Sendmail Logs

[Ivan Mirisola]

Hi all,

I think this is related somehow to the bugbear virus. Note that the IP
63.123.249.67 might belong to a DSL/Cable company, and it is probably an
user's IP trying to disseminate the virus. When they try to connect to
the MTA, the MTA refuses to RELAY for this IP and therefore you have a
NOQUEUE error.
If only we had a list o networks that belong to DSL users.......!

Good luck with that!

Ivan

Julian Field wrote:

> The "nocol" monitoring system will produce logs like this. Someone
> might be
> running that to check if your systems are up and running. Pretty harmless
> so long as they don't do it too much and waste your bandwidth/cpu.
>
> At 17:58 24/10/2002, you wrote:
>
>> This should probably go to a Sendmail list, so could someone recommend a
>> good sendmail list please.  But . . .
>>
>> I keep getting the following in my logs:
>>
>> Oct 24 09:47:14 yoda sendmail[26342]: NOQUEUE: [63.123.249.67] did not
>> issue MAIL/EXPN/VRFY/ETRN during connection to MTA
>> Oct 24 09:48:49 yoda sendmail[26380]: NOQUEUE:
>> 1-1-242.customer.bct.cmailinc.com [130.94.244.242] did not issue
>> MAIL/EXPN/VRFY/ETRN during connection to MTA
>> Oct 24 09:56:35 yoda sendmail[26707]: NOQUEUE: [63.123.249.67] did not
>> issue MAIL/EXPN/VRFY/ETRN during connection to MTA
>>
>> LogCheck 1.1.1 reports this as a possible security violation.  Should I
>> be concerned?
>>
>> Steve Evans
>> SDSU Foundation
>> (619) 594-0653
>
>
> --
> Julian Field                Teaching Systems Manager
> jkf at ecs.soton.ac.uk         Dept. of Electronics & Computer Science
> Tel. 023 8059 2817          University of Southampton
>                             Southampton SO17 1BJ