Tips for checking whether email proxy exists in the Sendmail environment (1)

We know that the email proxy may be good or malicious. How can weSendmailCheck and eliminate the impact of the mail proxy in the environment. See the following section.

As a widely used mail server software, sendmail needs to deal with various smtp client software. Some of these smtp client software are real mail software, such as Microsoft Outlook Express, and some applications with special purposes, such as Norton Antivirus.

Some applications will intercept the connection between the mail client and sendmail and receive client data in the form of "mail proxy, process the data (for example, Norton Antivirus uses this method to scan viruses in outgoing emails) and forward the data to sendmail.

Such "email proxy" programs may be malicious or malicious. However, when communication problems occur between sendmail and the mail client software, you should first detect the existence of such "mail proxy" programs to further eliminate their impact.

The sendmail service program has the smtp session record function, and most mail client software also has similar functions. We can compare the session records on the server and client to determine whether the email agent exists.

First, run sendmail with the-X parameter:

# Startsrc-s sendmail-a "-bd-q 30 m-X/tmp/smtp. sessions"

Note:

In a production environment, the-X parameter may generate a large amount of log information. Use the-X parameter only for testing or troubleshooting.

A typical client-server smtp session is recorded in/tmp/smtp. sessions as follows:

127184 >>> 220 export ak.austin.ibm.com ESMTP Sendmail Tue, 1 Nov 2005 10:31:22-0600

127184 <HELO IBM8370FEC6B24 ^ M

127184 >>> 250 export ak.austin.ibm.com Hello [9.53.167.160], pleased to meet you

127184 <mail from: ^ M

200898 >>>> 250 2.1.0... Sender OK

200898 <rcpt to: ^ M

200898 >>>> 250 2.1.5... Recipient OK

200898 <DATA ^ M

200898 >>> 354 Enter mail, end with "." on a line by itself

200898 <Message-ID: <000f01c5df01 $88a95fd0 $ a0a73509@austin.ibm.com> ^ M

200898 <From: "internship test" ^ M

200898 <To: ^ M

200898 <Subject: test ^ M

200898 <Date: Tue, 1 Nov 2005 10:29:06-0600 ^ M