Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.



2180 posts

Uber Geek
+1 received by user: 193

Subscriber

Topic # 97539 16-Feb-2012 12:09 Send private message

I have a server that looks like it is being used as a relay, it's SMTP queue is full of spam (Nigerian Scam letters).
It is NOT an open relay - I have tested.

Question: How do I find out what (or from where - internal or external) the messages are originating.
At the moment I am remote, but will be heading on site shortly (have to clear the decks to get there).
I have enabled message tracking (on full logging), but can't see anything helpful.
It looks like the attack has stopped (it happened overnight) but it is the second time in a week (different emails going out).

  

Create new topic
425 posts

Ultimate Geek
+1 received by user: 5

Trusted

  Reply # 582309 16-Feb-2012 12:38 Send private message

Possibly a hacked account. Are you using secure passwords? You could try looking on your firewall and block the subnet they are on.






425 posts

Ultimate Geek
+1 received by user: 5

Trusted

  Reply # 582315 16-Feb-2012 12:46 Send private message

Also disable the option to allow authenticated users to relay. Found under Server->servername->Protocols->SMTP right click default, Access tab, Relay restrictions.






468 posts

Ultimate Geek
+1 received by user: 39


  Reply # 582316 16-Feb-2012 12:46 Send private message

If you've got port 25 open to the world you should either:

1) Remove the tick from "Allow all computers which successfully authenticate to relay, regardless of the list above" from the Relay Restrictions screen on your Default SMTP Virtual Server.

2) If you don't want to do the above, ensure that all user accounts, including any built-in or test accounts, are secure. That means either settings good passwords on them or denying them relay access via permissions.

gjm

660 posts

Ultimate Geek
+1 received by user: 70

Subscriber

  Reply # 582331 16-Feb-2012 13:11 Send private message

also check that it isnt one of the pc's on the network trying to send it through the exchange server




[Amstrad CPC 6128: 128k Memory: 3 inch floppy drive: Colour Screen]



2180 posts

Uber Geek
+1 received by user: 193

Subscriber

  Reply # 582332 16-Feb-2012 13:11 Send private message

Kraven: If you've got port 25 open to the world you should either:

1) Remove the tick from "Allow all computers which successfully authenticate to relay, regardless of the list above" from the Relay Restrictions screen on your Default SMTP Virtual Server.

2) If you don't want to do the above, ensure that all user accounts, including any built-in or test accounts, are secure. That means either settings good passwords on them or denying them relay access via permissions.


OK, I can do that. If I do 1), all authenticated users in the office will still be able to send mail wont they? 

425 posts

Ultimate Geek
+1 received by user: 5

Trusted

  Reply # 582339 16-Feb-2012 13:19 Send private message

trig42: all authenticated users in the office will still be able to send mail wont they? 


Yes, you should have the local subnet entered into the allowed adresses. Also outlook connected to exchange uses a different mechanism to place mesaages in the queue. 








2180 posts

Uber Geek
+1 received by user: 193

Subscriber

  Reply # 582365 16-Feb-2012 13:53 Send private message

I think I have narrowed it down, and it does not look like it is coming from inside the network.

In the message tracking log file, under client_hostname is the IP 36.37.236.43 and the partner_name is 'user'.

I wonder how 'user' got to be able to send mail? Does 'user' mean that it the spammer is using the username/password of a 'user' on the network?

I have had everyone change their passwords to something a more secure (to much wailing and gnashing of teeth!) and blocked that IP address from connecting to the server. The mail has stopped coming into the queue, so I will see how we go.

3000 posts

Uber Geek
+1 received by user: 187

Trusted
Subscriber

  Reply # 582368 16-Feb-2012 13:56 Send private message

trig42: I think I have narrowed it down, and it does not look like it is coming from inside the network.

In the message tracking log file, under client_hostname is the IP 36.37.236.43 and the partner_name is 'user'.

I wonder how 'user' got to be able to send mail? Does 'user' mean that it the spammer is using the username/password of a 'user' on the network?

I have had everyone change their passwords to something a more secure (to much wailing and gnashing of teeth!) and blocked that IP address from connecting to the server. The mail has stopped coming into the queue, so I will see how we go.


Sounds like there is a user account called "user" in your active directory which as an insecure password. Try disabling the account. 







2180 posts

Uber Geek
+1 received by user: 193

Subscriber

  Reply # 582372 16-Feb-2012 14:01 Send private message

I looked for that. Can't find it. Might have a better look.

I think that the 'user' mentioned points more to the type of login (as opposed to Power user or Administrator) 

Create new topic




Twitter »
Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:




News »

Trending now »
Hot discussions in our forums right now:

Moment of Truth?
Created by BarTender, last reply by turnin on 18-Sep-2014 23:17 (365 replies)
Pages... 23 24 25


IOS8 - Network Load
Created by FireEngine, last reply by joker97 on 18-Sep-2014 19:43 (36 replies)
Pages... 2 3


10 Iphone 128gb 6+ iphones this weekend at auckland airport
Created by frysie, last reply by TimA on 17-Sep-2014 22:02 (36 replies)
Pages... 2 3


Mr. Key to extradite Kim Dotcom?
Created by TimA, last reply by SaltyNZ on 18-Sep-2014 09:20 (126 replies)
Pages... 7 8 9


Spark DNS Issues - Amazing - Broadband Service Alert
Created by PeteS, last reply by Demeter on 15-Sep-2014 14:13 (307 replies)
Pages... 19 20 21


New On Account mobile plans - Red+
Created by NikT, last reply by paulspain on 18-Sep-2014 21:39 (18 replies)
Pages... 2


Bizarre Policy on plan change
Created by toejam316, last reply by FireEngine on 18-Sep-2014 20:22 (17 replies)
Pages... 2


2014 Holden SS (V8) or Ford XR6-T (in-line 6 turbo)
Created by joker97, last reply by ilovemusic on 16-Sep-2014 14:34 (71 replies)
Pages... 3 4 5



Geekzone Live »
Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.

Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.