IMO, even relaying SMTP-like for the email which typically requires auth first isn't a great idea if there is any concern about an upstream getting abuse complaints about a relay (such as a leased box). A frequent way that spammers get their garbage out these days is to compromise a user account, I say this as a mail server admin who has to deal with the mess regularly. Oftentimes they guess the PW via dictionary attacks, but sometimes they keylog the user's box to get the email login. If the spammer has compromised an account and is forced to use webmail to dump the spam instead of an SMTP-like means, your relay doesn't show up in the email headers in the same way and may even be obfuscated. The differences are good things if you want to minimize abuse complaints of this sort. Also the SMTP-like sending seems to get more spam out the door faster than something which must use webmail instead. On 07/30/2014 03:08 PM, krishna e bera wrote:

On 14-07-30 05:11 AM, tor@t-3.net wrote:

...

You somewhat made a mistake here - you've got to have an exit

policy

...

that (minimally) rejects ports 25 and 465, or else your relay becomes a giant abuse tool for spammers, scammers, and phishers instead of what you intended it to be (which was a standard-functioning Tor relay).

You might try telling your ISP that you made a mistake in your configuration which allowed spam email to go out, and you're willing to correct that error and move forward.

ExitPolicy reject *:25 ExitPolicy reject *:465

Most SMTP servers i have seen listening on port 465 and 587 require authentication, so it shouldnt be necessary to block those ports. Can anyone name some that dont need authentication to send email?

_______________________________________________ tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays