EMail Server Relay Check

Overview

The eMail Server Relay Check Tool is a simple security tool designed for testing email servers for signs of misconfiguration. It is designed to be useful for ISPs and server administrators performing security audits on their networks. Instead of having to visit multiple web pages, you will get a lot of information with one click.

The tool checks for the following:

• SMTP banner - reverse DNS mismatch
• Open Relay
• Bounce Messages or Non-Delivery Reports (NRS's)
• Listings on DNS-based Realtime Blacklists
• Optional NETBIOS port scan
• SPF test (in the next revision)

You can access the eMail Server Relay Check page by selecting

 NSTWUI > Network > email > eMail Server Relay Check

Configuration

The config file for Relay Check is /usr/share/relaycheck/cgi-bin/relaycheck.conf. Values need to stay in single quotes.

In order for the tool to work correctly, you will need to change the default email to your own email address.

 my email address = 'change-me@some.domain.com' 

Change this to your actual email address, it is where test messages will be sent.

You can also change server timeout values.

Enter your preferred timeout value in seconds for an initial connection to the target server. Default value is 5 seconds.

initial timeout = '5'

Enter your preferred timeout value for individual SMTP commands EHLO, MAIL FROM, RCPT TO, etc. Default value is 3 seconds, which may be too short. This value may need to be changed to '20' in order to accommodate most servers. Default timeout values are being tested and will be changed in a future revision.

individual smtp command timeouts = '3'

Usage

The Relay Check tool is designed to be very easy to use. Type the hostname or IP address of the target server into the box and hit enter. You will immediately see diagnostic information on the output page:

• If the target server is accepting connections on port 25 (SMTP) you will see output of three SMTP transactions.

• if the server is an open relay, you will receive a test message sent to your email inbox.

• if the server is delivering bounce messages outside its internal organization, you will receive a bounce message. See Backscatter.

• If the IP address is blacklisted on public Internet blacklists, that information will be shown, along with a link to verify blacklisting at mxtoolbox.com.

• If you choose to check for open relay plus portscan, the server will also be tested for public-facing open NETBIOS ports. Use caution when selecting this option. NETBIOS ports are used by Microsoft computers for printer and file-sharing on a Local Area Network (LAN) and should never be open facing the public Internet because of inherent security vulnerabilities, especially unpatched XP machines. NETBIOS ports, especially 139 and 445, are the most frequently targeted ports on the Internet by hackers, and can lead to an attacker taking full control of the target machine.

(this documentation is currently under development)