Re: Annoying Connections...

[Harald Hanche-Olsen]

- "J.P. Racine" <[EMAIL PROTECTED]>:

|   I'm having some problems with a remote site that seems to be
| attempting to use us as an open relay, fact is, we arent...

Might be useful if you could turn on verbose logging for connections
from that site.  Could it not be possible that they have a broken smtp
client that chokes on some response from your server, then retries
without proper delays?  (Never attribute to malice what can be
explained by stupidity (I don't remember who said that.))

|  My guess is, the remote mailer is using a scanner that reports open
| relays with sendmail return codes.  I'm tempted to recompile qmail
| with the sendmail return codes instead of the X.X.X codes [...]

I don't quite understand what you mean by that.  The codes that matter
in the SMTP dialog are the first three characters of the response.
The text that follows, including qmail's X.X.X codes, are just comments.

- Harald

Re: Annoying Connections...

[Markus Stumpf]

On Sun, Jan 10, 1999 at 09:35:48PM -0500, J.P. Racine wrote:
> tcp6  0 dns2:smtp   www.zone.com:1219   CLOSE
> tcp6  0 dns2:smtp   www.zone.com:3030   CLOSE
> tcp6  0 dns2:smtp   www.zone.com:1260   CLOSE
> tcp6  0 dns2:smtp   www.zone.com:3106   CLOSE
> tcp0 25 dns2:smtp   www.zone.com:1299
> ESTABLISHED
> tcp0  0 dns2:smtp   www.zone.com:3181
> ESTABLISHED
> 
>  This has been going on for about 5 days now and i've exausted every
> reasonable
> means at bringing attention to this issue with microsoft.  I've sent emails,
> telephone calls (left messages) and sent faxes.  Now I feel that something

Had the same problem starting last Friday.
I've sent mail to [EMAIL PROTECTED] and got a reply within 10
minutes. But it took them hours to stop it. In the meantime not
only one IP address that resolves to www.zone.com did the connects,
but anotherone jumped in. Had a connection rate of up to 10 per second.

I have then blocked them via tcpcontrol and patched tcpcontrol
(one line fix) to do a sleep(500) before exiting on a deny rule.
That kept the suckers busy and didn't stress the system as much as
the high connection frequency did. The problem was "solved" (?) about
36 hours after I reported it.

Symptoms where identical:
They did a MAIL TO: to a non existant local user, but the mail never
arrived in the queue, but the SMTP connection was hangup.
As it was Friday evening and I had better things to do, I didn't
investigate any further.

\Maex

-- 
SpaceNet GmbH |   http://www.Space.Net/   | In a world without
Research & Development| mailto:[EMAIL PROTECTED] |   walls and fences,
Joseph-Dollinger-Bogen 14 |  Tel: +49 (89) 32356-0| who needs
D-80807 Muenchen  |  Fax: +49 (89) 32356-299  |   Windows and Gates?