567.txt

snort入侵检测规则文件2.4 Snort是众所周知的网络入侵检测工具

Rule: 

--
Sid: 
567

--
Summary: 
This event is generated when a failed attempt is made to use a Simple Mail Transfer Protocol (SMTP) server to relay mail to a third party.

--
Impact: 
Rejected of unauthorized use.  This event indicates that an SMTP server is properly configured to reject mail relay attempts.


--
Detailed Information: 
An attacker may attempt to use an improperly configured SMTP server to relay mail, reflecting the origin of the mail to be the relay SMTP server instead of the actual sender.  A poorly configured SMTP server may be used to relay spam and other undesirable mail.  If an SMTP server rejects relay attempts, it will return an error message indicating the failure.  

--
Affected Systems: 
SMTP servers

--
Attack Scenarios: 
An attacker may attempt to relay mail through an improperly configured SMTP server.

--
Ease of Attack: 
Simple

--
False Positives: 
None Known

--
False Negatives: 
An SMTP server may reject mail using other errors.

--
Corrective Action: 
Configure an SMTP server to reject relayed mail.

--
Contributors:
Original rule written by Max Vision <[e-mail]>
Modified by Brian Caswell <[e-mail]>
Snort documentation contributed by Chaos <[e-mail]>
Sourcefire Research Team
Judy Novak <[e-mail]>

-- 
Additional References:

Arachnids
http://www.whitehats.com/info/IDS249

Miscellaneous
http://mail-abuse.org/tsi/ar-fix.html

--