Tracking mail connections ( Was Re: Fake headers on Internet mail )

Article View: comp.security.misc

Article #381

Back to comp.security.misc Previous Next

#381

From: Rob Quinn
Date: Fri, 14 Aug 1992 19:24

33 lines
1887 bytes

In <1513@lysator.liu.se> pen@lysator.liu.se (Peter Eriksson) writes:
>[sendmail patch at ftp.lysator.liu.se to add
> "(rfc931-sender: realuserid@realhostid)" lines to the mail header]

 I would like to be able to track things like this:

From daemon Fri Aug 14 14:09:25 1992
Return-Path: <Mailer-Daemon>
Received: by phys.ksu.edu (4.1/SMI-4.1)
        id AB18747; Fri, 14 Aug 92 14:09:16 CDT
Date: Fri, 14 Aug 92 14:09:16 CDT
From: Mailer-Daemon (Mail Delivery Subsystem)
Subject: Returned mail: Unable to deliver mail
Message-Id: <9208141909.AB18747@phys.ksu.edu>
To: Postmaster

   ----- Transcript of session follows -----
<<< vrfy rjj
550 rjj... User unknown
<<< quit

  ----- No message was collected -----

 I know some of these are innocent checks, I do it all of the time myself,
but about a month ago I had about a dozen of these in one day, and several
the next day. How can I tell where they came from? Do any of the public
sendmails provide better information? Anyway to log the VRFY's that succeed
too?

--
|                                                                Rob Quinn |
|                                                         rjq@phys.ksu.edu |
|                                                    QuinnBob@KSUVM.BITNET |

Technical Details

Message-ID: <16h18tINNhin@moe.ksu.ksu.edu>

Path: arc1-ca.pugleaf.net!sparky!uunet!ogicse!uwm.edu!zaphod.mps.ohio-state.edu!moe.ksu.ksu.edu!phys.ksu.edu!rjq

References:

<1992Aug12.151404.1424@lub001.lamar.edu>  <1992Aug13.164814.11389@aio.jsc.nasa.gov> <NICKEL.92Aug13221704@desaster.cs.tu-berlin.de> <1513@lysator.liu.se>

Show Full Headers

Complete Article Headers

Path: arc1-ca.pugleaf.net!sparky!uunet!ogicse!uwm.edu!zaphod.mps.ohio-state.edu!moe.ksu.ksu.edu!phys.ksu.edu!rjq
From: rjq@phys.ksu.edu (Rob Quinn)
Newsgroups: comp.security.misc
Subject: Tracking mail connections ( Was Re: Fake headers on Internet mail )
Message-ID: <16h18tINNhin@moe.ksu.ksu.edu>
Date: 14 Aug 92 19:24:13 GMT
Article-I.D.: moe.16h18tINNhin
References: <1992Aug12.151404.1424@lub001.lamar.edu>  <1992Aug13.164814.11389@aio.jsc.nasa.gov> <NICKEL.92Aug13221704@desaster.cs.tu-berlin.de> <1513@lysator.liu.se>
Organization: Kansas State University
Lines: 33
NNTP-Posting-Host: bohr.phys.ksu.edu

Reply to Parent Message