My server is possibly relaying spam

This topic is empty.

Viewing 3 posts - 1 through 3 (of 3 total)

Author

Posts
November 30, 2005 at 1:54 pm #364244
Anonymous
Guest
On a newly installed Tiger Server (10.4.3) I’m getting a lot of spam addressed to other servers. The domain is litoscan.com. For example, this e-mail header:
```
Return-Path: <yaqf@rbc.ru>
Received: from murder ([unix socket])
	 by litoscan.com (Cyrus v2.2.12-OS X 10.4.0) with LMTPA;
	 Wed, 30 Nov 2005 04:32:02 +0300
X-Sieve: CMU Sieve 2.2
Received: from localhost (localhost [127.0.0.1])
	by litoscan.com (Postfix) with ESMTP id 8F4F327920;
	Wed, 30 Nov 2005 04:32:01 +0300 (MSK)
Received: from litoscan.com ([127.0.0.1])
 by localhost (LitoscanServer.local [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id 08096-02; Wed, 30 Nov 2005 04:32:00 +0300 (MSK)
Received: from cust228.ap1s1.lucs3tx.dfwair.net (cust228.ap1s1.lucs3tx.dfwair.net [63.249.41.228])
	by litoscan.com (Postfix) with SMTP id BC1AC27915;
	Wed, 30 Nov 2005 04:31:57 +0300 (MSK)
Message-ID: <0a1501c5f537$82e99640$0f0e0d0c@vovan>
From: =?koi8-r?B?4ffp4SD2L+Qg9PXy6frt?= <mahwopc@rbc.ru>
To: <iq@wazzup.ru>
Subject: =?koi8-r?B?5cjB1Ngg7MXUxdTYIO/UxNnIwdTY?=
Date: Tue, 29 Nov 2005 20:29:53 -0500
MIME-Version: 1.0
Content-Type: multipart/related;
 type="multipart/alternative";
 boundary="----=_NextPart_000_0A11_01C5F550.A817D490"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1437
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441
```
All I can understand is that the e-mail is addressed to iq@wazzup.ru. I can’t understand why my mail server has accepted the message, not to mention that the domain wazzup.ru doesn’t seem to exist at all. I have only 2 records in the “Accept SMTP relays only from these” list: 127.0.0.1/32 and 192.168.10.1/24, the latter being the LAN address range. Do spammers spoof their IP so that the server thinks the messages come from LAN or itself? Can I delete both entries safely without breaking something? Can it be so that the server is relaying the spam?

Any help/advice appreciated. Thanks in advance.
December 1, 2005 at 7:21 am #364262

Anonymous
Guest

Thanks, MacTroll. I’m afraid my emotions overcame my English.

MacTroll wrote:

You’re the final destination for litoscan.com, Yes, as it was intended.

as such any mail for litoscan.com will be accepted by your server.

Good. We need exactly that. The questions is as follows. The e-mail header I quoted above suggests (I may be wrong here, actually) that the message arrived from some cust228.ap1s1.lucs3tx.dfwair.net to iq@wazzup.ru. wazzup.ru is not our domain and dig wazzup.ru does not return anything useful, which makes me think it doesn’t exist at all. All I want is not to receive mail for fake or wrong domains; all I want is mail for litoscan.com. Now I think I misconfigured something since our server accepted mail for a fake domain. The real question is how I can correct that.

If you don’t want this to happen the easiest way would be to use your firewall to block connections on port 25 from anything but the 2 servers you want to accept from.

I’m not even sure that I need 127.0.0.1/32 and 192.168.10.1/24 in the “Accept SMTP relays only from these” list. Our needs are standard: we want to receive all mail from the Internet addressed to our domain (litoscan.com) and only for our domain. We also want to send mail from our LAN through our mail server. I enabled our mail server to require SMTP authentication – can I delete our LAN network addresses from the relay list? What if I delete 127.0.0.1 too? Will that break anything, like our mail server sending report messages to itself for the admin?

December 1, 2005 at 9:48 am #364264

Anonymous
Guest

Thanks a lot! I feel better now 😀
Author

Posts

Viewing 3 posts - 1 through 3 (of 3 total)

You must be logged in to reply to this topic.