Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I asked this same question in serverfault but realized that wasn't the right place, I apologize.

Background

Server OS: Ubuntu 10.04

Mailing Application: Sendmail

Recently I asked about backscatter on a mail server running sendmail, Amazon noticed me that my server is sending junk mails to others in the form of backscatter. I later removed the sendmail's ability to receive incoming emails by stopping the daemon from listening on port 25. The message queue is still setup to run periodically. So after that my server can only send emails to outside, preventing backscatter.

Bad News

After a few days I got an abuse report from Amazon, saying the exact same thing (sending spam). I immediately check the mail log on my server and found that my daemon sent out 3 emails to 2 unfortunate users at gmail.

What Next?

Since I'm certain that my server can not receive any incoming emails, I believe there is some malicious scripts sitting on my server doing nasty things. Thus what are the steps that I can take to diagnose for any of these evil scripts? What logs can I check for more records, and how can I locate the scripts who sent these emails?

share|improve this question
1  
Is the spam still happening? If so, load up Wireshark or a similar tool and look for incoming data that might be related. It may just be that you've misconfigured your mail daemon and it's acting as a relay. –  Polynomial Aug 22 '12 at 19:16
    
@Polynomial Thanks for the reply, I checked and those 3 were the only records I have found so far. They all happened today. –  Xavier_Ex Aug 22 '12 at 20:02

1 Answer 1

This sounds like you have Open SMTP relays that need to be configured. The SMTP relay machine should only accept mail for relay to domains you host. For example, if you host the domain maildomain.com, the SMTP relay should only accept mail for that domain and reject mail for any other domain. (At least, this should be the case for unauthenticated connections). The reason for this is that if external SMTP servers and clients can send mail to other domains through your SMTP relay, then those machines will be able to relay spam through your SMTP server. You want to reject mail sent to the SMTP relay for domains you do not host.

This is a critical configuration. I’ve talked to a lot of ISA Server and Exchange administrator’s who have been put on dreaded RBLs because they did not correctly configure their SMTP relays to prevent unauthenticated relay. If you’ve been victimized by one or more of these RBLs, you know that you might as well try to come out a winner in an IRS audit. For this reason I highly recommend that you do not publish SMTP relays to the Internet until you have a good understanding on how to configure the relay to prevent spammers from abusing it.

The IIS SMTP service allows you to create remote domains and then configure those remote domains to relay mail to a server on your internal network. The SMTP relay is configured with remote domains for the domains you host and relay mail to your Exchange Server or to another SMTP relay on your internal network. The default IIS and Exchange SMTP server configuration blocks mail relay while allowing relay for mail addressed to the remote domains you configure.

share|improve this answer
    
Thanks for the anwer! I am aware of the open relay issue, thus I configured the daemon to only listen to localhost as it is only intended to send out notifications, not expecting any incoming emails from outside. The following lines are written in my sendmail.mc, I think they mean what I said? ail. ` DAEMON_OPTIONS(Family=inet, Name=MTA-v4, Port=smtp, Addr=127.0.0.1')dnl DAEMON_OPTIONS(Family=inet, Name=MSP-v4, Port=submission, M=Ea, Addr=127.0.0.1')dnl ` –  Xavier_Ex Aug 24 '12 at 18:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.