Article View: comp.security.misc
Article #385Re: Tracking mail connections ( Was Re: Fake headers on Internet mail )
From: David Lemson
Date: Sat, 15 Aug 1992 15:33
Date: Sat, 15 Aug 1992 15:33
28 lines
1888 bytes
1888 bytes
rjq@phys.ksu.edu (Rob Quinn) writes: > ----- Transcript of session follows ----- ><<< vrfy rjj >550 rjj... User unknown ><<< quit > I know some of these are innocent checks, I do it all of the time myself, >but about a month ago I had about a dozen of these in one day, and several >the next day. How can I tell where they came from? Do any of the public >sendmails provide better information? Anyway to log the VRFY's that succeed >too? I believe that the 'netfind' program does this as well as fingers to find e-mail addresses. For more info, you can ftp to bruno.cs.colorado.edu, or telnet there and login as 'netfind'. I also believe that the tcp_wrapper package will do logging on smtp daemon connections to log where they came from (and from whom, if the remote site is running an authd - RFC931 daemon). I know it does this for telnetd and rlogind and so on, I think it said it had support for sendmail, too. You can ftp it from cert.sei.cmu.edu in the /pub/tools directory. -- David Lemson (217) 244-1205 University of Illinois NeXT Campus Consultant / CCSO NeXT Lab System Admin Internet : lemson@uiuc.edu UUCP :...!uiucuxc!uiucux1!lemson NeXTMail accepted BITNET : LEMSON@UIUCVMD
Technical Details
Message-ID:
<Bt178K.HL@ux1.cso.uiuc.edu>Path:
arc1-ca.pugleaf.net!sparky!uunet!wupost!sdd.hp.com!ux1.cso.uiuc.edu!lemsonReferences:
<1992Aug12.151404.1424@lub001.lamar.edu> <1992Aug13.164814.11389@aio.jsc.nasa.gov> <NICKEL.92Aug13221704@desaster.cs.tu-berlin.de> <1513@lysator.liu.se> <16h18tINNhin@moe.ksu.ksu.edu>Show Full Headers
Complete Article Headers
Newsgroups: comp.security.misc Path: arc1-ca.pugleaf.net!sparky!uunet!wupost!sdd.hp.com!ux1.cso.uiuc.edu!lemson From: lemson@ux1.cso.uiuc.edu (David Lemson) Subject: Re: Tracking mail connections ( Was Re: Fake headers on Internet mail ) Message-ID: <Bt178K.HL@ux1.cso.uiuc.edu> Organization: University of Illinois at Urbana References: <1992Aug12.151404.1424@lub001.lamar.edu> <1992Aug13.164814.11389@aio.jsc.nasa.gov> <NICKEL.92Aug13221704@desaster.cs.tu-berlin.de> <1513@lysator.liu.se> <16h18tINNhin@moe.ksu.ksu.edu> Date: Sat, 15 Aug 1992 15:33:42 GMT Lines: 28