Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

I have email server for my office, OS: Fedora12, MTA :sendmail, webmail: squirellmail . I was accussed of sending spam to others recently .
I found at maillog on my email server , there are someone trying to get access into my email server using pop3-login with brute force attack. like these :

Jul 6 06:23:43 a dovecot: pop3-login: Aborted login (auth failed, 1 attempts): user=, method=PLAIN, rip=74.63.196.71, lip=1.2.3.4 Jul 6 06:23:46 a dovecot: pop3-login: Aborted login (auth failed, 1 attempts): user=, method=PLAIN, rip=74.63.196.71, lip=1.2.3.4 Jul 6 06:23:48 a dovecot: pop3-login: Aborted login (auth failed, 1 attempts): user=, method=PLAIN, rip=74.63.196.71, lip=1.2.3.4 Jul 6 06:23:50 a dovecot: pop3-login: Aborted login (auth failed, 1 attempts): user=, method=PLAIN, rip=74.63.196.71, lip=1.2.3.4 etc , another logion try

and then after they managed to hack a user id , they start sending out spam being sent through my email server , use the authenticated user. How to stop these kind of attack , thank you for any response and help ?

share|improve this question
Your hard to follow. What e-mail domain are you using and what do you mean by "mail log"? If you mean that e-mails are in your sent folder that you did not send then someone has hacked into your account. – Celeritas Jul 7 '12 at 9:40
Currently this is not a real question. Please have a read of the faq on how to ask questions. – Rory Alsop♦ Jul 7 '12 at 9:46
I suggest you force all of your users to change their password. Lock out any account that is attacked in this way. – Ramhound Jul 9 '12 at 11:29

closed as not a real question by Rory Alsop♦ Jul 7 '12 at 9:43

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, see the FAQ.

Browse other questions tagged or ask your own question.