SUMMARY: Understanding Maillog Entry

This is a summary of the responses to a question I asked earlier about
understanding a maillog entry. My question was about the part of the log
indicated by arg2=127.0.0.2 and what that meant as I always equated that
address range as being a loopback-addresses. Thanks to all who were kind
enough to respond:

The log in question was:

	Sep 14 11:33:54 rosewood sendmail[10711]: ruleset=check_relay,
arg1=smtp2.tidc.telus.com, arg2=127.0.0.2, relay=smtp2.tidc.telus.com
[209.171.56.4] (may be forged), reject=550 5.7.1 Rejected: 209.171.56.4
listed at relays.ordb.org

So, the answer is that we have our server set to check with various RBL's
and this entry in the logs indicates that the sending host was listed at
relays.ordb.org (this host was an open-relay host). 

Tom Yates point out the following: 

"from the ordb FAQ (http://ordb.org/faq/): "The theory of operation is
simple. Given a host address in its dotted-quad form, reverse the octets and
check for the existence of an ``A RR'' at that node under the
relays.ordb.org node. So if you get an SMTP session from [192.89.123.5] you
would check for the existence of: 5.123.89.192.relays.ordb.org. IN A
127.0.0.2"

what you're seeing is your mailer checking ordb, getting a 127.0.0.2 answer,
deciding that it's from a known spammer, and binning the incoming mail
("Rejected: 209.171.56.4 listed at relays.ordb.org")."

And Mike Brodbelt wrote"

"Different blacklists have different policies on what the actual response to
the DNS query means - some use 127.0.0.10 for dialups, for example.
127.0.0.2 is the basic "listed" response used by most lists."

More info can be found at: http://www.sdsc.edu/~jeff/spam/cbc.html

Again, my thanks to Wayde, Binand, Tom and Mike for 'educating' me ;-)

Cheers

Dave

David Filchak
President - Zuka Inc.
Toronto, On Canada M5V2J1
www.zuka.net | www.screamingmedia.ca 
_______________________________________________
LinuxManagers mailing list - http://www.linuxmanagers.org
submissions: LinuxManagers-35TzE1X9F6582KRnZfj+bdi2O/[email protected]
subscribe/unsubscribe: http://www.linuxmanagers.org/mailman/listinfo/linuxmanagers