Re: [cobalt-users] Email Relay Bug (?) (WAS: Removing the POP before SMTP pkg)

[Jeff Lasman <jblists@xxxxxxxxxxxxx>]

At 09:19 AM 1/8/00  Fathi Said wrote:

> In my relay list there are the names of all virtual sites hosted on this 
> server and their IP addresses.

See my previous post response, to Dan.

More below...

> Now, the following scenario
>
> * I want to send an email to afriend@xxxxxxxxxxx
> * This email should be sent with my email@xxxxxxxxxxxxxxxxx email address
> * a-virtualsite.com is hosted  my server

So far so good.  None of the above has anything to do with what goes into 
the "relay" window.

> * I have a dial-up Internet account with a local ISP, and my IP address is 
> NOT listed in the relay field (as I already said, only
> the names and IPs of the virtual sites are in there).

Your dialup block should NOT be listed in the window.  So far, okay, as far 
as it goes.

> Now, the strange thing is this behaviour:
> When I send an email to afriend@xxxxxxxxxxx (inrussia.ru is NOT hosted on 
> my server), I get the "Relaying denied" error. If I add
> "inrussia.ru" OR "ru" to my relay list, the mail can be sent without any 
> problems, although my IP address (that I get from my ISP
> everytime I dial-in) is NOT listed. Shouldn't the Relay list *only* relay 
> email FROM hosts whom's IP addresses are listed in the
> Relay field?

If <inrussia.ru> is in the "relay" window, then sendmail, when checking 
against rule S98, presumes the mail is for local delivery, and accepts 
it.  Later, when it sees the actual address is not on the box, it relays it.

This is insecure behavior; anyone could use your box to send email to or 
from anyone, using the "inrussia.ru" as their origination point (requires 
good knowledge of spoofing).  If "inrussia.ru" is improperly cofigured, 
then anyone could send mail to anyone using your box and the server at 
"inrussia.ru".  To check this configuration, try sending mail to me as 
follows:  <jblists#nobaloney.net@xxxxxxxxxxx> and I'll let you know if I 
get it.

Presuming in the above scenario you're using the same dialup ISP that you 
use when you email the list, you might be tempted to put "telekom.at" into 
the "relay" window.  Resist that temptation, or everyone dialing in through 
your ISP could use your server.

The proper procedure when using a dialup account is to either use POP 
before SMTP on your server, OR use your ISPs server, which is what you're 
doing when you write the list.

Jeff

--
Jeff Lasman, nobaloney.net
<jblists@xxxxxxxxxxxxx>
<www.nobaloney.net>, <www.mailtraqna.com>, <www.email-lists.com>