QMail's Relay Filters Allow SPAM?

ynotds asks: "Our low profile, security-conscious specialty hosting service might have been relaying spam from an untraceable IP for around 43 hours before we tracked the source of a significant traffic increase across quite a few of our less active client IPs. After we firewalled the first spammer IP, three more appeared in quick succession trying the same thing, then after we took qmail down for a while and brought it back up, another group of four tried the same trick, all but one from 203.x.x.x IPs like our own. We now have 90Mb of mainly these unsent messages in our (appropriately named) mess directory queues, but don't want to get side tracked into duplicating others' research if this is a better known problem than it appears to be after another scan of anti-spam resources."

Comments

Do not blame your mistake on Qmail

[davidu]

Ok, I can't believe I am going to bite on this troll but here it goes:

QMAIL is not your problem. In fact, even if you REALLY screw up in your setup qmail is still hard to use as a relay as you ACTIVELY have to open it up as one.
Now I'll get to your points (which are few):

I think you are saying that qmail allows relaying. -- That is false. If you read the relaying section in life with qmail you will notice that it says "If you follow the official directions for installing qmail, relaying will be turned off by default." -- Obviously you messed that up.

To monitor your rule you will look in the /etc/tcp.smtp file and find rules in this pattern:
IP address of client:allow,RELAYCLIENT=""
IP address of client:allow,RELAYCLIENT=""

Now unless you are using like pop-before-smtp then that' it. If you are using pop-before-smtp make sure your cron job is running every half hour to clear out old relay entries.

<RANT> PLEASE DON'T BLAME QMAIL FOR YOUR MISCONFIGURATION</RANT>

You can email me privately if you still need help and Cliff, you should not have posted this troll.

-dave

Yes.

[Russ Nelson]

Yes, Dan Bernstein has been running surveys of SMTP servers.
-russ