Rob
Mon Oct 06 12:48:36 CDT 2003
This is a multi-part message in MIME format.
------=_NextPart_000_00E3_01C38C10.8A7DEE20
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
No that was not the issue.
But I found it -=20
DOH!
It was something simple - on the connections button (the one right above =
relay) I had evidentally clicked on "Only the list below" and with no =
computers there - nothing could attach.
Changed that restarted the SMTP service.
BAM! It goes fine.
Now I will watch for un-authorized relaying.
=20
Thanks for the help to all - especially Jim and Susan.
Been almost a year since my last issue (Jeff was a lifesaver) but it is =
nice to see the group still has in my opinion the best support there is!
=20
"Dana Becker [MSFT]" <danabeck@online.microsoft.com> wrote in message =
news:Oh8neUCjDHA.1928@cpmsftngxa06.phx.gbl...
> Hello Rob,
>=20
> In the Exchange System Manager, expand your server and then Protocols. =
Next=20
> expand SMTP and go into the Properties of your SMTP virtual server. In =
the=20
> General tab, make sure you the virtual server is listening on "All=20
> unassigned". If it is not, make the change and stop and start the =
virtual=20
> server. If this does not help you let us know.
>=20
> Regards,
>=20
> Dana Becker
> Microsoft Small Business Server Support
>=20
> This posting is provided "AS IS" with no warranties, and confers no =
rights.
> =20
> |=20
> | Another note - I just ran a nestat -an and it does not show the =
external=20
> Ip
> | as listening on Port 25. This is not right - correct?
> |=20
> |=20
> | "Rob" <gillis@nslc.org> wrote in message
> | news:%23ItTJ4AjDHA.1960@TK2MSFTNGP12.phx.gbl...
> | > I had another posting over the weekend "Oh No..." this is an =
extension=20
> of
> | > those issues.
> | > Background:
> | > Machine had been hacked in a remote office - one user password =
stolen.
> | > Using that on Port25 to send thru the SBS server. Disabled user =
account
> | and
> | > began cleaning machine.
> | >
> | > Following Susan and Jim's advice and the MS article they pointed =
to me=20
> - I
> | > was able to successfully clean the vs1 bad mail folder. it only =
had 7GB
> | of
> | > messages (over 400,000 total in the last 30 days).
> | >
> | > After doing that I attempted to secure the machine by removing the =
check
> | box
> | > "allow any computer to relay that authenticates...". per Jim's=20
> suggestion
> | I
> | > also removed the IP's listed above.
> | >
> | > I noticed no mail was flowing in-bound.
> | >
> | > Reran the ICW - it replaced the Ip's that I removed other settings =
were
> | left
> | > alone. But again - no inbound email was received.
> | >
> | > So now I go to my full-time job and attempt to send an email to =
the=20
> other
> | > domain. Does not bounce. Log in via VPN - it is not in my =
in-box.
> | Nothing
> | > inbound shows up. Can send outbound just fine.
> | >
> | > I grabbed the logs and they looked as follows:
> | > Any Ideas?
> | > #Software: Microsoft Internet Information Services 5.0
> | >
> | > #Version: 1.0
> | >
> | > #Date: 2003-10-06 11:52:43
> | >
> | > #Fields: time c-ip cs-method cs-uri-stem sc-status
> | >
> | > 11:52:43 x.x.x.x - - 0
> | >
> | > 11:52:43 x.x.x.x EHLO - 0
> | >
> | > 11:52:43 x.x.x.x - - 0
> | >
> | > 11:52:43 x.x.x.x MAIL - 0
> | >
> | > 11:52:43 x.x.x.x - - 0
> | >
> | > 11:52:43 x.x.x.x RCPT - 0
> | >
> | > 11:52:43 x.x.x.x - - 0
> | >
> | > 11:52:43 x.x.x.x XEXCH50 - 0
> | >
> | > 11:52:43 x.x.x.x - - 0
> | >
> | > 11:52:43 x.x.x.x - - 0
> | >
> | > 11:52:43 x.x.x.x BDAT - 0
> | >
> | > 11:52:43 x.x.x.x - - 0
> | >
> | > 11:52:43 x.x.x.x QUIT - 0
> | >
> | > 11:52:43 x.x.x.x - - 0
> | >
> | > Here at work the sending Exchange server says this:
> | >
> | > 11:52:24 x.x.x.x EHLO - 250
> | >
> | > 11:52:24 x.x.x.x MAIL - 250
> | >
> | > 11:52:24 x.x.x.x RCPT - 250
> | >
> | > 11:52:24 x.x.x.x xexch50 - 354
> | >
> | > 11:52:24 x.x.x.x DATA - 250
> | >
> | > 11:52:24 x.x.x.x QUIT - 0
> | >
> | >
> |=20
> |=20
> |=20
>
------=_NextPart_000_00E3_01C38C10.8A7DEE20
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 6.00.2800.1226" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY>
<DIV><FONT face=3DArial size=3D2>No that was not the issue.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>But I found it - </FONT></DIV>
<DIV>
<DIV><FONT face=3DArial><FONT size=3D2><SPAN =
class=3D099054417-06102003></SPAN><SPAN=20
class=3D099054417-06102003></SPAN></FONT></FONT> </DIV>
<DIV><SPAN class=3D099054417-06102003><FONT face=3DArial=20
size=3D2>DOH!</FONT></SPAN></DIV>
<DIV><SPAN class=3D099054417-06102003><FONT face=3DArial=20
size=3D2></FONT></SPAN> </DIV>
<DIV><SPAN class=3D099054417-06102003><FONT face=3DArial size=3D2>It was =
something=20
simple - on the connections button (the one right above relay) I had =
evidentally=20
clicked on "Only the list below" and with no computers there - nothing =
could=20
attach.</FONT></SPAN></DIV>
<DIV><SPAN class=3D099054417-06102003><FONT face=3DArial=20
size=3D2></FONT></SPAN> </DIV>
<DIV><SPAN class=3D099054417-06102003><FONT face=3DArial =
size=3D2>Changed that=20
restarted the SMTP service.</FONT></SPAN></DIV>
<DIV><SPAN class=3D099054417-06102003><FONT face=3DArial=20
size=3D2></FONT></SPAN> </DIV>
<DIV><SPAN class=3D099054417-06102003><FONT face=3DArial =
size=3D2>BAM! It goes=20
fine.</FONT></SPAN></DIV>
<DIV><SPAN class=3D099054417-06102003><FONT face=3DArial=20
size=3D2></FONT></SPAN> </DIV>
<DIV><?xml:namespace prefix =3D o ns =3D =
"urn:schemas-microsoft-com:office:office"=20
/><o:p><SPAN class=3D099054417-06102003><FONT face=3DArial size=3D2>Now =
I=20
will watch for un-authorized =
relaying.</FONT></SPAN></o:p></DIV>
<DIV><o:p><SPAN class=3D099054417-06102003></SPAN></o:p><FONT =
face=3DArial=20
size=3D2> </FONT></DIV>
<DIV><o:p><SPAN class=3D099054417-06102003></SPAN><SPAN=20
class=3D099054417-06102003><FONT face=3DArial size=3D2>Thanks for the =
help to all -=20
especially Jim and Susan.</FONT></SPAN></o:p></DIV>
<DIV><o:p><SPAN class=3D099054417-06102003><FONT face=3DArial=20
size=3D2></FONT></SPAN></o:p> </DIV>
<DIV><o:p><SPAN class=3D099054417-06102003><FONT face=3DArial =
size=3D2>Been almost a=20
year since my last issue (Jeff was a lifesaver) but it is nice to see =
the group=20
still has in my opinion the best support there =
is!</FONT></SPAN></o:p></DIV>
<DIV><o:p><SPAN class=3D099054417-06102003></SPAN></o:p> </DIV>
<DIV><o:p><SPAN class=3D099054417-06102003></SPAN><FONT face=3DArial=20
size=3D2> </FONT></o:p></DIV></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>"Dana Becker [MSFT]" <</FONT><A=20
href=3D"mailto:danabeck@online.microsoft.com"><FONT face=3DArial=20
size=3D2>danabeck@online.microsoft.com</FONT></A><FONT face=3DArial =
size=3D2>>=20
wrote in message </FONT><A=20
href=3D"news:Oh8neUCjDHA.1928@cpmsftngxa06.phx.gbl"><FONT face=3DArial=20
size=3D2>news:Oh8neUCjDHA.1928@cpmsftngxa06.phx.gbl</FONT></A><FONT =
face=3DArial=20
size=3D2>...</FONT></DIV><FONT face=3DArial size=3D2>> Hello =
Rob,<BR>> <BR>>=20
In the Exchange System Manager, expand your server and then Protocols. =
Next=20
<BR>> expand SMTP and go into the Properties of your SMTP virtual =
server. In=20
the <BR>> General tab, make sure you the virtual server is listening =
on "All=20
<BR>> unassigned". If it is not, make the change and stop and start =
the=20
virtual <BR>> server. If this does not help you let us know.<BR>> =
<BR>>=20
Regards,<BR>> <BR>> Dana Becker<BR>> Microsoft Small Business =
Server=20
Support<BR>> <BR>> This posting is provided "AS IS" with no =
warranties,=20
and confers no rights.<BR>> <BR>> | <BR>> | Another note =
- I just=20
ran a nestat -an and it does not show the external <BR>> Ip<BR>> | =
as=20
listening on Port 25. This is not right - correct?<BR>> | =
<BR>> |=20
<BR>> | "Rob" <</FONT><A href=3D"mailto:gillis@nslc.org"><FONT =
face=3DArial=20
size=3D2>gillis@nslc.org</FONT></A><FONT face=3DArial size=3D2>> =
wrote in=20
message<BR>> | </FONT><A=20
href=3D"news:%23ItTJ4AjDHA.1960@TK2MSFTNGP12.phx.gbl"><FONT face=3DArial =
size=3D2>news:%23ItTJ4AjDHA.1960@TK2MSFTNGP12.phx.gbl</FONT></A><FONT =
face=3DArial=20
size=3D2>...<BR>> | > I had another posting over the weekend "Oh =
No..." this=20
is an extension <BR>> of<BR>> | > those issues.<BR>> | >=20
Background:<BR>> | > Machine had been hacked in a remote office - =
one user=20
password stolen.<BR>> | > Using that on Port25 to send thru the =
SBS=20
server. Disabled user account<BR>> | and<BR>> | > began =
cleaning=20
machine.<BR>> | ><BR>> | > Following Susan and Jim's advice =
and the=20
MS article they pointed to me <BR>> - I<BR>> | > was able to=20
successfully clean the vs1 bad mail folder. it only had =
7GB<BR>> |=20
of<BR>> | > messages (over 400,000 total in the last 30 =
days).<BR>> |=20
><BR>> | > After doing that I attempted to secure the machine =
by=20
removing the check<BR>> | box<BR>> | > "allow any computer to =
relay=20
that authenticates...". per Jim's <BR>> suggestion<BR>> | =
I<BR>>=20
| > also removed the IP's listed above.<BR>> | ><BR>> | > =
I=20
noticed no mail was flowing in-bound.<BR>> | ><BR>> | > =
Reran the=20
ICW - it replaced the Ip's that I removed other settings were<BR>> |=20
left<BR>> | > alone. But again - no inbound email was=20
received.<BR>> | ><BR>> | > So now I go to my full-time job =
and=20
attempt to send an email to the <BR>> other<BR>> | > =
domain. Does=20
not bounce. Log in via VPN - it is not in my in-box.<BR>> |=20
Nothing<BR>> | > inbound shows up. Can send outbound just=20
fine.<BR>> | ><BR>> | > I grabbed the logs and they looked =
as=20
follows:<BR>> | > Any Ideas?<BR>> | > #Software: Microsoft =
Internet=20
Information Services 5.0<BR>> | ><BR>> | > #Version: =
1.0<BR>> |=20
><BR>> | > #Date: 2003-10-06 11:52:43<BR>> | ><BR>> | =
>=20
#Fields: time c-ip cs-method cs-uri-stem sc-status<BR>> | =
><BR>> | >=20
11:52:43 x.x.x.x - - 0<BR>> | ><BR>> | > 11:52:43 =
x.x.x.x EHLO=20
- 0<BR>> | ><BR>> | > 11:52:43 x.x.x.x - - 0<BR>> | =
><BR>> | > 11:52:43 x.x.x.x MAIL - 0<BR>> | =
><BR>> |=20
> 11:52:43 x.x.x.x - - 0<BR>> | ><BR>> | > 11:52:43 =
x.x.x.x RCPT - 0<BR>> | ><BR>> | > 11:52:43 =
x.x.x.x - -=20
0<BR>> | ><BR>> | > 11:52:43 x.x.x.x XEXCH50 - =
0<BR>> |=20
><BR>> | > 11:52:43 x.x.x.x - - 0<BR>> | ><BR>> =
| >=20
11:52:43 x.x.x.x - - 0<BR>> | ><BR>> | > 11:52:43=20
x.x.x.x BDAT - 0<BR>> | ><BR>> | > 11:52:43 =
x.x.x.x - -=20
0<BR>> | ><BR>> | > 11:52:43 x.x.x.x QUIT - 0<BR>> =
|=20
><BR>> | > 11:52:43 x.x.x.x - - 0<BR>> | ><BR>> =
| >=20
Here at work the sending Exchange server says this:<BR>> | =
><BR>> |=20
> 11:52:24 x.x.x.x EHLO - 250<BR>> | ><BR>> | > =
11:52:24=20
x.x.x.x MAIL - 250<BR>> | ><BR>> | > 11:52:24 =
x.x.x.x =20
RCPT - 250<BR>> | ><BR>> | > 11:52:24 x.x.x.x xexch50 =
-=20
354<BR>> | ><BR>> | > 11:52:24 x.x.x.x DATA - =
250<BR>> |=20
><BR>> | > 11:52:24 x.x.x.x QUIT - 0<BR>> | =
><BR>> |=20
><BR>> | <BR>> | <BR>> | <BR>> </FONT></BODY></HTML>
------=_NextPart_000_00E3_01C38C10.8A7DEE20--