First of all thanks for your help. Here are the log records for your reference :-
11:12 00:00 SMTPD(4E78017E) [210.187.0.208] HELO yahoo.com 11:12 00:00 SMTPD(000000B1) Authenticated [EMAIL PROTECTED], session treated as local. 11:12 00:00 SMTPD(4E78017E) [210.187.0.208] MAIL FROM:<[EMAIL PROTECTED]> 11:12 00:00 SMTPD(4E78017E) [210.187.0.208] RCPT TO:<[EMAIL PROTECTED]> 11:12 00:00 SMTPD(4E78017E) [210.187.0.208] RCPT TO:<[EMAIL PROTECTED]> 11:12 00:00 SMTPD(4E78017E) [210.187.0.208] RCPT TO:<[EMAIL PROTECTED]> 11:12 00:00 SMTPD(4E78017E) [210.187.0.208] RCPT TO:<[EMAIL PROTECTED]> 11:12 00:00 SMTPD(4E78017E) [210.187.0.208] RCPT TO:<[EMAIL PROTECTED]> 11:12 00:00 SMTPD(4E78017E) [210.187.0.208] RCPT TO:<[EMAIL PROTECTED]> 11:12 00:00 SMTPD(4E78017E) [210.187.0.208] RCPT TO:<[EMAIL PROTECTED]> 11:12 00:00 SMTPD(4E78017E) [210.187.0.208] RCPT TO:<[EMAIL PROTECTED]> 11:12 00:00 SMTPD(4E78017E) [210.187.0.208] E:\IMail\spool\Dd40117e.SMD 1201 As you can see, the spammer authenticate himself using one of the valid user in our server [EMAIL PROTECTED] and start sending mail from [email protected] mail to ???@????.com which are all not local users. The question is, while the relay option set to "Relay for local host", how can it by pass my setting and send mail thru SMTP AUTH? Regards, Mak ----- Original Message ----- From: "Smart Business Lists" <[EMAIL PROTECTED]> To: "Mak" <[EMAIL PROTECTED]> Sent: Tuesday, 12 November, 2002 6:53 PM Subject: Re: [IMail Forum] Spam relay problem > Mak, > > Tuesday, November 12, 2002 you wrote: > M> Here is the funny problem, my IMail 6.06 relay option set to "Relay > M> for Local Host" (I know this is not secure enough), > > Then please fix it. Use No Relay or Relay for Addresses and SMTP > AUTH. > > You're mail server is not listed on the blacklists yet but it has > no PTR record. > > M> but I found a spammer relay large quantity of spam mail thru my > M> mail server thru SMTP Authentication! > > That is unlikely but all you have to do is change the password for > the authenticated user. I would like to see the proof this has > occurred so get the proof from your log lines and post it. Just > the part where someone uses smtpauth to send spam. > > M> Yes, SMTP Authentication! They some how able to authenticate > M> themself and then send mail from [email protected] to ???@???.com which > M> should be block by may "Relay for local Host" setting. > > Well I don't know what the "???" means. But if you are complaining > because someone is sending mail to an address on your domain then > that has nothing to do with relaying. SMTPAUTH has nothing to do > with stopping mail incoming to a domain hosted on your server. > That's simply a spam problem and you need to teach yourself to use > IMAIL rules or invest in one of the Spam filter options. > > M> Please Help! How can this be possible? > > The first thing you need to do is lock down your server. > > Terry Fritts > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
