Search Results

Search found 3578 results on 144 pages for 'smtp auth'.

Page 16/144 | < Previous Page | 12 13 14 15 16 17 18 19 20 21 22 23  | Next Page >

  • Exchange 2010 periodically stops responding to SMTP events with error 421 4.4.1 Connection timed out

    - by Michael Shimmins
    After some help diagnosing why Exchange 2010 Enterprise stops responding to SMTP events. I can't find a pattern to it. It doesn't appear to be an actual timeout, as the server responds immediately with the error. To reproduce it I telnet into the server on port 25 and issue a EHLO. The server immediately replies with the 421: 421 4.4.1 Connection timed out Once this starts happening I've found restarting the exchange box is the only reliable way to get it flowing again. Sometimes restarting the Transport service or the mailbox attendant service seems to fix it, but this could be coincidental as it often has no effect.

    Read the article

  • Does SMTP greylisting a) stop much spam and b) stop much legitimate mail?

    - by Whisk
    I've just set up an SMTP server on a relatively little used domain using Postfix and enabled greylisting with SQLGrey. So far it seems to be working OK, and while there's the slight irritation of delays to emails from new senders, I can see from the logs that it's deterring a number of spam messages. In your experience does greylisting effectively stop much spam? Is it a useful addition to e.g. SpamAssassin or is adding it on top overkill/unnecessary? If I were to roll this out to heavier use domains (perhaps with more demanding users) would you anticipate a significant portion of poorly configured mail servers that would end up bouncing or losing messages?

    Read the article

  • SMTP IP - Bad reputation, how do I work around?

    - by Louis van Tonder
    I recently had a spamming incident and got listed on a blacklist. I have rectified the issue, removed from the blacklist, but my IP reputation is now classified as a high volume sender. What is the best way to rectify this? I have an additional IP address. I am thinking configure my server to make outbound SMTP connections using the other IP. My questions are: How long does it take for my reputation to stabilize again? How do I configure my server/mailserver to use a specified outbound IP? Setup: Server 2008 Web hMailserver 2 IPs configured on one NIC Cloud based server Your urgent help would be greatly appreciated. Cheers

    Read the article

  • Windows 2003 SMTP virtual server, why emails are not delivered?

    - by bardan
    Configured Windows 2003 as my email client, everything works fine with POP3 (i'm able to recieve emails), the problem is with SMTP and i can't figure out how to find where excatly this problem is, because email looks like it is sent, but recipients don't recieve anything... i had some problems with relying, but fixed everything, and now i configured outlook express on the same machine, trying to send emails and it looks everything fine, email goes to SENT folder, no errors, but recipients (tried several diffrent) don't revieve any letters... tried to test from the same machine with telnet like it described there http://support.microsoft.com/kb/153119 ant everything looks ok...

    Read the article

  • How secure is using "Normal password" for SMTP with connection type = STARTTLS?

    - by harshath.jr
    I'm using an email client for the first time - for the most part I've always used gmail via the web interface. Now I'm setting up thunderbird to connect to an email server of my own (on my own server, own domain name, etc). The server machine (and the email server on it) was preconfigured for me. Now i figured out away by which I'm able to send and receive email, but I noticed that in the outgoing and incoming servers section, the connection type was STARTTLS (and not SSL/TLS), and the Authentication Type was "Normal Password". Does this mean that the password will be sent across in plain text? I'm very paranoid about security - its the only way that it works for me. Can someone please post links that explain how SMTP (my outbound server) and IMAP (my inbound server) servers work, and what connection type means what? Thanks! PS: If this question does not belong here, please redirect me.

    Read the article

  • It's possible to use google smtp for sending email from my server?

    - by Magnetic_dud
    Well, I am becoming crazy to let my email deliver to gmail/hotmail from my new ip. Last year, i had no problems with my past ip, but now my emails go straight to the spam folder of gmail and hotmail. I checked with mxtoolbox.com and i am not blacklisted, not an open proxy, rdns is configured the right way, SPF policy is present on the DNS. My spf is v=spf1 a mx ~all But, still, I am filtered. So, I am wondering: since gmail does not accept my emails, it's possible to use gmail smtp server to deliver all mails from my server? AFAIK, it will change all the "from" address, but maybe there is a way to not let it happen?

    Read the article

  • Solution to: Hotmail Senders receiving NDR : “550-Please turn on SMTP Authentication in your mail client…”

    - by Tony Yustein
    Original question is here original question I can not answer to that question because the system requires me to have 10 credits, very nice.... This error is based mostly on mobile devices, mostly on iPhones and mostly on mobile networks. This is how much I have narrowed it to. I believe: Hotmail checks where your are connecting from If it is a mobile network it requires additional security for sending messages but the default iPhone config does not have this option for hotmail if the user creates the hotmail account on the iPhone with SMTP AUTH enabled manually it might solve the situation Cheers, Tony

    Read the article

  • Setting Return-Path Header Other than Sender Address using SMTP command.

    - by Matt
    Greetings all. I'm faced with an issue with basic SMTP.. I would like to set the return-path header to an address other than the Sender address (i.e. From: Header) using SMTP command. I know MAIL -F sets it. However, I issued the following sequence of commands into my mail daemon (TELNET rlogin) and got the SMTP error 503 - Bad Command Sequence TELNET HELO: MAIL FROM : MAIL -F: RCPT TO: Subject: Test Bounce test mail for bounce functinlaity quit Can anyone of you please suggest me a possible way out of this? I will be grateful. Cheers, Matt.

    Read the article

  • auth.log is empty (Ubuntu)

    - by Vinicius Pinto
    The /var/log/auth.log file in my Ubuntu 9.04 is empty. syslogd is running and /etc/syslog.conf content is as follows. Any help? Thanks. # /etc/syslog.conf Configuration file for syslogd. # # For more information see syslog.conf(5) # manpage. # # First some standard logfiles. Log by facility. # auth,authpriv.* /var/log/auth.log *.*;auth,authpriv.none -/var/log/syslog #cron.* /var/log/cron.log daemon.* -/var/log/daemon.log kern.* -/var/log/kern.log lpr.* -/var/log/lpr.log mail.* -/var/log/mail.log user.* -/var/log/user.log # # Logging for the mail system. Split it up so that # it is easy to write scripts to parse these files. # mail.info -/var/log/mail.info mail.warning -/var/log/mail.warn mail.err /var/log/mail.err # Logging for INN news system # news.crit /var/log/news/news.crit news.err /var/log/news/news.err news.notice -/var/log/news/news.notice # # Some `catch-all' logfiles. # *.=debug;\ auth,authpriv.none;\ news.none;mail.none -/var/log/debug *.=info;*.=notice;*.=warning;\ auth,authpriv.none;\ cron,daemon.none;\ mail,news.none -/var/log/messages # # Emergencies are sent to everybody logged in. # *.emerg * # # I like to have messages displayed on the console, but only on a virtual # console I usually leave idle. # #daemon,mail.*;\ # news.=crit;news.=err;news.=notice;\ # *.=debug;*.=info;\ # *.=notice;*.=warning /dev/tty8 # The named pipe /dev/xconsole is for the `xconsole' utility. To use it, # you must invoke `xconsole' with the `-file' option: # # $ xconsole -file /dev/xconsole [...] # # NOTE: adjust the list below, or you'll go crazy if you have a reasonably # busy site.. # daemon.*;mail.*;\ news.err;\ *.=debug;*.=info;\ *.=notice;*.=warning |/dev/xconsole

    Read the article

  • Exchange 2003 - how to route ALL mail (including internal) via an external SMTP gateway? (Or, domain

    - by Scandalon
    Short version: Is there a way to have Exchange route all email, including internal AD users that would normally be routed directly, through an external gateway? (SMTP, probably a "Smart Host" in exchange nomenclature.) Longer version: I'm not an email expert/admin/orevencompetent. Inherited an exchange 2003 server, migrating to web-based SaaS provider. To add to the fun, we're also (forced by deadlines) transitioning domains. What we (my boss) wants is any email sent to the new domain to have a copy sent to both domains. Getting mail sent to the new domain/provider to then be copied/forwarded to our old domain/exchange is easy. But we want mail sent from the old domain to the old domain to get sent to the new domain as well. However: If we route all outgoing exchange mail through the new provider gateway, w/ the new domain forwarding to the old, we'd get an email loop. The "solution" desired is for an exchange user that sends to another exchange user to still be sent via the external gateway, which would in turn be sent to the new domain, and copied/forwarded back to the old domain. Is it possible? A bit of a strange request I'm sure. And I expect that what we're attempting to do is DoingItWrong(tm). Any better ideas?

    Read the article

  • postfix smtp relay script

    - by Peter Sander
    I have a Postfix server and using it with Outlook (POP/SMTP). I have different sender addresses for an account. Now I want to configure a relay for a specific sender address. For example I have postfix for my main domain domain1.com. Now I have a sender address that is domain2.com. For that sender address I want that postfix to relay mail to a second SMTP server. I think that should be possible without problems. But the problem is that I have to create a SSH tunnel to the second server to connect to the SMTP server. But I cant use a persistent SSH connection so I want to know if it is possible that postfix executes some script before relaying the mail to the second SMTP server. I already found some information for executing a script when incomming emails but I only want to establish the SSH tunnel before postfix relays the mail to the second SMTP server.

    Read the article

  • unable to connect gmail and hotmail via telnet

    - by codeomnitrix
    Hey all i am try to connect to gmail and hotmail server via telnet. As: $: telnet smtp.gmail.com 25 Trying 74.125.127.109... Connected to gmail-smtp-msa.l.google.com. Escape character is '^]'. 220 mx.google.com ESMTP j3sm3044317ybe.11 helo 250 mx.google.com at your service 220 2.0.0 Ready to start TLS mail from: [email protected] Connection closed by foreign host. Here codeomnitrix is a user of smtp.localhost.com. And i am running postfix at my system with sitename being smtp.localhost.com. And i am able to sent mail locally from one user to another user but can't send to any other user who is not local. Thanks in advance:)

    Read the article

  • DKIM for email through Google Apps domain with external outbound relay

    - by David Gardiner
    I'd like to enable the new Domain Keys DKIM email authentication feature for a domain hosted in Google Apps. Some of my users use an external SMTP gateway (such that when they send email, it doesn't go through smtp.gmail.com). I have an SPF record configured for the domain, and this allows the external SMTP gateways as valid SMTP hosts. (I realise SPF is different to DKIM) Will enabling DKIM adversely affect the external gateway email? eg. Are the externally sent emails at risk of being marked as spam because they would not have the DKIM signature, or will DKIM only positively benefit emails sent through Google's SMTP server?

    Read the article

  • SMTP mailbox unavailable - intermittent and self-inflicted

    - by user134451
    I have an app that runs daily, sending confirmation emails to dozens of customers. Emails are sent using SMTP with authentication. The app also has some error handling, and occasionally anonymous SMTP is used to notify the webmaster that an e-mail issue has been encountered (a malformed email address, usually). Whenever these warning notifications are sent, the customer notifications that follow throw an error: "Mailbox unavailable. The server response was: 5.7.1 Unable to relay". The customer notification emails are sent, but my app drops into the exception handler. And all subsequent customer notification emails have this problem. Everything is fine next time the programs run, until a webmaster warning email is sent. Anyone have an ideas what would cause this? My first thought was that the client didn't like being switched back and forth between anonymous to authenticated modes. I created a separate client for each mode, but that didn't help.

    Read the article

  • Could Python's logging SMTP Handler be freezing my thread for 2 minutes?

    - by Oddthinking
    A rather confusing sequence of events happened, according to my log-file, and I am about to put a lot of the blame on the Python logger, which is a bold claim. I thought I should get some second opinions about whether what I am saying could be true. I am trying to explain why there is are several large gaps in my log file (around two minutes at a time) during stressful periods for my application when it is missing deadlines. I am using Python's logging module on a remote server, and have set-up, with a configuration file, for all logs of severity of ERROR or higher to be emailed to me. Typically, only one error will be sent at a time, but during periods of sustained problems, I might get a dozen in a minute - annoying, but nothing that should stress SMTP. I believe that, after a short spurt of such messages, the Python logging system (or perhaps the SMTP system it is sitting on) is encountering errors or congestion. The call to Python's log is then BLOCKING for two minutes, causing my thread to miss its deadlines. (I was smart enough to move the logging until after the critical path of the application - so I don't care if logging takes me a few seconds, but two minutes is far too long.) This seems like a rather awkward architecture (for both a logging system that can freeze up, and for an SMTP system (Ubuntu, sendmail) that cannot handle dozens of emails in a minute**), so this surprises me, but it exactly fits the symptoms. Has anyone had any experience with this? Can anyone describe how to stop it from blocking? ** EDIT: I actually counted. A little under 4000 short emails in two hours. So far more than I suggested, sorry. But enough to over-fill a Sendmail's buffers?

    Read the article

  • How can I debug PEAR auth?

    - by croceldon
    I have a directory on my site that I've implemented PEAR's Auth to run my authentication. It is working great. However, I've tried to make a copy of my site (it's going to be translated to a different language), and on this new site, the Auth process doesn't seem to be working correctly. I can login properly, but every time I try to go to a different page in the same directory, and use Auth to authorize, it forces me to login again. Here's my logic: $auth_options = array( 'dsn' => mysql://user:password@server/db', 'table' => 'users', 'usernamecol' => 'username', 'passwordcol' => 'password', 'db_fields' => '*' ); $auth = new Auth("DB", $auth_options, "login_function"); $auth->setFailedLoginCallback('bad_login'); $auth->start(); if (!$auth->checkAuth()) { die('cannot succeed in checkAuth') exit; } else { include("nocache.php"); } This is part of a file that's included in every php page I that I desire to require authentication. I can login properly once, but whenever I then try to go to a different page that requires authentication, it makes me login again (and I see the 'cannot succeed' die message at the bottom of the page). Again, this solution works fine on my original site, I copied all the files, and only changed the db server/password - it still doesn't work. And I'm using the same webhost for both. What am I doing wrong here? Or how can I debug this further?

    Read the article

  • OSX telnet not working from localhost

    - by Stewie
    Telnet from my mac OSx doesn't work while it works from the AWS instances and other networks. I have no local firewalls. Nothing related in /var/log/system In the below transcript, the telnet hangs at "Trying 74.125.136.26..." I have tried many different addresses across multiple domains.. same result ! Rocky-Balboas-MacBook-Pro:~ rocky$ Rocky-Balboas-MacBook-Pro:~ rocky$ dig gmail.com MX +short 30 alt3.gmail-smtp-in.l.google.com. 40 alt4.gmail-smtp-in.l.google.com. 10 alt1.gmail-smtp-in.l.google.com. 20 alt2.gmail-smtp-in.l.google.com. 5 gmail-smtp-in.l.google.com. Rocky-Balboas-MacBook-Pro:~ rocky$ telnet alt2.gmail-smtp-in.l.google.com 25 Trying 74.125.136.26... ^C Rocky-Balboas-MacBook-Pro:~ rocky$ telnet localhost 80 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. ^C Connection closed by foreign host. Rocky-Balboas-MacBook-Pro:~ rocky$ edit: let the telnet command run and here are the results telnet: connect to address 74.125.136.27: Operation timed out Trying 2a00:1450:4013:c01::1a... telnet: connect to address 2a00:1450:4013:c01::1a: No route to host telnet: Unable to connect to remote host

    Read the article

  • Postfix connects to wrong relay?

    - by Eric
    I am trying to set up postfix on my ubuntu server in order to send emails via my isp's smtp server. I seem to have missed something because the mail.log tells me: Jan 19 11:23:11 mediaserver postfix/smtp[5722]: CD73EA05B7: to=<[email protected]>, relay=new.mailia.net[85.183.240.20]:25, delay=6.2, delays=5.7/0.02/0.5/0, dsn=4.7.0, status=deferred (SASL authentication failed; server new.mailia.net[85.183.240.20] said: 535 5.7.0 Error: authentication failed: ) The relay "new.mailia.net[85.183.240.20]:25" was not set up by me. I use "relayhost = smtp.alice.de". Why is postfix trying to connect to a different server? Here is my main.cf: # See /usr/share/postfix/main.cf.dist for a commented, more complete version # Debian specific: Specifying a file name will cause the first # line of that file to be used as the name. The Debian default # is /etc/mailname. #myorigin = /etc/mailname smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu) biff = no # appending .domain is the MUA's job. append_dot_mydomain = no # Uncomment the next line to generate "delayed mail" warnings #delay_warning_time = 4h readme_directory = no # TLS parameters smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key smtpd_use_tls=yes smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache # See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for # information on enabling SSL in the smtp client. myhostname = mediaserver alias_maps = hash:/etc/aliases alias_database = hash:/etc/aliases mydestination = mediaserver, localhost.localdomain, , localhost relayhost = smtp.alice.de mynetworks = 127.0.0.0/8 mailbox_size_limit = 0 recipient_delimiter = + inet_interfaces = all myorigin = /etc/mailname inet_protocols = all sender_canonical_maps = hash:/etc/postfix/sender_canonical smtp_sasl_auth_enable = yes smtp_sasl_password_maps = hash:/etc/postfix/sasl_password smtp_sasl_security_options = noanonymous Output of postconf -n: alias_database = hash:/etc/aliases alias_maps = hash:/etc/aliases append_dot_mydomain = no biff = no config_directory = /etc/postfix inet_interfaces = all inet_protocols = ipv4 mailbox_size_limit = 0 mydestination = mediaserver, localhost.localdomain, , localhost myhostname = mediaserver mynetworks = 127.0.0.0/8 myorigin = /etc/mailname readme_directory = no recipient_delimiter = relayhost = smtp.alice.de sender_canonical_maps = hash:/etc/postfix/sender_canonical smtp_generic_maps = hash:/etc/postfix/generic smtp_sasl_auth_enable = yes smtp_sasl_password_maps = hash:/etc/postfix/sasl_password smtp_sasl_security_options = noanonymous smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu) smtpd_tls_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem smtpd_tls_key_file = /etc/ssl/private/ssl-cert-snakeoil.key smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache smtpd_use_tls = yes

    Read the article

  • Apache, Tomcat 5 and problem with HTTP basic auth

    - by Juha Syrjälä
    I have setup a Tomcat with a webapp that uses http basic auth in some of its URLs. There is a Apache server in front of the Tomcat. I have setup Apache as a proxy like this (all traffic should go directly to tomcat): /etc/httpd/conf.d/proxy_ajp.conf: LoadModule proxy_ajp_module modules/mod_proxy_ajp.so ProxyPass / ajp://localhost:8009/ ProxyPassReverse / ajp://localhost:8009/ There is a webapp installed to root of Tomcat (ROOT.war), so I should be able to use http://localhost/ to access my webapp. But it is not working with http basic auth. The problem is that everything works until I try to access URL that are protected by the HTTP basic auth. URLs without authentication work just fine. When accessing this url via apache I am getting an error message from Apache. If I access the same URL directly from tomcat, everything works just fine. I am getting this to Apache error log: [Wed Sep 01 21:34:01 2010] [error] proxy: dialog to [::1]:8009 (localhost) failed access log looks like this: ::1 - - [01/Sep/2010:21:34:01 +0300] "GET /protected_path/ HTTP/1.0" 503 360 "-" "w3m/0.5.2" I am using: Fedora release 13 (Goddard) httpd-2.2.16-1.fc13.x86_64 tomcat5-5.5.27-7.4.fc12.noarch The basic auth is implemented in the webapp (not in Apache or Tomcat). The webapp is actually implemented in Scala/Lift, but that shouldn't matter. The auth works if I access the tomcat directly. Error message that I am getting from Apache. It is curious that the title is Unauthorized and not Internal error: Unauthorized The server is temporarily unable to service your request due to maintenance downtime or capacity problems. Please try again later. Apache/2.2.16 (Fedora) Server at my.server.name.com Port 80 It could be that Apache is seeing a some thing else than 200 OK response and thinks that it is an error when it actually should pass the received 401 Unauthorized response directly to browser. If this is the problem, how to fix it?

    Read the article

  • Ubuntu 13.10 gives "Package 'libapache2-mod-auth-mysql' has no installation candidate" error

    - by John Crawford
    I'm trying to install my LAMP environment on Ubuntu 13.10 using my script file that can be found here. That script worked for Ubuntu 12.04, Ubuntu 13.04 but when I try it on Ubuntu 13.10 it gives the following error: E: Package 'libapache2-mod-auth-mysql' has no installation candidate Any idea on how to fix this? Note, I do want this package to be installed. EDIT: I've found out now that the reason this could not be installed was because it needed the following two packages that were missing: libmysqlclient16 and apache2.2-common. Do I just need to install these packages or were they removed for a reason?

    Read the article

  • Postfix connection lost after AUTH

    - by user84104
    Looking at the logs on my mailservers, I have noticed messages like the following: Nov 29 12:09:38 mta postfix/smtpd[8362]: connect from unknown[183.13.165.14] Nov 29 12:09:39 mta postfix/smtpd[8362]: lost connection after AUTH from unknown[183.13.165.14] Nov 29 12:09:39 mta postfix/smtpd[8362]: disconnect from unknown[183.13.165.14] Nov 29 12:09:39 mta postfix/smtpd[8409]: connect from unknown[183.13.165.14] Nov 29 12:09:40 mta postfix/smtpd[8409]: lost connection after AUTH from unknown[183.13.165.14] Nov 29 12:09:40 mta postfix/smtpd[8409]: disconnect from unknown[183.13.165.14] There are no SASL failures in these cases. There are SASL failures are logged at other times, but never with lost connection after AUTH. What is happening here, and should I do any about it? These are not MXs, and already have smtpd_client_connection_rate_limit set. Possibly related: The systems require either SMTPS or STARTTLS before AUTH is announced.

    Read the article

  • Apache: Stealth 404 the admin area until authenticated via basic auth, then allow access

    - by Kzqai
    Given a administrative area with urls like this: wp-admin/ wp-admin/whatever wp-admin/another-page wp-adminsecretlogin/ A standard basic-auth coverage would provide a username and password prompt on all three urls, and return a 403 on all failed auth attempts. This is a pretty obvious signal that something exists there, and thus is an invitation to script/brute force access. I would like to instead, require basic auth everywhere, but when not authenticated, not prompt for username and password, and instead return a 404 not found error for all urls except a wp-adminsecretlogin/ url. At that individual-to-the-site url, basic auth could go through, and unlock the rest of the administrative functionality (though the standard application login would still be necessary). How would I do that via apache .htaccess or .conf directives?

    Read the article

  • Auth succeeded No requires line available

    - by user286223
    Upgrading to Ubuntu 14.04 (and Apache2 2.4) server I can't use MySQL as htaccess; Before upgrading I was using MySQL as htaccess in the virtual host - worked nicely: <Directory /var/www/html/tilmelding/login> AuthBasicAuthoritative Off AuthUserFile /dev/null # begin auth_mysql configuration AuthMySQL On AuthMySQL_Host localhost AuthMySQL_User ********** AuthMySQL_Password ********* AuthMySQL_DB ********** AuthMySQL_Password_Table user_info AuthMySQL_Username_Field user_name AuthMySQL_Password_Field user_passwd AuthMySQL_Empty_Passwords Off AuthMySQL_Encryption_Types PHP_MD5 AuthMySQL_Authoritative AuthType Basic AuthName "auth_mysql test" Require valid-user After upgrade it didn’t work. In the logfile I got: [:debug] [pid 31333] mod_auth_mysql.c(1578): Constructing password collection query with passfield=[user_passwd], table=[user_info], userfield=[helgoland], where_clause=[] [:debug] [pid 31333] mod_auth_mysql.c(1410): sec->dbh in /var/www/html/tilmelding/login/ is [:debug] [pid 31333] mod_auth_mysql.c(1417): Ordinary query [:debug] [pid 31333] mod_auth_mysql.c(1434): Running query: [SELECT user_passwd FROM user_info WHERE user_name='helgoland'] [:debug] [pid 31333] mod_auth_mysql.c(1522): Checking with PHP_MD5 [:debug] [pid 31333] mod_auth_mysql.c(1524): Auth succeeded [:error] [pid 31333] No requires line available I am able to do the query from CLI and get an MD5 back. What have I missed ?

    Read the article

  • Has this server been compromised?

    - by Griffo
    A friend is running a VPS (CentOS) His business partner was the sysadmin but has left him high and dry to look after the system. So, I've been asked to help out in fixing an apparent spam problem. His IP address got blacklisted for unsolicited mail. I'm not sure where to look for a problem, but I started with netstat to see what open connections were running. It looks to me like he has remote hosts connected to his SMTP server. Here's the output: Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 78.153.208.195:imap 86-40-60-183-dynamic.:10029 ESTABLISHED tcp 0 0 78.153.208.195:imap 86-40-60-183-dynamic.:10010 ESTABLISHED tcp 0 1 78.153.208.195:35563 news.avanport.pt:smtp SYN_SENT tcp 0 0 78.153.208.195:35559 vip-us-br-mx.terra.com:smtp TIME_WAIT tcp 0 0 78.153.208.195:35560 vip-us-br-mx.terra.com:smtp TIME_WAIT tcp 1 1 78.153.208.195:imaps 86-40-60-183-dynamic.:11647 CLOSING tcp 1 1 78.153.208.195:imaps 86-40-60-183-dynamic.:11645 CLOSING tcp 0 0 78.153.208.195:35562 mx.a.locaweb.com.br:smtp TIME_WAIT tcp 0 0 78.153.208.195:35561 mx.a.locaweb.com.br:smtp TIME_WAIT tcp 0 0 78.153.208.195:imap 86-41-8-64-dynamic.b-:49446 ESTABLISHED Does this indicate that his server may be acting as an open relay? Mail should only be outgoing from localhost. Apologies for my lack of knowledge but I don't work on linux in my day job. EDIT: Here's some output from /var/log/maillog which looks like it may be the result of spam. If it appears to be the case to others, where should I look next to investigate a root cause? I put the server IP through www.checkor.com and it came back clean. Jun 29 00:02:13 vps-1001108-595 qmail: 1309302133.721674 status: local 0/10 remote 9/20 Jun 29 00:02:13 vps-1001108-595 qmail: 1309302133.886182 delivery 74116: deferral: 200.147.36.15_does_not_like_recipient./Remote_host_said:_450_4.7.1_Client_host_rejected:_cannot_find_your_hostname,_[78.153.208.195]/Giving_up_on_200.147.36.15./ Jun 29 00:02:13 vps-1001108-595 qmail: 1309302133.886255 status: local 0/10 remote 8/20 Jun 29 00:02:13 vps-1001108-595 qmail: 1309302133.898266 delivery 74115: deferral: 187.31.0.11_does_not_like_recipient./Remote_host_said:_450_4.7.1_Client_host_rejected:_cannot_find_your_hostname,_[78.153.208.195]/Giving_up_on_187.31.0.11./ Jun 29 00:02:13 vps-1001108-595 qmail: 1309302133.898327 status: local 0/10 remote 7/20 Jun 29 00:02:14 vps-1001108-595 qmail: 1309302134.137833 delivery 74111: deferral: Sorry,_I_wasn't_able_to_establish_an_SMTP_connection._(#4.4.1)/ Jun 29 00:02:14 vps-1001108-595 qmail: 1309302134.137914 status: local 0/10 remote 6/20 Jun 29 00:02:19 vps-1001108-595 qmail: 1309302139.903536 delivery 74000: failure: 209.85.143.27_failed_after_I_sent_the_message./Remote_host_said:_550-5.7.1_[78.153.208.195_______1]_Our_system_has_detected_an_unusual_rate_of/550-5.7.1_unsolicited_mail_originating_from_your_IP_address._To_protect_our/550-5.7.1_users_from_spam,_mail_sent_from_your_IP_address_has_been_blocked./550-5.7.1_Please_visit_http://www.google.com/mail/help/bulk_mail.html_to_review/550_5.7.1_our_Bulk_Email_Senders_Guidelines._e25si1385223wes.137/ Jun 29 00:02:19 vps-1001108-595 qmail: 1309302139.903606 status: local 0/10 remote 5/20 Jun 29 00:02:19 vps-1001108-595 qmail-queue-handlers[15501]: Handlers Filter before-queue for qmail started ... EDIT #2 Here's the output of netstat -p with the imap and imaps lines removed. I also removed my own ssh session Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 1 78.153.208.195:40076 any-in-2015.1e100.net:smtp SYN_SENT 24096/qmail-remote. tcp 0 1 78.153.208.195:40077 any-in-2015.1e100.net:smtp SYN_SENT 24097/qmail-remote. udp 0 0 78.153.208.195:48515 125.64.11.158:4225 ESTABLISHED 20435/httpd

    Read the article

  • How to solve "Warning: mail() [function.mail]: SMTP server response: 530 Relaying not allowed - sender domain not local in D:\\... " Error?

    - by Kiran Rs
    I have a contact page where users can contact me via that form. But I'm getting this error, Warning: mail() [function.mail]: SMTP server response: 530 Relaying not allowed - sender domain not local in D:\INETPUB\VHOSTS\nextoption.in\httpdocs\auto-replay\contact.php on line 33 My Php code is, if(isset($_POST['send'])) //if "email" is filled out, send email { //send email $email1=$_POST['email']; $headers = "From: My site\r\n"; $headers .= "Reply-To: [email protected]\r\n"; $headers .= "Return-Path: [email protected]\r\n"; $headers .= "X-Mailer: Drupal\n"; $headers .= 'MIME-Version: 1.0' . "\n"; $headers .= 'Content-type: text/html; charset=iso-8859-1' . "\r\n"; $to = "[email protected]"; $subject = "Test mail"; $message = "Hello!This is a simple email message $from = $email1; mail($to,$subject,$message,$headers); ? alert ("Enquiry form submited successfully ! We'll get back you soon "); What will be my fault..... What is the Fault in SMTP Server?

    Read the article

< Previous Page | 12 13 14 15 16 17 18 19 20 21 22 23  | Next Page >