Astaro User Bulletin Board
Go Back   Astaro User Bulletin Board > Astaro Gateway Products > Mail Security: SMTP, POP3, Antispam and Antivirus
Reload this Page Help on Log SMTP-Proxy
Register FAQ Members List Calendar Search Today's Posts Mark Forums Read

Welcome to the Astaro User Bulletin Board.
If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below.

Reply
 
LinkBack Thread Tools Display Modes
  #1 (permalink)  
Old 11-20-2008, 02:55 PM
msi msi is offline
Junior Member
  
Join Date: Jun 2008
Posts: 8
Default Help on Log SMTP-Proxy
Hi,

i need some help on some log entries of our SMTP-Proxy.

One of our users (tried ?) to send a mail to a couple of recipients (same mail-domain).

I'm not sure though (according to the log) if the mail was delivered to the recipients mail server.

As far as i understand the log:
- mail got accepted by and delivered to the recipients mail server (to both recipients)
- _afterwards_ the recipients mail server connected to our astaro to deny the correct transmission (falsely in SMTP-terms)

Can anyone confirm or correct me in this matter.

Thanks in advance and regards

The corresponding log-entries:
Code:
2008:10:22-12:35:10 (none) smtpd[31872]: SCANNER[31872]: id="1000" severity="info" sys="SecureMail" sub="smtp" name="email passed" srcip="ip_internal_Mailserver" from="our_sender" to="recipient_1" subject="Subject" queueid="0yvRAf-0008Iu-1t" size="10697"
2008:10:22-12:35:10 (none) smtpd[31872]: SCANNER[31872]: id="1000" severity="info" sys="SecureMail" sub="smtp" name="email passed" srcip="ip_internal_Mailserver" from="our_sender" to="Recipient_2" subject="Subject" queueid="0yvRAg-0008Iu-1t" size="10697"
2008:10:22-12:35:10 (none) exim[31926]: 2008-10-22 12:35:10 0yvRAf-0008Iu-1t => recipient_1 R=dnslookup T=remote_smtp H=recipient_mx [recipient_Mailserver_IP]:25
2008:10:22-12:35:10 (none) exim[31926]: 2008-10-22 12:35:10 0yvRAf-0008Iu-1t Completed
2008:10:22-12:35:11 (none) exim[31927]: 2008-10-22 12:35:11 0yvRAg-0008Iu-1t => Recipient_2 R=dnslookup T=remote_smtp H=recipient_mx [recipient_Mailserver_IP]:25
2008:10:22-12:35:11 (none) exim[31927]: 2008-10-22 12:35:11 0yvRAg-0008Iu-1t Completed
2008:10:22-12:35:13 (none) exim[5680]: 2008-10-22 12:35:13 SMTP connection from [recipient_Mailserver_IP]:46493 (TCP/IP connection count = 1)
2008:10:22-12:35:13 (none) exim[5680]: 2008-10-22 12:35:13 SMTP connection from [recipient_Mailserver_IP]:46494 (TCP/IP connection count = 2)
2008:10:22-12:35:14 (none) exim[31930]: 2008-10-22 12:35:14 id="1003" severity="info" sys="SecureMail" sub="smtp" name="email rejected" srcip="recipient_Mailserver_IP" from="" to="our_sender" size="-1" reason="batv" extra="Missing, invalid or expired BATV signature"
2008:10:22-12:35:14 (none) exim[31930]: 2008-10-22 12:35:14 H=recipient_mx [recipient_Mailserver_IP]:46493 F=<> rejected RCPT <our_sender>: Missing, invalid or expired BATV signature
2008:10:22-12:35:14 (none) exim[31930]: 2008-10-22 12:35:14 SMTP connection from recipient_mx [recipient_Mailserver_IP]:46493 closed by DROP in ACL
2008:10:22-12:35:14 (none) exim[31931]: 2008-10-22 12:35:14 id="1003" severity="info" sys="SecureMail" sub="smtp" name="email rejected" srcip="recipient_Mailserver_IP" from="" to="our_sender" size="-1" reason="batv" extra="Missing, invalid or expired BATV signature"
2008:10:22-12:35:14 (none) exim[31931]: 2008-10-22 12:35:14 H=recipient_mx [recipient_Mailserver_IP]:46494 F=<> rejected RCPT <our_sender>: Missing, invalid or expired BATV signature
2008:10:22-12:35:14 (none) exim[31931]: 2008-10-22 12:35:14 SMTP connection from recipient_mx [recipient_Mailserver_IP]:46494 closed by DROP in ACL
Reply With Quote
  #2 (permalink)  
Old 11-20-2008, 03:04 PM
tom's Avatar
tom tom is offline
Super Moderator
  
Join Date: Nov 2000
Location: Heidelberg, Germany
Posts: 1,172
Default
It looks like the remote site accepts the messages. It looks like it sends back OOO messages or similar a few seconds later, but uses the header sender for that, so those run into the BATV filter. You can turn off BATV or make an exception for their domain.
__________________
Tom Kistner
Product Development & Administrator
Astaro AG
Reply With Quote
  #3 (permalink)  
Old 11-20-2008, 03:31 PM
msi msi is offline
Junior Member
  
Join Date: Jun 2008
Posts: 8
Default
thanks for your answer.

What do you mean by "OOO messages"?

And to my "problem":

Are the following assumptions correct?
(i'm "not really" a smtp specialist, just read a little about bounces, BATV, etc. a minute ago)

in the quoted log the following happened:
- mail got delivered to recipients mail server (correct and complete)
- the recipients mail server sends a (incorrect?) bounce-message
- our ASG doesn't accept the bounce, caused by an invalid BATV signature (*1)

*1
probably because of some encoding problems

What parts of a mail is the BATV-signature created from?

log quote again with some (important?) detail:
the @s in <sender@our.domain> at timestamp "2008:10:22-12:35:14" are replaced by %40 in the ASG-log
Code:
2008:10:22-12:35:10 (none) smtpd[31872]: SCANNER[31872]: id="1000" severity="info" sys="SecureMail" sub="smtp" name="email passed" srcip="ip_internal_Mailserver" from="sender@our.domain" to="rcp1@target.domain" subject="Subject" queueid="0yvRAf-0008Iu-1t" size="10697"
2008:10:22-12:35:10 (none) smtpd[31872]: SCANNER[31872]: id="1000" severity="info" sys="SecureMail" sub="smtp" name="email passed" srcip="ip_internal_Mailserver" from="sender@our.domain" to="rcp2@target.domain" subject="Subject" queueid="0yvRAg-0008Iu-1t" size="10697"
2008:10:22-12:35:10 (none) exim[31926]: 2008-10-22 12:35:10 0yvRAf-0008Iu-1t => rcp1@target.domain R=dnslookup T=remote_smtp H=recipient_mx [recipient_Mailserver_IP]:25
2008:10:22-12:35:10 (none) exim[31926]: 2008-10-22 12:35:10 0yvRAf-0008Iu-1t Completed
2008:10:22-12:35:11 (none) exim[31927]: 2008-10-22 12:35:11 0yvRAg-0008Iu-1t => rcp2@target.domain R=dnslookup T=remote_smtp H=recipient_mx [recipient_Mailserver_IP]:25
2008:10:22-12:35:11 (none) exim[31927]: 2008-10-22 12:35:11 0yvRAg-0008Iu-1t Completed
2008:10:22-12:35:13 (none) exim[5680]: 2008-10-22 12:35:13 SMTP connection from [recipient_Mailserver_IP]:46493 (TCP/IP connection count = 1)
2008:10:22-12:35:13 (none) exim[5680]: 2008-10-22 12:35:13 SMTP connection from [recipient_Mailserver_IP]:46494 (TCP/IP connection count = 2)
2008:10:22-12:35:14 (none) exim[31930]: 2008-10-22 12:35:14 id="1003" severity="info" sys="SecureMail" sub="smtp" name="email rejected" srcip="recipient_Mailserver_IP" from="" to="sender%40our.domain" size="-1" reason="batv" extra="Missing, invalid or expired BATV signature"
2008:10:22-12:35:14 (none) exim[31930]: 2008-10-22 12:35:14 H=recipient_mx [recipient_Mailserver_IP]:46493 F=<> rejected RCPT <sender@our.domain>: Missing, invalid or expired BATV signature
2008:10:22-12:35:14 (none) exim[31930]: 2008-10-22 12:35:14 SMTP connection from recipient_mx [recipient_Mailserver_IP]:46493 closed by DROP in ACL
2008:10:22-12:35:14 (none) exim[31931]: 2008-10-22 12:35:14 id="1003" severity="info" sys="SecureMail" sub="smtp" name="email rejected" srcip="recipient_Mailserver_IP" from="" to="sender%40our.domain" size="-1" reason="batv" extra="Missing, invalid or expired BATV signature"
2008:10:22-12:35:14 (none) exim[31931]: 2008-10-22 12:35:14 H=recipient_mx [recipient_Mailserver_IP]:46494 F=<> rejected RCPT <sender@our.domain>: Missing, invalid or expired BATV signature
2008:10:22-12:35:14 (none) exim[31931]: 2008-10-22 12:35:14 SMTP connection from recipient_mx [recipient_Mailserver_IP]:46494 closed by DROP in ACL
Last edited by msi; 11-20-2008 at 03:35 PM.
Reply With Quote
  #4 (permalink)  
Old 11-21-2008, 07:36 PM
Jack Daniel's Avatar
Moderator
  
Join Date: Jul 2008
Location: Cape Cod, Mass, US
Posts: 355
Default
OOO- Out Of Office (or possibly another autoresponse message).

Does the recipient get the message? It could be one of those anti-spam challenge/response emails.
__________________
Are you Linkedin to Astaro? http://www.linkedin.com/e/gis/139679/189D6C60EC64

Random Rants from an InfoSec Curmudgeon, UnCommon Sense Security Blog http://blog.uncommonsensesecurity.com
Reply With Quote
  #5 (permalink)  
Old 11-22-2008, 06:31 PM
msi msi is offline
Junior Member
  
Join Date: Jun 2008
Posts: 8
Default
The recipient didn't receive the messages.

As those were answers of our support-team, they wanted to check me if we caused those undelivered mails.
Reply With Quote
Reply

« Previous Thread | Next Thread »
Thread Tools
Display Modes
Linear Mode Linear Mode

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On


All times are GMT. The time now is 11:11 PM.

 
Contact Us - Astaro User Bulletin Board - Archive - Top

Powered by vBulletin® Version 3.8.2
Copyright ©2000 - 2009, Jelsoft Enterprises Ltd.


These pages are specifically maintained for the discussion of firewall issues within the Open Source community, and might already reflect new alpha/beta releases under development. Please refer to our product specifications for the functionality of the actual release. Discussions of new/enhanced functionality does not constitute a commitment of Astaro, to integrate this functionality into future releases. issues within the Open Source community, and might already reflect new alpha/beta releases under development. Please refer to our product specifications for the functionality of the actual release. Discussions of new/enhanced functionality does not constitute a commitment of Astaro, to integrate this functionality into future releases.