2

MAILER-DAEMON notices are spamming our email administrator account, causing it to fill up, and bringing down our email server.

Our email server is a Virtual FreeBSD box hosted by Verio. Their support has been useless. I am not very familiar with FreeBSD, and because it is a virtual private server, I don't have wheel access.

Could someone who is familiar with FreeBSD and email headers please let me know whether this looks like spam coming from outside the server, or if perhaps a client machine has been hijacked and is causing all the trouble.

http://pastebin.com/UCUpgMNF

The pastebin file is an example of the notices we are receiving. In the file I changed our domain to {DOMAIN.com}, and our IP address to {IP.ADD.RE.SS}. We are receiving about 30+ of these notices every minute. The list of email addresses are different in each notice.

We have offices in 3 locations and our IT guy was injured in an automobile accident this morning, so I'm just trying to narrow down the cause of the problem.

Any help would be appreciated.

  • What other services are running on that system? – Cry Havok Jan 11 '12 at 18:20
6

The first thing I'd look at is, "Is my mail queue full of messages?"

Received: from localhost (localhost)
    by {DOMAIN.com} (8.12.11.20060614/8.12.11) id q0ANsViM026627;

Finding that at the top of your mail headers where your server says it came from localhost doesn't look good for you.

Mail headers showing the path history of a message are appended to the top of a message. If you happen to see a series of Received: lines, read them from the bottom up.

It's common to fake to / from, etc., but a Received line will always give up the last server IP talked to.

| improve this answer | |
  • "Is my mail queue full of messages?" – the_buff Jan 11 '12 at 2:41
  • Yes is the answer [accidently clicked add too soon]. Does that eliminate a client machine as the culprit? – the_buff Jan 11 '12 at 2:51
  • @the_buff It makes most likely that the mail was fed into the server from a process running on it rather than received over the network. One case from my past: SMTP port was forwarded over SSH from machine A to machine B. In that instance, a lot of spam was generated because the server thought everything was coming from localhost no matter where on the Internet it was. – Jeff Ferland Jan 11 '12 at 17:19
  • Is there a webserver running on the same machine? It's likely that there is a vulnerable email script on there. And Jeff is right, that machine is spamming like hell, you are only seeing the error messages for Spam sent to invalid addresses. – Hendrik Brummermann Feb 20 '12 at 8:59

Not the answer you're looking for? Browse other questions tagged or ask your own question.