0

My mail server (IP, not domains) was recently flagged as a spam source by Spamhaus and I'm looking for help at tracking down the source.

First, I verified the forward and reverse DNS records, SPF records, and the SMTP service HELO. Next I looked through the mail log(s), but found nothing other than what I expected and that's when it dawned on me. Maybe the spam is not being sent by my SMTP service itself.

As a part of isolating to troubleshoot the source I cut off user access from sending and set up several firewall rules on the mail host. The firewall rules quickly revealed 25/tcp, of course, and 443/http traffic, neither of which should have been originating (TCP SYN) from the mail host. Next, I ran a ClamAV scan which didn't reveal anything. After, I ran rkhunter. From those scans I gave more attention to looking through /dev/shm.

I found the file /dev/shm/rhm.<redacted> (<redacted> is 20 hexadecimal characters) which contains nothing but a list of 500 URLs which - several picked at random - all came back as Phishing. The owner and group of this file are both _rspamd which in interesting in that that is one of the Postfix milters I run. In particular the Rspamd web interface is exposed to the Internet though it requires authentication (password only, no username). I wonder if there's a vulnerability in the web interface that is the root of this. Or maybe even the password was compromised and from there something was exploited.

I've started looking through ps output but nothing stands out to me. The same with cron and netstat. Linux Malware Detect doesn't find anything except an EICAR test sample.

How do I go about finding what is doing the emailing? Is the 443/tcp traffic the malicious software trying to check in to get updates?

  • Ubuntu 20.04
  • Postfix 3.4.13
  • Dovecot 2.3
  • Rspamd 1.9.4
  • Apache 2.4.41

Thanks for your guidance.

12
  • Given that the goal of rspamd is to analyze mail and detect spam and phishing it might not be unexpected to see phishing URLs in its shared memory. "How do I go about finding what is doing the emailing?" - there is absolutely nothing known about your system. Is it solely used as a mail host, are there any user accounts on it, ... Commented May 8 at 20:00
  • The only local accounts are those that are typical to Linux. It's only a mail server for several domains. There are lots of details to share. What would you like to know? Commented May 8 at 20:13
  • If you want to get help you need to provide details about what is exposed on the system, who has access, how things are protected ... Also, I find it strange that you consider outgoing tcp/25 as a problem - it is a mail host I thought. Or is it only a host to receive mail but never send mail? Too much unknown. And note that rspamd gets updates for various lists, which might explain outgoing tcp/443. Also, what is Apache for if this is a mail host only? Commented May 8 at 20:22
  • 1
    As for nothing special in the mail logs: it might also be that some recipient considered a mail send by your host as spam/phishing, even if you did not intend to spam the user. Or that the mails contained malicious links due to a compromised mail client - which you don't see from the mail logs. Commented May 8 at 20:28
  • Added basic system info the main post. There are two user account I added. Mine and a backup. There is a firewall in front of the host which I control. Then there is netfilter on the host. I have lots of rules and all chains in and out are default deny. Some chains are updated daily based on OSINT. Fail2ban runs and is pretty strict. Postfix is hardened and has pretty strict limits. I said new (TCP sessions) from the host are strange when there is no access to anybody to send mail since I purposely blocked it for troubleshooting. Commented May 8 at 20:31

0

You must log in to answer this question.