Is this indicative of an open relay?

mcleodnine · 06-25-2003, 02:08 AM

I'm running qmail, with the qmailqueue and logrelay patches. I noticed the following in the log files this evening

From smtpd logs...

Code:

2003-06-24 23:41:05.127333500 tcpserver: status: 1/20
2003-06-24 23:41:05.127540500 tcpserver: pid 2065 from 218.233.19.200
2003-06-24 23:41:05.177742500 tcpserver: ok 2065 mydomain.net:10.10.201.4:25 :218.233.19.200::4523
2003-06-24 23:41:07.732345500 tcpserver: end 2065 status 0
2003-06-24 23:41:07.732350500 tcpserver: status: 0/20

and from the qmail logs...

Code:

2003-06-24 23:41:07.535523500 new msg 34789
2003-06-24 23:41:07.535530500 info msg 34789: bytes 727 from <edu_web@returnmails.com> qp 2072 uid 1005
2003-06-24 23:41:07.556375500 starting delivery 283: msg 34789 to remote edu_test@hanmail.net
2003-06-24 23:41:07.556382500 status: local 0/10 remote 1/20
2003-06-24 23:41:25.865891500 delivery 283: success: 211.43.197.77_accepted_message./Remote_host_said:_250_2.0.0_h5P6f4tt011912_Message_accepted_for_delivery/
2003-06-24 23:41:25.865901500 status: local 0/10 remote 0/20
2003-06-24 23:41:25.865904500 end msg 34789

To me this looks like I've just been hopped on. I've tried a couple of different online open relay tests and both came out okay, but I can't figure out why this message seems to have been sent successfully.

unSpawn · 06-25-2003, 07:52 AM

A trace on the three addresses supplied shows they're in APNIC and IIRC all within the .kr TLD. Korean netblock owners are not that renowned for their good network management practices, innit?

but I can't figure out why this message seems to have been sent successfully.
Well, what anti-spam measures/reinforcements do you have in place in /var/qmail/control and/or tcp wrappers? Please FUP/Post the restrictions you set Qmail up with to the appropriate forum: Linux-networking.

Pcghost · 06-27-2003, 03:31 PM

I would suggest having your mail server tested for open relay by the ordb.org site. It will tell you for sure if you have a problem..

mcleodnine · 06-27-2003, 03:34 PM

Yep. did that recently and all seemed fine. The problems ocurred after a qmail-scanner install and was traced back to a missing "127." in my smtp rules. Must have looked at that file 20 times before someone else pointed out the mistake (thanks jer!).

lsimon4180 · 10-07-2004, 03:25 PM

hey mcleodnine,

I am having the same issue as you, what file did you have to make the change too and what did you actually change?

Thanks

Lenny

mcleodnine · 10-07-2004, 08:09 PM

Most qmail how-to's put something like this in their /etc/tcp.smtp

Code:

127.:allow,RELAYCLIENT=""