Subject: mails not delivered due to possible spoof

From: Holger Will <[email-masked]>
Date: Wed, 08 Nov 2000 10:46:49 +0100

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hello,

as far I have had understood the docs if a sending
mailserver does not have a correct A or PTR record
smap is logging a message about a poosible spoof
but should accept the message for further delivery.

But on our system this is definitly not the case. I
get messages like this:

smap[14831]: securityalert: possible spoof
NS.Nepustil.NET/193.96.243.22 != 212.71.192.22 name lookup mismatch

but the mail is not accepted. Since the sending
servers tries to send the message again every 3
minutes, this is very annoying. I've had applied
the yao-patch to smap.c. Maybe that's why the smap
is so strict in its behavior?
-- 
Holger Will

---

From: Ted Keller <[email-masked]>
Date: Wed, 8 Nov 2000 08:51:53 -0500 (EST)

Holger,

In an earlier version of the fwtk - lib/pname.c used to return an error if
the reverse lookup name did not match.  As I remember, pname.c, if it
detects a difference, jumps to "badguy" where he returns something other
than a success.  You should be able to do a return (0) there and solve
this problem.

ted keller

---

From: Holger Will <[email-masked]>
Date: Thu, 09 Nov 2000 14:59:20 +0100

Ted,

thanks for your answer. Unfortunetly this didn't solve my problem.

You mean this part:
...
syslog(LLEV,"securityalert: possible spoof %.512s/%.20s != %.512s name
lookup mismatch",lname,sname,inet_ntoa(a.sin_addr));
------->            goto badguy;
        }

        for(x = lname; *x != '\0'; x++)
            if(isupper((unsigned char)*x))
                *x = tolower((unsigned char)*x);
        return(0);
    }
badguy:
    strcpy(lname,unknown);
    return(0);
}
I've changed it to return(0) and compiled the libs and smap again --> no
success.

The second try was to change the line to

    strcpy(lname,unknown);
    return(0);

to ensure that it returns "unknown" for this host ---> no success too.

Any other ideas?

-- 
Holger Will

> Von: Ted Keller <[email-masked]>
> Datum: Wed, 8 Nov 2000 08:51:53 -0500 (EST)
> An: Holger Will <[email-masked]>
> Cc: [email-masked]
> Betreff: Re: mails not delivered due to possible spoof
>

---

From: Ted Keller <[email-masked]>
Date: Thu, 9 Nov 2000 13:32:36 -0500 (EST)

Holger,

You have the spot I was remembering.  The return (0) should be correct.

Revalidate that you are executing the new version ...in the meantime - let
me ponder....

tek

---

From: Rick Murphy <[email-masked]>
Date: Thu, 09 Nov 2000 18:20:55 -0500

>but should accept the message for further delivery.

That's true, *if you don't have it set up to reject it*. For the Joe Yao 
patch, turning on "smap: check-from-address 1" works the way you describe.
The repeated resends are an unfortunate side-effect of badly implemented 
SMTP servers; they don't recognize the fatal error and requeue the message. 
I had one of these that requeued it immediately, to the tune of tens of 
thousands of attempts.
         -Rick

---

From: Holger Will <[email-masked]>
Date: Fri, 10 Nov 2000 11:49:45 +0100

Rick,

I've checked this but the problem still remains the same.

Currently there are two servers which cause this problem. Both have
uppercase letters in their name, maybe this causes the problem.

Additionally I get a connect host ... message but neither deny host ... nor
permit host ... messages.

-- 
Holger Will

> Von: Rick Murphy <[email-masked]>
> Datum: Thu, 09 Nov 2000 18:20:55 -0500
> An: Holger Will <[email-masked]>, <[email-masked]>

---

From: Rick Murphy <[email-masked]>
Date: Fri, 10 Nov 2000 14:28:16 -0500

>permit host ... messages.

I never see permit or deny host messages from smap.

What you may be seeing is a host with a broken PTR lookup. If you try a 
nslookup for the name (nslookup 1.2.3.4), dig -x 1.2.3.4 does it take a 
long time? If so, you could be seeing a timeout due to the overhead of the 
name lookup. Smap looks up the hostname for each entry in your 
netperm-table 'smap: spam xxxxx" list.
          -Rick

---

From: Holger Will <[email-masked]>
Date: Mon, 13 Nov 2000 10:12:37 +0100

Since I applied the yao-Patch I get a permit or deny message for each
connect:

Nov 12 21:21:37 is smap[26250]: connect
host=max3pool146.vegasnet.net/208.147.126.146
Nov 12 21:21:39 is smap[26247]: deny
host=max3pool146.vegasnet.net/208.147.126.146 use of gateway
Nov 12 21:21:39 is smap[26247]: fwtksyserr: Mail not local <[email-masked]>
(this is a relaying attempt)

or (normal):

Nov 13 06:06:18 is smap[26648]: connect
host=neo.daxinternet.com/209.219.103.10
Nov 13 06:06:19 is smap[26648]: permit
host=neo.daxinternet.com/209.219.103.10 use of gateway
Nov 13 06:06:19 is smap[26648]: host=neo.daxinternet.com/209.219.103.10
bytes=12761 from=<[email-masked]>
to=<[email-masked]> xma026648
Nov 13 06:06:19 is smap[26648]: exiting
host=neo.daxinternet.com/209.219.103.10 bytes=12761
Nov 13 06:06:36 is smapd[26649]: delivered file=sma026648 pid=26650 code=0

but in the case of the discussed problem I only get a

Nov 13 05:44:15 is smap[26629]: securityalert: possible spoof
NS.Nepustil.NET/193.96.243.22 != 212.71.192.22 name lookup mismatch
Nov 13 05:44:15 is smap[26629]: connect host=NS.Nepustil.NET/193.96.243.22

and nothing else.

nslookup and dig behave normal (3ms), but of course there is a problem
because the entries are different.

nslookup ns.nepustil.net

Non-authoritative answer:
Name:    ns.nepustil.net
Address:  212.71.192.22

nslookup 193.96.243.22

Name:    NS.Nepustil.NET
Address:  193.96.243.22

-- 
Holger Will

> Datum: Fri, 10 Nov 2000 14:28:16 -0500