[SPAM] Re: [vchkpw] Qmail maillog vchkpw-submission vs vchkpw-smtp
LHTek <[email protected]> Tue, 4 Mar 2014 22:43:51 -0800 (PST)
| Newsgroups | gmane.mail.vpopmail |
|---|---|
| Message-ID | <[email protected]> |
--1988236031-490048227-1394001831=:93827 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit Thanks for the reply. NOTE: None of my users will have sent anything from outside the US. I've got some log entries for vchkpw-submission (marked as successful in the log) with non-US IP's (Russia, Egypt, Honk Kong, etc).In my analysis I'm marking those entries as hacked accounts. From what I read from your response, vchkpw-smtp (marked as successful in the log) entries could be mail sent TO my server FROM another server on port 25. That tells me those are probably safe submissions - even if they are from overseas IPs. Am I thinking correctly? >________________________________ > From: Tom Collins <[email protected]> >To: [email protected] >Sent: Wednesday, March 5, 2014 12:02 AM >Subject: Re: [vchkpw] Qmail maillog vchkpw-submission vs vchkpw-smtp > > > >vchkpw-submission is on port 587, and is typically used for emai clients relaying mail. It's often set up to require authentication. > > >vchkpw-smtp is on port 25, and can be used for email clients to relay mail, or by other servers delivering mail to your server. > > >-Tom > > >On Mar 4, 2014, at 9:41 PM, LHTek wrote: > >In the /var/log/maillog file what is the difference between these 2 entries (vchkpw-submission, vchkpw-smtp)? >> >> >>example: >>Mar 4 17:27:03 michael vpopmail[14701]: vchkpw-submission: (PLAIN) login success [email protected]:64.185.3.238 >> >>Mar 4 10:54:42 michael vpopmail[29027]: vchkpw-smtp: (PLAIN) login success [email protected]:64.57.239.114 >> >> >> >> > > > !DSPAM:5316c7aa34265248780387! --1988236031-490048227-1394001831=:93827 Content-Type: text/html; charset=iso-8859-1 Content-Transfer-Encoding: 8bit <html><body><div style="color:#000; background-color:#fff; font-family:Courier New, courier, monaco, monospace, sans-serif;font-size:10pt">Thanks for the reply.<br><br>NOTE: None of my users will have sent anything from outside the US.<span><br><br></span>I've got some log entries for vchkpw-submission (marked as successful in the log) with non-US IP's (Russia, Egypt, Honk Kong, etc).<span> In my analysis I'm marking those entries as hacked accounts.</span><div style="color: rgb(0, 0, 0); font-size: 13.3333px; font-family: Courier New,courier,monaco,monospace,sans-serif; background-color: transparent; font-style: normal;"><br><span></span></div><div style="color: rgb(0, 0, 0); font-size: 13.3333px; font-family: Courier New,courier,monaco,monospace,sans-serif; background-color: transparent; font-style: normal;"><span>From what I read from your response, </span>vchkpw-smtp (marked as successful in the log) entries could be mail sent TO my server FROM another server on port 25. That tells me those are probably safe submissions - even if they are from overseas IPs. Am I thinking correctly?</div><div style="color: rgb(0, 0, 0); font-size: 13.3333px; font-family: Courier New,courier,monaco,monospace,sans-serif; background-color: transparent; font-style: normal;"><br></div><div style="color: rgb(0, 0, 0); font-size: 13.3333px; font-family: Courier New,courier,monaco,monospace,sans-serif; background-color: transparent; font-style: normal;"><br></div><div style="color: rgb(0, 0, 0); font-size: 13.3333px; font-family: Courier New,courier,monaco,monospace,sans-serif; background-color: transparent; font-style: normal;"><br></div><div><br><blockquote style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; margin-top: 5px; padding-left: 5px;"> <div style="font-family: Courier New, courier, monaco, monospace, sans-serif; font-size: 10pt;"> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div dir="ltr"> <hr size="1"> <font face="Arial" size="2"> <b><span style="font-weight:bold;">From:</span></b> Tom Collins <[email protected]><br> <b><span style="font-weight: bold;">To:</span></b> [email protected] <br> <b><span style="font-weight: bold;">Sent:</span></b> Wednesday, March 5, 2014 12:02 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [vchkpw] Qmail maillog vchkpw-submission vs vchkpw-smtp<br> </font> </div> <div class="y_msg_container"><br><div id="yiv8551571901"><div>vchkpw-submission is on port 587, and is typically used for emai clients relaying mail. It's often set up to require authentication.<div><br clear="none"></div><div>vchkpw-smtp is on port 25, and can be used for email clients to relay mail, or by other servers delivering mail to your server.</div><div><br clear="none"><div> <span class="yiv8551571901Apple-style-span" style="border-collapse:separate;border-spacing:0px 0px;color:rgb(0, 0, 0);font-family:Helvetica;font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:auto;text-indent:0px;text-transform:none;orphans:2;white-space:normal;widows:2;word-spacing:0px;"></span><div>-Tom</div><br class="yiv8551571901Apple-interchange-newline" clear="none"> </div> <br clear="none"><div class="yiv8551571901yqt6697663901" id="yiv8551571901yqt19840"><div><div>On Mar 4, 2014, at 9:41 PM, LHTek wrote:</div><br class="yiv8551571901Apple-interchange-newline" clear="none"><blockquote type="cite"><div><div style="color:#000;background-color:#fff;font-family:Courier New, courier, monaco, monospace, sans-serif;font-size:10pt;"><div class="yiv8551571901msg-body yiv8551571901inner yiv8551571901undoreset" style=""><div id="yiv8551571901"><div><div style="color:#000;background-color:#fff;font-family:Courier New, courier, monaco, monospace, sans-serif;font-size:10pt;"><div>In the /var/log/maillog file what is the difference between these 2 entries (vchkpw-submission, vchkpw-smtp)?</div><div><br clear="none"></div><div style="color:rgb(0, 0, 0);font-size:13.3333px;f ont-family:Courier New, courier, monaco, monospace, sans-serif;background-color:transparent;font-style:normal;">example:</div><div style="color:rgb(0, 0, 0);font-size:13.3333px;font-family:Courier New, courier, monaco, monospace, sans-serif;background-color:transparent;font-style:normal;">Mar 4 17:27:03 michael vpopmail[14701]: vchkpw-submission: (PLAIN) login success [email protected]:64.185.3.238<br clear="none"></div><div>Mar 4 10:54:42 michael vpopmail[29027]: vchkpw-smtp: (PLAIN) login success [email protected]:64.57.239.114</div><div><br clear="none"></div><div style="color:rgb(0, 0, 0);font-size:13.3333px;font-family:Courier New, courier, monaco, monospace, sans-serif;background-color:transparent;font-style:normal;"><br clear="none"></div></div></div></div></div></div> </div> </blockquote></div></div><br clear="none"></div> </div></div><br><br></div> </div> </div> </blockquote></div> </div> !DSPAM:5316c7aa34265248780387! </body></html> --1988236031-490048227-1394001831=:93827--