RE: [cobalt-users] Logcheck-Sendmail Relay Report

[aljuhani <aljuhani@xxxxxxxxx>]

The user who is trying to relay through your mail server uses dial-up access 
from madisonriver.net ISP.  The first part 
(216-166-248-214.clec.peknil.madisonriver.net ) is the hostname of that user 
which also shows the IP address (216.166.248.214).  There is nothing to worry 
about if your pop b4 smtp is active.

If you want to block that ISP completly from accessing pop3, ftp, ssh, etc, 
you can edit /etc/hosts.deny and add the following:

ALL: 216.166.

or you can add the hostname as:

ALL: madisonriver.net
ALL: .madisonriver.net

aljuhani

>===== Original Message From cobalt-users@xxxxxxxxxxxxxxx =====
>I have these type of reports coming in very now and then. I know the box is
>rejecting, but does this mean that the madisonriver.net is trying to relay
>to me? I see an awful lot of this stuff from this network. They are an ISP
>about 10 miles away.
>
>
>Sep 27 05:17:44 corporate sendmail[22427]: g8RAHiL22427: ruleset=check_rcpt,
>arg1=<stxvilla@xxxxxxxxxxxx>,
>relay=216-166-248-214.clec.peknil.madisonriver.net [216.166.248.214],
>reject=550 5.7.1 <stxvilla@xxxxxxxxxxxx>... Relaying denied.  Please check
>your mail first or restart your mail session.
>--