Re: [cobalt-users] user can *log in* to sendmail with telnet disabled

[Larry Smith <lesmith@xxxxxxxxx>]

On Wednesday 05 November 2003 07:37, Jale wrote:
> Good day all,
>
> I have a RAQ3i. I have telnet disabled as we only use SSH. I have one smart
> user that did:
> telnet www.domain.com 25
> and got into sendmail directly and could issue sendmail commands. He is
> able to sends SPAM mail using the sendmail commands without ever having
> logged on to the server.
>
> His comment:
> ------------------
> No. I have no access to the file system as in a standard (port 23)
> telnet connection. However, connected as I am, I can send reams of spam
> if I desire even though I have no account (I didn't log in) on your
> server. I'll check around to see if I should be able to do this...
> -----------------
>
> Do I have something misconfigured to allow this? Any way to prevent it?
>
> Thanks,
> J.A.L.E.

Jale,

  Yes, just about anyone can connect to sendmail on port 25.  Whether or not 
they can send mail depends upon generally the IP address they are coming from 
(eg and approved for relay IP) and whether or not the mail is directed to 
something "on" that box (local delivery) or for something off that box (relay 
to another host/domain).

  I can connect to my box and send messages to users on that box all day - 
that is "legitimate".  But if I connect from an "outside" IP address (not one 
of mine) and attempt to send mail to - for example - hotmail.com, then the 
box will tell me "relay denied" and probably "check mail first" (eg login in 
some form or fashion).

-- 
Larry Smith
SysAd ECSIS.NET
sysad@xxxxxxxxx