[Dshield] DShield submission confirmation error?

Sam Kuper sam.kuper at uclmail.net
Tue Jan 6 02:14:20 GMT 2009

2009/1/6 John Hardin <jhardin at impsec.org>

> On Mon, 5 Jan 2009, Sam Kuper wrote:
> > but my DShield submission reports always come with
> > the message, "The e-mail address you used to submit this report from
> > did not match the address we have on file."
> Carbon copy yourself on the submission message, and check the From address
> on it against the registered address.

I'm not sure psad's config permits CC'ing. I tried that and it didn't work.
I've now changed the email address for psad to send DShield submissions to
from reports at dshield.org to sam.kuper at uclmail.net, so I should get the next
one before too long.

I'm fairly confident its "from" line will be the same as  the one I've
registered in DShield's "Report E-Mail Address" field, but hey, you never
know until you check :)

> Take a look at hostname masquerading. If you registered
> sam.kuper at uclmail.net then something like sam.kuper at gw.uclmail.net won't
> work. If root is sending the mail from a cron job, that might be what's
> biting you. You might have to go to some effort to send the mail using a
> more complex command line that explicitly specifies the From address to
> use.

Thanks for the tip. I'll watch out for these issues.

psad's submitting the reports using Mutt as its mail command, via Exim
configured to send all email using my domain hosting company's email
smarthost, since my server is on a dynamic (ISP-assigned) IP address and
would otherwise have its outgoing email blacklisted.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.sans.org/pipermail/list/attachments/20090106/b1098dfd/attachment.htm 

More information about the Dshield mailing list