Basic DNS & Mail troubleshooting

За следващото обучение/презентация

MAIL TROUBLESHOOTING
e-mail servers function : nothing more than sends piece of text over the Internet
Major Steps : MUA > MSA > MTA > … > MTA > MDA >> MRA >> MUA
MUA - Mail User Agent - end user's mail client (MS Outlook, Thunderbird, WEB Browser, etc)
MSA - Mail submission agent - complicated, but treat it like a borderline MTA (kind of SMTP proxy or smart host for example)
MTA - Mail Transfer Agent - A true mail server (exim, postfix, qmail, exchange)
MDA - Mail Delivery Agent - performs the actual delivery including process "filtering" (auto-replay, white/black lists, spamassassin, amavis, AV, etc)
MRA - Mail Retrival Agent - POP(s)/IMAP(s) services (cyrus, courier, dovecot, qmail)
What's realy happen after hitting SEND button:
1. MUA looks in their settings and find outgoing mail server entry
2. MUA perform DNS lookup to convert NAM-IP
3. MUA perform route/arp/etc lookup to find route out to outgoing mail server destination
4. SEnding MTA perform DNS lookup to find MX record (respect MX priority), ask Receiving MTA to accept message and send that message
5. Receiving MTA perform initial check and accept/reject mail (message format check, WL/BL check, AV check etc)
6. MDA perform some additional checks and manipulations and deliver mail to users home foleders (SPAM check and classification, rewrite, re-route, etc)
7. MRA is waiting for connections via well-known protocols/ports
8. MUA authenticate/connect to MRA and get mails
Troubleshooting tools: nmap, telnet, mail-message source
MTA SMTP - tcp/25
SMTPs - tcp/465
MRA POP3 - tcp/110
POP3s - tcp/995
IMAP - tcp/143
IMAPs - tcp/993
Successful communication (MTA service is working)
telnet mail.evolink.com 25
Trying 194.12.255.146...
Connected to mail.evolink.com.
Escape character is '^]'.
220 ESMTP
ehlo privet
250-
250-STARTTLS
250-PIPELINING
250-8BITMIME
250-SIZE 20971520
250 AUTH LOGIN PLAIN CRAM-MD5
quit
221
Connection closed by foreign host.
Unsuccessful communication (no running MTA service or firewall issue)
telnet linkstat.evolink.net 25
Trying 85.14.44.7...
telnet: Unable to connect to remote host: Connection refused
SMTP command
* HELO - introduce yourself
* EHLO - introduce yourself and request extended mode
* MAIL FROM: - specify the sender
* RCPT TO: - specify the recipient
* DATA - specify the body of the message (To, From and Subject should be the first three lines.)
* RSET - reset
* QUIT - quit the session
* HELP - get help on commands
* VRFY - verify an address
* EXPN - expand an address
* VERB - verbose
POP3 commands
* USER - enter your user ID
* PASS - enter your password
* QUIT - quit the POP3 server
* LIST - list the messages and their size
* RETR - retrieve a message, pass it a message number
* DELE - delete a message, pass it a message number
* TOP - show the top x lines of a message, pass it a message number and the number of lines
Sending mail via telnet
telnet example.com 25
ehlo example.com
mail from: username@example.com
rcpt to: friend@hotmail.com, friend2@yahoo.com
data
Subject: Send mail via telnet
I was here!
.
Check or read email with telnet
user username@example.com
pass passwordgoeshere
list
retr 2
dele 1
quit
Reading mail-message source
Full mail-message header example: (spammer's mail address and IP intentionaly leaved as is)
Return-Path: <0-chinomi akita-pu.ac.jp="">
X-Original-To: mailinglist_or_mail.alias@example.com
Delivered-To: me@example.com
Received: from localhost (localhost [127.0.0.1])
by mail.example.com (Postfix) with ESMTP id 9872A8221A2
for ; Thu, 3 Nov 2011 12:31:01 +0300 (EEST)
X-Virus-Scanned: Debian amavisd-new at mail.example.com
X-Spam-Flag: NO
X-Spam-Score: 9.372
X-Spam-Level: *********
X-Spam-Status: No, score=9.372 tagged_above=2 required=14.31
tests=[BAYES_99=3.5, DCC_CHECK=2.17, DIGEST_MULTIPLE=0.001,
PYZOR_CHECK=3.7, UNPARSEABLE_RELAY=0.001]
Received: from mail.example.com ([127.0.0.1])
by localhost (mail.example.com [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id Fm+2o1grwwo5 for ;
Thu, 3 Nov 2011 12:30:29 +0300 (EEST)
Received: by mail.example.com (Postfix, from userid 5001)
id 0A1948221A6; Thu, 3 Nov 2011 12:30:29 +0300 (EEST)
Received-SPF: none (akita-pu.ac.jp: No applicable sender policy available) receiver=mail.example.com;
identity=mailfrom; envelope-from="0-chinomi@akita-pu.ac.jp"; helo="[59.94.251.160]"; client-ip=59.94.251.160
Received: from [59.94.251.160] (unknown [59.94.251.160])
by mail.example.com (Postfix) with ESMTP id 95C9382219D
for ; Thu, 3 Nov 2011 12:30:28 +0300 (EEST)
Received: from 59.94.251.160 (account HELO example.com)
by example.com (CommuniGate Pro SMTP 5.2.3)
with ESMTPA id 168978161 for ; Thu, 3 Nov 2011 15:00:27 +0530
From:
To:
Subject: Administrative Assistant Vacancy
Date: Thu, 3 Nov 2011 15:00:27 +0530
Return-Path: - contains FQDN of originating sender. Cannot be forged. From where realy mail comes
X-Original-To: - original send-to destination
Delivered-To: - to wich mailbox this email was delivered
Received: - added to the envelope header for each step of the host-to-host delivery process. Include address of sending MTA, local (for MTA) date and time of message transfer and type of used application
X-Virus/X-SPAM/Received-SPF - some additional checks with basic information about who-chek-what
From: - can be anything including google@boiko.borisov.yes
To: - content in TO field on sending MUA
Subject: - can be re-writed by MDA, corporate policy, etc
Date: - this field is set by originating (sending) host [realy clever way to place your message on-top of received messages in recipient's mailbox]