SMTP authentication strange behaviour

[ergos]

I have double checked, in my Plesk admin interface SMTP auth is on.

But, if I try to telnet to my smtp server and do a manual sending I still manage to get an empty header message to an email address... why??

Also, my log files are full of this:

"date" as xinetd[11340]: START: smtp pid=22106 from="numerical_ip"

relly full of this... lots of lines... is this an attempt to use my smtp server as a relay?

What should I do?

Thanks

 

[breun]

I have double checked, in my Plesk admin interface SMTP auth is on.

But, if I try to telnet to my smtp server and do a manual sending I still manage to get an empty header message to an email address... why??

Are you sending this message to a local address? If so, this is normal. When trying to send a message to a non-local address you should get a message saying relaying is denied.

Also, my log files are full of this:

"date" as xinetd[11340]: START: smtp pid=22106 from="numerical_ip"

relly full of this... lots of lines... is this an attempt to use my smtp server as a relay?

All that message says is that numerical_ip opened an SMTP connection to your server. They could be looking for open relays, yes. It could also be a client sending a message, or some other server delivering some mail. Nothing to worry about, although you might want to act when they're hammering your server.

 

[ergos]

Re: Re: SMTP authentication strange behaviour

Originally posted by breun
Are you sending this message to a local address? If so, this is normal. When trying to send a message to a non-local address you should get a message saying relaying is denied.

Yes! Thanks a lot, if I try to another address I get 553 sorry, that domain isn't in my list of allowed rcpthosts (#5.7.1)


All that message says is that numerical_ip opened an SMTP connection to your server. They could be looking for open relays, yes. It could also be a client sending a message, or some other server delivering some mail. Nothing to worry about, although you might want to act when they're hammering your server.

I think that is someone looking for open relays this for two reasons:

too many different ip's (I don't have so many clients and all my clients connect from lan in their work place that go out with the same IP)

looking in the mail log I don't see the same ip's accessing POP/IMAP..... they just seem to look for the relay.

What do you think? I may ignore it?

Thanks for the answers.