all groups > iis smtp nntp > april 2006 >
You're in the

iis smtp nntp

group:

smtp log shows unauthorized activity


smtp log shows unauthorized activity deciacco
4/27/2006 4:37:10 PM
iis smtp nntp:
I setup Windows 2003 server as a mail server with pop and smtp
services. Smtp is setup with anonymous access and integrated win auth.
Relay is set to Only list below (with an empty list) and allow all
computers which succ. auth to relay regardless of the list. I've set
my logging to hourly so i can better monitor the activity. I haven't
been using the server so I can see what happends. It hasn't happend
often but I have gotten a few log files with activity. So this leads me
to belive that the server is relaying even if not supposed to. Here is
what one log files looks like:

203.67.89.208 0 HELO - +<<myip>> 250 0 33 18 0
203.67.89.208 0 MAIL - +FROM:+<eiwueirw@msa.hinet.net> 250 0 47 35 0
203.67.89.208 0 RCPT - +TO:+<uu1553@so-net.net.tw> 550 0 52 31 0
203.67.89.208 0 QUIT - <<myip>> 240 1421 52 31 343

Trying to figure out what I can do to fix this.

Any suggestions?
Re: smtp log shows unauthorized activity PL
4/29/2006 6:18:53 PM

Check "Allow only list below" and UNCHECK "Allow all computers which
successfully authenticate to relay regardless of the list".

PL.


"deciacco" <eugenio@iatmgu.com> skrev i meddelandet
news:1146181030.431030.51880@v46g2000cwv.googlegroups.com...
[quoted text, click to view]

Re: smtp log shows unauthorized activity Johan Karl Larsen
4/30/2006 12:48:00 PM
There is nothing to fix :-)

From the log entries it is clear that 203.67.89.208 did not manage to relay
because the RCPT command gave a 550 error in return. Also, there is no DATA
command present between RCPT and QUIT, hence, no mail was sent. Looks like
you got a visit from a compromised machine or 13-year-old script kiddie
looking for open relays.

Correct netiquette would be to (...yawn...):
1. Complain to owner of network 203.67.89.208
2. Tell postmaster of so-net.net.tw to close down account uu1553

If you lookup the ip at
http://openrbl.org/client/#203.67.89.208
you will see that he (or his ip range) has been listed in different
blackholes/lists whatever.

If you want to block listed ip's from sending mail to your server use a tool
like Open Relay Filter
http://martijnjongen.com/Default.aspx?tabid=27

--
Johan

[quoted text, click to view]

Re: smtp log shows unauthorized activity jeff.nospam NO[at]SPAM zina.com
5/1/2006 10:42:42 AM
[quoted text, click to view]

Block all IP ranges assigned to the TW TLD. Assuming you have no
reason to expect legitimate mail from Taiwan.

AddThis Social Bookmark Button