I have determined that my server is compromised because it is sending spam (from one of my legitimate addresses).

  • How can I determine what's compromised? Does the attacker know my SSH password? Mail password? Should I simply assume that everything is compromised?
  • Is it possible that mail could be sent from my address (e.g., myactualemail@mydomain.com) without the attacker knowing my mail password?
  • Does the "Received" mail header really include your server as the sending server? As per RFC 5322 section 6.3.2 ( tools.ietf.org/html/rfc5322#section-3.6.2 ), the originator fields (including the from field, which your mail program usually shows) are not connected to the sending server. – rbialon Sep 29 '15 at 19:11
  • It's possible that your server could be functioning as an open relay, or it's possible that the attacker could simply be exploiting a contact form on your site. If either of those are the case, then the good news is that the attacker probably has not gained shell access to your server, and the attacker probably does not know your mail password. As Schroeder said, your server logs will go a long way to track down how and why this is happening. – mti2935 Sep 29 '15 at 19:47

You mention "I have determined my server is compromised". How have you made this determination? Have you found entries in your logs? Have you seen active logins? Etc.

Or are you making the assumption that your server has been compromised because you are getting bounce back emails you have not sent, or perhaps you are getting blacklisted as a spammer, etc.?

More specifics are needed on what you have found (facts not assertions without details) to be able to determine if you have been compromised and at least have a guess at the level of compromise.

As mentioned by others, the email headers are key in understanding what is happening with the emails received/sent so that can be quite helpful if you are tracking emails. As for your question, it is trivial to spoof sending addresses and does not require your system being compromised (in which case the headers would show the actual systems the email passed through and not your system).

As for diagnosing what may be happening to your system, start with the log files. Check logins to see who has been logging in to your system. Check active connections to monitor if someone may be sneaking on. Check your mail log to see if the emails are originating from your system - and for this, you then need to see if you are being used as an open relay or as a bounceback relay (someone sends to you as a bogus sender to an invalid recipient, your system bounces it back which means you are now spamming all these bogus senders and your IP is seen as the email sender).

Hope this helps to start with. Add more details and we may be able to provide more suggestions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.