EMail Server Relay Check

Overview

The eMail Server Relay Check Tool is a simple security tool designed for testing email servers for signs of misconfiguration. It is designed to be useful for ISPs and server administrators performing security audits on their networks. Instead of having to visit multiple web pages, you will get a lot of information with one click.

The tool checks for the following:

• SMTP banner - reverse DNS mismatch
• Open Relay
• Bounce Messages or Non-Delivery Reports (NRS's)
• Listings on DNS-based Realtime Blacklists
• DNS zone file MX and SPF lookups (in the next revision soon to be released)
• GeoIP lookup for host under test (in the next revision soon to be released)
• Optional NETBIOS port scan

You can access the eMail Server Relay Check page by selecting

 NSTWUI > Network > email > eMail Server Relay Check

Configuration

The config file for Relay Check is /usr/share/relaycheck/cgi-bin/relaycheck.conf. Values need to stay in single quotes.

(The next revision will allow for config values to be changed from the web GUI interface.)

In order for the tool to work correctly, you will need to change the default email to your own email address.

 my email address = 'change-me@some.domain.com' 

Change this to your actual email address, it is where test messages will be sent.

You can also change server timeout values.

Enter your preferred timeout value in seconds for an initial connection to the target server. Default value is 5 seconds.

initial timeout = '5'

Enter your preferred timeout value for individual SMTP commands EHLO, MAIL FROM, RCPT TO, etc. Default value is 20 seconds.

individual smtp command timeouts = '20'

Usage

The Relay Check tool is designed to be very easy to use. Type the hostname or IP address of the target server into the box and press Enter. You will immediately see diagnostic information on the output page:

(you may be asked to enter your password to log in to the backscatter tool, even if you are already logged in to NST. There is a fix for this in the next revision.)

• If the target server is accepting connections on port 25 (SMTP) you will see output of three SMTP transactions.

• if the server is an open relay, you will receive a test message sent to your email inbox.

• If the server is delivering bounce messages outside its internal organization, you will receive a bounce message. See Backscatter.

• If the IP address is blacklisted on public Internet blacklists, that information will be shown, along with a link to verify blacklisting at mxtoolbox.com.

• The tool will attempt to guess the email domain from the reverse DNS record of the target IP address, as well as from the the SMTP banner, and will make an educated guess as to which domain might be used for sending and receiving email.

 Side note: A more correct term for a "domain" such as yahoo.com, is actually "zone,"  since a domain refers to the Top Level
 Domain (TLD) such as .com, .edu, .net, etc.  The information for a zone is stored in an a "DNS zone file" on the authoritative 
 DNS server.  For more information about the structure of DNS, refer to Wikipedia

• MX and SPF record lookups will be performed on the zone that is found (if any). (in the next revision soon to be released)

• To see the location of the target server on a world map using NST's GeoIP functionality, click the Map It button the diagnostic output page. You must first set up GeoIP on the NST server for this to work.

• If you choose to check for open relay plus portscan, the server will also be tested for public- facing open NETBIOS ports. Use caution when selecting this option. NETBIOS ports are used by Microsoft computers for printer and file-sharing on a Local Area Network (LAN) and should never be open facing the public Internet because of inherent security vulnerabilities. This is particularly true for unpatched XP and Windows 2000 machines. NETBIOS ports, especially 139 and 445, are the most frequently targeted ports on the Internet by hackers, and having these ports open can lead to an attacker taking full control of the target machine.

Interpreting Output

• Urgent messages are in red

• Warnings are in orange

• Positive messages are in blue

(this documentation is currently under development)

Feedback

If you see bugs, errors, undocumented features, or have a feature request, you can contact me at bob <at> bob3 <dot> net.