Open Relay

[Caustic]

One of my Exchange 5.5 servers has been blacklisted by RSS
despite the fact that routing restrictions are set
to "hosts and clients with these IP addresses" and
appropriate domain is listed as inbound on the routing tab
under "Reroute incoming SMTP". (Basically all the good
stuff from Q199656 and Q196626).

My most recent reponse from RSS was this:

"Check your machine for the recent SMTP AUTH bug. Your
removal requests have been denied as we are able to
authenticate against your server and relay messages using
this mechanism."

I am able to telnet into the server and enter garbage
character to bypass authentication. Anyone know if there
is a way to stop this? I checked with the
administrator of the domain and the guest account is not active. The IP address of the server is 63.116.192.229. I appreciate any advice. Thanks.


Example telnet session:

Connecting to <IP address> ...
<<< 220 <some domain> ESMTP Server (Microsoft Exchange
Internet Mail Service 5.5.2653.13) ready
>>> EHLO <some domain>
<<< 250-<some domain> Hello [<some domain>]250-XEXCH50250-
HELP250-ETRN250-DSN250-SIZE 0250-AUTH LOGIN250 AUTH=LOGIN
>>> AUTH LOGIN
<<< 334 VXNlcm5hbWU6
>>> VXNlcm5hbWU6
<<< 334 UGFzc3dvcmQ6
>>> UGFzc3dvcmQ6
<<< 235 LOGIN authentication successful

 

[Caustic]

Ok, I'm replying to my own post. More information and more simplified this time.

I can authenticate to my server through ESMTP using the AUTH LOGIN command simply by responding to the Username/Password prompts with:

Username
Password

...and yet, if I try to enter a non-existant username and password such as:

jshmoe
cornbeef

It denies access.