You are viewing a plain text version of this content. The canonical link for it is here.
Posted to server-user@james.apache.org by Stefano Bagnara <ap...@bago.org> on 2008/11/01 18:45:32 UTC
Re: Current abuse of James 2.3.0 as open relay
Tor-Einar Jarnbjo ha scritto:
> The connections causing the spam hickup this week were _not_
> authenticated, or at least James did not log any authentication attempt:
>
> 27/10/08 13:14:17 INFO smtpserver: Connection from
> wvps212-241-x-y.vps.webfusion.co.uk (212.241.x.y)
> 27/10/08 13:14:18 INFO smtpserver: Successfully spooled mail
> Mail1225109658790-1134809 from ...@abbey.co.uk on 212.241.x.y for
> [...@telewest.co.uk, ...@yahoo.co.uk, ...@backhome.co.uk,
> ...@yahoo.co.uk, ...@ukonline.co.uk, ...@ukonline.co.uk,
> ...@headboy.co.uk, ...@esc.cam.ac.uk, ...@europoint.co.uk,
> ...@telewest.co.uk, ...@4thenet.co.uk, ...@telewest.co.uk,
> ...@yahoo.co.uk, ...@yahoo.co.uk, ...@esc.cam.ac.uk,
> ...@blueyonder.co.uk, ...@blueyonder.co.uk, ...@doctors.net.uk,
> ...@doctors.org.uk, ...@grim.abel.co.uk]
>
> To me, it looks very much as if James is actually accepting to relay
> these messages without authentication, although the config file
> indicates that it shouldn't.
>
> Tor
Have you tried to reproduce the same FROM/TO in an SMTP conversation
originated remotely to see if JAMES replies you what you expect?
Stefano
---------------------------------------------------------------------
To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
For additional commands, e-mail: server-user-help@james.apache.org
Re: Current abuse of James 2.3.0 as open relay
Posted by David Legg <da...@searchevent.co.uk>.
I guess the only way to be sure of what is going on is to capture the
complete network conversation that goes on when this address connects...
but I don't know what tools you could use for that. Switching all the
logging to debug would create a lot of unusable output.
I presume you have a firewall in place that only opens the bare minimum
of ports to the outside world? I would hope that the manager port is
not open for example.
David Legg
---------------------------------------------------------------------
To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
For additional commands, e-mail: server-user-help@james.apache.org
Re: Current abuse of James 2.3.0 as open relay
Posted by Tor-Einar Jarnbjo <to...@jarnbjo.name>.
Stefano Bagnara schrieb:
> Did you get thousands of unathorized "relay" like in June?
>
It was similar. The spammer managed to deliver about 100.000 mails, of
which 60.000 were forwarded and 40.000 left in the spool because of the
recipients mail server not accepting the mail for some reason.
> Did they originated from a single IP? Did it successfully sent ALL mails
> or first started with some failure? Does it connect with multiple
> connections or a single connection?
>
All mails originated from the same IP, there were no errors to start
with (as I experienced in June) and the mails were sent using different
SMTP connections. I think without exception, the client connected, sent
one message to 20 different recipients, disconnected and repeated this
procedure about 5000 times with some breaks over a period of 24 hours.
Tor
---------------------------------------------------------------------
To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
For additional commands, e-mail: server-user-help@james.apache.org
Re: Current abuse of James 2.3.0 as open relay
Posted by Stefano Bagnara <ap...@bago.org>.
Tor-Einar Jarnbjo ha scritto:
> Stefano Bagnara schrieb:
>> Have you tried to reproduce the same FROM/TO in an SMTP conversation
>> originated remotely to see if JAMES replies you what you expect?
>>
>
> Hi Stefano,
> yes I have. It answers with:
>
> 530 5.7.1 Authentication Required
>
> Regards,
> Tor
Did you get thousands of unathorized "relay" like in June?
Did they originated from a single IP? Did it successfully sent ALL mails
or first started with some failure? Does it connect with multiple
connections or a single connection?
Stefano
---------------------------------------------------------------------
To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
For additional commands, e-mail: server-user-help@james.apache.org
Re: Current abuse of James 2.3.0 as open relay
Posted by Tor-Einar Jarnbjo <to...@jarnbjo.name>.
Stefano Bagnara schrieb:
> Have you tried to reproduce the same FROM/TO in an SMTP conversation
> originated remotely to see if JAMES replies you what you expect?
>
Hi Stefano,
yes I have. It answers with:
530 5.7.1 Authentication Required
Regards,
Tor
---------------------------------------------------------------------
To unsubscribe, e-mail: server-user-unsubscribe@james.apache.org
For additional commands, e-mail: server-user-help@james.apache.org