Subject: [fwtk-users] RE: SMAP

From: "Hutchison, Chris" <[email-masked]>
Date: Mon, 9 Dec 2002 23:57:59 -0500

I'm hoping this reaches the fwtk email list.  I have been having trouble
posting and receiving.
Lucky for me Ted Keller was kind enough to help me with my smap questions
directly.

I'm posting this one to confirm that I have resolved my smap problems and to
share the information Ted gave.

Thanks again for your help Ted.
Chris

-----Original Message-----
From: Keller, Ted
Sent: December 9, 2002 9:23 PM
To: 'Hutchison, Chris '
Subject: RE: SMAP

Chris,

See answers below....

tek

-----Original Message-----
From: Hutchison, Chris
To: 'Keller, Ted'
Sent: 12/9/2002 8:45 AM
Subject: RE: SMAP

Ted, 

Just added the postmaster entry and its seems to have resolved the segv.

It looks like everything is good now. 

I have just a couple of quick questions. 

1. What are the following log messages trying to tell me: 
        "Security: Remote Client Confused host=unknown/202.141.25.233" 
        "Notice: Remote Clinet Buffer: EHLO mail11.uunets.ca^M" 

I've noted over time that there are some poor imitation e-mail servers out
there that simply don't understand rfc821 protocols.  What we see with them
are sequences like....

ehlo xxx
500 unrecognized command
from <abc.dat>
500 must say hello
...

inother words - the remote system didn't autofall back to the helo command -
simply ignored the error message - and continued on.  Now - we continued to
send back error meesages - we will get ourselves in a loop with some bad
behaving remote servers that simply don't give up - but try to continously
get through our e-mail systems.  This almost results in a denail of service
type attack.  So what I did was to implement some error counters - the
number of bad commands since the last good command.  And if we exceed the
threshold (something like 10 bad commands in a row) I know that I don't want
to talk to them - print out the error - and exit.

Now the second entry is the optional feature of printing out when we detect
an error in the remote client stream.

2. In my last email I asked about blocking all address to a specific domain
with the exception of only a few.  Can this be done and if so how.

Well - let's think about this...  I suspect we could do something like

from @aol.com>

 in the spamlist.dat file - then have entries like

<[email-masked]>

in the trusted domain file.  I think this would work...

3. As part of my debugging process I would have loved to capture the
original email to see why it was rejected by smap.  Is there a way to
capture the session and email but not deliver it for whatever the reject
reason may have been?

For internal hosts - I report the reason for the reject in the 552 error
message. - and log it in syslog.

For external hosts - I only log it in syslog.  The syslog entries try to
capture the scan stream "in context" - by printing out what immediatly
precedes and follows the offending phrase.

-----------------

Now - there is also a debug option in the netperm-table.  This doesn't quite
work the way you are asking - but will allow you to capture a message in the
inspool directory if it detects the phrase in the message - this then allows
you to review the complete message manually.  It will delete any messages,
however, that it detects the spam phrase in.

This will be the end of my bugging you ( I hope ).  I do appreciate all your
efforts. 
I have been using the FWTK for a number of years but never became an expert
due to the lack of "C" knowledge.  Everyone at our place is a Microsoft
worshiper so I carry the lone Unix / Linux torch.  I think the toolkit is a
great way to help protect the weak Microsoft world.

Thanks again for all your help! 
Chris 

-----Original Message----- 
From: Keller, Ted 
Sent: December 7, 2002 7:37 PM 
To: 'Hutchison, Chris ' 
Subject: RE: SMAP 

Chris, 

OK - This is just about the time when we create the temp sma file - and
write the header.  There is special logic in the code to insert the
postmaster mail address for outbound.  I tend to use this because a number
of sites will not accept null mail addresses.  I wonder...  (I will look
just a bit later) if by not having a postmaster entry - I reference a out of
bounds address for that substitution process.... (hmmm - you just can't get
good coders anymore....).  Let me know if you have a smap postmaster entry -
or if you deleted it.  I will assume for the time being that you don't - and
will check the code to ensure I process that stuff correctly.

tek 

-----Original Message----- 
From: Hutchison, Chris 
To: 'Keller, Ted' 
Sent: 12/7/2002 5:10 PM 
Subject: RE: SMAP 

Ted, 

Thanks for getting back to me.  I was in a bit of a crises last Thursday but
was able to put in a work around. 

I have attached a copy of my netperm-table although I don't think that is
the problem. 
I only get the segv errors under this one condition. 

When a local-host connects to smap and gives a "mail from: <>", its causes
the smap program to segv right after you hit enter on the DATA command.  You
can see this displayed at the bottom of this email.

At first I thought it was exchange being a Microsoft product and all, but I
can reproduce it using telnet on port 25. 

I was also wondering if you can block a complete domain and only allow a
handful of valid email address. 
I have two other domains with a total of 10-15 users each and I get A LOT of
spam. 

If you need more info I will have to forward it Monday. 

Thanks for your help. 

Chris 

-----Original Message----- 
From: Keller, Ted
Sent: December 7, 2002 1:49 PM 
To: [email-masked]' 
Subject: RE: SMAP 

Chris, 

I'm convinced that the fwtk list is broken.... 

Can you forward me a copy of your smap netperm-table config entries? Also,
if you can capture it - a tcpdump of the incoming line that causes the segv.
I haven't seen any of these .... so I'm a bit baffled.  My best guess
possibly is that MS exchange is passing some extended smtp entries on the
line that I don't expect for some reason.  Would like to see the input - and
what was sent just prior to the segv.  Null addresses are permitted....

tek 

-----Original Message----- 
From: Hutchison, Chris
Sent: Thursday, December 05, 2002 1:19 PM 
To: [email-masked]' 
Subject: SMAP 

Hi Ted, 

Sorry to email you direct but I'm not sure if my email's to the list are
working. 
I recently changed domain names and had to re subscribe. 

Below is the email I sent to the fwtk-list.  I would appreciate any help you
could give. 

Thanks 
Chris 

P.S. do you have a syslog.conf file that will redirect all fwtk messages to
a separate file? 

Not sure if this went through the first time. 

I am having two new problems with smap.  Both cause the following error:

Nov 29 11:13:52 smtp4 smap[2624]: connect host=exng.tbs.ca/192.168.201.30
Nov 29 11:13:52 smtp4 smap[2625]: connect host=exng.tbs.ca/192.168.201.30
Nov 29 11:13:52 smtp4

smap[2627]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:52 smtp4
smap[2620]: received SIGSEGV (segmentation error), aborting 

Nov 29 11:13:52 smtp4 smap[2618]: received SIGSEGV (segmentation error),
aborting 
Nov 29 11:13:53 smtp4 smap[2629]: connect host=exng.tbs.ca/192.168.201.30
Nov 29 11:13:53 smtp4 smap[2621]: received SIGSEGV (segmentation error),
aborting 

Nov 29 11:13:53 smtp4 smap[2630]: connect host=exng.tbs.ca/192.168.201.30
Nov 29 11:13:53 smtp4 smap[2627]: received SIGSEGV (segmentation error),
aborting 

Nov 29 11:13:54 smtp4 smap[2636]: connect host=exng.tbs.ca/192.168.201.30
Nov 29 11:13:54 smtp4 smap[2629]: received SIGSEGV (segmentation error),
aborting 

Nov 29 11:13:54 smtp4 smap[2630]: received SIGSEGV (segmentation error),
aborting 
Nov 29 11:13:54 smtp4 smap[2634]: received SIGSEGV (segmentation error),
aborting 
Nov 29 11:13:54 smtp4 smap[2633]: received SIGSEGV (segmentation error),
aborting 
Nov 29 11:13:55 smtp4 smap[2636]: received SIGSEGV (segmentation error),
aborting 

It only appears to happen from internal connections, specifically from
Microsoft Exchange. The session shown below also causes a SIGSEGV error.
Note the MAIL FROM: <>  line. I'm guessing an empty from line is not valid??
This may be normal behaviour for smap for outbound traffic however the error
doesn't happen for inbound.

polar:/home/admin% telnet cor_smtp4 25 
Trying 192.168.201.244... 
Connected to smtp4.bws.com. 
Escape character is '^]'. 
220 smtp4 SMTP/smap Ready. 
EHLO diamond.bri.bws.com 
500 Command unrecognized 
HELO diamond.bri.bws.com 
250 (diamond.bri.bws.com) pleased to meet you. 
MAIL FROM:<> 
250 <>... Sender OK 
RCPT TO:<[email-masked]> 
250 <[email-masked]> OK 
DATA 
354 Enter mail, end with "." on a line by itself 
Connection closed by foreign host. 
polar:/home/admin% 

As a result of this error my smap spool directory is quickly filling with
empty sma?????? files. Any thoughts? 

Chris 

 <<netperm-table.txt>> 

---
You are currently subscribed to fwtk-users as: [email-masked]
To unsubscribe send a blank email to [email-masked]