Virus/Worms/Spam problem from portuguese dial-in mail server ?

Virus/Worms/Spam problem from portuguese dial-in mail server ?

[Martin Langer]

Rui,

damned. What's that? A dial-in account for spammers from netcabo.pt???
Still in hope that you're not the reason for my virus/worm traffic explosion.
Please, don't take it personally. It's only the spam/virus traffic I hate.

The reason, why you are on the IP blacklist is obvious: You are sending Spam.
Nevertheless netcabo.pt shouldn't allow this...


martin



Received: from localhost ([127.0.0.1] helo=projects.sourceforge.net)
	by sc8-sf-list2.sourceforge.net with esmtp (Exim 4.30)
	id 1B9Zxr-0001m5-4G; Fri, 02 Apr 2004 17:28:51 -0800
Received: from sc8-sf-mx2-b.sourceforge.net ([10.3.1.12] helo=sc8-sf-mx2.sourceforge.net)
	by sc8-sf-list2.sourceforge.net with esmtp (Exim 4.30)
	id 1B9Zw2-0001Gi-Sw
	for alsa-devel@lists.sourceforge.net; Fri, 02 Apr 2004 17:26:58 -0800
Received: from a213-22-206-106.netcabo.pt ([213.22.206.106] helo=beta.rncbc.lan)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
	by sc8-sf-mx2.sourceforge.net with esmtp (Exim 4.30)
	id 1B9Zw2-00084U-2T
	for alsa-devel@lists.sourceforge.net; Fri, 02 Apr 2004 17:26:58 -0800
Received: from www.rncbc.org (localhost [127.0.0.1])
	by beta.rncbc.lan (8.11.6/8.11.0) with SMTP id i331OGW07653;
	Sat, 3 Apr 2004 02:24:16 +0100
Received: from gamma.rncbc.lan ([192.168.1.5])
        (SquirrelMail authenticated user rncbc)
        by www.rncbc.org with HTTP;
        Sat, 3 Apr 2004 02:24:16 +0100 (WEST)

-- 
                                     Living on earth may be expensive,
                   but it includes an annual free trip around the sun. 


-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click

Re: Virus/Worms/Spam problem from portuguese dial-in mail server ?

[Rui Nuno Capela]

Martin,

> Rui,
>
> damned. What's that? A dial-in account for spammers from netcabo.pt???

No dial-in but cable. Netcabo.pt is my ISP, and rncbc.org is just my own
dynamic DNS domain name, although it's IP address hasn't change for almost
more than an year.

> Still in hope that you're not the reason for my virus/worm traffic
> explosion. Please, don't take it personally. It's only the spam/virus
> traffic I hate.

I hate it too, and thank you for pointing me out. Maybe I'm a bit relaxed
about my sendmail administration, but I am confident that it's not
configured as an open relay. I will check it out a little more deeper,
rest assured.

>
> The reason, why you are on the IP blacklist is obvious: You are sending
> Spam.
>

If that's happening it's not with my consent, but I'll do my homework
research, nevertheless.

>
> Received: from localhost ([127.0.0.1] helo=projects.sourceforge.net)
> 	by sc8-sf-list2.sourceforge.net with esmtp (Exim 4.30)
> 	id 1B9Zxr-0001m5-4G; Fri, 02 Apr 2004 17:28:51 -0800
> Received: from sc8-sf-mx2-b.sourceforge.net ([10.3.1.12]
> helo=sc8-sf-mx2.sourceforge.net)
> 	by sc8-sf-list2.sourceforge.net with esmtp (Exim 4.30)
> 	id 1B9Zw2-0001Gi-Sw
> 	for alsa-devel@lists.sourceforge.net; Fri, 02 Apr 2004 17:26:58 -0800
> Received: from a213-22-206-106.netcabo.pt ([213.22.206.106]
> helo=beta.rncbc.lan)
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> 	by sc8-sf-mx2.sourceforge.net with esmtp (Exim 4.30)
> 	id 1B9Zw2-00084U-2T
> 	for alsa-devel@lists.sourceforge.net; Fri, 02 Apr 2004 17:26:58 -0800
> Received: from www.rncbc.org (localhost [127.0.0.1])
> 	by beta.rncbc.lan (8.11.6/8.11.0) with SMTP id i331OGW07653;
> 	Sat, 3 Apr 2004 02:24:16 +0100
> Received: from gamma.rncbc.lan ([192.168.1.5])
>         (SquirrelMail authenticated user rncbc)
>         by www.rncbc.org with HTTP;
>         Sat, 3 Apr 2004 02:24:16 +0100 (WEST)
>

What's the trouble with these headers?

AFAICT it's a perfectly normal header to me, and it traces a message
written by ME (rncbc) using SquirrelMail, that is serving as webmail
client on MY HTTP server (www.rncbc.org), and was served on MY intranet
SMTP (beta.rncbc.lan), which I think is closed within it. The message was
sent to alsa-devel@lists.sourceforge.net, which I'm a legal subscriber.

Note that rncbc.org is one of my own domain names that points to the same
IP address (a213-22-206-106.netcabo.pt) which is a dynamic DNS one.
Nothing strange about it, at least to me ;) It's a perfectly legal header.

Please do check on your received spam if anything really relates to me. I
still don't know why my IP's being blacklisted.

Help me out in clearing this up. Please.
-- 
rncbc aka Rui Nuno Capela
rncbc@rncbc.org


-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click

[OT] Re: Virus/Worms/Spam problem from portuguese dial-in mail server ?

[Martin Langer]

On Sun, Apr 04, 2004 at 05:46:35PM +0100, Rui Nuno Capela wrote:
> >
> > damned. What's that? A dial-in account for spammers from netcabo.pt???
> 
> No dial-in but cable. Netcabo.pt is my ISP, and rncbc.org is just my own
> dynamic DNS domain name, although it's IP address hasn't change for almost
> more than an year.
> 

Is it possible to run a local smtp server without using the smarthost of
your provider by dynamic IP. Then it's easy to spam around. So I
understand the reason why those IPs are blacklisted. Dynamic IP's aren't
static. 

> > Still in hope that you're not the reason for my virus/worm traffic
> > explosion. Please, don't take it personally. It's only the spam/virus
> > traffic I hate.
> 
> I hate it too, and thank you for pointing me out. Maybe I'm a bit relaxed
> about my sendmail administration, but I am confident that it's not
> configured as an open relay. I will check it out a little more deeper,
> rest assured.

If it's a dynamic IP range and someone spams there, they will blacklist the
whole range. Blacklisting only one IP wouldn't solve the problem.

> Help me out in clearing this up. Please.

I remember a similar discussion in a longer thread here:
http://www.music.columbia.edu/pipermail/linux-audio-dev/2003-September/004935.html

Use a smarthost for your mails and the sun will shine again.


martin

-- 
                                     Living on earth may be expensive,
                   but it includes an annual free trip around the sun. 


-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click