我在网上找了很多资料，都没有说到这方面的东西，我已经加了SMTP认证的，在OPEN RELAY TEST的时候，发现有一种情况是可以发信的，就是RCPT TO：test%test.com的时候，他会成功送出!!晕。percenthack的文件是不存在的。但他还是发了出去，有谁知道这方面的问题，请告知，谢谢
http://linux.slcatv.com.cn/linuxbbs/
artxing 回复于：2003-12-26 11:35:00
我发现有一部分人经常会出现这个问题.但是安装方法是没错的.
但我安装过很多次都没有这个问题.
所以我也不知道该怎么解决.
eamon 回复于：2003-12-29 13:37:59
啊，不是吧!难到是我们的包有问题，安装方法应该不存在问题。真是难搞呀。
qujidong 回复于：2003-12-29 15:28:05
no.1
eamon 回复于：2003-12-29 15:36:21
我是不是开了VIRTUREDOMAIN。那个PERCENTHACK就不起作用了吗？？真是的，当我发到test%test.com的时候，实际上是发给：test%test.com@mydomain.com!我看到他是这样做的。当然这信是不能发出去了，但在OPEN RELAY TEST的时候，老是显示OK。。气死了。我们公司进了外国佬的SPAM LIST。写信给他们，他们又说我们还是OPEN RELAY。就是用http://members.iinet.net.au/~remmie/relay/测试的。谁帮帮我啊！！
prodou 回复于：2003-12-29 16:02:14
引用：我是不是开了VIRTUREDOMAIN。那个PERCENTHACK就不起作用了吗？？真是的，当我发到test%test.com的时候，实际上是发给：test%test.com@mydomain.com!我看到他是这样做的。当然这信是不能发出去了，但在OPEN RELAY TEST的时候，老是显示OK。。气死了。我们公司进了外国佬的SPAM LIST。写信给他们，他们又说我们还是OPEN RELAY。就是用http://members.iinet.net.au/~remmie/relay/测试的。谁帮帮我啊！！
关注、关注，进了SPAM LIST可就不好玩了
eamon 回复于：2003-12-30 09:48:50
找了一天的时间，终于找到了一个SMTP的PATCH。我安装后没事了。
--- orig/qmail-smtpd.c Mon Jun 15 06:53:16 1998
+++ qmail-smtpd.c Sat Feb 9 12:07:19 2002
@@ -53,6 +53,7 @@
void err_nogateway() { out("553 sorry, that domain isn't in my list of allowed rcpthosts (#5.7.1)\r\n"); }
void err_unimpl() { out("502 unimplemented (#5.5.1)\r\n"); }
void err_syntax() { out("555 syntax error (#5.5.4)\r\n"); }
+void err_relay() { out("553 we don't relay (#5.7.1)\r\n"); }
void err_wantmail() { out("503 MAIL first (#5.5.1)\r\n"); }
void err_wantrcpt() { out("503 RCPT first (#5.5.1)\r\n"); }
void err_noop() { out("250 ok\r\n"); }
@@ -216,6 +217,21 @@
return r;
}
+int addrrelay()
+{
+ int j;
+ j = addr.len;
+ while(--j >;= 0)
+ if (addr.s[j] == '@') break;
+ if (j < 0) j = addr.len;
+ while(--j >;= 0) {
+ if (addr.s[j] == '@') return 1;
+ if (addr.s[j] == '%') return 1;
+ if (addr.s[j] == '!') return 1;
+ }
+ return 0;
+}
+
int seenmail = 0;
int flagbarf; /* defined if seenmail */
@@ -250,6 +266,7 @@
void smtp_rcpt(arg) char *arg; {
if (!seenmail) { err_wantmail(); return; }
if (!addrparse(arg)) { err_syntax(); return; }
+ if (addrrelay()) { err_relay(); return; }
if (flagbarf) { err_bmf(); return; }
if (relayclient) {
--addr.len;
-------------------------------->;
http://linux.slcatv.com.cn/linuxbbs/
zz 回复于：2003-12-30 14:34:20
我以前就是这样，装了补丁，open play还是关不了，最后用的是以前讨论的一个补丁，artxing——我忘了那个补丁叫什么了，装上就好了！artxing还记得吗？fgay（名字忘了）那个搞研发的！
eamon 回复于：2003-12-30 16:05:36
惨呀，我现在搞好那个OPEN RELAY 但那个外国佬还是不让通过，说我的服务器不是RFC标准，晕啊。你们看看他回的邮件：
Subject: Re: Fw: MAPS RSS Remove Request: mydomain.com
>; We have our own tester and series of tests. No other organization performs
>; the tests that we do, and we cannot and do not rely on any relay test data
>; other then our own. While we appreciate that you have used other testers,
>; to be removed from the RSS your IP must test secure using our tester.
>;
>; We queued a re-test this evening. The results remain the same:
>;
>; Mon Dec 29 19:00:03 2003
>;
>; Connecting to mydomain.com ...
>; <<< 220 mydomain.com ESMTP
>; >;>;>; EHLO cygnus.mail-abuse.org
>; <<< 250-mydomain.com250-AUTH=LOGIN250-AUTH LOGIN250-PIPELINING250
>; 8BITMIME
>; >;>;>; AUTH LOGIN
>; <<< 334 VXNlcm5hbWU6
>; >;>;>; VXNlcm5hbWU6
>; <<< 334 UGFzc3dvcmQ6
>; >;>;>; UGFzc3dvcmQ6
>; <<< user invalid username:\n
>; >;>;>; RSET
>; <<< 535 auth failure
>; >;>;>;
>; >;>;>;
>; connection on port 25 was terminated
>;
>; Tested mydomain.com using mydomain.com
and [mydomain.com]
>; Banner: mydomain.com ESMTP
>; Accepted 0 of 0
>; test done
>;
>; mydomain.com test finished.
>;
>; There is nothing in the RFC's that states your mail server should
>; disconnect after an SMTP AUTH failure. We perform this check as we
>; discovered an SMTP AUTH bug and vulnerability earlier this year that was
>; allow spam to be relayed through otherwise secure servers.
>;
>; You need to review your configuration again, or contact your mail server
>; software vendor for support, and allow us to perform our tests. You should
>; also feel free to review the RFC's that deal with mail servers, their
>; behavior, and SMTP transactions at www.ietf.org.
>;
>; --
>; Susan Tait
>; MAPS LLC
eamon 回复于：2003-12-30 17:39:37
我想问问你们，你们用telnet mydomain.com 25来测试的时候，当用户认证失败的时候会退出联接吗？？我的就是退出联接，鬼佬就说不行！！是不是我的qmail-smtpd.c有问题？SOS
----------------------------------------------
ehlo
250-mydomain.com
250-AUTH=LOGIN
250-AUTH LOGIN
250-PIPELINING
250 8BITMIME
auth login
334 VXNlcm5hbWU6
test
t334 UGFzc3dvcmQ6
test
user invalid 惦-
535 auth failure
失去了跟主机的连接。
--------------------------------------------
COME ON!!!
qujidong 回复于：2003-12-30 18:44:37
good
gadfly 回复于：2003-12-30 20:39:10
换个patch试试看吧
eamon 回复于：2003-12-31 09:19:57
你们试过是没有掉的吗？？？我换了几个PATCH也一样啊。加了认证就会掉线的，当认证不通过的时候。闷啊。。
谁有好的PATCH是不会掉线的呀，给我一个，谢谢。
linliangxu@21cn.com
eamon 回复于：2003-12-31 18:11:56
成功了。妈的，都是qmail-smtp.c搞的鬼。你们如果是用QMAIL应该和我一样的。因为我看了他的代码，如果认证不通过他会exit的。。没有办法我只能把他给去了，让他符合RFC。但有可能会受loop attack！：）
void smtp_auth(arg) char *arg; {
int st, pid, fds[2];
/* netscape 4.5 sends AUTH LOGIN <base64encodedusername>;
microsoft outlook express sends AUTH LOGIN
idea is simple
use an external program to test authority
if success, set 'RELAYCLIENT'
otherwise, let them know nicely (hangup)
note, i really don't like djb's coding style even though i'm using it here.
i think using spaces for tabs is bad.
-mrs.brisby@nimh.org
*/
while (arg && *arg && *arg != ' ') arg++;
/* pass over the space */
while (arg && *arg && *arg == ' ') arg++;
if (arg && *arg) {
/* here's the base64 encoded login */
base64_dec_buffer(arg, smtpauthlogin, sizeof(smtpauthlogin));
} else {
out("334 VXNlcm5hbWU6\r\n"); /* b64 <- 'Username:' */
flush();
if (smtpauth_getl() >; 0)
base64_dec_buffer(smtpauth.s, smtpauthlogin, sizeof(smtpauthlogin));
else
die_read();
}
out("334 UGFzc3dvcmQ6\r\n"); /* b64 <- 'Password:' */
flush();
if (smtpauth_getl() >; 0)
base64_dec_buffer(smtpauth.s, smtpauthpass, sizeof(smtpauthpass));
else
die_read();
if (pipe(fds)) {
out("535 pipe failure\r\n");
flush();
_exit(0);
}
/* spawn external program
external program should return '0' if it was successful,
submit: /bin/checkpassword /bin/true
*/
switch ((pid=fork())) {
case -1: die_nomem();
case 0: close(fds[1]);
fd_copy(3,fds[0]);
execvp(smtpauth_argv[1], smtpauth_argv+1);
die_nomem();
};
close(fds[0]);
write(fds[1], smtpauthlogin, str_len(smtpauthlogin)+1);
write(fds[1], smtpauthpass, str_len(smtpauthpass)+1);
close(fds[1]);
wait_pid(&st, pid);
if (wait_exitcode(st) == 0) {
out("235 go ahead\r\n");
flush();
relayclient="";
return;
}
sleep(2);
out("535 auth failure\r\n"); flush(); _exit(0);###把_exit(0)给去了。呵可这就没有问题了。。。
/* done */
}
|
