LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 02-20-2005, 10:12 PM   #1
tangle
Senior Member
 
Registered: Apr 2002
Location: Arbovale, WV
Distribution: Slackware
Posts: 1,761

Rep: Reputation: 78
possible mail relay


I got this in my logs. I only relay to localhost and my domain. I am not running pop3. Does this this mean that someone relayed through my mail server?

Feb 20 22:18:43 srv1 sm-mta[22451]: j1L3IeRj022451: ruleset=check_rcpt,
arg1=fnlee11@hanmail.net, relay=[211.224.152.168], reject=550 5.7.1
fnlee11@hanmail.net... Relaying denied. IP name lookup failed [211.224.152.168]

Feb 20 22:18:43 srv1 sm-mta[22451]: j1L3IeRj022451: ruleset=check_rcpt,
arg1=fnlee11@hanmail.net, relay=[211.224.152.168], reject=550 5.7.1
fnlee11@hanmail.net... Relaying denied. IP name lookup failed [211.224.152.168]

Feb 20 22:18:43 srv1 sm-mta[22451]: j1L3IeRj022451: lost input channel from
[211.224.152.168] to MTA after rcpt

Feb 20 22:18:43 srv1 sm-mta[22451]: j1L3IeRj022451: from=w686560@weppy.com, size=0,
class=0, nrcpts=0, proto=SMTP, daemon=MTA, relay=[211.224.152.168]
 
Old 02-21-2005, 02:11 AM   #2
bathory
LQ Guru
 
Registered: Jun 2004
Location: Piraeus
Distribution: Slackware
Posts: 13,163
Blog Entries: 1

Rep: Reputation: 2032Reputation: 2032Reputation: 2032Reputation: 2032Reputation: 2032Reputation: 2032Reputation: 2032Reputation: 2032Reputation: 2032Reputation: 2032Reputation: 2032
Those logs mean that you're OK, since the "relay=[211.224.152.168]" tried to use your mail-server but failed with the "reject=550 5.7.1 fnlee11@hanmail.net... Relaying denied. IP name lookup failed "
You can also test your mail-server here to see if it passes all the relay tests.

Regards
 
Old 02-21-2005, 06:59 AM   #3
tangle
Senior Member
 
Registered: Apr 2002
Location: Arbovale, WV
Distribution: Slackware
Posts: 1,761

Original Poster
Rep: Reputation: 78
The only part I didn't understand was this.
Feb 20 22:18:43 srv1 sm-mta[22451]: j1L3IeRj022451: from=w686560@weppy.com, size=0,
class=0, nrcpts=0, proto=SMTP, daemon=MTA, relay=[211.224.152.168]

I seen where it dropped the other name, but this says nothing about a drop. I wasn't sure if they relayed through the server or not. So I shut it down and post here. Didn't want to be part of the spaml problem. Thanks
 
Old 02-23-2005, 04:41 PM   #4
bagira
LQ Newbie
 
Registered: Dec 2003
Location: Germany
Distribution: Gentoo
Posts: 27

Rep: Reputation: 15
I donīt know much about your mail server and the according logs, but j1L3IeRj022451 is the ID of the email and itīs always the same in your logs. I think thats only an entry to let you know, that the address 211.224.152.168 wanted to relay. Do you have sender verification turned on? What MTA do you use?
~bagira
 
Old 02-23-2005, 06:42 PM   #5
tangle
Senior Member
 
Registered: Apr 2002
Location: Arbovale, WV
Distribution: Slackware
Posts: 1,761

Original Poster
Rep: Reputation: 78
I am using Sendmail 8.12.11. I think that I had the verification turned off. So I edited the sendmail.mc say this:
dnl# EATURE(`accept_unresolvable_domains')dnl
This should turn it on, right?
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Using sendmail to relay mail to ISP mail server Swift&Smart Linux - Software 26 11-09-2008 03:00 PM
Postfix as a mail relay (getting relay access denied) hypexr Linux - Software 3 09-13-2005 07:15 PM
relay mail to sendmail relay server??? lemay_jeff Linux - Newbie 0 07-06-2004 04:54 PM
Mail Relay romel Debian 9 12-14-2003 11:28 PM
RH 9.0 MAil Relay clintonm9 Linux - Software 1 06-24-2003 07:54 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 12:39 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration