Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

MAILER-DAEMON notices are spamming our email administrator account, causing it to fill up, and bringing down our email server.

Our email server is a Virtual FreeBSD box hosted by Verio. Their support has been useless. I am not very familiar with FreeBSD, and because it is a virtual private server, I don't have wheel access.

Could someone who is familiar with FreeBSD and email headers please let me know whether this looks like spam coming from outside the server, or if perhaps a client machine has been hijacked and is causing all the trouble.

http://pastebin.com/UCUpgMNF

The pastebin file is an example of the notices we are receiving. In the file I changed our domain to {DOMAIN.com}, and our IP address to {IP.ADD.RE.SS}. We are receiving about 30+ of these notices every minute. The list of email addresses are different in each notice.

We have offices in 3 locations and our IT guy was injured in an automobile accident this morning, so I'm just trying to narrow down the cause of the problem.

Any help would be appreciated.

share|improve this question

closed as too localized by Iszi, Scott Pack, AviD Feb 23 '12 at 21:43

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

    
What other services are running on that system? –  Cry Havok Jan 11 '12 at 18:20

1 Answer 1

The first thing I'd look at is, "Is my mail queue full of messages?"

Received: from localhost (localhost)
    by {DOMAIN.com} (8.12.11.20060614/8.12.11) id q0ANsViM026627;

Finding that at the top of your mail headers where your server says it came from localhost doesn't look good for you.

Mail headers showing the path history of a message are appended to the top of a message. If you happen to see a series of Received: lines, read them from the bottom up.

It's common to fake to / from, etc., but a Received line will always give up the last server IP talked to.

share|improve this answer
    
"Is my mail queue full of messages?" –  the_buff Jan 11 '12 at 2:41
    
Yes is the answer [accidently clicked add too soon]. Does that eliminate a client machine as the culprit? –  the_buff Jan 11 '12 at 2:51
    
@the_buff It makes most likely that the mail was fed into the server from a process running on it rather than received over the network. One case from my past: SMTP port was forwarded over SSH from machine A to machine B. In that instance, a lot of spam was generated because the server thought everything was coming from localhost no matter where on the Internet it was. –  Jeff Ferland Jan 11 '12 at 17:19
    
Is there a webserver running on the same machine? It's likely that there is a vulnerable email script on there. And Jeff is right, that machine is spamming like hell, you are only seeing the error messages for Spam sent to invalid addresses. –  Hendrik Brummermann Feb 20 '12 at 8:59

Not the answer you're looking for? Browse other questions tagged or ask your own question.