How can I tell if my system is being used to relay email?

[Paul Mancillas]

I checked the /var/log/maillog file and I can see several "from=" entries with user names on my system that should not be sending email out from my system. There is also a "relay=" entry on the same line that refers to a domain other than mine. Does this mean that someone is using my system as a mail relay? If so, then how can I stop this? I'm using sendmail 8.9.3 on a Red Hat 6.1 system.

Thanks,

Paul Mancillas

[Roberto_30]

You have the ability to control who you allow to relay from your machine. By configuring your machine to use promiscuous relaying, you allow anyone to use your machine as relay. To enable promiscuous relaying configure the etc/mail/sendmail.mc by appending the following line:
FEATURE(promiscuous_relay)dnl

To disable promiscuous relaying configure the etc/mail/sendmail.mc by removing the following line:
FEATURE(promiscuous_relay)dnl

To allow relayn from a specific host, domain, or network, edit /etc/mail/access and add an entry to permit this.
Then restart sendmail.

Hope this can help you.
Roberto

[U.SivaKumar_2 · Accepted solution]

Hi,
It is ok that
The remote mail servers will be refered in the
relay= parameter in maillog

If you are interested in checking whether your
mail server is a open relay . Do this

Open telnet port in firewall for your mail server.

Then.

#telnet relay-test.mail-abuse.org

Wait for 10 minutes , it will give you the results.

regards,
U.SivaKumar

[Balaji N]

Alternatively, just visit the following URL and give your mail server address

http://www.abuse.net/relay.html

hth
-balaji

[Chan Choth PUTH]

Dear U.SivaKumar,

When I try to telnet:
$ telnet relay-test.mail-abuse.org
I have got the following:
Trying 204.152.187.123...
telnet: connect to address 204.152.187.123: No route to host
What's happen?

Thanks,

Choth

[U.SivaKumar_2]

Welcome my old friend choth,

Have you opened outgoing telnet port in your firewall ?.

regards,
U.SivaKumar

[U.SivaKumar_2]

Also can you reach internet from this mail server ?

Have you got default gateway as internet gateway or your firewall


regards,
U.SivaKumar