Re: [cobalt-users] Is someone relaying through my Qube 2?

[Hendrik Runte <cobalt@xxxxxxxxxx>]

am 15.05.2001 16:48 Uhr schrieb GebaDFW@xxxxxxx unter GebaDFW@xxxxxxx:

> Today I received many automated replies saying that mail I sent was
> undeliverable.  However, I did not send this mail.  The sender is said to be
> lifesavingsresource@xxxxxxxxxxxxxxxxxx  Yet the automated replies are coming
> to my personal email address on our Qube, not the mail administrator.  Below
> is a sample of one of the replies I have been getting.  Any insights would be
> greatly appreciated.
> 
> Thanks,
> 
> Gerald Braun
> 
> X-Authentication-Warning: server1.placeyourmail.com: majordomo set sender to
> lifesavingsresource@xxxxxxxxxxxxxxxxx using -f
> To: lifesavingsresource@xxxxxxxxxxxxxxxxx
> From: Mail Administrator<Postmaster@xxxxxxxxxxxxxx>
> Reply-To: Mail Administrator<Postmaster@xxxxxxxxxxxxxx>
> Subject: Mail System Error - Returned Mail
> Date: Mon, 14 May 2001 17:14:31 -0500
> Sender: lifesavingsresource@xxxxxxxxxxxxxxxxx
> 
<snip>

Hi Gerald,

assuming that none of the mail addresses were yours, it looks like someone
tried to post the spam mail to a mailing list on your Qube.

The warning in the first line tells you that the transport agent 'majordomo'
(this mailing list thingy) tried to send a mail without using any domain
names placed on your Qube but any foreign domain name (which does not really
have to exist).

Using Sendmail it is possible to 'rewrite' the 'From:' field (and Reply-To)
with any domain name one can guess, ie. under special circumstances sendmail
is able to send any outgoing mail with a different than the senders address.

Normally this is allowed to so-called 'trusted users' (see sendmail.cf
section 'T') only.

Probably your majordomo is one of the trusted users and there is a mailing
list running that is open to anybody.

Many spammers just try to post their spam into open mailing lists (see
Cobalt GUI / Site Management / List Management / *any list' / Allow
unsubscribed posting to list)

HTH


Regards,

Hendrik
--