Subject: About spam mail

From: [email-masked]
Date: Mon, 8 Jan 2001 10:53:08 +0800 (CST)

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

  use smap to encapsulation sendmail, but many many spam mails went to our email server, and I modifyed the sendmail.cf, in which change an item like this:

O PrivacyOptions=authwarnings # orignal
O PrivacyOptions=authwarnings, noexpn, novrfy # Now I used

but when I telnet the firewall port 25, the command "expn" & "vrfy" is still active! and How can I deal with this problem? Ted.

_____________________________________________
�׶�����--�й��˵����ϼ�԰ http://www.263.net
@263.net�й����������ʾ� http://freemail.263.net
�й��˵����߹�����԰����263�̳� http://shopping.263.net
������ѧ��ѯ-�й����������� http://edu.263.net/

---

From: Ted Keller <[email-masked]>
Date: Mon, 8 Jan 2001 22:38:51 -0500 (EST)

smap has a set of built in functions which include support for expn and
vrfy.  However, they simply echo the email address entered - and no real
lookups against the system occur.  Therefore - it provides no useful
information.

Sendmail is never contacted for these functions.  That's why your sendmail
modifications had no effect.

ted keller

---

From: Jan Muenther <[email-masked]>
Date: Tue, 09 Jan 2001 09:30:27 +0000

Hi,

> but when I telnet the firewall port 25, the command "expn" & "vrfy" is still active! and How can I deal with this problem? Ted.

As you were already told, twiddling the sendmail config won't
help, since smap's the external wrapper. Above that, EXPN and
VRFY have no direct effect on spamming. They're there to verify
whether a certain address exists and which user may be behind it.
This can be used to find out valid user names, which is half way
for a successful attack. 

Spamming is caused by letting people use your mail host as a
relay. Unfortunately, smap does this by default. You'll have to
patch it to stop this behaviour. Get the Yao patch from fwtk.org
and read the comments in the source to find out what to do about
it. 

Cheers, Jan

-- 
Radio HUNDERT,6 Medien GmbH Berlin
- EDV -
[email-masked]

---

From: "auther_bin" <[email-masked]>
Date: Tue, 9 Jan 2001 16:45:34 +0800

Now I find the reason of so much spam mail, for I recived many unkonwn mails from our inside email server, these letters' head writed like this:

from: <>
RPPT TO:<[email-masked]>
.........

So smap accept this mail, and put it into it's queue. And no next works.