On 02/08/2019 15:07, Fred Smith wrote:
and I didn't even mention the huge number of failed attempts on port 25. /var/log/maillog is full of systems trying to send spam, or trying to DOS me with incompleted connection attempts, or just plain spamming with mail for addresses not at this system. The little light on the network switch serving this machine hardly ever stops blinking with all the traffic hitting it. One thing I don't understand is how/why the firewall is DROPping so many attempts on port 25 when it in fact has a port forward rule sending port 25 on to my mailserver. How does it know, or why does it think that some of them can be dropped at the outer barrier?
Some spamming tools are just telnet with an expect script, lightweight and can be loaded onto embedded systems, e.g. other firewalls / modems etc...
A downside of using these tools is that telnet sets the PUSH TCP flag, so many firewalls (e.g. Cisco ASA) have protocol inspection for SMTP and signals the connection as invalid. if it uses the PUSH TCP flag, which a proper SMTP daemon wouldn't use for that protocol (PUSH flags ask the server to service the sent data, even if it hasn't finished with a CR/LF)
_______________________________________________ CentOS mailing list CentOS@xxxxxxxxxx https://lists.centos.org/mailman/listinfo/centos
