Based on customer complaints of unreceived mail, I tracked down the cause of a remote server not being able to deliver incoming mail. They were unable to connect to our mail server despite a clean network connection, so on a hunch I restarted the SMTP service and monitored it. The remote server was able to deliver messages for a day, then they were blocked again with this message
02:13 05:53 SMTPD(7C84002E) Possible hack attempt from X.X.X.X, address will be denied future connections until restart We have the SMTP "Auto deny possible hack attempts" flag set. The previous log entry was a RCPT TO a user that no longer exists. Although the remote mail server isn't one of the big boys, I don't believe they were probing for buffer overflows. I'm guessing that they ignored the "Invalid user" return code and started sending the E-mail body instead of closing the connection or moving to another user. The E-mail body looked like a buffer overflow attempt therefore the hack block. I looked for other autodeny hack attempt log entries; there was one from one of our own users. It was one of the recent viruses that alters the first letter of the return address. There were so many postmaster messages from her that I just sent her an E-mail telling her she had a virus, then blocked the invalid address. So now when the virus tries to send, it ignores the "unacceptable FROM address" message and continues trying to send the virus. This looks like a hack and WHAM one of our own dialup IP's is blocked until restart. The other hack cases (many) seem to be from a spammer with a similar lame mail blaster software problem. This one I like - my own "Auto deny possible spam attempts" function!!!!!!! I like the function of this flag. If someone is up to no good, block them as soon as possible. I wonder if the software would properly handle the cases with the "Auto deny" flag unchecked. Having the software block your own IP address and other mail servers might be inconvenient. It also seems not to have been happening last year (or maybe was just never entered in the logs). Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
