Re: smtp_auth spam using anonymous -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Marc G. Fournier wrote:
> 
> 
> --On Saturday, February 23, 2008 23:06:02 -0500 Victor Duchovni 
>  wrote:
> 
>> On Sat, Feb 23, 2008 at 09:12:42PM -0400, Marc G. Fournier wrote:
> 
>>>>> half-dozen or so different VPSs so far, all running Postfix 2.4.x, and
>>>>> I've checked on all of them and there is no user 'anonymous' :(
>>>>>
>>>>> In fact, my sasl/smtpd.conf file looks like:
>>>>>
>>>>> pwcheck_method: auxprop
>>>>> auxprop_plugin: sql
>>>>> sql_engine: sqlite
>>>>> sql_database: /var/db/sqlite/mailsys
>>>>> sql_select: SELECT %p FROM sasl_auth WHERE userid = '%u@%r'
>> 	mechanism=LOGIN
>> 	user=anonymous
>> 	password=
> 
>> Well the empty password seems to work. Does the above query return no
>> rows or an empty row?
> 
> Is there some way I can test this from the command line?  through a telnet 
> session or something like that?  I have a theory based on your comment above 
> that I'd like to test ...
> 
> ----
> Marc G. Fournier           Hub.Org Networking Services (http://www.hub.org)
> Email . pdbzoqn@hub.org                              MSN . pdbzoqn@hub.org
> Yahoo . yscrappy               Skype: hub.org        ICQ . 7615664

Marc
with the "sql_verbose: yes" in sasl/smtpd.conf you should be getting the
SQL statement logged somewhere (on my setup the sasl messages go to
/var/log/messages) so you can see what the %p, %u and %r are being
replaced with. You can try running the query manually against sqlite
database with the sqlite command line client, to verify that it works as
expected (i.e should return no rows).

To test auth login manually:

telnet mydomain.com.au 25

> server responds:
> 220 mydomain.com.au ESMTP Postfix

ehlo something

> server responds:
> 250-PIPELINING
> 250-SIZE 10240000
> 250-ETRN
> 250-AUTH LOGIN PLAIN DIGEST-MD5 CRAM-MD5
> 250-ENHANCEDSTATUSCODES
> 250-8BITMIME
> 250 DSN

auth login

> server responds:
> 334 VXNlcm5hbWU6 (i.e. asks for username)

input the base64 coded username, in this case:
YW5vbnltb3Vz

> server responds:
> 334 UGFzc3dvcmQ6 (i.e. asks for password)

press return for blank password

> server responds:
> 235 2.0.0 Authentication successful

John
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.4-svn0 (GNU/Linux)
Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org

iD8DBQFHwn7wd4I3jTtt9EIRAm7eAJ98Dsdh9uXA/JYoBWJgdTqfz7rvCACglMcY
n96Irfuk0tyLe7koQWIFT9E=
=g6zA
-----END PGP SIGNATURE-----


