Re: mail storm via 203.98.24.1

From: Joe Abley To: soa(a)xtra.co.nz; abuse(a)xtra.co.nz; postmaster(a)xtra.co.nz; info(a)onthenet.co.nz; soa(a)onthenet.co.nz Cc: nburgess(a)clear.net.nz; bob(a)wonderland.org.nz; olof(a)clear.net.nz; nznog(a)list.waikato.ac.nz Subject: mail storm via 203.98.24.1 Date: Saturday, 17 October 1998 10:23

Hi,

Someone is using 203.98.24.1 (pcombo.co.nz) to relay mail to the CLEAR Net MX hosts. Since 00:16:57 this morning there have been several hundreds of thousands of attempts to deliver mail to CLEAR Net, which have been blocked at CLEAR Net since the senders' domain is not real.

Oct 17 00:16:57 fep4 sendmail[25135]: Ruleset check_mail () rejection: 451 ... Sender domain (udie.com) not found in DNS, or not compliant with section 6 of RFC822

Oct 17 00:16:57 fep4 sendmail[25135]: AAA25135: from=, size=0, class=0, pri=0, nrcpts=0, proto=ESMTP, relay=pcombo.co.nz [203.98.24.1]

Oct 17 00:16:57 fep3 sendmail[1621]: Ruleset check_mail () rejection: 451 ... Sender domain (udie.com) not found in DNS, or not compliant with section 6 of RFC822

Oct 17 00:16:57 fep3 sendmail[1621]: AAA01621: from=, size=0, class=0, pri=0, nrcpts=0, proto=ESMTP, relay=pcombo.co.nz [203.98.24.1]

The offending relay is reached from CLEAR via Xtra and onthenet:

traceroute to 203.98.24.1 (203.98.24.1), 30 hops max, 40 byte packets 1 router (203.97.2.225) 3.125 ms 2.839 ms 2.940 ms 2 d1.test.clear.net.nz (203.167.224.30) 26.798 ms 27.121 ms 26.944 ms 3 ba1-atm1-0-1.acld.clix.net.nz (203.167.224.1) 27.307 ms ba2-atm1-0-1.acld.clix.net.nz (203.167.224.2) 27.199 ms 27.307 ms 4 ba1-ser0-15.hmtn.clix.net.nz (203.97.1.70) 37.072 ms s3-0.akcr1.netgate.net.nz (202.37.245.33) 30.615 ms 29.995 ms 5 xtra.akcr1.netgate.net.nz (202.37.245.46) 29.765 ms ngthn1-b1.nzix.waikato.ac.nz (140.200.128.9) 34.387 ms 36.746 ms 6 192.168.200.241 (192.168.200.241) 35.184 ms 35.428 ms s6-1.akcr1.netgate.net.nz (202.37.245.125) 42.860 ms 7 xtra.akcr1.netgate.net.nz (202.37.245.46) 38.670 ms 34.878 ms 53.744 ms 8 192.168.30.18 (192.168.30.18) 65.403 ms 192.168.200.241 (192.168.200.241) 42.500 ms 192.168.30.18 (192.168.30.18) 100.988 ms 9 otn2.gw.onthenet.co.nz (210.55.215.247) 48.387 ms 72.757 ms

Well, it was early morning Saturday that I discovered this was happening .. it is on the go again right now! Take some action please. Regards Norman Burgess ---------- pcombo.co.nz (203.98.24.1) 131.373 ms

I have just checked 203.98.24.1 from tardis.patho.gen.nz, and it is

a promiscuous relay:

tardis[5]% telnet pcombo.co.nz 25 Trying 203.98.24.1... Connected to pcombo.co.nz. Escape character is '^]'. 220 pcombo.co.nz ESMTP Sendmail 8.8.7/8.8.5; Sat, 17 Oct 1998 10:01:33 +1245 HELO blah 250 pcombo.co.nz Hello tardis.patho.gen.nz [203.97.2.226], pleased to meet you MAIL FROM: 250 ... Sender ok RCPT TO: 250 ... Recipient ok DATA 354 Enter mail, end with "." on a line by itself From: moo(a)cow.dog.horse To: jabley(a)patho.gen.nz Subject: oh no

This is an open relay . 250 KAA19201 Message accepted for delivery QUIT 221 pcombo.co.nz closing connection Connection closed by foreign host.

which resulted in the following delivery attempt to tardis:

Oct 17 10:05:58 tardis sendmail[21233]: KAA21233: ruleset=check_mail, arg1=, relay=root(a)pcombo.co.nz [203.98.24.1], reject=501 ... Sender domain must exist

Until it is evident that these antics have stopped, we have applied

indeed packet

filters to refuse connections from 203.98.24.1 on tcp/25.

We would be grateful if appropriate people at Xtra and/or onthenet could take similar action or otherwise arrange for this to stop.

Joe

-- Joe Abley

To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog