I'd suggest hiring a reasonably competent router engineer to configure
your router correctly to prevent IP spoofing, via ACL's. That, together
with the other suggestions below, will prevent your server from being
used as a mail relay.
/wiZZ
----- Original Message -----
From: Len Conrad <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: 23 February 2000 02:56
Subject: RE: [IMail Forum] I am getting killed by spammers relaying onmy
servers.
> Then relaying for addresses won't work, if they are spoofing your
addresses.
>
> In your log, can you see any highly recurrent, repeating "from:"
values
> that you could filter against ?
>
> Len
>
> =======
>
> >That is exactly what they are doing. Faking the IP address so it
looks like
> >it is sending internally.
> >
> >Although when you say:
> >
> >the way we solved it was by putting in each ip and or subnet as we
went
> >along.. much more tedious..
> >
> >Could you be more specific?
> >
> >
> >Thanks for the quick response!!!
> >
> >-----Original Message-----
> >From: [EMAIL PROTECTED]
> >[mailto:[EMAIL PROTECTED]]On Behalf Of Simon
> >Sent: Tuesday, February 22, 2000 6:30 PM
> >To: [EMAIL PROTECTED]
> >Subject: RE: [IMail Forum] I am getting killed by spammers relaying
on
> >my servers.
> >
> >
> >we had that very same problem.. it seemed that messages were only
able
> >to be sent to our internal network & virtual hosts, but from one of
the
> >spam 'authorities' we were sent an example of how the 'spammers'
managed
> >to get by, the first two attempts at using our mailserver as a relay
were
> >denied, then the 3rd time, it faked our IP so that it looked like it
was
> >coming thru our internal network - this was using imail 5.08 or
something.
> >the way we solved it was by putting in each ip and or subnet as we
went
> >along.. much more tedious.. with what shuld have been the same result
using
> >relay mail for local hosts only.
> >
> >simon
> >
> > > -----Original Message-----
> > > From: [EMAIL PROTECTED]
> > > [mailto:[EMAIL PROTECTED]]On Behalf Of Scott
Bishop
> > > Sent: Wednesday, 23 February 2000 10:54
> > > To: [EMAIL PROTECTED]
> > > Subject: [IMail Forum] I am getting killed by spammers relaying on
my
> > > servers.
> > >
> > >
> > > I have several options selected
> > >
> > >
> > > smtp security
> > > relay mail for internal addresses only (on my network)
> > > allow remote mail to local groups is checked.
> > > check valid sender is checked
> > > aut deny possible hack attempts is checked.
> > > disable smtp vrfy command is checked.
> > >
> > > people are still able to relay mail from my server without
authenticating.
> > > Im about 1 day away from my UPPER ISP providor filtering mail to
> > > my servers
> > > cause I cant stop the spam! I have even denied access to the
offenders
> > > causing the spam, and emailed the proper authorites. But new spam
servers
> > > pop up everyday relaying through my secured smtp server (secured
hah)
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
