How do I stop someone from telneting to port 25 and then creating a new email?
It's impossible for a mailserver to identify someone telneting to port 25 to create a new E-mail (as opposed to sending it via SMTP using a standard mail client). There are ways that you might be able to identify it some of the time (if you have low-level access to TCP/IP), but even that wouldn't detect it all the time.
But it seems that telnet versus SMTP isn't the issue here:
I have security set to "relay for local users" but, have tried every possible security option and it still allows jo-blow from anywhwre to login and send mail. All he has to do is use a valid email address thats on the server (ie. <mailto:[EMAIL PROTECTED]>[EMAIL PROTECTED])
helo mydomainname.com (any domain name works) mail from:[EMAIL PROTECTED] (he's now spoofed my email address) rcpt to:[EMAIL PROTECTED] (any email address he wants)
at this point, all he needs to do is the data command, and he's sending email.
surely there is a way to keep him off the server or, a way to keep him from being able to do this??
There's no need to resort to telnet -- anyone (including a spammer!) can just enter "[EMAIL PROTECTED]" in their mail client, and voila! They can now relay mail through your server. That's because IMail includes several pretend anti-relay options (ones that don't work).
IMail's SMTP Security options have a number of relaying choices. Of them, only 2 can be used safely (the rest cause you to be an open relay). The two safe options are "Relay for Addresses" and "No Mail Relay".
If you use IMail's "Relay for addresses", you would enter a list of "safe" IP addresses that your users may come from; anyone not coming from those safe IPs would need to use SMTP AUTH. If you use "No mail relay", everyone must use SMTP AUTH to relay mail. Note that relay settings apply only to outgoing E-mail, so no matter what your settings are, your users will still be able to get mail.
So to reiterate: "Relay for Addresses" or "No Mail Relay" are safe; everything else will get you listed in a number of spam databases.
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection.
Find out what you have been missing: Ask for a free 30-day evaluation.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
