Re: open-relay with malformed MAIL syntax ?

[mw-list-qmail@xxxxxx]

Unless you show us actual messages with full headers, the real smtp
conversation, the contents of your tcprules and rcpthosts files, we
cannot help you.

Mate


On Tue, Jul 02, 2002 at 04:38:24PM -0400, Ben Parker wrote:
> I've discovered that my qmail server relays mail even though it shouldn't.
> 
> I'm running qmail 1.03 installed according to the LWQ tutorial. I have also
> installed vpopmail 4.9.10 to serve virtual domains.  Mail delivery has
> worked fine for over 150 days, but recently I realized that my local Outlook
> client is connecting to my server via an IP address which is NOT in
> /etc/tcp.smtp ... meaning that RELAYCLIENT should not be set for SMTP
> connections from my desktop machine.
> 
> This led me to wonder how I was able to send mail at all. Because according
> to everything I've read  about qmail, my Outlook client should be blocked
> from sending SMTP through my qmail server to remote domains, but allowed to
> pickup POP3 mail via authentication through vpopmail. But I can still send
> via SMTP to domains not in my RCPTHOSTS!
> 
> So I tested telneting to my server port 25 and trying to send mail where the
> RCPT TO is NOT in my RCPTHOSTS:
> 
> HELO
> 220 mydomain.org ESMTP
> 250 mydomain.org
> MAIL From: someone@notmydomain.com
> 250 ok
> RCPT To: someone@notmydomaineither.com
> 553 sorry, that domain isn't in my list of allowed rcpthosts (#5.7.1)
> 
> This made me happy, but it doesn't explain why I can send SMTP via Outlook.
> So I messed around a bit and discovered what I think is the hole:
> 
> If I try telneting to port 25 and using an invalid MAIL format, the mail is
> accepted and relayed to the recipient, even though they are not in my
> RCPTHOSTS:
> 
> HELO
> 220 mydomain.org ESMTP
> 250 mydomain.org
> MAIL Fro:
> 250 ok
> RCPT To: <someone@notmydomain.com>
> 250 ok
> DATA
> 345 go ahead
> From: <someone@notmydomain.com>
> To: <someone@notmydomaineither.com>
> Subject: open-relays stink
> 
> Receiving this mail means our relay is not fully closed.
> .
> 250 ok 1025635235 qp 4155
> QUIT
> 221 mydomain.org
> 
> and I received the latter mail at the "someone@notmydomaineither.com"
> account, which I believe indicates that an invalid/unsecure relay had taken
> place.
> 
> How can I close this loophole in qmail?!  I'm happy to provide more
> information as necessary.
> 
> Ben
> ben@brothersparker.com
> 

-- 
---
Mate Wierdl | Dept. of Math. Sciences | University of Memphis