qmail smtp authentication

[zaratustra78]

Hi, somebody somehow is authenticating trough my qmail server and sending mails out.

I would like either to disable SMTP authentication or to understand where the login/pass is getting from. I have a mysql base and pop3 is going via qmail-sql.

A log looks like that:

220 myserver ESMTPM
EHLO smtp039.mail.yahoo.comM
250-myserverM
250-AUTH=LOGINM
250-PIPELININGM
250 8BITMIMEM
AUTH LOGINM
334 VXNlcm5hbWU6M
d2VibWFzdGVyM
334 UGFzc3dvcmQ6M
d2VibWFzdGVyM
235 go aheadM

As fas as i understand, the user/pass is d2VibWFzdGVy/d2VibWFzdGVy?

tnx & br,
Greg

 

[thedaver]

Uh, your logs should correspond to the events...

/var/log/qmail/qmail-smtp/current

use tai64nlocal < ./current to see the timestamped display.

you could also block the IP in /etc/tcp.smtp