relay test: #test 3 > > > >>> mail from: <spamtest@localhost> > > > <<< 250 ok > > > >>> rcpt to: <nobody@mail-abuse.org> > > > <<< 550 not local host mail-abuse.org, not a gateway > > > >>> rset > > > <<< 250 ok its reset > > > :Relay test: #Test 4 > > > >>> mail from: <spamtest> > > > <<< 501 unacceptable mail address > > > >>> rset > > > <<< 250 ok its reset > > > :Relay test: #Test 5 > > > >>> mail from: <> > > > <<< 250 ok > > > >>> rcpt to: <nobody@mail-abuse.org> > > > <<< 550 not local host mail-abuse.org, not a gateway > > > >>> rset > > > <<< 250 ok its reset > > > :Relay test: #Test 6 > > > >>> mail from: <spamtest@TheServerStuff.com> > > > <<< 250 ok > > > >>> rcpt to: <nobody@mail-abuse.org> > > > <<< 550 not local host mail-abuse.org, not a gateway > > > >>> rset > > > <<< 250 ok its reset > > > :Relay test: #Test 7 > > > >>> mail from: <spamtest@[111.11.11.111]> > > > <<< 250 ok > > > >>> rcpt to: <nobody@mail-abuse.org> > > > <<< 550 not local host mail-abuse.org, not a gateway > > > >>> rset > > > <<< 250 ok its reset > > > :Relay test: #Test 8 > > > >>> mail from: <spamtest@TheServerStuff.com> > > > <<< 250 ok > > > >>> rcpt to: <nobody%mail-abuse.org@TheServerStuff.com> > > > <<< 550 not local host mail-abuse.org, not a gateway > > > >>> rset > > > <<< 250 ok its reset > > > :Relay test: #Test 9 > > > >>> mail from: <spamtest@TheServerStuff.com> > > > <<< 250 ok > > > >>> rcpt to: <nobody%mail-abuse.org@[111.11.11.111]> > > > <<< 550 not local host mail-abuse.org, not a gateway > > > >>> rset > > > <<< 250 ok its reset > > > :Relay test: #Test 10 > > > >>> mail from: <spamtest@TheServerStuff.com> > > > <<< 250 ok > > > >>> rcpt to: <"nobody@mail-abuse.org"> > > > <<< 550 not local host mail-abuse.org", not a gateway > > > >>> rset > > > <<< 250 ok its reset > > > :Relay test: #Test 11 > > > >>> mail from: <spamtest@TheServerStuff.com> > > > <<< 250 ok > > > >>> rcpt to: <"nobody%mail-abuse.org"> > > > <<< 550 not local host mail-abuse.org", not a gateway > > > >>> rset > > > <<< 250 ok its reset > > > :Relay test: #Test 12 > > > >>> mail from: <spamtest@[111.11.11.111]> > > > <<< 250 ok > > > >>> rcpt to: <"nobody@mail-abuse.org@TheServerStuff.com"> > > > <<< 550 not local host TheServerStuff.com", not a gateway > > > >>> rset > > > <<< 250 ok its reset > > > :Relay test: #Test 13 > > > >>> mail from: <spamtest@TheServerStuff.com> > > > <<< 250 ok > > > >>> rcpt to: <"nobody@mail-abuse.org"@[111.11.11.111]> > > > <<< 550 not local host mail-abuse.org", not a gateway > > > >>> rset > > > <<< 250 ok its reset > > > :Relay test: #Test 14 > > > >>> mail from: <spamtest@TheServerStuff.com> > > > <<< 250 ok > > > >>> rcpt to: <nobody@mail-abuse.org@[111.11.11.111]> > > > <<< 550 not local host mail-abuse.org, not a gateway > > > >>> rset > > > <<< 250 ok its reset > > > :Relay test: #Test 15 > > > >>> mail from: <spamtest@[111.11.11.111]> > > > <<< 250 ok > > > >>> rcpt to: <@TheServerStuff.com:nobody@mail-abuse.org> > > > <<< 550 not local host mail-abuse.org, not a gateway > > > >>> rset > > > <<< 250 ok its reset > > > :Relay test: #Test 16 > > > >>> mail from: <spamtest@TheServerStuff.com> > > > <<< 250 ok > > > >>> rcpt to: <@[111.11.11.111]:nobody@mail-abuse.org> > > > <<< 550 not local host mail-abuse.org, not a gateway > > > >>> rset > > > <<< 250 ok its reset > > > :Relay test: #Test 17 > > > >>> mail from: <spamtest@[111.11.11.111]> > > > <<< 250 ok > > > >>> rcpt to: <mail-abuse.org!nobody> > > > <<< 250 ok deliver to alternate > > > >>> QUIT > > > <<< 221 Goodbye > > > Tested host banner: 220 X1 NT-ESMTP Server Obelix.TheServer.com > > (IMail 6. > > > 04 1-1) > > > System appeared to accept 1 relay attempts > > > > > > > > > Connection to host lost. > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > >