Relay på Exchange-server er skrudd av. Loggene fylles opp

[el_torro]

I de siste to dagene har loggene på mailserveren fylt seg opp med noe som ser ut som vellykkede forsøk på å sende mail via mailserveren (Exchange2003 SBS siste ServicePack og patcher) til eksterne adresser. Dette til tross for at relay er skrudd av og at autentisering kreves på lokal SMTP. Kan det være at dette er NDR-meldinger (Non-Delivery-Reports) som trigges ut? Og i såfall, hvordan kan jeg forhindre at NDR sendes ut fra eksterne adresser? Eksempel i logg:

 

2008-06-25 00:04:05 205.188.249.91 OutboundConnectionResponse SMTPSVC1 FIKT-EXCHANGE - 25 - - 220-rly-de09.mx.aol.com+ESMTP+mail_relay_in-de09.3;+Tue,+24+Jun+2008+20:05:56+-0400 0 0 83 0 344 SMTP - - - -

2008-06-25 00:04:05 205.188.249.91 OutboundConnectionCommand SMTPSVC1 FIKT-EXCHANGE - 25 EHLO - mail.serveren.no 0 0 4 0 344 SMTP - - - -

2008-06-25 00:04:05 205.188.249.91 OutboundConnectionResponse SMTPSVC1 FIKT-EXCHANGE - 25 - - 250-rly-de09.mx.aol.com+peer+name+unknown 0 0 41 0 469 SMTP - - - -

2008-06-25 00:04:05 205.188.249.91 OutboundConnectionCommand SMTPSVC1 FIKT-EXCHANGE - 25 MAIL - FROM:<[email protected]> 0 0 4 0 469 SMTP - - - -

2008-06-25 00:04:05 205.188.249.91 OutboundConnectionResponse SMTPSVC1 FIKT-EXCHANGE - 25 - - 250+OK 0 0 6 0 594 SMTP - - - -

2008-06-25 00:04:05 205.188.249.91 OutboundConnectionCommand SMTPSVC1 FIKT-EXCHANGE - 25 RCPT - TO:<[email protected]> 0 0 4 0 594 SMTP - - - -

2008-06-25 00:04:05 205.188.249.91 OutboundConnectionResponse SMTPSVC1 FIKT-EXCHANGE - 25 - - 250+OK 0 0 6 0 719 SMTP - - - -

2008-06-25 00:04:05 205.188.249.91 OutboundConnectionCommand SMTPSVC1 FIKT-EXCHANGE - 25 RCPT - TO:<[email protected]> 0 0 4 0 719 SMTP - - - -

2008-06-25 00:04:05 205.188.249.91 OutboundConnectionResponse SMTPSVC1 FIKT-EXCHANGE - 25 - - 250+OK 0 0 6 0 828 SMTP - - - -

2008-06-25 00:04:05 205.188.249.91 OutboundConnectionCommand SMTPSVC1 FIKT-EXCHANGE - 25 RCPT - TO:<[email protected]> 0 0 4 0 828 SMTP - - - -

2008-06-25 00:04:05 205.188.249.91 OutboundConnectionResponse SMTPSVC1 FIKT-EXCHANGE - 25 - - 250+OK 0 0 6 0 953 SMTP - - - -

 

2008-06-25 02:51:36 64.12.139.249 OutboundConnectionResponse SMTPSVC1 FIKT-EXCHANGE - 25 - - 220-rly-mh02.mx.aol.com+ESMTP+mail_relay_in-mh02.8;+Tue,+24+Jun+2008+22:53:27+-0400 0 0 83 0 344 SMTP - - - -

2008-06-25 02:51:36 64.12.139.249 OutboundConnectionCommand SMTPSVC1 FIKT-EXCHANGE - 25 EHLO - mail.serveren.no 0 0 4 0 344 SMTP - - - -

2008-06-25 02:51:37 64.12.139.249 OutboundConnectionResponse SMTPSVC1 FIKT-EXCHANGE - 25 - - 250-rly-mh02.mx.aol.com+peer+name+unknown 0 0 41 0 547 SMTP - - - -

2008-06-25 02:51:37 64.12.139.249 OutboundConnectionCommand SMTPSVC1 FIKT-EXCHANGE - 25 MAIL - FROM:<[email protected]> 0 0 4 0 547 SMTP - - - -

2008-06-25 02:51:37 64.12.139.249 OutboundConnectionResponse SMTPSVC1 FIKT-EXCHANGE - 25 - - 250+OK 0 0 6 0 672 SMTP - - - -

2008-06-25 02:51:37 64.12.139.249 OutboundConnectionCommand SMTPSVC1 FIKT-EXCHANGE - 25 RCPT - TO:<[email protected]> 0 0 4 0 672 SMTP - - - -

2008-06-25 02:51:37 64.12.139.249 OutboundConnectionResponse SMTPSVC1 FIKT-EXCHANGE - 25 - - 250+OK 0 0 6 0 797 SMTP - - - -

2008-06-25 02:51:37 64.12.139.249 OutboundConnectionCommand SMTPSVC1 FIKT-EXCHANGE - 25 RCPT - TO:<[email protected]> 0 0 4 0 797 SMTP - - - -

2008-06-25 02:51:37 64.12.139.249 OutboundConnectionResponse SMTPSVC1 FIKT-EXCHANGE - 25 - - 250+OK 0 0 6 0 922 SMTP - - - -

2008-06-25 02:51:37 64.12.139.249 OutboundConnectionCommand SMTPSVC1 FIKT-EXCHANGE - 25 RCPT - TO:<[email protected]> 0 0 4 0 922 SMTP - - - -

 

2008-06-25 05:24:02 205.188.249.91 OutboundConnectionResponse SMTPSVC1 FIKT-EXCHANGE - 25 - - 220-rly-de05.mx.aol.com+ESMTP+mail_relay_in-de05.7;+Wed,+25+Jun+2008+01:25:53+-0400 0 0 83 0 250 SMTP - - - -

2008-06-25 05:24:02 205.188.249.91 OutboundConnectionCommand SMTPSVC1 FIKT-EXCHANGE - 25 EHLO - mail.serveren.no 0 0 4 0 250 SMTP - - - -

2008-06-25 05:24:03 205.188.249.91 OutboundConnectionResponse SMTPSVC1 FIKT-EXCHANGE - 25 - - 250-rly-de05.mx.aol.com+peer+name+unknown 0 0 41 0 437 SMTP - - - -

2008-06-25 05:24:03 205.188.249.91 OutboundConnectionCommand SMTPSVC1 FIKT-EXCHANGE - 25 MAIL - FROM:<[email protected]> 0 0 4 0 453 SMTP - - - -

2008-06-25 05:24:03 205.188.249.91 OutboundConnectionResponse SMTPSVC1 FIKT-EXCHANGE - 25 - - 250+OK 0 0 6 0 562 SMTP - - - -

2008-06-25 05:24:03 205.188.249.91 OutboundConnectionCommand SMTPSVC1 FIKT-EXCHANGE - 25 RCPT - TO:<[email protected]> 0 0 4 0 562 SMTP - - - -

2008-06-25 05:24:03 205.188.249.91 OutboundConnectionResponse SMTPSVC1 FIKT-EXCHANGE - 25 - - 250+OK 0 0 6 0 703 SMTP - - - -

2008-06-25 05:24:03 205.188.249.91 OutboundConnectionCommand SMTPSVC1 FIKT-EXCHANGE - 25 RCPT - TO:<[email protected]> 0 0 4 0 703 SMTP - - - -

2008-06-25 05:24:03 205.188.249.91 OutboundConnectionResponse SMTPSVC1 FIKT-EXCHANGE - 25 - - 250+OK 0 0 6 0 812 SMTP - - - -

2008-06-25 05:24:03 205.188.249.91 OutboundConnectionCommand SMTPSVC1 FIKT-EXCHANGE - 25 RCPT - TO:<[email protected]> 0 0 4 0 812 SMTP - - - -

2008-06-25 05:24:03 205.188.249.91 OutboundConnectionResponse SMTPSVC1 FIKT-EXCHANGE - 25 - - 250+OK 0 0 6 0 937 SMTP - - - -

[el_torro]

Forøvrig har jeg også filtrert ut NDR-meldinger med "Filter Out Mail to Non-Existent Users"

 

http://www.amset.info/exchange/filter-unknown.asp