Mailing List Archive: Is My Qmail Email Server an Open Relay?

Is My Qmail Email Server an Open Relay?

Mar 31, 2014, 1:01 AM

Post #1 of 4 (2164 views)

Hi,

This is my /etc/tcp.smtp.

[root@centos-6 ~]# cat /etc/tcp.smtp
127.:allow,RELAYCLIENT=""
192.168.1.:allow,RELAYCLIENT=""
:allow,RELAYCLIENT=""

[root@centos-6 ~]# cat /var/qmail/control/rcpthosts
teo-en-ming.com
zhang-enming.com

[root@centos-6 ~]# /var/qmail/bin/qmail-qread
29 Mar 2014 15:24:12 GMT #2356540 665 <teo-en-ming@teo-en-ming.com>
remote qmail-subscribe@list.cr.yp.to
28 Mar 2014 08:51:49 GMT #2356435 52894 <>
remote jeromesalmon@orange.fr
28 Mar 2014 17:43:37 GMT #2356530 3046 <teo-en-ming@teo-en-ming.com>
bouncing
done remote collections@dbs.com
done remote lee_hsien_loong@pmo.gov.sg
done remote gilbert@transitioning.org
remote president@whitehouse.gov
remote comments@whitehouse.gov
remote singaporeusembassy@state.gov
remote information@icj-cij.org
remote isunga.hchr@unog.ch
done remote webmaster@echr.coe.int
done remote americas@rsf.org
done remote aimember@aiusa.org
remote secretary@state.gov
done remote ecu@un.org
done remote james@a2000.net
done remote margaret@a2000.net

Yahoo! Mail servers, several mailing lists including qmail, the White
House email server, and the U.S. Department of State email server have
been rejecting emails originating from my qmail email server. My qmail
email server is hosted on a home-based M1 fiber optic broadband internet
connection.

How can I rectify this problem?

I am looking forward to your reply.

Thank you very much.

Yours sincerely,

Teo En Ming

Re: Is My Qmail Email Server an Open Relay? [ In reply to ]

feh at fehcom

Mar 31, 2014, 1:17 AM

Post #2 of 4 (2111 views)

Permalink

Hi,

--On 31. MÃ¤rz 2014 16:01:06 +0800 Teo En Ming <teo.enming@yahoo.com.sg>
wrote:

>
>
> Hi,
>
>
> This is my /etc/tcp.smtp.
>
>
> [root@centos-6 ~]# cat /etc/tcp.smtp
> 127.:allow,RELAYCLIENT=""
> 192.168.1.:allow,RELAYCLIENT=""
> :allow,RELAYCLIENT=""

Yes is is ! The last line is wrong. Usually, it should simply tell:

:allow

In your case control/rcpthosts is never consulted, since it only read in
the None-RELAYCLIENT case.

> [root@centos-6 ~]# cat /var/qmail/control/rcpthosts
> teo-en-ming.com
> zhang-enming.com
>

regards.
--eh.

--
Dr. Erwin Hoffmann | FEHCom | http://www.fehcom.de/ | PGP-Key-Id: 7E4034BE

Re: Is My Qmail Email Server an Open Relay? [ In reply to ]

ar-djblists at acrconsulting

Mar 31, 2014, 2:39 AM

Post #3 of 4 (2122 views)

Permalink

On Monday 31 Mar 2014 16:01:06 you wrote:
> This is my /etc/tcp.smtp.
>
> [root@centos-6 ~]# cat /etc/tcp.smtp
> 127.:allow,RELAYCLIENT=""
> 192.168.1.:allow,RELAYCLIENT=""
> :allow,RELAYCLIENT=""

The final line there turns your system into an open relay. Instead you should
have,
127.:allow,RELAYCLIENT=""
192.168.1.:allow,RELAYCLIENT=""
:allow

- and don't forget to rebuild the corresponding .cdb file - as described on
e.g. lifewithqmail.org,

http://lifewithqmail.org/lwq.html#relaying

esp. section 3.2.3

> [root@centos-6 ~]# cat /var/qmail/control/rcpthosts
> teo-en-ming.com
> zhang-enming.com
>
>...<snip>...
>
> Yahoo! Mail servers, several mailing lists including qmail, the White
> House email server, and the U.S. Department of State email server have
> been rejecting emails originating from my qmail email server. My qmail
> email server is hosted on a home-based M1 fiber optic broadband internet
> connection.

Also consider if it would be useful to use your upstream provider as a
smarthost, and maybe take a look at 'mail submission' where you authenticate
with the server for it to accept mail for domains not in rcpthosts; it may be
useful, esp. if you wish to be able to 'relay' email through your mail server
when away from home; this is typically run separately from normal SMTP (e.g.
port 587 is often used for mail submission with TLS).

> How can I rectify this problem?

See above.

cheers,

Andrew.
--
====================================================================
* Custom email solutions * Systems Administration * Networking
http://www.acrconsulting.co.uk/email/qmail.html
====================================================================

Re: Is My Qmail Email Server an Open Relay? [ In reply to ]

hutchlists at midwales

Mar 31, 2014, 2:42 AM

Post #4 of 4 (2144 views)

Permalink

On 31/03/14 09:01, Teo En Ming wrote:
> Hi,
>
> This is my /etc/tcp.smtp.
>
> [root@centos-6 ~]# cat /etc/tcp.smtp
> 127.:allow,RELAYCLIENT=""
> 192.168.1.:allow,RELAYCLIENT=""
> :allow,RELAYCLIENT=""
>
> [root@centos-6 ~]# cat /var/qmail/control/rcpthosts
> teo-en-ming.com
> zhang-enming.com

Apart from the point raised by Erwin, mail.teo-en-ming.com is
124.197.88.191 which is listed at

http://www.spamhaus.org/query/ip/124.197.88.191

>
> [root@centos-6 ~]# /var/qmail/bin/qmail-qread
> 29 Mar 2014 15:24:12 GMT #2356540 665 <teo-en-ming@teo-en-ming.com>
> remote qmail-subscribe@list.cr.yp.to
> 28 Mar 2014 08:51:49 GMT #2356435 52894 <>
> remote jeromesalmon@orange.fr
> 28 Mar 2014 17:43:37 GMT #2356530 3046 <teo-en-ming@teo-en-ming.com>
> bouncing
> done remote collections@dbs.com
> done remote lee_hsien_loong@pmo.gov.sg
> done remote gilbert@transitioning.org
> remote president@whitehouse.gov
> remote comments@whitehouse.gov
> remote singaporeusembassy@state.gov
> remote information@icj-cij.org
> remote isunga.hchr@unog.ch
> done remote webmaster@echr.coe.int
> done remote americas@rsf.org
> done remote aimember@aiusa.org
> remote secretary@state.gov
> done remote ecu@un.org
> done remote james@a2000.net
> done remote margaret@a2000.net
>
> Yahoo! Mail servers, several mailing lists including qmail, the White
> House email server, and the U.S. Department of State email server have
> been rejecting emails originating from my qmail email server. My qmail
> email server is hosted on a home-based M1 fiber optic broadband internet
> connection.
>
> How can I rectify this problem?
>
> I am looking forward to your reply.
>
> Thank you very much.
>
> Yours sincerely,
>
> Teo En Ming
>
>

--
-----------------
Bob Hutchinson
Midwales dot com
-----------------