RE: Website link for 66.172.9.19

OK well that provides an explanation thanks Bert.  The messages shown in the
status report from your web site regarding my server 66.172.9.19 however,
all say they are Open Relay Test Messages.

Cracked email account passwords are a different issue than Open Relays are
they not?

I do have a tarpitting program installed on my mailservers.  So there
shouldn't be much spam.  However, I don't allow *any* spam sent through my
servers, customers or not, so I'll check with my Linux consultant to see if
he can determine which *email* accounts have been cracked.  I do have the
Plesk feature enabled where passwords are checked in the dictionary and
rejected if they are found in the dictionary, however, perhaps this is more
effective on my Plesk 7 server than my Plesk 6.5 (of which the .19 IP
represents.)  I do know that I've been under attack with crackers attempting
to gain access to the system, as I can tell from my logs.

Jim

___________________________

*  *  Jim Guiltinan
  *   ABW Host, LLC
*  *  http://abwhost.net
  *   "Industrial Strength Web Hosting"

Support URLs:
http://abwhost.net/faq/
http://bizorgnet.com
     
-----Original Message-----
From: Bert Driehuis [mailto:[email protected]] 
Sent: Wednesday, May 10, 2006 5:35 PM
To: Jim Guiltinan
Cc: [email protected]
Subject: Re: [DSBL-Contact] Website link for 66.172.9.19

[ Note: I do not represent DSBL. I just track [email protected] to keep abreast
of possible issues that might affect my use of DSBL, and occasionally I help
out with questions. You may get responses from other subscribers to
[email protected], possibly even with dissenting opinions. ]

On Wed, 10 May 2006, Jim Guiltinan wrote:

> I think your system has a flaw as I do not have open relay set on my 
> Plesk server.

If all software had a checkbox that said "disable all insecurities",
assisting system administrators would be easy. But most security issues are
harder than that. According to the information shown on
http://dsbl.org/listing?66.172.9.19 you have multiple user accounts with bad
passswords. You may wish to audit your system for more compromised user
accounts.

> And no other RBL's have our server listed.  I would think if we had an 
> open relay, that the spammers would find out and that we'd be listed 
> in all the popularly used RBLs, such as spamhaus which is one we use
ourself.

If all RBLs were equal, why have more than one? One of DSBL's defining
features is that there is no a-priori limitation on the kind of security
issue that may cause a listing.

> I'll try the remove request again.  I did it last week but then I got 
> listed in your RBL afterwards.  A few customers are reporting problems 
> with your RBL as a result.

Gee, everytime I hit myself in the head with a hammer my head hurts. 
Must be something wrong with the hammer. Puhleaze, if you don't understand
the info on http://dsbl.org/listing?66.172.9.19 , just ask.
Most of the folks that track [email protected] are not ogres (and actually, the
resident ogre rarely steps in unless provoked).

Hope this helps!