This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Mail Relay

My ISP is getting spam notices from SpamCop about my IP Address being an originator of spam. I am also getting failed bounce messages from orbz which means that they are tesing me for an open relay - I hope the bounces mean that they have failed.

Version of ASL 2.014 as of just now

I am using the SMTP proxy which is setup as follows:
Status : Green
Virus Protection : Green
Accept Incoming Domains : Two defined domains that I own internally
Mail Relay for : Single Defined Host only
SMTP Routes: Both domains routed to the Mail host on the LAN.

Packet Filet Rules:
Any SMTP External Interface Allow - although I believe that this is unrequired and have just removed it.

Is it unlikely that I am an open relay. People seem to think that I am. How do I check. I have from the outside world telnetted in on port 25 and tried to send mail - no luck. ASL refuses.

Any ideas / suggestions ?

Sean

[ 02 November 2001: Message edited by: NugentS ]

This thread was automatically locked due to age.

Parents

0 NugentS over 23 years ago

OK - further to this.

There does seem to be a problem - either with Astaro or with my setup.

A number of people are being spammed from my source IP address which I wasn't aware could be spoofed (but maybe someone can tell me differently). I'm going to set my smtp server to route via a different method and only accept incoming from my ISP but this doesn't/ won't solve the problem.

Is anyone aware of any exploits on the version of qmail that Astaro use?

Enclosed (hopefully) is one of several spamcop emails:

Sean

[I should add at this stage that I am not sending this SPAM - deliberately

- SpamCop V1.3.2 -
This message is brief for your comfort.  Please follow links for details.

http://spamcop.net/w3m?i=z44363619z1a7fb820add3de60a03897dac2f3bbdez
Email from 212.19.79.143 / Thu, 8 Nov 2001 04:04:45 +0100

Offending message:
Return-Path:
Received: from mx03.mrf.mail.rcn.net ([207.172.4.52] [207.172.4.52])
          by mta03.mrf.mail.rcn.net with ESMTP
          id ;
          Wed, 7 Nov 2001 21:13:56 -0500
Received: from mail.mnfl.lt ([212.122.65.37] helo=srv.office.mnfl.lt)
        by mx03.mrf.mail.rcn.net with esmtp (Exim 3.33 #10)
        id 161ehX-0000WH-00; Wed, 07 Nov 2001 21:13:55 -0500
Received: from mx1.mail.yahoo.com (212.19.79.143 [212.19.79.143]) by srv.office.mnfl.lt with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2650.21)

        id 42CWW3B7; Thu, 8 Nov 2001 04:04:45 +0100
Message-ID:
To:
From: fxtrader186@yahoo.com
Subject: Free Foreign Currency Newsletter
Date: Wed, 07 Nov 2001 18:08:44 -2000
MIME-Version: 1.0
Content-Type: text/html;
        charset="iso-8859-1"
Reply-To: fxtrader186@yahoo.com
X-Spam-Warning: This message was accepted from a host or IP address which
        is suspected of being used to distribute spam.  Please see
        http://www.mail.rcn.net/external/x-header/ for more information

Untitled Document

Volume Over 1.2 Trillion Dollars a Day

          Tap into the high-income
      opportunity
found in the World's largest financial
      market.

The Foreign Currency Markets

Discover how:

              $20,000 "properly positioned" in the Euro vs.
              the US Dollar,

              on 12/13/00 could have returned $70,000 on 1/03/01


Learn how successful professional traders assisting you can
              potentially achieve double-digit monthly returns of 10-30% or more!









For
              a Free Foreign Currency Trading Newsletter
              and a comprehensive report on the foreign currency markets.


Click
              on the link below.







Click Here







There is considerable
        exposure to risk in any Forex (FX) transaction. Before deciding to
        participate in FX trading,
you should carefully consider your
        objectives, level of experience and risk appetite. Most importantly
        don't invest money
you can't afford to
      lose.

If you are receiving this e-mail in error, we sincerely
      apologize. Simply click on Reply, and type Remove in the
      subject line. We Honor any and all Remove Requests. Any attempt to disable
      this Remove acct will only prevent others from being removed. Again, we
      apologize for any inconvenience and it wont happen again.

[ 08 November 2001: Message edited by: NugentS ]

Reply

0 NugentS over 23 years ago

Volume Over 1.2 Trillion Dollars a Day

          Tap into the high-income
      opportunity
found in the World's largest financial
      market.

The Foreign Currency Markets

Discover how:

              $20,000 "properly positioned" in the Euro vs.
              the US Dollar,

              on 12/13/00 could have returned $70,000 on 1/03/01


Learn how successful professional traders assisting you can
              potentially achieve double-digit monthly returns of 10-30% or more!









For
              a Free Foreign Currency Trading Newsletter
              and a comprehensive report on the foreign currency markets.


Click
              on the link below.







Click Here







There is considerable
        exposure to risk in any Forex (FX) transaction. Before deciding to
        participate in FX trading,
you should carefully consider your
        objectives, level of experience and risk appetite. Most importantly
        don't invest money
you can't afford to
      lose.

[ 08 November 2001: Message edited by: NugentS ]

Children

0 tom_01 over 23 years ago in reply to NugentS
hi nugents,

first of all, your ASL is NOT an open relay. I tested it myself:

You see that it won't accept mail for foreign domains. It can be temporarily fooled by the percent hack, due to the modular concept of qmail, but the delivery will fail later on.

The mail's header points to http://www.mail.rcn.net/external/x-header/, which descibes rcn.net's policey of using ORDB and SPEWS to mark mail as "possible spam".

Some user received such a mail and then contacted Spamcop.

But .... you are completely innocent. Proof follows.

Your IP has indeed been spoofed:

quote:

Received: from mx1.mail.yahoo.com (212.19.79.143 [212.19.79.143]) by srv.office.mnfl.lt with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2650.21)

This is a forged header line, because mx1.mail.yahoo.com resolves as:

... and NOT as 212.19.79.143 (your IP).

So:

A) Your ASL is perfectly safe. It was not even involved in the spamming.
B) Spamcop and/or ORDB and SPEWS are stupid.

C) some spammer picked your IP as a disguise.

have a nice day [:)]

/tom
Cancel
Vote Up 0 Vote Down

Cancel
0 tom_01 over 23 years ago in reply to tom_01
followup:

mail.mnfl.lt (aka srv.office.mnfl.lt, 212.122.65.37) is the REAL open relay:
Cancel
Vote Up 0 Vote Down

Cancel
0 NugentS over 23 years ago in reply to tom_01

Thank you. I have passed that on to my ISP. I guess there isn't a lot I can do about it.

Sean
Cancel
Vote Up 0 Vote Down

Cancel
0 NugentS over 23 years ago in reply to NugentS

Some more on this one. SpamCop still reckon its coming from me. I have reconfigured my email and firewall so that it only accepts email from my ISP who are relaying for me. However this isn't an ideal situation as the SMTP proxy is turned off at the moment and I am no longer Virus Scanning email (well I am - but not by ASL)

I have just asked my ISP wether they are still getting Spamcop reports - hopefully I'll get an answer soon.
No reports as yet - but I guess waiting till after the weekend is a good idea

The note below is the reponse from Spamcop to an email I sent them.

Any ideas ?

Sean
--------------------------------------------------
Subject: Re: With reference to IP address 212.19.79.143

> Not guilty.
>
> The spam is actually coming from 212.122.65.37 belonging to
> some Nordic bank. The IP address 212.19.79.143 is being spoofed.

Before passing trhough 212.122.65.37 it originated at 212.19.79.143. That's
precisely what the server at 212.122.65.37 is saying: received from
212.19.79.143.

> 212.19.79.143 does not run - and never will run an open
> relay. (I am the administrator & postmaster for the SMTP
> server on 212.19.79.143)

I believe you. Further, it has also been tested by ORBZ on Nov, 1 and they
found it closed. Anyway, this spam wasn't *relayed* by your server, it just
*originated* at its IP. Note there's no "Received: from ... by
asl.sendarian.co.uk" line that would have been written by your server if it
had actually relayed the message.

> [snip]
>
> "Received: from mx1.mail.yahoo.com (212.19.79.143
> [212.19.79.143]) by srv.office.mnfl.lt with SMTP (Microsoft
> Exchange Internet Mail Service Version 5.5.2650.21)"
>
> This is a forged header line, because mx1.mail.yahoo.com resolves as:

It's not a forged line. It's a valid line added by srv.office.mnfl.lt saying
it received the message from someone just *claiming* to be
mx1.mail.yahoo.com but who was actually at 212.19.79.143 (which has no
reverse DNS). That reference to mx1.mail.yahoo.com is just what the spammer
used as the HELO string while connecting to srv.office.mnfl.lt. He can use
whatever fake HELO string he wants, but the receiving server is saying the
connection was actually from 212.19.79.143. The fact that mx1.mail.yahoo.com
resolves to a different IP, doesn't mean the spam didn't originated at your
IP. It just means it didn't originated at yahoo. On the other hand, the
receiving server (srv.office.mnfl.lt) does know the true IP of the sending
machine, because the entire SMTP conversation is done over TCP/IP and every
received packet carries the IP of the sender, and that IP is also used when
sending packets back. That's why the HELO string used by the spammer (yahoo)
is totally irrelevant; the !
important thing is the IP address. Now, despite the fact that
srv.office.mnfl.lt is an open relay, it does accurately report the IP
address of the sending machine, as you can confirm looking at the headers of
the following test:
http://ordb.org/lookup/?host=212.122.65.37

So, the spam did originate at your IP 212.19.79.143

> [snip]
> Not only that but the smtp relay server on that address is
> qmail and certainly not Exchange 5.5

Yes, nobody said the yahoo server was running Exchange. srv.office.mnfl.lt
was the one writing that line and running Exchange.

I guess you are now wondering how the spammer managed to send his spam using
your IP. I'm afraid the answer is that there's a security hole in your
network and some spammer exploited or is still exploiting it. That's the
lattest spammers trick.

Please look at the following URLs from our FAQ, related to the many ways the
spammers have been found hijacking innocent machines.

"I'm receiving spam reports, but my mail server logs don't reflect it. Why?"

http://spamcop.net/fom-serve/cache/183.html

"HTTP Proxies"
http://spamcop.net/fom-serve/cache/269.html

"Formmail"
http://spamcop.net/fom-serve/cache/270.html

"SOCKS Proxy Servers"
http://spamcop.net/fom-serve/cache/278.html

I hope the above information helps you resolve this situation, but please
let us know if you think we can be of further assistance.

Best regards,

[ 15 November 2001: Message edited by: NugentS ]
Cancel
Vote Up 0 Vote Down

Cancel
0 spike_01 over 23 years ago in reply to NugentS

Hi,

I'm getting problems from Orbz also, proxying from latest up2date to my sendmail server.

I'm getting damn frustrated with them as I can't get email to some important clients and can't contact them to discuss.

Spamcorp say I am clean, orbz insists I am both an input and output relay.

Any suggestions? I can supply details if requested.
Cancel
Vote Up 0 Vote Down

Cancel