On Sat, 2005-04-02 at 10:52, Mike Pelley wrote:
> Folks - I noticed some strange errors in my logwatch report and when I checked my maillog I found the entries below. I have SMTPS with TLS set up for authentication. Does this mean I'm being used as a relay?
>
> maillog:Mar 29 09:30:24 zeus postfix/smtpd[26863]: connect from unknown[216.113.195.131]
> maillog:Mar 29 09:30:24 zeus postfix/smtpd[26863]: setting up TLS connection from unknown[216.113.195.131]
> maillog:Mar 29 09:30:24 zeus postfix/smtpd[26863]: TLS connection established from unknown[216.113.195.131]: TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)
> maillog:Mar 29 09:30:25 zeus postfix/smtpd[26863]: 0A1267031D: client=unknown[216.113.195.131]
> maillog:Mar 29 09:30:25 zeus postfix/smtpd[26863]: 0A1267031D: reject: RCPT from unknown[216.113.195.131]: 450 <wjwwwdk@xxxxxxxxxxx>: User unknown in local recipient table; from=<> to=<wjwwwdk@xxxxxxxxxxx> proto=ESMTP helo=<email.noproblemnetworks.com>
> maillog:Mar 29 09:30:27 zeus postfix/smtpd[26863]: disconnect from unknown[216.113.195.131]
>
> Thanks,
> Mike
Mike,
I would have said no.
This looks to me like a machine at 216.113.195.131
(pd-pd-a.static.uniserve.ca) tried to send a mail to a users at your
domain who did not exist.
Now noproblemnetworks.com is:
Technical Contact:
Diamond, Paul paul@xxxxxxxxxxxxxxx
8771 Myhill Road
Richmond, BC V6Y 2J3
CA
(604) 761-0839
Fax:(604) 448-0218
Record last updated 12-06-2004 10:41:41 AM
Record expires on 02-03-2006
Record created on 02-03-2001
Domain servers in listed order:
NS1.NOPROBLEMNETWORKS.COM 216.113.195.131
NS3.NOPROBLEMNETWORKS.COM 69.90.29.94
Which shows that the sending machine 216.113.195.131 is supposed to be a
NS.
It looks to me that 216.113.195.131 is either an open relay or
compromised.
Rob
