Date: Mon, 04 Jan 2010 14:21:39 +0000 From: Matthew Seaman <m.seaman@infracaninophile.co.uk> To: Peter Ulrich Kruppa <ulrich@pukruppa.net> Cc: FreeBsd-Questions <freebsd-questions@freebsd.org> Subject: Re: sendmail: open-relay Message-ID: <4B41F973.4040101@infracaninophile.co.uk> In-Reply-To: <1262613595.9547.28.camel@pukruppa.net> References: <1262613595.9547.28.camel@pukruppa.net>
next in thread | previous in thread | raw e-mail | index | archive | help
This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enig70C7DA4B261863B94BFF45F7
Content-Type: text/plain; charset=ISO-8859-15; format=flowed
Content-Transfer-Encoding: quoted-printable
Peter Ulrich Kruppa wrote:
> Am Montag, den 04.01.2010, 13:45 +0000 schrieb Matthew Seaman:=20
>> Matthew Seaman wrote:
>>
>>> find the records in /var/mail/maillog to show abuse.net's server
>> connecting
>>
>> Ooops. /var/log/maillog
>>
> That would be those:
> --------------------------------------------
>> cat maillog | grep "abuse.net"
> Jan 4 12:26:46 pukruppa sm-mta[8964]: o04BQi0O008964:
> from=3D<prvs=3D0613aad273=3Dpostmaster-ulrich=3Dpukruppa.net@abuse.net>=
,
> size=3D333, class=3D0, nrcpts=3D1,
> msgid=3D<20100104112454.38321.qmail@gal.iecc.com>, proto=3DESMTP,
> daemon=3DIPv4, relay=3Dgal.iecc.com [208.31.42.53]
> Jan 4 12:32:12 pukruppa sm-mta[10672]: o04BWBOA010672:
> from=3D<spamtest@abuse.net>, size=3D909, class=3D0, nrcpts=3D1,
> msgid=3D<rlytest-1262604620-41202@abuse.net>, proto=3DSMTP, daemon=3DIP=
v4,
> relay=3Dverify.abuse.net [208.31.42.77]
> Jan 4 12:33:00 pukruppa spamd[1650]: spamd: checking message
> <rlytest-1262604620-41202@abuse.net> for ulrich:1001=20
> Jan 4 12:33:03 pukruppa spamd[1650]: spamd: result: . -4 -
> BAYES_50,FH_DATE_PAST_20XX,RCVD_IN_DNSWL_HI
> scantime=3D3.4,size=3D1231,user=3Dulrich,uid=3D1001,required_score=3D5.=
0,rhost=3Dlocalhost,raddr=3D127.0.0.1,rport=3D28691,mid=3D<rlytest-126260=
4620-41202@abuse.net>,bayes=3D0.486826,autolearn=3Dham=20
> Jan 4 13:28:39 pukruppa sm-mta[56503]: o04CSb9P056503:
> from=3D<spamtest@abuse.net>, size=3D909, class=3D0, nrcpts=3D1,
> msgid=3D<rlytest-1262608007-71317@abuse.net>, proto=3DSMTP, daemon=3DIP=
v4,
> relay=3Dverify.abuse.net [208.31.42.77]
> Jan 4 13:29:20 pukruppa spamd[1650]: spamd: checking message
> <rlytest-1262608007-71317@abuse.net> for ulrich:1001=20
> Jan 4 13:29:24 pukruppa spamd[1650]: spamd: result: . -6 -
> AWL,BAYES_00,FH_DATE_PAST_20XX,RCVD_IN_DNSWL_HI
> scantime=3D3.4,size=3D1231,user=3Dulrich,uid=3D1001,required_score=3D5.=
0,rhost=3Dlocalhost,raddr=3D127.0.0.1,rport=3D21436,mid=3D<rlytest-126260=
8007-71317@abuse.net>,bayes=3D0.000000,autolearn=3Dham=20
> Jan 4 13:35:47 pukruppa sm-mta[58137]: o04CZkfq058137:
> from=3D<spamtest@abuse.net>, size=3D909, class=3D0, nrcpts=3D1,
> msgid=3D<rlytest-1262608435-75287@abuse.net>, proto=3DSMTP, daemon=3DIP=
v4,
> relay=3Dverify.abuse.net [208.31.42.77]
> Jan 4 13:39:20 pukruppa spamd[1650]: spamd: checking message
> <rlytest-1262608435-75287@abuse.net> for ulrich:1001=20
> Jan 4 13:39:24 pukruppa spamd[1650]: spamd: result: . -6 -
> AWL,BAYES_00,FH_DATE_PAST_20XX,RCVD_IN_DNSWL_HI
> scantime=3D4.1,size=3D1231,user=3Dulrich,uid=3D1001,required_score=3D5.=
0,rhost=3Dlocalhost,raddr=3D127.0.0.1,rport=3D24280,mid=3D<rlytest-126260=
8435-75287@abuse.net>,bayes=3D0.000000,autolearn=3Dham=20
> Jan 4 14:27:59 pukruppa sm-mta[87839]: o04DRvKd087839:
> from=3D<spamtest@abuse.net>, size=3D906, class=3D0, nrcpts=3D1,
> msgid=3D<rlytest-1262611567-9843@abuse.net>, proto=3DSMTP, daemon=3DIPv=
4,
> relay=3Dverify.abuse.net [208.31.42.77]
> Jan 4 14:29:27 pukruppa spamd[1650]: spamd: checking message
> <rlytest-1262611567-9843@abuse.net> for ulrich:1001=20
> Jan 4 14:29:30 pukruppa spamd[1650]: spamd: result: . -6 -
> AWL,BAYES_00,FH_DATE_PAST_20XX,RCVD_IN_DNSWL_HI
> scantime=3D3.1,size=3D1227,user=3Dulrich,uid=3D1001,required_score=3D5.=
0,rhost=3Dlocalhost,raddr=3D127.0.0.1,rport=3D27859,mid=3D<rlytest-126261=
1567-9843@abuse.net>,bayes=3D0.000000,autolearn=3Dham=20
> ----------------------------------------------------------
>=20
> BTW. I have read somewhere, there might be problems with hostnames like=
> pukruppa.net, since they would allow to relay all mails from .net ?!?
>=20
Something doesn't add up here -- the log shows the message being processe=
d
by SpamAssassin, but there was no indication in the sendmail .mc file you=
showed us of any integration with a spam filter. I'd expect some sort of=
milter configuration.
Unfortunately as well, the log line showing the delivery result is usuall=
y
one of the ones *following* the line showing the external MTA handing off=
the message to you. Try grepping for the sendmail queue IDs:
o04BQi0O008964
o04BWBOA010672
o04CSb9P056503
o04CZkfq058137
etc.
The lines that say 'dsn=3D<something>' are the important bits. If <somet=
hing>=20
is 2.0.0 (ie. successful delivery) then you've got a real problem. The r=
esult
should be 5.x.y (ie. permanent failure) and a snotty message about 'relay=
ing denied'.
Cheers,
Matthew
btw. you need to update your SpamAssassin rules -- you're triggering=20
on the FH_DATE_PAST_20XX test all the time, which will give you some fals=
e
positives.
--=20
Dr Matthew J Seaman MA, D.Phil. 7 Priory Courtyard
Flat 3
PGP: http://www.infracaninophile.co.uk/pgpkey Ramsgate
Kent, CT11 9PW
--------------enig70C7DA4B261863B94BFF45F7
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (FreeBSD)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEYEAREIAAYFAktB+XgACgkQ8Mjk52CukIyhrgCfTiXhS5Ur8s6Hrs+NLU8UuOXC
KmkAnjxA9tQsjEyU25qbNtUDHFQs/NsV
=0K4l
-----END PGP SIGNATURE-----
--------------enig70C7DA4B261863B94BFF45F7--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4B41F973.4040101>