smtp relay issue

[Rosli Ahmad]

I've ran ISS in preparing for an audit and received the following warning:

smtprelay: Third-party mail relaying can be used to obfuscate the origin of emails. Some SMTP servers support third-party or %style mail relaying. Third-party mail relaying occurs when a mail server processes a mail
message where neither the sender nor the recipient is local to the server's
mail domain.
While third party relaying has some legitimate purposes, such as allowing mail messages to be routed around known mail problems, email
hijackers (or spammers) primarily use it to obscure their identity while sending large amounts of junk mail.

Pls help on how to handle this. I'd assign points accordingly.

thank you.

[Jeff Schussele · Accepted solution]

Hi Rosli,

A simple solution would be as follows:

Make sure you have PHNE_17190 installed or it's superceding patch. Follow the following process after installing the patch.

#cd /etc/mail
#cp sendmail.cf sendmail.cf.norelay
# cp /usr/newconfig/etc/mail/sendmail.cf sendmail.cf
#vi sendmail.cf
Duplicate the customizations from sendmail.cf.norelay and save the file
#/sbin/init.d/sendmail restart

To verify:

Telnet mail-server-hostname 25
mail from: your_username@your_hostname
(should get => sender OK)
rcpt to: another_username@another_hostname
(should get => we do not relay)
quit

HTH,
Jeff

[Michael Tully]

What version of sendmail?
To check run

# sendmail -bs

If it is 8.8.6 then:
Edit the 'sendmail.cf' file
# vi sendmail.cf
at the section that starts with
## BEGIN anti-spamming

uncomment

F{Spammer} /etc/mail/Spammer
Save the file

Then create an anti-spamming file:

# vi /etc/mail/Spammer
add the addresses you wish to block.

Restart sendmail
# /sbin/init.d/sendmail stop
# /sbin/init.d/sendmail start

If your running version 8.9.3 See this document.
http://us-support2.external.hp.com/cki/bin/doc.pl/sid=b632581612cc93357b/screen=ckiDisplayDocument?docId=200000053533675

HTH
~Michael~

[Rosli Ahmad]

Thank you guys. I really appreciate that.