[Snort-sigs] How detect relaying with qmail and snort ?

From: <r2d2r4(at)crusoecids.dyndns.org>
Date: Wed May 28 2003 - 12:49:03 EDT

Hi,

I test snort 191b234 and 200b072,

and qmail103 ...

I run relaying test with abuse.net,

but snort not event this test,

Snort not have relaying rule with qmail,

I add this rule on smtp.rules and snort detect relaying with qmail :

alert tcp $SMTP_SERVERS 25 -> $ANY any (msg:"POLICY SMTP relaying denied"; flow: established,from_server; content: "553 sorry, that domain isn't in my list of al lowed rcpthosts"; depth:70; reference:url,mail-abuse.org/tsi/ar-fix.html; classt ype:misc-activity; )

Please cc me to your answers.

Regard.

---

This SF.net email is sponsored by: eBay
Get office equipment for less on eBay!
http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5

---

Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs Received on Thu May 29 09:04:01 2003