[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: How to close an open relay (exim3)?



Hello Mike,

thank you for your answer.

Am Samstag 29 Januar 2005 18:01 schrieb Miquel van Smoorenburg:
> In article <200501291350.49925.ggrubbish@web.de>,
>
> gerhard  <ggrubbish@web.de> wrote:
> >:Relay test: #Test 9
> > [...}
> ><<< 250 <nobody%mail-abuse.org@[213.6.36.105]> verified
> >
> >>>> QUIT
> >
> ><<< 221 debian closing connection
> >Tested host banner: 220 debian ESMTP Exim 3.36 #1 Fri, 28 Jan 2005
> >20:06:42 +0100
> >System appeared to accept 1 relay attempts
> >Connection closed by foreign host.
> >
> >does "System appeared to accept 1 relay attempts
> >Connection closed by foreign host." mean, that exim rejected the
> > mail internaly after accept it to relay the mail, or is my exim an
> > open relay (if the firewall isn't up).
>
> The former. The standard exim assumes "nobody%mail-abuse.org" is
> a so-called "local part" and the validity of local-parts is not
> tested at SMTP time with the default Debian config (which I
> think is the wrong default, but hey).
>
> Add this to the "main" part (first part) of you exim.conf file:
>
>         # Verify addresses in the SMTP stage
>         receiver_try_verify = true

  exim -bh 213.6.36.137
LOG: Exim configuration error
  "receiver_try_verify" option set for the second time in line 205

 grep -n receiver_try_verify /etc/exim/exim.conf
126:  receiver_try_verify = true
205:receiver_try_verify = true

So, I assume that I already used that option before.

> Restart exim, and test again. 

That's another strange behavior of /etc/init.d/exim on my box: It 
doesn't behave like expected. If I try it  without args there appears  
no help information. If I restart it exim can not be found by ps axu|
grep exim, and no notice is shown.

I use exim/testing uptodate 3.36-13 and the startscript is the ame as in 
the package (untouched). I use amavisd-new as transport.
amavisd-new/testing uptodate 20030616p10-5

> However the test may still 
> succeed if exim decides ggrubbish%web.de is actually
> a valid local address (as it seems to do based on the
> next test, below). No reason to panic.

Ok, I try to stay calm ;-)

> Well, you're not an open relay, your system simply accepted the
> message. Something in your local configuration (perhaps
> rewrite rules) makes exim decide that ggrubbish%web.de@[213.6.36.124]
> is a local address, to be delivered locally to ggrubbish.
>
> >Here is the header of the mail I received:
> >
> ><quote>
> >Return-path: <securitytest@abuse.net>
> > Envelope-to: ggrubbish%web.de@[213.6.36.124]
> > Received: from localhost
> > [...]
> >        for <ggrubbish%web.de@[213.6.36.124]>; Tue, 18 Jan 2005
> > 22:37:26
>
> Yup, not a relay (it's not getting sent _out_ again).
>
> Mike.
Thank you for pointing that out. Now I feel a bit more comfortable.

But there's another thing that appeared this afternoon while retesting 
the situation:

# exim -bh 172.181.203.112

**** SMTP testing session as if from host 172.181.203.112
**** Not for real!

>>> host in host_lookup? yes (*)
>>> looking up host name for 172.181.203.112
>>> IP address lookup yielded acb5cb70.ipt.aol.com
>>> host in host_reject? no (option unset)
>>> host in host_reject_recipients? no (option unset)
>>> host in rbl_hosts? yes (0.0.0.0/0)
>>> checking RBL domain blackholes.mail-abuse.org/reject
>>> RBL lookup for 112.203.181.172.blackholes.mail-abuse.org failed
>>> => that means it's not black listed at blackholes.mail-abuse.org
>>> checking RBL domain dialups.mail-abuse.org/reject
>>> RBL lookup for 112.203.181.172.dialups.mail-abuse.org failed
>>> => that means it's not black listed at dialups.mail-abuse.org
>>> checking RBL domain relays.mail-abuse.org/warn
>>> RBL lookup for 112.203.181.172.relays.mail-abuse.org failed
>>> => that means it's not black listed at relays.mail-abuse.org
>>> checking RBL domain rbl.mail-abuse.org/reject
>>> RBL lookup for 112.203.181.172.rbl.mail-abuse.org failed
>>> => that means it's not black listed at rbl.mail-abuse.org
>>> host in auth_hosts? no (option unset)
>>> host in sender_unqualified_hosts? no (option unset)
>>> host in receiver_unqualified_hosts? no (option unset)
>>> host in helo_verify? no (option unset)
>>> host in helo_accept_junk_hosts? no (option unset)
220 debian ESMTP Exim 3.36 #1 Sat, 29 Jan 2005 14:10:09 +0100
mail from: <spamtest@acb5cb70.ipt.aol.com>
>>> spamtest@acb5cb70.ipt.aol.com in sender_reject? no (option unset)
>>> spamtest@acb5cb70.ipt.aol.com in sender_reject_recipients? no 
(option unset)
250 <spamtest@acb5cb70.ipt.aol.com> is syntactically correct
rcpt to:<nobody%mail-abuse.org@[172.181.203.112]>
>>> [172.181.203.112] in local_domains? yes (matched [172.181.203.112])
>>> host in receiver_verify_hosts? yes (*)
>>> [172.181.203.112] in local_domains? yes (matched [172.181.203.112])
>>> [172.181.203.112] in percent_hack_domains? no (end of list)
>>> debian.workgroup.home in local_domains? yes (matched 
debian.workgroup.home)
>>> debian.workgroup.home in percent_hack_domains? no (end of list)
>>> debian.workgroup.home in local_domains? yes (matched 
debian.workgroup.home)
>>> debian.workgroup.home in percent_hack_domains? no (end of list)
250 <nobody%mail-abuse.org@[172.181.203.112]> verified
[waits for sth. a command I don't know (I'm not that good in SMTP) I 
tried ENTER]
500 Unrecognized command

I don't know how to close the session, but anyway:

I felt strange about the behavior of exim while I got a dial-up 
connection to compuserve/AOL.
Compuserve/AOL got an IP range from 172.128.0.0 to 172.191.255.255 
according to the whois database.
My local net got a range  172.16.0.0/24 thats right according to RFC 
1918 http://www.netzmafia.de/rfc/rfc/rfc1918.txt .

   The Internet Assigned Numbers Authority (IANA) has reserved the
   following three blocks of the IP address space for private internets:

     10.0.0.0        -   10.255.255.255  (10/8 prefix)
     172.16.0.0      -   172.31.255.255  (172.16/12 prefix)
     192.168.0.0     -   192.168.255.255 (192.168/16 prefix)

Extract from the 1st section of my exim.conf:

        rbl_hosts = !192.168.0.0/24:0.0.0.0/0
|---------------------------^^^^ ok should be  172.16.0.0/24, but 
because of that it's even stranger, that AOL IP's matches. 
        recipients_reject_except = postmaster@workgroup.home
        host_accept_relay = 127.0.0.1 : ::::1 : 172.16.240.0/24
|-----------------------------------------------------------^^^ here you 
can see explicit 172.16.240.0/24 and not that address range from AOL 
 172.128.0.0 - 172.191.255.255

Sorry, I don't understand that...

Thanks in advance

Kind regards

Gerhard Gaußling



Reply to: