Hi All,

Just been watching ORDB go through one of our mail servers checking for
"Open Relay" Those guys really hammer it don't they. Anyway it passed the
test......but I wasn't feeling too confident.

OK, here's the pitch.

This single server is dedicated to relaying and nothing else, since the
users' servers dial-in on a regular basis and send out their mail via this
server. There are NO user accounts and no domains listed on this server and
it works with "Relay For Local Hosts". Put the host names in the
"accept.txt" and away it goes. I KNOW it's bad practice but this was for
testing purposes only.

OK, so we're talking dynamic IP addresses and the clients only use the
dial-in accounts we give them and they all use the same dial-in servers.
Therefore the backbone provider's DHCP servers always give them a Class B
address in the same range eg.

Network address: 61.200.0.0 (fictitious)
Subnet: 255.255.0.0

Great, thought I - "Relay for Addresses" is the way to go having spent
several hours putting in filters, kill lists etc.

I checked "Relay for Addresses" put in the IP address range and subnet,
restarted the SMTP service and sat back and watched as our clients' servers
connected to see what happened. OH NO!!!! Every single message bounced back
to the client with an "Invalid User" message. What now......PANIC.....as I
had already submitted this server for testing by ORDB. Quickly switched back
to "Relay for local hosts" some quick fiddling in the kill.lst file and
managed to get past the test.

What was even worse was that the ORDB test comes from all sorts of different
IP addresses and the server connected to every one during the test.

My questions are:

1. Why didn't the server relay the messages, do I need to set up
domains/users on this server to be able to relay or what?
2. Why did the server allow IP addresses outside of the range to connect?

Ideas guys?

Allen




To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/

Reply via email to