On Mon, Mar 20, 2000 at 11:44:17PM +1100, David wrote:
> I'm trying to interpret my mail log. There are an aweful lot of "relay
> denied", but an occassional one that appears not to be denied. Can anyone
> suggest why? (sample below). What do I do to stop these buggars filling my
sendmail generates two entries in its log for each accepted message. The
first logs the receipt of the message by sendmail, and tells you what it
has done with it. The second logs the delivery to the recipient. The
`relay' host is actually the host that sendmail received the message from.
Here's an example from my workstation:
Mar 19 09:08:15 dropbear sendmail[14423]: JAA14423:
from=<[EMAIL PROTECTED]>,
size=6742, class=-60, pri=144742, nrcpts=1,
msgid=<00031815055700.09774@hackman>, proto=ESMTP,
relay=swamprat.vastsystems.com.au [192.168.1.1]
Mar 19 09:08:15 dropbear sendmail[14424]: JAA14423:
to=<[EMAIL PROTECTED]>, delay=00:00:01, xdelay=00:00:00,
mailer=local, stat=Sent
These first message tells me that the message came from the crossgcc
mailing list (the crossgcc-return... address) and was relayed to my
workstation by swamprat.vastsystems.com.au (our MX host). The second
tells me that the message was addressed to [EMAIL PROTECTED] and
was delivered ok. The queue id (JAA14423) identifies them as being
associated with the one message.
Now, here's a relay attempt:
jrc@zipperii:/home/jrc$ telnet swamprat.vastsystems.com.au 25
Trying 203.63.125.171...
Connected to swamprat.vastsystems.com.au.
Escape character is '^]'.
220 vastsystems.com.au ESMTP Sendmail 8.8.7/8.8.7; Tue, 21 Mar 2000 11:07:34 +1100
ehlo zipperii.zip.com.au
250-swamprat.vastsystems.com.au Hello [EMAIL PROTECTED] [203.12.97.87], pleased
to meet you
250-8BITMIME
250-SIZE
250-DSN
250-ONEX
250-ETRN
250-XUSR
250 HELP
mail from: [EMAIL PROTECTED]
250 [EMAIL PROTECTED] Sender ok
rcpt to: [EMAIL PROTECTED]
551 [EMAIL PROTECTED] we do not relay
quit
221 swamprat.vastsystems.com.au closing connection
Connection closed by foreign host.
And here's the log entries this generated:
Mar 21 11:08:05 swamprat sendmail[25277]: LAA25277: [EMAIL PROTECTED]
we do not relay
This merely logs that a relay attempt was denied, but it does tell me the
recipient address.
Mar 21 11:08:05 swamprat sendmail[25277]: LAA25277: ruleset=check_rcpt,
[EMAIL PROTECTED], [EMAIL PROTECTED] [203.12.97.87],
reject=551 [EMAIL PROTECTED] we do not relay
This one tells me the recipient address, [EMAIL PROTECTED] (in the `rcpt
to' command) and the hostname (and username in this case because zipperii
responds to auth requests) from which the attempt came
([EMAIL PROTECTED]).
Mar 21 11:08:07 swamprat sendmail[25277]: LAA25277:
[EMAIL PROTECTED], size=0, class=0, pri=0, nrcpts=0, proto=ESMTP,
[EMAIL PROTECTED] [203.12.97.87]
This one tells me the sender address, often forged in spam, was
[EMAIL PROTECTED] (in the `mail from' command), and again, the user and
host from which the message came.
So, on to your log:
> Mar 20 23:26:55 fast sendmail[25176]: XAA25176: ruleset=check_rcpt,
> arg1=<[EMAIL PROTECTED]>, relay=slc-pm10-11.sisna.com [216.
> 190.10.75], reject=550 <[EMAIL PROTECTED]>... Relaying denied
This tells you that the `rcpt to:' was [EMAIL PROTECTED], and it was
relayed to you from slc-pm10-11.sisna.com. The next one:
> Mar 20 23:26:57 fast sendmail[25176]: XAA25176:
> from=<[EMAIL PROTECTED]>, size=0, class=0, pri=0, nrcpts=0,
> proto=SMTP, relay=slc-pm10-11.sisna.com [216.190.10.75]
tells you the `mail from:' address was [EMAIL PROTECTED] A
whois query on 216.190.10.75 returns this:
SISNA� Inc. Portmaster Pool10 (NETBLK-SSNA-SLC-PM10) SSNA-SLC-PM10
216.190.10.64 - 216.190.10.127
and sisna.com is an ISP in the US, so this is probably one of their dialup
lines. Their AUP prohibits spam, so it may be worth a complaint to
[EMAIL PROTECTED]
This one:
> Mar 20 23:40:44 fast sendmail[25229]: XAA25229:
> from=<[EMAIL PROTECTED]>, size=0, class=0, pri=0, nrcpts=0,
> proto=SMTP, relay=slc-pm10-11.sisna.com [216.190.10.75]
is unrelated. The queue id is XAA25229, which is different to the queue
id of the relay attempt. Find the matching log entry and you may find
that it's another relay attempt.
Cheers,
John
--
whois [EMAIL PROTECTED]
--
SLUG - Sydney Linux Users Group Mailing List - http://www.slug.org.au
To unsubscribe send email to [EMAIL PROTECTED] with
unsubscribe in the text
