[Snort-sigs] PostFix Open Relay

Reinaldo Borges listas at ...2246...
Wed Feb 18 13:24:06 EST 2004


alert tcp $EXTERNAL_NET any <> $SMTP_SERVERS 25 (msg:"MAIL ABUSE - Open
Relay attempt"; content:"Relay access denied"; nocase; sid:1000001; rev:1;
classtype:unsuccessful-user; priority:1;
reference:url,mail-abuse.org/tsi/ar-fix.html; reference:arachnids,249; )

That rule works for my PostFix MTA, but the "smtp.rules" don´t work.
"smtp.rules" works just for Sendmail MTA.

Any sugestions ?





More information about the Snort-sigs mailing list