Re: [cobalt-users] Port 25 email via telnet exploit

[sm <sm@xxxxxxxxxxxx>]

Hi,
At 19:52 02-06-2002 -0600, Greg Hewitt-Long wrote:
>Why does port 25 allow email to be sent via telnet without validating user
login, domain etc?

This is not an exploit. :)  Your mail server allow you to relay though the
smtp port (25) as your IP is in the list of acceptable relays.

>I've changes the details to hide the IP etc, but needless to say, I got
the destination email - this is very scary!!  Needless to say, it's not
rocket science to setup a great big macro to send tons and tons of email
via a telnet session using a simple telnet program.

You can also use your favorite mail program to send tons and tons of emails
through your mail server. :)  There is nothing to be scared about.

>Any pointers as to how to lock this sucker down are greatly appreciated.

If you lock down the server, you will not be able to relay mail through it.

Regards,
-sm