sendmail: open-relay

[Peter Ulrich Kruppa]

Am Montag, den 04.01.2010, 13:45 +0000 schrieb Matthew Seaman: 
> Matthew Seaman wrote:
> 
> > find the records in /var/mail/maillog to show abuse.net's server
> connecting
> 
> Ooops.                /var/log/maillog
> 
That would be those:
--------------------------------------------
> cat maillog | grep "abuse.net"
Jan  4 12:26:46 pukruppa sm-mta[8964]: o04BQi0O008964:
from=<prvs=0613aad273=postmaster-ulrich=pukruppa.net at abuse.net>,
size=333, class=0, nrcpts=1,
msgid=<20100104112454.38321.qmail at gal.iecc.com>, proto=ESMTP,
daemon=IPv4, relay=gal.iecc.com [208.31.42.53]
Jan  4 12:32:12 pukruppa sm-mta[10672]: o04BWBOA010672:
from=<spamtest at abuse.net>, size=909, class=0, nrcpts=1,
msgid=<rlytest-1262604620-41202 at abuse.net>, proto=SMTP, daemon=IPv4,
relay=verify.abuse.net [208.31.42.77]
Jan  4 12:33:00 pukruppa spamd[1650]: spamd: checking message
<rlytest-1262604620-41202 at abuse.net> for ulrich:1001 
Jan  4 12:33:03 pukruppa spamd[1650]: spamd: result: . -4 -
BAYES_50,FH_DATE_PAST_20XX,RCVD_IN_DNSWL_HI
scantime=3.4,size=1231,user=ulrich,uid=1001,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=28691,mid=<rlytest-1262604620-41202 at abuse.net>,bayes=0.486826,autolearn=ham 
Jan  4 13:28:39 pukruppa sm-mta[56503]: o04CSb9P056503:
from=<spamtest at abuse.net>, size=909, class=0, nrcpts=1,
msgid=<rlytest-1262608007-71317 at abuse.net>, proto=SMTP, daemon=IPv4,
relay=verify.abuse.net [208.31.42.77]
Jan  4 13:29:20 pukruppa spamd[1650]: spamd: checking message
<rlytest-1262608007-71317 at abuse.net> for ulrich:1001 
Jan  4 13:29:24 pukruppa spamd[1650]: spamd: result: . -6 -
AWL,BAYES_00,FH_DATE_PAST_20XX,RCVD_IN_DNSWL_HI
scantime=3.4,size=1231,user=ulrich,uid=1001,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=21436,mid=<rlytest-1262608007-71317 at abuse.net>,bayes=0.000000,autolearn=ham 
Jan  4 13:35:47 pukruppa sm-mta[58137]: o04CZkfq058137:
from=<spamtest at abuse.net>, size=909, class=0, nrcpts=1,
msgid=<rlytest-1262608435-75287 at abuse.net>, proto=SMTP, daemon=IPv4,
relay=verify.abuse.net [208.31.42.77]
Jan  4 13:39:20 pukruppa spamd[1650]: spamd: checking message
<rlytest-1262608435-75287 at abuse.net> for ulrich:1001 
Jan  4 13:39:24 pukruppa spamd[1650]: spamd: result: . -6 -
AWL,BAYES_00,FH_DATE_PAST_20XX,RCVD_IN_DNSWL_HI
scantime=4.1,size=1231,user=ulrich,uid=1001,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=24280,mid=<rlytest-1262608435-75287 at abuse.net>,bayes=0.000000,autolearn=ham 
Jan  4 14:27:59 pukruppa sm-mta[87839]: o04DRvKd087839:
from=<spamtest at abuse.net>, size=906, class=0, nrcpts=1,
msgid=<rlytest-1262611567-9843 at abuse.net>, proto=SMTP, daemon=IPv4,
relay=verify.abuse.net [208.31.42.77]
Jan  4 14:29:27 pukruppa spamd[1650]: spamd: checking message
<rlytest-1262611567-9843 at abuse.net> for ulrich:1001 
Jan  4 14:29:30 pukruppa spamd[1650]: spamd: result: . -6 -
AWL,BAYES_00,FH_DATE_PAST_20XX,RCVD_IN_DNSWL_HI
scantime=3.1,size=1227,user=ulrich,uid=1001,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=27859,mid=<rlytest-1262611567-9843 at abuse.net>,bayes=0.000000,autolearn=ham 
----------------------------------------------------------

BTW. I have read somewhere, there might be problems with hostnames like
pukruppa.net, since they would allow to relay all mails from .net ?!?

Greetings

Uli.

> 	Cheers,
> 
> 	Matthew
> 
>