Re: [exim] Re: How can I tell if my server is getting bombar…

Top Page
Delete this message
Reply to this message
Author: Wakko Warner
Date:  
To: Tommy Butler
CC: exim-users, John W. Baxter
Subject: Re: [exim] Re: How can I tell if my server is getting bombardedwith spam?
Tommy Butler wrote:
> Wakko Warner wrote:
> >You have in your config somewhere:
> >domainlist relay_to_domains = *
>
> Yes I do; it's the only way I can get the server to send anything.


Then something is wrong. Maybe you want "relay_from_hosts" set instead
(provided your ACLs support it).

> >Don't do that. You should shut down your server or otherwise remove it
> >from
> >the internet until you close this hole.
>
> I have taken it offline.


That's good, for the internet atleast.

> >Since you're running debian, you can try this:
> >
> >find /etc/exim* | xargs grep relay_to_domains
>
> I've already made your suggested change, and when doing that it only will
> relay mail sent to other people with email addresses @cityairlines.net (our
> domain).


> >This should tell you where the problem is. I myself am not familiar with
> >debian's split config. I compiled exim 4.43 using debian's packaged 4.34
>
> I'm not using the split config. I'm using the configuration files that
> were installed by debian. As mentioned in an earlier post in this thread
> by Adam D. Barrat, when I first installed exim4 using apt-get, I
> encountered the following prompt, to which I accepted the default, which is
> to relay for no one. Even having done so the config file created by the
> installation said "domainlist relay_to_domains = *"


I wasn't sure, I had followed the thread some what.

> prompt was:
> ------------------------------------------------------------------------

[SNIP]
> ------------------------------------------------------------------------
>
> As I stated, I left the prompt empty.
>
> >when you find the file, edit it, and remove the *
> >also, you should run the update-<whatever> to rebuild the config file (if
> >you are infact using split config)
>
> This I have done, and my server continues to function as an open relay.
> What the #@$(* is going on?! I am going nuts. My boss is very unhappy
> that the smtp server is still down.


Yes, I can understand how the "boss" feels about down servers. But while
it's an open relay, it's either be up and relay spam then get listed in RBLs
until you fix the problem and try to get off the RBLs, or be down and fix
the problem.

> I even tried using postfix today. Did no good. I couldn't get it to work
> either. I experienced the same problems, and seeing this I decided that if
> I couldn't get anything to work, I might as well stick with exim4 as it is
> the preferred MTA for Debian and as such I feel that it is probably the
> best choice.


I like exim as well as it being the debian default. Very flexible. It's
like unix itself, gives you enough rope to hang yourself and the loaded gun
to shoot yourself in the foot. =)

Anyway, I still do not grasp exactly what you're trying to accomplish. Who
do you need to relay for? Are they outside your lan as well as inside? Do
you host other domains? Are you a backup mx for other domains?

If you can post your exim.conf file (w/o comments), I or someone else might
beable to figure out the problem.

you can run exim -bV (or exim4 -bV) to find out the config file location.
Send the contents of: grep "^[^#]" /path/to/exim.conf
That will strip most comments and blank lines.

--
Lab tests show that use of micro$oft causes cancer in lab animals