Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #2223 > unrolled thread

Keeping sendmail pest at bay

Started byClark Smith <noaddress@nowhere.net>
First post2013-06-26 16:03 +0000
Last post2013-06-27 15:40 +0100
Articles 5 — 3 participants

Back to article view | Back to comp.os.linux.networking

Contents

  Keeping sendmail pest at bay Clark Smith <noaddress@nowhere.net> - 2013-06-26 16:03 +0000
    Re: Keeping sendmail pest at bay Richard Kettlewell <rjk@greenend.org.uk> - 2013-06-27 13:29 +0100
      Re: Keeping sendmail pest at bay Clark Smith <noaddress@nowhere.net> - 2013-06-27 13:26 +0000
    Re: Keeping sendmail pest at bay Dale Dellutri <ddelQQQlutr@panQQQix.com> - 2013-06-27 14:33 +0000
      Re: Keeping sendmail pest at bay Richard Kettlewell <rjk@greenend.org.uk> - 2013-06-27 15:40 +0100

#2223 — Keeping sendmail pest at bay

FromClark Smith <noaddress@nowhere.net>
Date2013-06-26 16:03 +0000
SubjectKeeping sendmail pest at bay
Message-ID<kqf3db$34s$1@news.albasani.net>
	Some clown is connecting to my sendmail server every few minutes, 
eliciting the following traces in my /var/log/maillog file:

Jun 26 09:54:37 my_box sm-mta[18410]: r5PIcehn018410: [xxx.xxx.xxx.xxx] 
did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA

	I have tried to drop packets from the offending IP address 
(represented as xxx.xxx.xxx.xxx here) with 

	iptables -I INPUT -s xxx.xxx.xxx.xxx -j DROP
	iptables -A INPUT -s xxx.xxx.xxx.xxx -j DROP
	iptables -A INPUT -s xxx.xxx.xxx.xxx -p tcp --destination-port 25 
-j DROP

in succession, but none of these rules are achieving anything - i.e. the 
diagnostic above keeps appearing in my /var/log/maillog.

	Any ideas on how to proceed?

[toc] | [next] | [standalone]

#2224

FromRichard Kettlewell <rjk@greenend.org.uk>
Date2013-06-27 13:29 +0100
Message-ID<87d2r7pwhu.fsf@araminta.anjou.terraraq.org.uk>
In reply to#2223
Clark Smith <noaddress@nowhere.net> writes:

> 	Some clown is connecting to my sendmail server every few minutes, 
> eliciting the following traces in my /var/log/maillog file:
>
> Jun 26 09:54:37 my_box sm-mta[18410]: r5PIcehn018410: [xxx.xxx.xxx.xxx] 
> did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
>
> 	I have tried to drop packets from the offending IP address 
> (represented as xxx.xxx.xxx.xxx here) with 

I’m not sure why you feel the need to mask the address...

> 	iptables -I INPUT -s xxx.xxx.xxx.xxx -j DROP
> 	iptables -A INPUT -s xxx.xxx.xxx.xxx -j DROP
> 	iptables -A INPUT -s xxx.xxx.xxx.xxx -p tcp --destination-port 25 
> -j DROP
>
> in succession, but none of these rules are achieving anything - i.e. the 
> diagnostic above keeps appearing in my /var/log/maillog.
>
> 	Any ideas on how to proceed?

Obvious question: is the packet filter on the same box as the SMTP
listener?

-- 
http://www.greenend.org.uk/rjk/

[toc] | [prev] | [next] | [standalone]

#2225

FromClark Smith <noaddress@nowhere.net>
Date2013-06-27 13:26 +0000
Message-ID<kqhehr$ftg$1@news.albasani.net>
In reply to#2224
On Thu, 27 Jun 2013 13:29:49 +0100, Richard Kettlewell wrote:

> Clark Smith <noaddress@nowhere.net> writes:
> 
>> 	Some clown is connecting to my sendmail server every few minutes,
>> eliciting the following traces in my /var/log/maillog file:
>>
>> Jun 26 09:54:37 my_box sm-mta[18410]: r5PIcehn018410: [xxx.xxx.xxx.xxx]
>> did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
>>
>> 	I have tried to drop packets from the offending IP address
>> (represented as xxx.xxx.xxx.xxx here) with
> 
> I’m not sure why you feel the need to mask the address...
> 
>> 	iptables -I INPUT -s xxx.xxx.xxx.xxx -j DROP iptables -A INPUT -s
>> 	xxx.xxx.xxx.xxx -j DROP iptables -A INPUT -s xxx.xxx.xxx.xxx -p 
tcp
>> 	--destination-port 25
>> -j DROP
>>
>> in succession, but none of these rules are achieving anything - i.e.
>> the diagnostic above keeps appearing in my /var/log/maillog.
>>
>> 	Any ideas on how to proceed?
> 
> Obvious question: is the packet filter on the same box as the SMTP
> listener?

	Yes.

[toc] | [prev] | [next] | [standalone]

#2226

FromDale Dellutri <ddelQQQlutr@panQQQix.com>
Date2013-06-27 14:33 +0000
Message-ID<kqhigj$3rf$1@reader2.panix.com>
In reply to#2223
On Wed, 26 Jun 2013 12:03:55, Clark Smith <noaddress@nowhere.net> wrote:
>         Some clown is connecting to my sendmail server every few minutes, 
> eliciting the following traces in my /var/log/maillog file:

> Jun 26 09:54:37 my_box sm-mta[18410]: r5PIcehn018410: [xxx.xxx.xxx.xxx] 
> did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA

>         I have tried to drop packets from the offending IP address 
> (represented as xxx.xxx.xxx.xxx here) with 

>         iptables -I INPUT -s xxx.xxx.xxx.xxx -j DROP
>         iptables -A INPUT -s xxx.xxx.xxx.xxx -j DROP
>         iptables -A INPUT -s xxx.xxx.xxx.xxx -p tcp --destination-port 25 
> -j DROP

> in succession, but none of these rules are achieving anything - i.e. the 
> diagnostic above keeps appearing in my /var/log/maillog.

>         Any ideas on how to proceed?

The first command puts the rule at the beginning of the INPUT rules,
but you didn't specify -p tcp, so I'm not sure it was effective.
The next two puts the rule at the end of the INPUT rules.  Is there
an earlier rule which would accept the attempt?  Is there another
chain which accepts input requests?

I suggest that you try it again with the third rule format but
changed to -I, then look at all of your rules to see if there is
an early rule or another chain which accepts.

  # iptables -nvL --line-numbers

Use this command before and after the addition to see where it is.

Also watch the counts.  If the added rule is not being used,
the count on that rule will remain at zero.

-- 
Dale Dellutri <ddelQQQlutr@panQQQix.com> (lose the Q's)

[toc] | [prev] | [next] | [standalone]

#2227

FromRichard Kettlewell <rjk@greenend.org.uk>
Date2013-06-27 15:40 +0100
Message-ID<87obarobv8.fsf@araminta.anjou.terraraq.org.uk>
In reply to#2226
Dale Dellutri <ddelQQQlutr@panQQQix.com> writes:

> On Wed, 26 Jun 2013 12:03:55, Clark Smith <noaddress@nowhere.net> wrote:
>>         Some clown is connecting to my sendmail server every few minutes, 
>> eliciting the following traces in my /var/log/maillog file:
>
>> Jun 26 09:54:37 my_box sm-mta[18410]: r5PIcehn018410: [xxx.xxx.xxx.xxx] 
>> did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA
>
>>         I have tried to drop packets from the offending IP address 
>> (represented as xxx.xxx.xxx.xxx here) with 
>
>>         iptables -I INPUT -s xxx.xxx.xxx.xxx -j DROP
>>         iptables -A INPUT -s xxx.xxx.xxx.xxx -j DROP
>>         iptables -A INPUT -s xxx.xxx.xxx.xxx -p tcp --destination-port 25 
>> -j DROP
>
>> in succession, but none of these rules are achieving anything - i.e. the 
>> diagnostic above keeps appearing in my /var/log/maillog.
>
>>         Any ideas on how to proceed?
>
> The first command puts the rule at the beginning of the INPUT rules,
> but you didn't specify -p tcp, so I'm not sure it was effective.

“all” is supposed to be the default.

-- 
http://www.greenend.org.uk/rjk/

[toc] | [prev] | [standalone]

Back to top | Article view | comp.os.linux.networking

csiph-web