Re: Sendmail/Blacklists rejecting authenticated users
Scott Gifford <[email protected]>
| Newsgroups | gmane.comp.security.linux |
|---|---|
| Message-ID | <[email protected]> |
Bill Weiss <[email protected]> writes: > Scott Gifford([email protected])@Wed, Jan 11, 2006 at 04:47:05PM -0500: [...] >> Most blacklists put 127.0.0.2 on their blacklist for testing, so you >> can do: >> >> telnet 127.0.0.2 25 >> >> from the server to test. > > Uh... I don't think that's going to work. Even if a server uses a > blacklist that lists 127.0.0.2, that's not always going to provide > reverse DNS for that IP. Even if it does, telnet to that should just > come back to the same machine (maybe) or nowhere (probably). Did you try it? For the 2 DNSBL's I currently use, it works fine: $ dig +short 2.0.0.127.bl.spamcop.net. 127.0.0.2 $ dig +short 1.0.0.127.bl.spamcop.net. $ dig +short 2.0.0.127.relays.ordb.org 127.0.0.2 $ dig +short 1.0.0.127.relays.ordb.org $ $ telnet 127.0.0.2 25 Trying 127.0.0.2... Connected to 127.0.0.2. Escape character is '^]'. 220 rblsmtpd.local mail from:<blah> 250 rblsmtpd.local rcpt to:<blah> 451 Listed by ORDB - for testing purposes only Connection closed by foreign host. $ telnet 127.0.0.1 25 Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'. 220 accept.example.com ESMTP mail from:<blah> 250 ok rcpt to:<blah> 250 ok quit 221 accept.example.com Connection closed by foreign host. As you can see, these RBLs list 127.0.0.2 but not 127.0.0.1, so when you telnet to your own host using the address "127.0.0.2" it will act as if you're blacklisted, while if you use "127.0.0.1" it will act as normal. That's a good way to test whether your blacklist is configured properly: if it's overzealous, you'll be blacklisted at 127.0.0.1, and if it's underzealous, you'll be allowed to send via 127.0.0.2 Not all DNSBLs support this, but for those that do it's quite convenient. Some OS's require you to "ifconfig up" an interface alias with the address 127.0.0.2 to perform this test; Linux will automatically route 127/8 to the loopback adapter on standard configurations. ----Scott.