topic Re: How can I tell if my system is being used to relay email? in Operating System - Linux

How can I tell if my system is being used to relay email?

Paul Mancillas — Tue, 08 Oct 2002 14:01:06 GMT

I checked the /var/log/maillog file and I can see several "from=" entries with user names on my system that should not be sending email out from my system. There is also a "relay=" entry on the same line that refers to a domain other than mine. Does this mean that someone is using my system as a mail relay? If so, then how can I stop this? I'm using sendmail 8.9.3 on a Red Hat 6.1 system.

Thanks,

Paul Mancillas

Re: How can I tell if my system is being used to relay email?

Roberto_30 — Tue, 08 Oct 2002 14:39:36 GMT

You have the ability to control who you allow to relay from your machine. By configuring your machine to use promiscuous relaying, you allow anyone to use your machine as relay. To enable promiscuous relaying configure the etc/mail/sendmail.mc by appending the following line:
FEATURE(promiscuous_relay)dnl

To disable promiscuous relaying configure the etc/mail/sendmail.mc by removing the following line:
FEATURE(promiscuous_relay)dnl

To allow relayn from a specific host, domain, or network, edit /etc/mail/access and add an entry to permit this.
Then restart sendmail.

Hope this can help you.
Roberto

Re: How can I tell if my system is being used to relay email?

U.SivaKumar_2 — Thu, 10 Oct 2002 03:13:24 GMT

Hi,
It is ok that
The remote mail servers will be refered in the
relay= parameter in maillog

If you are interested in checking whether your
mail server is a open relay . Do this

Open telnet port in firewall for your mail server.

Then.

#telnet relay-test.mail-abuse.org

Wait for 10 minutes , it will give you the results.

regards,
U.SivaKumar

Re: How can I tell if my system is being used to relay email?

Balaji N — Mon, 14 Oct 2002 02:29:00 GMT

Alternatively, just visit the following URL and give your mail server address

http://www.abuse.net/relay.html

hth
-balaji

Re: How can I tell if my system is being used to relay email?

Chan Choth PUTH — Fri, 15 Nov 2002 09:33:47 GMT

Dear U.SivaKumar,

When I try to telnet:
$ telnet relay-test.mail-abuse.org
I have got the following:
Trying 204.152.187.123...
telnet: connect to address 204.152.187.123: No route to host
What's happen?

Thanks,

Choth

Re: How can I tell if my system is being used to relay email?

U.SivaKumar_2 — Fri, 15 Nov 2002 10:07:13 GMT

Welcome my old friend choth,

Have you opened outgoing telnet port in your firewall ?.

regards,
U.SivaKumar

Re: How can I tell if my system is being used to relay email?

U.SivaKumar_2 — Fri, 15 Nov 2002 10:10:53 GMT

Also can you reach internet from this mail server ?

Have you got default gateway as internet gateway or your firewall

regards,
U.SivaKumar