5

I asked this same question in serverfault but realized that wasn't the right place, I apologize.

Background

Server OS: Ubuntu 10.04

Mailing Application: Sendmail

Recently I asked about backscatter on a mail server running sendmail, Amazon noticed me that my server is sending junk mails to others in the form of backscatter. I later removed the sendmail's ability to receive incoming emails by stopping the daemon from listening on port 25. The message queue is still setup to run periodically. So after that my server can only send emails to outside, preventing backscatter.

Bad News

After a few days I got an abuse report from Amazon, saying the exact same thing (sending spam). I immediately check the mail log on my server and found that my daemon sent out 3 emails to 2 unfortunate users at gmail.

What Next?

Since I'm certain that my server can not receive any incoming emails, I believe there is some malicious scripts sitting on my server doing nasty things. Thus what are the steps that I can take to diagnose for any of these evil scripts? What logs can I check for more records, and how can I locate the scripts who sent these emails?

Improve this question
2
  • 1
    Is the spam still happening? If so, load up Wireshark or a similar tool and look for incoming data that might be related. It may just be that you've misconfigured your mail daemon and it's acting as a relay.
    – Polynomial
    Commented Aug 22, 2012 at 19:16
  • @Polynomial Thanks for the reply, I checked and those 3 were the only records I have found so far. They all happened today.
    – Xavier_Ex
    Commented Aug 22, 2012 at 20:02

1 Answer 1

Reset to default
2

This sounds like you have Open SMTP relays that need to be configured. The SMTP relay machine should only accept mail for relay to domains you host. For example, if you host the domain maildomain.com, the SMTP relay should only accept mail for that domain and reject mail for any other domain. (At least, this should be the case for unauthenticated connections). The reason for this is that if external SMTP servers and clients can send mail to other domains through your SMTP relay, then those machines will be able to relay spam through your SMTP server. You want to reject mail sent to the SMTP relay for domains you do not host.

This is a critical configuration. I’ve talked to a lot of ISA Server and Exchange administrator’s who have been put on dreaded RBLs because they did not correctly configure their SMTP relays to prevent unauthenticated relay. If you’ve been victimized by one or more of these RBLs, you know that you might as well try to come out a winner in an IRS audit. For this reason I highly recommend that you do not publish SMTP relays to the Internet until you have a good understanding on how to configure the relay to prevent spammers from abusing it.

The IIS SMTP service allows you to create remote domains and then configure those remote domains to relay mail to a server on your internal network. The SMTP relay is configured with remote domains for the domains you host and relay mail to your Exchange Server or to another SMTP relay on your internal network. The default IIS and Exchange SMTP server configuration blocks mail relay while allowing relay for mail addressed to the remote domains you configure.

Improve this answer
1
  • Thanks for the anwer! I am aware of the open relay issue, thus I configured the daemon to only listen to localhost as it is only intended to send out notifications, not expecting any incoming emails from outside. The following lines are written in my sendmail.mc, I think they mean what I said? ail. ` DAEMON_OPTIONS(Family=inet, Name=MTA-v4, Port=smtp, Addr=127.0.0.1')dnl DAEMON_OPTIONS(Family=inet, Name=MSP-v4, Port=submission, M=Ea, Addr=127.0.0.1')dnl `
    – Xavier_Ex
    Commented Aug 24, 2012 at 18:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .