openSUSE Security June 2003

security@lists.opensuse.org

156 participants
147 discussions

SuSE 8.2 and loop_fish2.o
by Jörg Maier 29 Jun '03

29 Jun '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, i updated my kernel to 2.4.21 and to mount my encrypted filesystems i tried to compile my own loop_fish2.o with ciphers-v1.0i.tar.bz2 or ciphers-v1.1d.tar.bz2 and a patched loop.o with loop-AES-v1.6i.tar.bz2 or loop-AES-v1.7d.tar.bz2, but none of the cipher archives gave me a loop_fish2.o. i tried to do an alias loop_fish2 loop_twofish, then he asked me for a passphrase, but to mount the filsystem he was not able. the hint for the ciphers and loop-AES files i got from http://mail.nl.linux.org/linux-crypto/2002-12/msg00044.html thank you joerg maier - -- GnuPG Key : http://www.shove-it.de/meinweb/joergpubkey03 Hi I am a signature virus. Please copy me to your .signature file to help me spread. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2-rc1-SuSE (GNU/Linux) iD8DBQE+/rfZTYj8eXbs1acRAss0AJ9bX8shQ4RItSj97aTfOHgbV/yETQCfZyBd 4WPE++zhDIEQiBSR5XObv64= =KrqB -----END PGP SIGNATURE-----

1 0

[suse-security] Need hints for FreeSwan
by pohl＠it-intern.de 28 Jun '03

28 Jun '03

>I'd like to connect a remote Win2K box to a internal LAN which has only >a dynamic IP via DSL. >I allready have dyndns.org domain, that gets updated on DSL login. > >Now I glimpsed at free-swan's documentation and - as far as I understand >- the setup-guide says I needed fixed IPs und update the DNS with key >info and so on. have a look at http://www.dr-lotz.de/freeSWAN-dyndns.html best regards Andreas Pohl ---------------------------------------------------- IT-intern eK Borriesstr. 19 27570 Bremerhaven Telefon: 0471 / 39 16 736 Telefax: 0471 / 39 16 738

1 0

RV: [suse-security] remote desktop access to SuSE 8.2 from Win2k
by Marco Antonio Sánchez Jullian 27 Jun '03

27 Jun '03

I recommend you to use VNC as well or SSH but if you prefer VNC I suggest TightVNC (http://www.tightvnc.com/) instead of the Nomral VNC from Cambridge, ´cause the other one has more features like view and control desktop passwords and other stuffs. Wish this help you! ------------------ Marco Sánchez -----Mensaje original----- De: Jaan Klouman [mailto:jaank@e-hackd.net] Enviado el: Jueves, 26 de Junio de 2003 08:11 a.m. Para: suse-security(a)suse.com Asunto: [suse-security] remote desktop access to SuSE 8.2 from Win2k Hello Can anyone give me some advise on remote access to my SuSE 8.2 Pro desktop remotely. I have tried vnc proxied through ssh which does work but then after a while I get invalid CBC from PuTTY on my Win2k client. Suggestion? Cheers Jaan Klouman Defend your privacy! Encrypt your email today! http://www.bytefusion.com/secexmail ---Tag My Public Key--- a2V5aWQ6IHsyNzc2NDVCQi02RTY1LTQzRjMtODk2NS1DRTVB OENBRjE0MUV9DQpvd25lcjogSmFhbl9LbG91bWFuDQplbWFp bDogamFhbmtAZS1oYWNrZC5uZXQNCmVuYWJsZWQ6IHllcw0K b3B0aW9uczogbm9uZQ0KDQotLS0tLUJFR0lOIFJTQSBQVUJM SUMgS0VZLS0tLS0KTUlHSkFvR0JBTHgyM3JBSjB0UHo4RE94 U3JKRFNEcmdYUVN6MzNZRFZ0Q0Rya3czTm9rcHl1bkdkUGRW WGZmKwp1eGlkdzB5cnJld29BMTgzVjB0OHpxcXQwSExQRGtm aVlZUE82cmRtRlprNnlxTyt5N3JHS3RkMCtOb1ZJWG44CjBH Y1J4c0Rmc2xYUUxJamFMSmQxa3N0QTRRNDYydkZMdk9jcmlX MVdMT2MxQ3BQVndUekpBZ01CQUFFPQotLS0tLUVORCBSU0Eg UFVCTElDIEtFWS0tLS0tCg0K ---End SecExMail Tag--- ---Tag My Public Key--- a2V5aWQ6IHsyNzc2NDVCQi02RTY1LTQzRjMtODk2NS1DRTVB OENBRjE0MUV9DQpvd25lcjogSmFhbl9LbG91bWFuDQplbWFp bDogamFhbmtAZS1oYWNrZC5uZXQNCmVuYWJsZWQ6IHllcw0K b3B0aW9uczogbm9uZQ0KDQotLS0tLUJFR0lOIFJTQSBQVUJM SUMgS0VZLS0tLS0KTUlHSkFvR0JBTHgyM3JBSjB0UHo4RE94 U3JKRFNEcmdYUVN6MzNZRFZ0Q0Rya3czTm9rcHl1bkdkUGRW WGZmKwp1eGlkdzB5cnJld29BMTgzVjB0OHpxcXQwSExQRGtm aVlZUE82cmRtRlprNnlxTyt5N3JHS3RkMCtOb1ZJWG44CjBH Y1J4c0Rmc2xYUUxJamFMSmQxa3N0QTRRNDYydkZMdk9jcmlX MVdMT2MxQ3BQVndUekpBZ01CQUFFPQotLS0tLUVORCBSU0Eg UFVCTElDIEtFWS0tLS0tCg0K ---End SecExMail Tag--- -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

FreeS/WAN load balancing
by Luis Abenza Sánchez 27 Jun '03

27 Jun '03

Hi all, I have 6 VPNs working with a central server, all with FreeS/WAN. Now I have two connections in this server, and I want to make use of the two. Anybody knows if I can do load balancing with the VPN? Im not using RSA, Im using passphrase. Thanks, Luis

2 1

Re: [suse-security] ssh2 - control comunication port
by Vladimir Dvorak 27 Jun '03

27 Jun '03

Niels Kueck wrote: > Hi, > > I've got a SuSE 8.2 system running with a ssh-daemon listening on port 22 > and I would like to control the comunication ports of the connection. In fact > the number of user is small so it would be enough just to have a few ports > open. > Is there any possibility to tell the ssh-daemon on which port he should > reply to the client ??? > > thanks a lot, ... > > ...niels. > There are a lot ways, how to do it. For example: tcp_wrappers (/etc/hosts.allow and hosts.deny), or in /etc/ssh/sshd_config (item ListenAddress some_ip_in_the_subnet), or by filter firewall iptables (iptables -A INPUT -m mac --mac-source ! your_mac_address -j DROP) and so on. :-) I prefer tcp_wrappers for this situation. -- Best Regards, Vladimir Dvorak, Internal IT --------------------------------------------------------------------- SuSE CR, s.r.o. e-mail: vlada(a)suse.cz Drahobejlova 27 tel:+420 2 96 542 373 190 00 Praha 9 fax:+420 2 8309 5374 Czech Republic http://www.suse.cz

1 0

ssh2 - control comunication port
by Niels Kueck 27 Jun '03

27 Jun '03

Hi, I've got a SuSE 8.2 system running with a ssh-daemon listening on port 22 and I would like to control the comunication ports of the connection. In fact the number of user is small so it would be enough just to have a few ports open. Is there any possibility to tell the ssh-daemon on which port he should reply to the client ??? thanks a lot, ... ...niels. -- +++ GMX - Mail, Messaging & more http://www.gmx.net +++ Bitte lächeln! Fotogalerie online mit GMX ohne eigene Homepage!

5 5

remote desktop access to SuSE 8.2 from Win2k
by Jaan Klouman 27 Jun '03

27 Jun '03

Hello Can anyone give me some advise on remote access to my SuSE 8.2 Pro desktop remotely. I have tried vnc proxied through ssh which does work but then after a while I get invalid CBC from PuTTY on my Win2k client. Suggestion? Cheers Jaan Klouman Defend your privacy! Encrypt your email today! http://www.bytefusion.com/secexmail ---Tag My Public Key--- a2V5aWQ6IHsyNzc2NDVCQi02RTY1LTQzRjMtODk2NS1DRTVB OENBRjE0MUV9DQpvd25lcjogSmFhbl9LbG91bWFuDQplbWFp bDogamFhbmtAZS1oYWNrZC5uZXQNCmVuYWJsZWQ6IHllcw0K b3B0aW9uczogbm9uZQ0KDQotLS0tLUJFR0lOIFJTQSBQVUJM SUMgS0VZLS0tLS0KTUlHSkFvR0JBTHgyM3JBSjB0UHo4RE94 U3JKRFNEcmdYUVN6MzNZRFZ0Q0Rya3czTm9rcHl1bkdkUGRW WGZmKwp1eGlkdzB5cnJld29BMTgzVjB0OHpxcXQwSExQRGtm aVlZUE82cmRtRlprNnlxTyt5N3JHS3RkMCtOb1ZJWG44CjBH Y1J4c0Rmc2xYUUxJamFMSmQxa3N0QTRRNDYydkZMdk9jcmlX MVdMT2MxQ3BQVndUekpBZ01CQUFFPQotLS0tLUVORCBSU0Eg UFVCTElDIEtFWS0tLS0tCg0K ---End SecExMail Tag--- ---Tag My Public Key--- a2V5aWQ6IHsyNzc2NDVCQi02RTY1LTQzRjMtODk2NS1DRTVB OENBRjE0MUV9DQpvd25lcjogSmFhbl9LbG91bWFuDQplbWFp bDogamFhbmtAZS1oYWNrZC5uZXQNCmVuYWJsZWQ6IHllcw0K b3B0aW9uczogbm9uZQ0KDQotLS0tLUJFR0lOIFJTQSBQVUJM SUMgS0VZLS0tLS0KTUlHSkFvR0JBTHgyM3JBSjB0UHo4RE94 U3JKRFNEcmdYUVN6MzNZRFZ0Q0Rya3czTm9rcHl1bkdkUGRW WGZmKwp1eGlkdzB5cnJld29BMTgzVjB0OHpxcXQwSExQRGtm aVlZUE82cmRtRlprNnlxTyt5N3JHS3RkMCtOb1ZJWG44CjBH Y1J4c0Rmc2xYUUxJamFMSmQxa3N0QTRRNDYydkZMdk9jcmlX MVdMT2MxQ3BQVndUekpBZ01CQUFFPQotLS0tLUVORCBSU0Eg UFVCTElDIEtFWS0tLS0tCg0K ---End SecExMail Tag---

5 4

Acrobat Reader
by Anders Johansson 26 Jun '03

26 Jun '03

Hi, Adobe has issued acroread 5.0.7 as a fix for CERT 200132, a bug that lets malicious web sites execute shell commands Will this show up in YOU?

2 1

Re: [suse-security] Sendmail 8.12.3-75 exploit
by Paulo Melo 26 Jun '03

26 Jun '03

> >What makes you think you have a problem? The logs show nothing out of the >ordinary. If you mean the NULL sender addresses <>, these can be perfectly >legal (for instance for bounce messages). Based on the log entries you >posted, it's hard to tell. ok... this is a portion of my today's log. As you can see, before a line with "from=<>" there are one before whith a tentative of a non-existent user. the pattern is to strong... for be just only bounced messages: smtp:/var/log # cat mail Jun 26 15:10:07 smtp sendmail[18532]: ruleset=check_relay, arg1=omr-m01.mx.aol.com, arg2=64.12.138.1, relay= omr-m01.mx.aol.com [64.12.138.1], reject=553 5.3.0 see http://www.blars.org/errors/block.html Jun 26 15:11:46 smtp sendmail[18633]: ruleset=check_relay, arg1=mc7-s15.law1.hotmail.com, arg2=65.54.251.155 , relay=mc7-s15.law1.hotmail.com [65.54.251.155] (may be forged), reject=553 5.3.0 see http://www.blars.org/ errors/block.html Jun 26 15:11:46 smtp sendmail[18686]: ruleset=check_relay, arg1=n14.grp.scd.yahoo.com, arg2=66.218.66.69, re lay=n14.grp.scd.yahoo.com [66.218.66.69], reject=553 5.3.0 see http://www.blars.org/errors/block.html Jun 26 15:11:57 smtp sendmail[18687]: h5QEBvrm018687: from=<Maria.Lurdes.Castro.Sousa(a)ccr-c.pt>, size=209172 , class=0, nrcpts=1, msgid=<5.1.0.14.2.20030626150540.00ab1440(a)mail.ccr-c.pt>, proto=ESMTP, daemon=MSA, rela y=[192.168.5.51] Jun 26 15:11:57 smtp amavis[18689]: starting. amavis 0.3.12pre5 Mon Mar 25 21:10:14 UTC 2002 Jun 26 15:11:58 smtp amavis[18689]: do_exit:832 - ending execution with 0 Jun 26 15:11:58 smtp sendmail[18687]: h5QEBvrm018687: Milter add: header: X-Virus-Scanned: by amavis-milter (http://amavis.org/) Jun 26 15:12:01 smtp sendmail[18695]: h5QEBvrm018687: to=<mjfig(a)ci.uc.pt>, delay=00:00:04, xdelay=00:00:03, mailer=esmtp, pri=120395, relay=smtp.ci.uc.pt. [193.136.200.62], dsn=2.0.0, stat=Sent (Ok: queued as 85EE815 754D) Jun 26 15:12:19 smtp sendmail[18777]: h5QECIrl018777: from=<>, size=5175, class=0, nrcpts=1, msgid=<0HH300E5 FDLLOZ(a)mstore2.iol.pt>, proto=ESMTP, daemon=MSA, relay=customer-240-190.lsb.net.KPNQwest.pt [193.126.240.190 ] Jun 26 15:12:20 smtp amavis[18779]: starting. amavis 0.3.12pre5 Mon Mar 25 21:10:14 UTC 2002 Jun 26 15:12:20 smtp amavis[18779]: do_exit:832 - ending execution with 0 Jun 26 15:12:20 smtp sendmail[18777]: h5QECIrl018777: Milter add: header: X-Virus-Scanned: by amavis-milter (http://amavis.org/) Jun 26 15:12:20 smtp sendmail[18784]: h5QECIrl018777: to=<pmanso(a)ccr-c.pt>, delay=00:00:01, xdelay=00:00:00, mailer=local, pri=35458, dsn=2.0.0, stat=Sent Jun 26 15:13:16 smtp sendmail[19574]: h5QECnrl019574: from=<JLapa(a)abrantina.pt>, size=2092, class=0, nrcpts= 1, msgid=<D9A3DA42D838C648BC33047111EB29E104B6A0@marte>, proto=ESMTP, daemon=MSA, relay=mail2.abrantina.pt [ 62.48.167.162] (may be forged) Jun 26 15:13:17 smtp amavis[24339]: starting. amavis 0.3.12pre5 Mon Mar 25 21:10:14 UTC 2002 Jun 26 15:13:17 smtp amavis[24339]: do_exit:832 - ending execution with 0 Jun 26 15:13:17 smtp sendmail[19574]: h5QECnrl019574: Milter add: header: X-Virus-Scanned: by amavis-milter (http://amavis.org/) Jun 26 15:13:17 smtp sendmail[24453]: h5QECnrl019574: to=<marta(a)ccr-c.pt>, delay=00:00:09, xdelay=00:00:00, mailer=local, pri=32371, dsn=2.0.0, stat=Sent Jun 26 15:13:19 smtp popper[24588]: Stats: pmelo 0 0 0 0 192.168.100.14 192.168.100.14 [pop_updt.c:296] Jun 26 15:13:23 smtp sendmail[24455]: h5QEDKrl024455: from=<c.browne(a)vam.ac.uk>, size=919, class=0, nrcpts=1 , msgid=<sefb0c39.054(a)vammail.vam.ac.uk>, proto=SMTP, daemon=MSA, relay=vammail.vam.ac.uk [193.62.208.129] Jun 26 15:13:24 smtp amavis[25141]: starting. amavis 0.3.12pre5 Mon Mar 25 21:10:14 UTC 2002 Jun 26 15:13:24 smtp amavis[25141]: do_exit:832 - ending execution with 0 Jun 26 15:13:24 smtp sendmail[24455]: h5QEDKrl024455: Milter add: header: X-Virus-Scanned: by amavis-milter (http://amavis.org/) Jun 26 15:14:06 smtp sendmail[30280]: h5QEE4rl030280: <dpdrc(a)ccr-c.pt>... User unknown Jun 26 15:14:06 smtp sendmail[30280]: h5QEE4rl030280: from=<assuncao(a)srsguarda.min-saude.pt>, size=55458, cl ass=0, nrcpts=0, bodytype=8BITMIME, proto=ESMTP, daemon=MSA, relay=host-17.min-saude.pt [194.65.151.17] Jun 26 15:14:25 smtp sendmail[18469]: h5QE8krl018469: collect: premature EOM: Connection reset by [159.213.1 00.253] Jun 26 15:14:26 smtp sendmail[18469]: h5QE8krl018469: SYSERR(root): collect: I/O error on connection from [1 59.213.100.253], from=<a.mazzoni(a)consiglio.regione.toscana.it> Jun 26 15:14:26 smtp sendmail[18469]: h5QE8krl018469: from=<a.mazzoni(a)consiglio.regione.toscana.it>, size=56 720, class=0, nrcpts=1, proto=ESMTP, daemon=MSA, relay=[159.213.100.253] Jun 26 15:15:08 smtp sendmail[32428]: h5QEF5rl032428: <g_davenportbs(a)ccr-c.pt>... User unknown Jun 26 15:15:08 smtp sendmail[32428]: h5QEF5rl032428: from=<>, size=2575, class=0, nrcpts=0, proto=ESMTP, da emon=MSA, relay=ausxndrpc101.aus.amer.dell.com [143.166.216.70] (may be forged) Jun 26 15:15:31 smtp sendmail[32538]: h5QEFPrl032538: from=<macorreia43(a)hotmail.com>, size=129459, class=0, nrcpts=1, msgid=<Law15-F196PYzDabigP000070aa(a)hotmail.com>, proto=ESMTP, daemon=MSA, relay=law15-f19.law15.ho tmail.com [64.4.23.19] Jun 26 15:15:31 smtp amavis[32542]: starting. amavis 0.3.12pre5 Mon Mar 25 21:10:14 UTC 2002 Jun 26 15:15:32 smtp amavis[32542]: do_exit:832 - ending execution with 0 Jun 26 15:15:32 smtp sendmail[32538]: h5QEFPrl032538: Milter add: header: X-Virus-Scanned: by amavis-milter (http://amavis.org/) Jun 26 15:15:32 smtp sendmail[32549]: h5QEFPrl032538: to=vf1022, delay=00:00:04, xdelay=00:00:00, mailer=loc al, pri=159743, dsn=2.0.0, stat=Sent Jun 26 15:15:40 smtp sendmail[32551]: h5QEFdrl032551: <latkinsiu(a)ccr-c.pt>... User unknown Jun 26 15:15:40 smtp sendmail[32551]: h5QEFdrl032551: from=<>, size=4108, class=0, nrcpts=0, proto=ESMTP, da emon=MSA, relay=mailout11.sul.t-online.com [194.25.134.85] JJun 26 15:16:08 smtp sendmail[32557]: ruleset=check_relay, arg1=llca097.servidoresdns.net, arg2=217.76.128.7 5, relay=llca097.servidoresdns.net [217.76.128.75], reject=553 5.3.0 see http://www.blars.org/errors/block.h tml Jun 26 15:16:18 smtp sendmail[32559]: h5QEGGrl032559: <s.puckett_fw(a)ccr-c.pt>... User unknown Jun 26 15:16:18 smtp sendmail[32559]: h5QEGGrl032559: from=<>, size=3139, class=0, nrcpts=0, proto=ESMTP, da emon=MSA, relay=[207.99.126.139] Jun 26 15:16:23 smtp sendmail[32561]: h5QEGNrm032561: from=<luis.filipe(a)ccr-c.pt>, size=1253, class=0, nrcpt s=1, msgid=<5.1.0.14.2.20030626150909.00aef980(a)mail.ccr-c.pt>, proto=ESMTP, daemon=MSA, relay=[192.168.4.63] Jun 26 15:16:23 smtp amavis[32563]: starting. amavis 0.3.12pre5 Mon Mar 25 21:10:14 UTC 2002 Jun 26 15:16:23 smtp amavis[32563]: do_exit:832 - ending execution with 0 Jun 26 15:16:23 smtp sendmail[32561]: h5QEGNrm032561: Milter add: header: X-Virus-Scanned: by amavis-milter (http://amavis.org/) Jun 26 15:16:24 smtp sendmail[32567]: h5QEGNrm032561: to=<sopertec-centro(a)sopertec.pt>, delay=00:00:01, xdel ay=00:00:00, mailer=esmtp, pri=120517, relay=smtp.net.vodafone.pt. [212.18.160.142], dsn=2.0.0, stat=Sent (O k.) Jun 26 15:16:44 smtp sendmail[32571]: h5QEGarm032571: <arlinepaigerf(a)ccr-c.pt>... User unknown Jun 26 15:17:02 smtp sendmail[32574]: h5QEGrrl032574: <glennar.bonner_tg(a)ccr-c.pt>... User unknown Jun 26 15:17:02 smtp sendmail[32574]: h5QEGrrl032574: from=<>, size=1789, class=0, nrcpts=0, proto=ESMTP, da emon=MSA, relay=gatekeeper.datatel.com [205.231.22.252] Jun 26 15:17:03 smtp sendmail[32575]: h5QEGurl032575: <cliftongilliamor(a)ccr-c.pt>... User unknown Jun 26 15:17:04 smtp sendmail[32575]: h5QEGurl032575: from=<>, size=4278, class=0, nrcpts=0, proto=ESMTP, da emon=MSA, relay=m1.dnx.net [65.192.199.14] JJun 26 15:17:22 smtp sendmail[32581]: h5QEHMrm032581: from=<luis.filipe(a)ccr-c.pt>, size=4072, class=0, nrcpt s=1, msgid=<5.1.0.14.2.20030626151028.00aeb440(a)mail.ccr-c.pt>, proto=ESMTP, daemon=MSA, relay=[192.168.4.63] Jun 26 15:17:22 smtp sendmail[32571]: h5QEGarm032571: from=<Symantec_AntiVirus_for_SMTP_Gateways(a)tmac.com>, size=0, class=0, nrcpts=0, proto=SMTP, daemon=MSA, relay=symantec.tmac.com [192.206.250.65] Jun 26 15:17:22 smtp amavis[32584]: starting. amavis 0.3.12pre5 Mon Mar 25 21:10:14 UTC 2002 Jun 26 15:17:22 smtp amavis[32584]: do_exit:832 - ending execution with 0 Jun 26 15:17:23 smtp sendmail[32581]: h5QEHMrm032581: Milter add: header: X-Virus-Scanned: by amavis-milter (http://amavis.org/) Jun 26 15:17:24 smtp sendmail[32583]: ruleset=check_relay, arg1=n13.grp.scd.yahoo.com, arg2=66.218.66.68, re lay=n13.grp.scd.yahoo.com [66.218.66.68], reject=553 5.3.0 see http://www.blars.org/errors/block.html Jun 26 15:17:25 smtp sendmail[32588]: h5QEHMrm032581: to=<feucomm(a)yahoogrupos.com.br>, delay=00:00:03, xdela y=00:00:02, mailer=esmtp, pri=120480, relay=mta2.grp.scd.yahoo.com. [66.218.66.217], dsn=2.0.0, stat=Sent (o k 1056636705 qp 55280) Jun 26 15:17:30 smtp sendmail[32589]: ruleset=check_relay, arg1=n34.grp.scd.yahoo.com, arg2=66.218.66.102, r elay=n34.grp.scd.yahoo.com [66.218.66.102], reject=553 5.3.0 see http://www.blars.org/errors/block.html Jun 26 15:18:48 smtp sendmail[32600]: h5QEIkrl032600: <randalljimenez_tz(a)ccr-c.pt>... User unknown Jun 26 15:18:48 smtp sendmail[32600]: h5QEIkrl032600: from=<>, size=4384, class=0, nrcpts=0, proto=ESMTP, da emon=MSA, relay=rsunx.crn.cogs.susx.ac.uk [139.184.48.12] JJun 26 15:19:43 smtp sendmail[32633]: starting daemon (8.12.3): SMTP+queueing@00:30:00 Jun 26 15:19:43 smtp sendmail-client[32637]: starting daemon (8.12.3): queueing@00:30:00 Jun 26 15:19:45 smtp sendmail[32661]: starting daemon (8.12.3): SMTP+queueing@00:30:00 Jun 26 15:19:45 smtp sendmail-client[32665]: starting daemon (8.12.3): queueing@00:30:00 Jun 26 15:20:06 smtp sendmail[32669]: h5QEJsq7032669: smtp.ccr-c.pt [10.1.3.3] did not issue MAIL/EXPN/VRFY/ ETRN during connection to MSA Jun 26 15:20:40 smtp sendmail[32682]: ruleset=check_relay, arg1=n36.grp.scd.yahoo.com, arg2=66.218.66.104, r elay=n36.grp.scd.yahoo.com [66.218.66.104], reject=553 5.3.0 see http://www.blars.org/errors/block.html Jun 26 15:20:41 smtp sendmail[32683]: ruleset=check_relay, arg1=[194.65.115.18], arg2=194.65.115.18, relay=[ 194.65.115.18], reject=553 5.3.0 Rejected by SPAM filter - see http://relays.osirusoft.com/ Jun 26 15:21:41 smtp sendmail[32700]: h5QELaq7032700: from=<psilva(a)metromondego.pt>, size=2982, class=0, nrc pts=3, msgid=<GLEBKPIJICCAPCFKLOHEMEIKDFAA.psilva(a)metromondego.pt>, bodytype=8BITMIME, proto=ESMTP, daemon=M SA, relay=server1.interacesso.pt [212.13.36.243] Jun 26 15:21:42 smtp amavis[32702]: starting. amavis 0.3.12pre5 Mon Mar 25 21:10:14 UTC 2002 Jun 26 15:21:42 smtp amavis[32702]: do_exit:832 - ending execution with 0 Jun 26 15:21:42 smtp sendmail[32700]: h5QELaq7032700: Milter add: header: X-Virus-Scanned: by amavis-milter (http://amavis.org/) Jun 26 15:21:42 smtp sendmail[32705]: h5QELaq7032700: to=lf1010, delay=00:00:01, xdelay=00:00:00, mailer=loc al, pri=93229, dsn=2.0.0, stat=Sent Jun 26 15:21:42 smtp sendmail[32705]: h5QELaq7032700: to=ms1011, delay=00:00:01, xdelay=00:00:00, mailer=loc al, pri=93229, dsn=2.0.0, stat=Sent Jun 26 15:21:42 smtp sendmail[32705]: h5QELaq7032700: to=rp1018, delay=00:00:01, xdelay=00:00:00, mailer=loc al, pri=93229, dsn=2.0.0, stat=Sent Jun 26 15:21:44 smtp popper[32709]: (v4.0.3) Unable to get canonical name of client 192.168.2.73: Unknown ho st (1) [pop_init.c:1054] Jun 26 15:21:57 smtp sendmail[32711]: h5QELvq8032711: from=<Margarida.Franca(a)ccr-c.pt>, size=1033, class=0, nrcpts=1, msgid=<5.1.0.14.2.20030626151405.00a78850(a)mail.ccr-c.pt>, proto=ESMTP, daemon=MSA, relay=[192.168. 2.56] Jun 26 15:21:58 smtp amavis[32713]: starting. amavis 0.3.12pre5 Mon Mar 25 21:10:14 UTC 2002 Jun 26 15:21:58 smtp amavis[32713]: do_exit:832 - ending execution with 0 Jun 26 15:21:58 smtp sendmail[32711]: h5QELvq8032711: Milter add: header: X-Virus-Scanned: by amavis-milter (http://amavis.org/) Jun 26 15:22:00 smtp sendmail[32717]: h5QELvq8032711: to=<clarasantos(a)hotmail.com>, delay=00:00:03, xdelay=0 0:00:02, mailer=esmtp, pri=120391, relay=mx1.hotmail.com. [65.54.166.99], dsn=2.0.0, stat=Sent ( <5.1.0.14.2 .20030626151405.00a78850(a)mail.ccr-c.pt> Queued mail for delivery) Jun 26 15:24:52 smtp sendmail[32737]: h5QEOpq8032737: from=<Ana.Pires(a)ccr-c.pt>, size=1332, class=0, nrcpts= 1, msgid=<5.1.0.14.2.20030626151735.00a92920(a)mail.ccr-c.pt>, proto=ESMTP, daemon=MSA, relay=[192.168.2.73] Jun 26 15:24:52 smtp amavis[32739]: starting. amavis 0.3.12pre5 Mon Mar 25 21:10:14 UTC 2002 Jun 26 15:24:52 smtp amavis[32739]: do_exit:832 - ending execution with 0 Jun 26 15:24:52 smtp sendmail[32737]: h5QEOpq8032737: Milter add: header: X-Virus-Scanned: by amavis-milter (http://amavis.org/) Jun 26 15:24:55 smtp sendmail[32743]: h5QEOpq8032737: to=<clara.pires(a)verizon.net>, delay=00:00:03, xdelay=0 0:00:03, mailer=esmtp, pri=120430, relay=relay.verizon.net. [206.46.170.12], dsn=2.0.0, stat=Sent (Message r eceived: 20030626141914.MKQM29366.mta008.verizon.net(a)smtp.ccr-c.pt) Jun 26 15:25:40 smtp sendmail[32748]: h5QEPPq7032748: from=<cantunes(a)inescc.pt>, size=93093, class=0, nrcpts =1, msgid=<3EFAFE9F.5010500(a)inescc.pt>, proto=ESMTP, daemon=MSA, relay=pombo.inescc.pt [193.137.103.1] Jun 26 15:25:41 smtp amavis[32751]: starting. amavis 0.3.12pre5 Mon Mar 25 21:10:14 UTC 2002 Jun 26 15:25:41 smtp amavis[32751]: do_exit:832 - ending execution with 0 Jun 26 15:25:41 smtp sendmail[32748]: h5QEPPq7032748: Milter add: header: X-Virus-Scanned: by amavis-milter (http://amavis.org/) Jun 26 15:25:41 smtp sendmail[32755]: h5QEPPq7032748: to=as0023, delay=00:00:14, xdelay=00:00:00, mailer=loc al, pri=123356, dsn=2.0.0, stat=Sent Jun 26 15:25:53 smtp popper[32757]: (v4.0.3) Unable to get canonical name of client 192.168.5.55: Unknown ho st (1) [pop_init.c:1054] Jun 26 15:26:12 smtp sendmail[32759]: ruleset=check_relay, arg1=server.equal.mts.gov.pt, arg2=195.22.29.42, relay=server.equal.mts.gov.pt [195.22.29.42], reject=553 5.3.0 see http://www.blars.org/errors/block.html Jun 26 15:26:30 smtp popper[32760]: (v4.0.3) Unable to get canonical name of client 192.168.2.96: Unknown ho st (1) [pop_init.c:1054] Jun 26 15:26:55 smtp sendmail[32761]: ruleset=check_relay, arg1=omr-m11.mx.aol.com, arg2=64.12.138.23, relay =omr-m11.mx.aol.com [64.12.138.23], reject=553 5.3.0 see http://www.blars.org/errors/block.html Jun 26 15:27:12 smtp popper[32763]: (v4.0.3) Unable to get canonical name of client 192.168.13.3: Unknown ho st (1) [pop_init.c:1054] Jun 26 15:27:41 smtp sendmail[32765]: h5QERYq7032765: from=<a.m.campos(a)iol.pt>, size=400929, class=0, nrcpts =1, msgid=<786833783e3d.783e3d786833(a)iol.pt>, bodytype=8BITMIME, proto=ESMTP, daemon=MSA, relay=customer-240 -190.lsb.net.KPNQwest.pt [193.126.240.190] Jun 26 15:27:42 smtp amavis[32767]: starting. amavis 0.3.12pre5 Mon Mar 25 21:10:14 UTC 2002 Jun 26 15:27:42 smtp amavis[32767]: do_exit:832 - ending execution with 0 Jun 26 15:27:42 smtp sendmail[32765]: h5QERYq7032765: Milter add: header: X-Virus-Scanned: by amavis-milter (http://amavis.org/) Jun 26 15:27:42 smtp sendmail[303]: h5QERYq7032765: to=ms0032, delay=00:00:05, xdelay=00:00:00, mailer=local , pri=431227, dsn=2.0.0, stat=Sent Jun 26 15:27:54 smtp sendmail[305]: h5QERoq7000305: <emile_wilkerson_rh(a)ccr-c.pt>... User unknown Jun 26 15:27:54 smtp sendmail[305]: h5QERoq7000305: from=<>, size=4299, class=0, nrcpts=0, proto=ESMTP, daem on=MSA, relay=smtpny4.vnuusa.com [63.251.31.41] Jun 26 15:27:54 smtp sendmail[308]: h5QERsq8000308: from=<fcsacadu(a)ccr-c.pt>, size=2119, class=0, nrcpts=1, msgid=<5.1.0.14.2.20030626151254.009e21b0(a)mail.ccr-c.pt>, proto=ESMTP, daemon=MSA, relay=[192.168.7.7] Jun 26 15:27:55 smtp amavis[310]: starting. amavis 0.3.12pre5 Mon Mar 25 21:10:14 UTC 2002 Jun 26 15:27:55 smtp amavis[310]: do_exit:832 - ending execution with 0 Jun 26 15:27:55 smtp sendmail[308]: h5QERsq8000308: Milter add: header: X-Virus-Scanned: by amavis-milter (h ttp://amavis.org/) Jun 26 15:27:56 smtp sendmail[315]: h5QERsq8000308: to=<pedro.cardoso(a)iambiente.pt>, ctladdr=<fcsacadu@ccr-c .pt> (604/100), delay=00:00:02, xdelay=00:00:01, mailer=esmtp, pri=120428, relay=urano.dga.min-amb.pt. [194. 79.68.1], dsn=2.0.0, stat=Sent (Ok.) Jun 26 15:28:41 smtp sendmail[321]: ruleset=check_relay, arg1=tybclbsmtpa01.listbuilder.com, arg2=204.71.191 .27, relay=tybclbsmtpa01.listbuilder.com [204.71.191.27], reject=553 5.3.0 Rejected by SPAM filter - see htt p://relays.osirusoft.com/ Jun 26 15:28:49 smtp sendmail[322]: ruleset=check_relay, arg1=calvin.oninet, arg2=195.245.128.9, relay=calvi n.oninet [195.245.128.9] (may be forged), reject=553 5.3.0 see http://www.blars.org/errors/block.html Jun 26 15:28:54 smtp sendmail[324]: h5QESpq7000324: from=<av_sic_pmsantos(a)lojadocidadao.pt>, size=1323, clas s=0, nrcpts=1, msgid=<670AA5A72F435D408DD680988615EE520607EF(a)LCPO-EXCH01.lc.pt>, proto=ESMTP, daemon=MSA, re lay=[193.126.127.66] Jun 26 15:28:54 smtp amavis[327]: starting. amavis 0.3.12pre5 Mon Mar 25 21:10:14 UTC 2002 Jun 26 15:28:54 smtp amavis[327]: do_exit:832 - ending execution with 0 Jun 26 15:28:54 smtp sendmail[324]: h5QESpq7000324: Milter add: header: X-Virus-Scanned: by amavis-milter (h ttp://amavis.org/) Jun 26 15:28:54 smtp sendmail[330]: h5QESpq7000324: to=<lberna(a)ccr-c.pt>, delay=00:00:01, xdelay=00:00:00, m ailer=local, pri=31569, dsn=2.0.0, stat=Sent Jun 26 15:28:58 smtp sendmail[332]: ruleset=check_relay, arg1=mc10-s20.bay6.hotmail.com, arg2=65.54.165.94, relay=mc10-s20.bay6.hotmail.com [65.54.165.94], reject=553 5.3.0 see http://www.blars.org/errors/block.html Jun 26 15:32:26 smtp sendmail[375]: h5QEWNq7000375: <mike.n.mcNamara_ne(a)ccr-c.pt>... User unknown Jun 26 15:32:26 smtp sendmail[375]: h5QEWNq7000375: from=<>, size=3007, class=0, nrcpts=0, proto=ESMTP, daem on=MSA, relay=mx5.mx.voyager.net [216.93.66.84] Jun 26 15:32:27 smtp popper[377]: (v4.0.3) Unable to get canonical name of client 192.168.100.13: Unknown ho st (1) [pop_init.c:1054] Jun 26 15:32:27 smtp popper[377]: Stats: vribeiro 0 0 0 0 192.168.100.13 192.168.100.13 [pop_updt.c:296] Jun 26 15:32:30 smtp popper[378]: (v4.0.3) Unable to get canonical name of client 192.168.2.96: Unknown host (1) [pop_init.c:1054] Jun 26 15:32:32 smtp popper[378]: Stats: al1012 0 0 0 0 192.168.2.96 192.168.2.96 [pop_updt.c:296] Jun 26 15:32:39 smtp sendmail[338]: h5QET8q7000338: [194.65.114.179] did not issue MAIL/EXPN/VRFY/ETRN durin g connection to MSA Jun 26 15:32:53 smtp sendmail[380]: h5QEWrq7000380: from=<>, size=3239, class=0, nrcpts=1, msgid=<2003062614 27.h5QERCaJ001138(a)www.ccr-c.pt>, proto=ESMTP, daemon=MSA, relay=www [10.1.3.2] Jun 26 15:32:53 smtp amavis[382]: starting. amavis 0.3.12pre5 Mon Mar 25 21:10:14 UTC 2002 Jun 26 15:32:53 smtp amavis[382]: do_exit:832 - ending execution with 0 Jun 26 15:32:53 smtp sendmail[380]: h5QEWrq7000380: Milter add: header: X-Virus-Scanned: by amavis-milter (h ttp://amavis.org/) Jun 26 15:32:53 smtp sendmail[387]: h5QEWrq7000380: to=<pmelo(a)ccr-c.pt>, delay=00:00:00, xdelay=00:00:00, ma iler=local, pri=33477, dsn=2.0.0, stat=Sent Jun 26 15:32:57 smtp sendmail[379]: h5QEWsq7000379: <juliann.haas_yw(a)ccr-c.pt>... User unknown Jun 26 15:32:57 smtp sendmail[379]: h5QEWsq7000379: from=<>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon= MSA, relay=216.163.91.2.cypresscom.net [216.163.91.2] (may be forged) Jun 26 15:33:09 smtp sendmail[390]: h5QEX5q7000390: <rosariomdenniswo(a)ccr-c.pt>... User unknown Jun 26 15:33:09 smtp sendmail[390]: h5QEX5q7000390: from=<>, size=2642, class=0, nrcpts=0, proto=ESMTP, daem on=MSA, relay=ex3beimcoims02.cec.eu.int [158.169.131.58] Paulo Jorge de Melo Gabinete de Informática e Estatística Comissão de Coordenação da Região Centro _________________________________________________________________________________________________ "What? You search? You would multiply yourself by ten, by a hundred? You seek followers? Seek zeros! "- Nietzsche

2 1

Re: [suse-security] Sendmail 8.12.3-75 exploit
by Paulo Melo 26 Jun '03

26 Jun '03

> >Looks like bounce messages to me. Are those the only lines you get in >your log? No "to" lines after each "from"? No messages before those >saying something like "No such user" or some other error that would >generate a bounce? This is what I get. Before the message that I sent to the list, the line before I can see an attempt to send mail from a non-existent user, in this case atlyon_sz(a)ccr-c.pt. Then the report from=<> Jun 26 17:21:42 smtp sendmail[2550]: h5QGLdiQ002550: <atlyon_sz(a)ccr-c.pt>... User unknown Jun 26 17:21:42 smtp sendmail[2550]: h5QGLdiQ002550: from=<>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MSA, relay=mail.bonniej.com [207.41.169.205] And I've 300 user mail accounts and this is what I've for a couple of minutes, and you can see that this is to much for only bounce messages: Jun 26 15:12:19 smtp sendmail[18777]: h5QECIrl018777: from=<>, size=5175, class=0, nrcpts=1, msgid=<0HH300E5 FDLLOZ(a)mstore2.iol.pt>, proto=ESMTP, daemon=MSA, relay=customer-240-190.lsb.net.KPNQwest.pt [193.126.240.190 ] Jun 26 15:13:25 smtp sendmail[24919]: h5QEDMrl024919: from=<>, size=1602, class=0, nrcpts=0, proto=ESMTP, da emon=MSA, relay=remt22.cluster1.charter.net [209.225.8.32] Jun 26 15:15:08 smtp sendmail[32428]: h5QEF5rl032428: from=<>, size=2575, class=0, nrcpts=0, proto=ESMTP, da emon=MSA, relay=ausxndrpc101.aus.amer.dell.com [143.166.216.70] (may be forged) Jun 26 15:15:40 smtp sendmail[32551]: h5QEFdrl032551: from=<>, size=4108, class=0, nrcpts=0, proto=ESMTP, da emon=MSA, relay=mailout11.sul.t-online.com [194.25.134.85] Jun 26 15:16:18 smtp sendmail[32559]: h5QEGGrl032559: from=<>, size=3139, class=0, nrcpts=0, proto=ESMTP, da emon=MSA, relay=[207.99.126.139] Jun 26 15:17:02 smtp sendmail[32574]: h5QEGrrl032574: from=<>, size=1789, class=0, nrcpts=0, proto=ESMTP, da emon=MSA, relay=gatekeeper.datatel.com [205.231.22.252] Jun 26 15:17:04 smtp sendmail[32575]: h5QEGurl032575: from=<>, size=4278, class=0, nrcpts=0, proto=ESMTP, da emon=MSA, relay=m1.dnx.net [65.192.199.14] Jun 26 15:18:48 smtp sendmail[32600]: h5QEIkrl032600: from=<>, size=4384, class=0, nrcpts=0, proto=ESMTP, da emon=MSA, relay=rsunx.crn.cogs.susx.ac.uk [139.184.48.12] Jun 26 15:23:03 smtp sendmail[32722]: h5QEN0q7032722: from=<>, size=1677, class=0, nrcpts=0, proto=ESMTP, da emon=MSA, relay=remt29.cluster1.charter.net [209.225.8.39] Jun 26 15:27:54 smtp sendmail[305]: h5QERoq7000305: from=<>, size=4299, class=0, nrcpts=0, proto=ESMTP, daem on=MSA, relay=smtpny4.vnuusa.com [63.251.31.41] Jun 26 15:29:08 smtp sendmail[336]: h5QET6q7000336: from=<>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon= MSA, relay=omr-r09.mx.aol.com [152.163.225.154] Jun 26 15:32:26 smtp sendmail[375]: h5QEWNq7000375: from=<>, size=3007, class=0, nrcpts=0, proto=ESMTP, daem on=MSA, relay=mx5.mx.voyager.net [216.93.66.84] Jun 26 15:32:53 smtp sendmail[380]: h5QEWrq7000380: from=<>, size=3239, class=0, nrcpts=1, msgid=<2003062614 27.h5QERCaJ001138(a)www.ccr-c.pt>, proto=ESMTP, daemon=MSA, relay=www [10.1.3.2] Jun 26 15:32:57 smtp sendmail[379]: h5QEWsq7000379: from=<>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon= MSA, relay=216.163.91.2.cypresscom.net [216.163.91.2] (may be forged) Jun 26 15:33:09 smtp sendmail[390]: h5QEX5q7000390: from=<>, size=2642, class=0, nrcpts=0, proto=ESMTP, daem on=MSA, relay=ex3beimcoims02.cec.eu.int [158.169.131.58] Jun 26 15:34:01 smtp sendmail[408]: h5QEXwq7000408: from=<>, size=2410, class=0, nrcpts=0, proto=ESMTP, daem on=MSA, relay=[206.80.206.8] Jun 26 15:36:11 smtp sendmail[443]: h5QEa9q7000443: from=<>, size=2597, class=0, nrcpts=0, proto=ESMTP, daem on=MSA, relay=atlmail4.turner.com [64.236.221.5] Jun 26 15:36:37 smtp sendmail[460]: h5QEaXq7000460: from=<>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon= MSA, relay=[196.31.136.43] Jun 26 15:37:42 smtp sendmail[517]: h5QEbdq7000517: from=<>, size=3356, class=0, nrcpts=0, proto=ESMTP, daem on=MSA, relay=motgate6.mot.com [144.189.100.106] Jun 26 15:38:27 smtp sendmail[550]: h5QEcOq7000550: from=<>, size=4308, class=0, nrcpts=0, proto=ESMTP, daem on=MSA, relay=server11.internet-hosting-services.com [64.94.231.3] Jun 26 15:39:17 smtp sendmail[580]: h5QEdFq7000580: from=<>, size=3543, class=0, nrcpts=0, proto=ESMTP, daem on=MSA, relay=pascoe.ucs.ed.ac.uk [129.215.128.240] Jun 26 15:39:26 smtp sendmail[586]: h5QEdNq7000586: from=<>, size=0, class=0, nrcpts=0, proto=SMTP, daemon=M SA, relay=[63.112.247.66] Jun 26 15:45:01 smtp sendmail[723]: h5QEikq7000723: from=<>, size=4728, class=0, nrcpts=1, msgid=<2003062614 3342.2BC5D2C073(a)imap.ualg.pt>, proto=ESMTP, daemon=MSA, relay=smtp.ualg.pt [193.136.224.8] Jun 26 15:45:32 smtp sendmail[773]: h5QEjRq7000773: from=<>, size=0, class=0, nrcpts=0, proto=SMTP, daemon=M SA, relay=babe.carverclan.com [204.228.230.36] Jun 26 15:47:24 smtp sendmail[789]: ruleset=check_relay, arg1=[81.195.84.110], arg2=81.195.84.110, relay=[81 .195.84.110], reject=550 5.7.1 ACCESS DENIED to <> thru [81.195.84.110] by easynet.nl DNSBL (http://blackhol es.easynet.nl/errors.html) Jun 26 15:48:16 smtp sendmail[792]: h5QElXq7000792: from=<>, size=2242, class=0, nrcpts=0, proto=ESMTP, daem on=MSA, relay=ego.mind.net [69.9.129.1] Jun 26 15:48:38 smtp sendmail[801]: h5QEmZq7000801: from=<>, size=4206, class=0, nrcpts=0, proto=ESMTP, daem on=MSA, relay=iris.hmdnsgroup.com [63.247.131.52] Jun 26 15:49:35 smtp sendmail[820]: h5QEnWq7000820: from=<>, size=2996, class=0, nrcpts=0, proto=ESMTP, daem on=MSA, relay=mx12.mx.voyager.net [216.93.66.91] Jun 26 15:52:17 smtp sendmail[856]: h5QEqEq7000856: from=<>, size=2530, class=0, nrcpts=0, proto=ESMTP, daem on=MSA, relay=[63.93.126.52] Jun 26 15:52:37 smtp sendmail[859]: h5QEqYq7000859: from=<>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon= MSA, relay=www.wescraven.com [66.155.35.129] Jun 26 15:55:28 smtp sendmail[960]: h5QEtPiQ000960: from=<>, size=4398, class=0, nrcpts=0, proto=ESMTP, daem on=MSA, relay=[139.133.7.24] Jun 26 15:56:50 smtp sendmail[1001]: h5QEuliQ001001: from=<>, size=1658, class=0, nrcpts=0, proto=ESMTP, dae mon=MSA, relay=nsccfw.gscc.com [208.195.54.129] Jun 26 15:57:52 smtp sendmail[1011]: h5QEvmiQ001011: from=<>, size=0, class=0, nrcpts=0, proto=SMTP, daemon= MSA, relay=[12.42.86.2] Jun 26 15:57:56 smtp sendmail[1012]: h5QEvriQ001012: from=<>, size=2564, class=0, nrcpts=0, proto=ESMTP, dae mon=MSA, relay=mail.micruscorp.com [67.104.107.101] (may be forged) Jun 26 16:01:07 smtp sendmail[1093]: h5QF14iQ001093: from=<>, size=2985, class=0, nrcpts=0, proto=ESMTP, dae mon=MSA, relay=mailout09.sul.t-online.com [194.25.134.84] Jun 26 16:07:50 smtp sendmail[1170]: h5QF7kiQ001170: from=<>, size=2702, class=0, nrcpts=0, proto=ESMTP, dae mon=MSA, relay=rcpt-expgw.biglobe.ne.jp [202.225.89.187] Jun 26 16:08:37 smtp sendmail[1192]: h5QF8ZiQ001192: from=<>, size=3673, class=0, nrcpts=0, proto=ESMTP, dae mon=MSA, relay=buzz.frogspace.net [216.222.200.2] Jun 26 16:08:51 smtp sendmail[1195]: h5QF8niQ001195: from=<>, size=2559, class=0, nrcpts=0, proto=ESMTP, dae mon=MSA, relay=[160.79.25.114] Jun 26 16:10:05 smtp sendmail[1223]: h5QFA2iQ001223: from=<>, size=0, class=0, nrcpts=0, proto=SMTP, daemon= MSA, relay=mail11.voicenet.com [207.103.0.37] Jun 26 16:10:21 smtp sendmail[1226]: h5QFAIiQ001226: from=<>, size=0, class=0, nrcpts=0, proto=SMTP, daemon= MSA, relay=bigbrother2.ahh.com [12.151.131.136] Jun 26 16:16:58 smtp sendmail[1337]: ruleset=check_relay, arg1=[212.253.129.11], arg2=212.253.129.11, relay= [212.253.129.11], reject=550 5.7.1 ACCESS DENIED to <> thru [212.253.129.11] by easynet.nl DNSBL (http://bla ckholes.easynet.nl/errors.html) Jun 26 16:20:32 smtp sendmail[1410]: h5QFKUiQ001410: from=<>, size=2912, class=0, nrcpts=0, proto=ESMTP, dae mon=MSA, relay=mail6.atl.registeredsite.com [64.224.219.80] Jun 26 16:21:39 smtp sendmail[1427]: h5QFLXiQ001427: from=<>, size=0, class=0, nrcpts=0, proto=SMTP, daemon= MSA, relay=mail-3.firstworld.net [66.179.72.35] (may be forged) Jun 26 16:23:00 smtp sendmail[1460]: h5QFMviQ001460: from=<>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon =MSA, relay=mx1.fl.megamailservers.com [64.29.144.68] (may be forged) Jun 26 16:27:37 smtp sendmail[1505]: h5QFRYiQ001505: from=<>, size=2150, class=0, nrcpts=0, proto=ESMTP, dae mon=MSA, relay=orpheus2.amdahl.com [129.212.11.23] Jun 26 16:28:27 smtp sendmail[1545]: h5QFSPiQ001545: from=<>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon =MSA, relay=omr-r09.mx.aol.com [152.163.225.154] Jun 26 16:28:51 smtp sendmail[1550]: h5QFSgiQ001550: from=<>, size=4529, class=0, nrcpts=0, proto=ESMTP, dae mon=MSA, relay=gandalf.warpdrive.net [24.56.130.20] Jun 26 16:32:38 smtp sendmail[1607]: h5QFWXiQ001607: from=<>, size=0, class=0, nrcpts=0, proto=SMTP, daemon= MSA, relay=mx1.thebiz.net [216.238.0.21] Jun 26 16:34:34 smtp sendmail[1630]: h5QFYWiQ001630: from=<>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon =MSA, relay=omr-r09.mx.aol.com [152.163.225.154] Jun 26 16:34:55 smtp sendmail[1633]: h5QFYriQ001633: from=<>, size=5120, class=0, nrcpts=0, proto=ESMTP, dae mon=MSA, relay=smtp03.infoave.net [165.166.0.28] Jun 26 16:36:20 smtp sendmail[1644]: h5QFaHiQ001644: from=<>, size=4693, class=0, nrcpts=0, proto=ESMTP, dae mon=MSA, relay=e35.co.us.ibm.com [32.97.110.133] Jun 26 16:38:15 smtp sendmail[1653]: h5QFcDiQ001653: from=<>, size=3302, class=0, nrcpts=0, proto=ESMTP, dae mon=MSA, relay=blackbox.inta.net [194.70.70.70] Jun 26 16:42:27 smtp sendmail[1713]: h5QFgPiQ001713: from=<>, size=3453, class=0, nrcpts=0, proto=ESMTP, dae mon=MSA, relay=fep21.swip.net [130.244.199.149] Jun 26 16:46:13 smtp sendmail[1764]: h5QFkAiQ001764: from=<>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon =MSA, relay=orbit.bluegravity.com [64.57.64.181] Jun 26 16:46:55 smtp sendmail[1775]: h5QFkpiQ001775: from=<>, size=2709, class=0, nrcpts=0, proto=ESMTP, dae mon=MSA, relay=zmail-5.hanmail.net [211.43.197.114] Jun 26 16:48:46 smtp sendmail[1806]: h5QFmhiQ001806: from=<>, size=3116, class=0, nrcpts=0, proto=ESMTP, dae mon=MSA, relay=mx5.mx.voyager.net [216.93.66.84] Jun 26 16:48:58 smtp sendmail[1811]: h5QFmsiQ001811: from=<>, size=1024, class=0, nrcpts=0, proto=ESMTP, dae mon=MSA, relay=mx.fsr.net [207.141.26.12] Jun 26 16:49:03 smtp sendmail[1810]: h5QFmviQ001810: from=<>, size=4801, class=0, nrcpts=0, proto=ESMTP, dae mon=MSA, relay=mail.tor.primus.ca [216.254.136.21] Jun 26 16:50:50 smtp sendmail[1865]: h5QFooiR001865: from=<>, size=796, class=0, nrcpts=1, msgid=<2003062615 50.h5QFooiR001865(a)smtp.ccr-c.pt>, proto=ESMTP, daemon=MSA, relay=[192.168.4.59] Jun 26 16:52:17 smtp sendmail[1900]: h5QFqFiQ001900: from=<>, size=0, class=0, nrcpts=0, proto=SMTP, daemon= MSA, relay=erebus.uk.clara.net [195.8.69.223] Jun 26 16:54:39 smtp sendmail[1933]: h5QFsaiQ001933: from=<>, size=3109, class=0, nrcpts=0, proto=ESMTP, dae mon=MSA, relay=homer.perfectpresence.com [209.123.207.194] Jun 26 16:54:44 smtp sendmail[1942]: h5QFsfiQ001942: from=<>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon =MSA, relay=smtp.enpointe.com [12.9.171.26] Jun 26 16:54:55 smtp sendmail[1945]: h5QFsriQ001945: from=<>, size=1755, class=0, nrcpts=0, proto=ESMTP, dae mon=MSA, relay=toucan.inebraska.com [199.184.119.10] Jun 26 16:56:38 smtp sendmail[1975]: h5QFuZiQ001975: from=<>, size=2455, class=0, nrcpts=0, proto=ESMTP, dae mon=MSA, relay=[209.52.73.149] Jun 26 16:57:39 smtp sendmail[1983]: h5QFvdiR001983: from=<>, size=774, class=0, nrcpts=1, msgid=<2003062615 57.h5QFvdiR001983(a)smtp.ccr-c.pt>, proto=ESMTP, daemon=MSA, relay=[192.168.4.59] Jun 26 16:57:44 smtp sendmail[1991]: h5QFvfiQ001991: from=<>, size=2482, class=0, nrcpts=0, proto=ESMTP, dae mon=MSA, relay=ganos.holmes.com [65.197.153.226] Jun 26 16:58:58 smtp sendmail[2009]: h5QFwtiQ002009: from=<>, size=0, class=0, nrcpts=0, proto=SMTP, daemon= MSA, relay=smithers.synacor.com [208.197.227.10] Jun 26 16:59:27 smtp sendmail[2023]: h5QFxPiQ002023: from=<>, size=3590, class=0, nrcpts=0, proto=ESMTP, dae mon=MSA, relay=smtpl.ha-net.ptd.net [207.44.96.100] Jun 26 17:01:52 smtp sendmail[2079]: h5QG1niQ002079: from=<>, size=0, class=0, nrcpts=1, proto=ESMTP, daemon =MSA, relay=goliath.siemens.de [192.35.17.28] Jun 26 17:01:56 smtp sendmail[2082]: h5QG1riQ002082: from=<>, size=0, class=0, nrcpts=1, proto=ESMTP, daemon =MSA, relay=gecko.sbs.de [194.138.37.40] Jun 26 17:01:57 smtp sendmail[2083]: h5QG1tiQ002083: from=<>, size=0, class=0, nrcpts=1, proto=ESMTP, daemon =MSA, relay=david.siemens.de [192.35.17.14] Jun 26 17:01:59 smtp sendmail[2088]: h5QG1uiQ002088: from=<>, size=0, class=0, nrcpts=1, proto=ESMTP, daemon =MSA, relay=thoth.sbs.de [192.35.17.2] Jun 26 17:02:00 smtp sendmail[2086]: h5QG1uiQ002086: from=<>, size=0, class=0, nrcpts=1, proto=ESMTP, daemon =MSA, relay=thoth.sbs.de [192.35.17.2] Jun 26 17:02:04 smtp sendmail[2094]: h5QG21iQ002094: from=<>, size=0, class=0, nrcpts=1, proto=ESMTP, daemon =MSA, relay=iramx1.ira.uni-karlsruhe.de [141.3.10.80] Jun 26 17:02:06 smtp sendmail[2098]: h5QG25iQ002098: from=<>, size=0, class=0, nrcpts=1, proto=ESMTP, daemon =MSA, relay=david.siemens.de [192.35.17.14] Jun 26 17:02:07 smtp sendmail[2097]: h5QG24iQ002097: from=<>, size=0, class=0, nrcpts=1, proto=SMTP, daemon= MSA, relay=mlucom8.urz.Uni-Halle.DE [141.48.10.118] Jun 26 17:02:08 smtp sendmail[2095]: h5QG23iQ002095: from=<>, size=0, class=0, nrcpts=1, proto=SMTP, daemon= MSA, relay=mail-in2.tiscali.be [62.235.13.192] Jun 26 17:02:15 smtp sendmail[2107]: h5QG2DiQ002107: from=<>, size=0, class=0, nrcpts=1, proto=SMTP, daemon= MSA, relay=mail-in1.tiscali.be [62.235.13.191] Jun 26 17:02:18 smtp sendmail[2109]: h5QG2GiQ002109: from=<>, size=0, class=0, nrcpts=1, proto=SMTP, daemon= MSA, relay=[62.235.13.189] Jun 26 17:02:23 smtp sendmail[2111]: h5QG2KiQ002111: from=<>, size=0, class=0, nrcpts=1, proto=SMTP, daemon= MSA, relay=lists.sourceforge.net [66.35.250.206] Jun 26 17:02:23 smtp sendmail[2111]: h5QG2KiR002111: from=<>, size=0, class=0, nrcpts=1, proto=SMTP, daemon= MSA, relay=lists.sourceforge.net [66.35.250.206] Jun 26 17:02:31 smtp sendmail[2118]: h5QG2TiQ002118: from=<>, size=0, class=0, nrcpts=1, proto=SMTP, daemon= MSA, relay=landau.PH-Karlsruhe.DE [193.197.80.51] Jun 26 17:02:32 smtp sendmail[2120]: h5QG2UiQ002120: from=<>, size=0, class=0, nrcpts=1, proto=ESMTP, daemon =MSA, relay=goliath.siemens.de [192.35.17.28] Jun 26 17:02:33 smtp sendmail[2124]: h5QG2WiQ002124: from=<>, size=0, class=0, nrcpts=1, proto=ESMTP, daemon =MSA, relay=thoth.sbs.de [192.35.17.2] Jun 26 17:02:35 smtp sendmail[2126]: h5QG2YiQ002126: from=<>, size=0, class=0, nrcpts=1, proto=ESMTP, daemon =MSA, relay=gecko.sbs.de [194.138.37.40] Jun 26 17:02:37 smtp sendmail[2128]: h5QG2aiQ002128: from=<>, size=0, class=0, nrcpts=1, proto=ESMTP, daemon =MSA, relay=gecko.sbs.de [194.138.37.40] Jun 26 17:02:38 smtp sendmail[2130]: h5QG2biQ002130: from=<>, size=0, class=0, nrcpts=1, proto=ESMTP, daemon =MSA, relay=thoth.sbs.de [192.35.17.2] Jun 26 17:02:40 smtp sendmail[2132]: h5QG2ciQ002132: from=<>, size=0, class=0, nrcpts=1, proto=ESMTP, daemon =MSA, relay=david.siemens.de [192.35.17.14] Jun 26 17:02:40 smtp sendmail[2133]: h5QG2diQ002133: from=<>, size=0, class=0, nrcpts=1, proto=ESMTP, daemon =MSA, relay=david.siemens.de [192.35.17.14] Jun 26 17:03:38 smtp sendmail[2153]: h5QG3ZiQ002153: from=<>, size=3139, class=0, nrcpts=0, proto=ESMTP, dae mon=MSA, relay=[207.99.126.139] Jun 26 17:09:30 smtp sendmail[2229]: h5QG9RiQ002229: from=<>, size=3577, class=0, nrcpts=0, proto=ESMTP, dae mon=MSA, relay=postfix4-2.free.fr [213.228.0.176] Jun 26 17:12:01 smtp sendmail[2284]: h5QGBxiQ002284: from=<>, size=2999, class=0, nrcpts=0, proto=ESMTP, dae mon=MSA, relay=mx5.mx.voyager.net [216.93.66.84] Jun 26 17:16:11 smtp sendmail[2399]: h5QGG7iQ002399: from=<>, size=0, class=0, nrcpts=0, proto=SMTP, daemon= MSA, relay=216-21-149-210.ip.van.radiant.net [216.21.149.210] Jun 26 17:17:49 smtp sendmail[2456]: h5QGHfiQ002456: from=<>, size=1024, class=0, nrcpts=0, proto=ESMTP, dae mon=MSA, relay=mx11.mx.voyager.net [216.93.66.90] Jun 26 17:21:23 smtp sendmail[2530]: h5QGLLiQ002530: from=<>, size=3673, class=0, nrcpts=0, proto=ESMTP, dae mon=MSA, relay=buzz.frogspace.net [216.222.200.2] Jun 26 17:21:26 smtp sendmail[2531]: h5QGLNiQ002531: from=<>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon =MSA, relay=mail.cybertrails.com [162.42.150.35] Jun 26 17:21:42 smtp sendmail[2550]: h5QGLdiQ002550: from=<>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon =MSA, relay=mail.bonniej.com [207.41.169.205] Jun 26 17:21:48 smtp sendmail[2552]: h5QGLhiQ002552: from=<>, size=4116, class=0, nrcpts=0, proto=ESMTP, dae mon=MSA, relay=ztxmail05.ztx.compaq.com [161.114.1.209] Paulo Jorge de Melo Gabinete de Informática e Estatística Comissão de Coordenação da Região Centro _________________________________________________________________________________________________ "What? You search? You would multiply yourself by ten, by a hundred? You seek followers? Seek zeros! "- Nietzsche

1 0

Jump to page:

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

1997

1996

openSUSE Security June 2003