stop the relay

  • From: "Stelley, Doug" <dstelley@xxxxxxx>
  • To: "[ExchangeList]" <exchangelist@xxxxxxxxxxxxx>
  • Date: Tue, 27 May 2003 10:36:46 -0400

OK, 
    When we first setup our Exchange, we installed an SMTP server in our
DMZ to handle inbound mail. We weren'r fast enough on protecting from
relaying though and for about 4 hours on that day (early February), that
SMTP server was open for relaying. Damned if someone in malaysia didn't
find it and start relaying through us!. We stopped it (the server)
reconfigured it, started it back up and all was well, no one can use it
as a relay, we get  mail through it, send mail through it, all good
right? No.
    It does work as designed, however we still get 4-500 mails an hour
from some putz trying to use it. He can't, but for each message, he gets
a non delivery. This still floods our system with un-needed traffic.
   Here's what I see,
    The person establishes an SMTP copnnection on port 25
    They send the message
    Our server digests it, sees we cannot accept messages for relay 
    send off a notification to the sendor stating that fact.
    The sender then sends the next message, and on and on for ever and
ever.
My question.
    How can I make this stop!
Just because some A-Whole had an open port for a couple of hours months
ago, now I get his spam mail 24 hours a day.
 
Doug Stelley
Network Admin.
Olean General Hospital
(716)375-7320

Logic is a tweeting bird in a green meadow. - Mr. Spock 
 


_________________
Confidentiality Notice: The information contained in this message may be 
legally privileged and confidential information intended only for the use of 
the individual or entity named above. If the reader of this message is not the 
intended recipient, or the employee or agent responsible to deliver it to the 
intended recipient, you are hereby notified that any release, dissemination, 
distribution, or copying of this communication is strictly prohibited. If you 
have received this communication in error please notify the author immediately 
by replying to this message and deleting the original message. Thank you.


Other related posts: