Anti-Spam SMTP Proxy Server

smtp auth?  they're using known credentials?

adamc

-----Original Message-----
From: Phil Cook [mailto:philc@...] 
Sent: Tuesday, June 22, 2010 1:48 PM
To: assp-user@...
Subject: [Assp-user] Need help

I have someone who is relaying thru my server and for the life of me I can't
figure out how. Here is the log line:

Jun-14-10 07:06:08 17138-11328 [Local] 93.174.88.178 <notefy@...>
to: engleesq0410@... local --  --  [Your craiglist account is
temporarily suspended] -> ./notspam/11328.eml

That ip is not Local to us, so why is assp thinking it is?


----------------------------------------------------------------------------
--
ThinkGeek and WIRED's GeekDad team up for the Ultimate 
GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the 
lucky parental unit.  See the prize list and enter to win: 
http://p.sf.net/sfu/thinkgeek-promo
_______________________________________________
Assp-user mailing list
Assp-user@...
https://lists.sourceforge.net/lists/listinfo/assp-user

Do you use 

Relay Port (relayPort) ?

Note that you'll want to keep the relayPort protected from external
access by your firewall.

In newer versions you can protect this with
 
->Allow Relay Connection from these IPs* (allowRelayCon)
Enter any addresses that are allowed to use the relayPort , separated
by pipes (|). If empty, any ip address is allowed to connect to the
relayPort. If this option is defined, keep in mind : Addresses defined
in acceptAllMail are NOT automaticly included and have to be also
defined here, if they should be allowed to use the relayPort. For
example: 127.0.0.1|172.16..

> That ip is not Local to us, so why is assp thinking it is?

stolen credentials

Is there a way for ASSp to log the username sent when smtp-auth is used?

On Tue, Jun 22, 2010 at 4:13 PM, Grayhat <grayhat@...> wrote:

>
> > That ip is not Local to us, so why is assp thinking it is?
>
> stolen credentials
>
>
>
> ------------------------------------------------------------------------------
> ThinkGeek and WIRED's GeekDad team up for the Ultimate
> GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the
> lucky parental unit.  See the prize list and enter to win:
> http://p.sf.net/sfu/thinkgeek-promo
> _______________________________________________
> Assp-user mailing list
> Assp-user@...
> https://lists.sourceforge.net/lists/listinfo/assp-user
>

On 2010-06-22 4:43 PM, K Post wrote:
> Is there a way for ASSp to log the username sent when smtp-auth is used?

That would (should) be in your MTA logs.

ASSP doesn't have to reproduce every wheel...

-- 

Best regards,

Charles

I agree that it doesn't HAVE to do everything.  It works great as is.

What I was asking is if it does have a way to do simply stick the smtp-auth
username in the log.  That would help diagnose this problem for the OP
without having to check the MTA which may or may not have that logged.





On Wed, Jun 23, 2010 at 6:52 AM, Charles Marcus
<CMarcus@...:

> On 2010-06-22 4:43 PM, K Post wrote:
> > Is there a way for ASSp to log the username sent when smtp-auth is used?
>
> That would (should) be in your MTA logs.
>
> ASSP doesn't have to reproduce every wheel...
>
> --
>
> Best regards,
>
> Charles
>
>
> ------------------------------------------------------------------------------
> ThinkGeek and WIRED's GeekDad team up for the Ultimate
> GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the
> lucky parental unit.  See the prize list and enter to win:
> http://p.sf.net/sfu/thinkgeek-promo
> _______________________________________________
> Assp-user mailing list
> Assp-user@...
> https://lists.sourceforge.net/lists/listinfo/assp-user
>

On 2010-06-23 2:24 PM, K Post wrote:
> What I was asking is if it does have a way to do simply stick the smtp-auth
> username in the log.  That would help diagnose this problem for the OP
> without having to check the MTA which may or may not have that logged.

If the MTA doesn't log it then the MTA's logging is broken.

-- 

Best regards,

Charles

>If the MTA doesn't log it then the MTA's logging is broken.
Or it's not set to log

Or it's on a different system and the assp admin doesn't have access to it
(this was the case back in the day when I was in the corporate world)

Broken or not, all I'm saying is that it would be easier to track this
specific problem if there is a way for ASSP to log this stuff itself.  Enter
the message ID in the maillog page and poof you've got your answer as to
what username was used.

I am NOT suggesting that it should be implemented, I'm wondering if it is.

On 2010-06-23 3:40 PM, K Post wrote:
>> If the MTA doesn't log it then the MTA's logging is broken.

> Or it's not set to log

In which case it would be broken. An MTA that doesn't log enough useful
information to troubleshoot basic problems has broken logging, ven if it
is intentional.

> Or it's on a different system and the assp admin doesn't have access to it
> (this was the case back in the day when I was in the corporate world)

Different situation, and admittedly one use case where it might be nice
to have this available in the ASSP logs. I wonder how common this is.

> Broken or not, all I'm saying is that it would be easier to track this
> specific problem if there is a way for ASSP to log this stuff itself.  Enter
> the message ID in the maillog page and poof you've got your answer as to
> what username was used.
> 
> I am NOT suggesting that it should be implemented, I'm wondering if it is.

Understood...

It's all probably moot anyway - if the methane gas pocket in the Gulf
explodes, which it appears it will, it will kill millions within
minutes, and the rest of the world within probably a few months due to
the ocean providing 80% of our oxygen, and when it dies - which it will
if this happens - we die.

Well, it was a nice ride...

-- 

Best regards,

Charles

Is there any way that ASSP can be coded to provide oxygen or does it do this
already?

On 2010-06-23 4:53 PM, K Post wrote:
> Is there any way that ASSP can be coded to provide oxygen or does it do this
> already?

lol... or at least it would be funny if it wasn't so pathetically serious...