Michael,<br><br>I run your instructions and find that one of our clients has a user "info" that is the one to blame. sadly there was a similar post previos to mine.<br><br>We sould get this in a forum.<br><br><br>
Thanks for your support.<br><br>Regards<br><br><br>H.<br><br><div class="gmail_quote">On Mon, Jun 7, 2010 at 6:25 PM, Michael Stauber <span dir="ltr"><<a href="mailto:mstauber@blueonyx.it">mstauber@blueonyx.it</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">Hi Hugo,<br>
<div class="im"><br>
> since friday our server has been exploited as a relay for several domains<br>
> who are spammers<br>
<br>
</div>Do you have SMTP-Auth enabled? If not, enable it. But from what I see it in<br>
your logs it should be on already. With SMTP-Auth enabled only users<br>
authenticated with their username and password can send emails through your<br>
server.<br>
<br>
> Here is some logs<br>
<br>
>From those log lines only one entry indicates the actual relaying of emails<br>
through your server:<br>
<div class="im"><br>
Jun 7 16:23:14 ns1 sendmail[23694]: o57LMj4U023694:<br>
from=<<a href="mailto:tbent@wanadoo.co.uk">tbent@wanadoo.co.uk</a>>, size=1509, class=0, nrcpts=50,<br>
msgid=<<a href="mailto:201006072122.o57LMj4U023694@ns1.abaco.net.mx">201006072122.o57LMj4U023694@ns1.abaco.net.mx</a>>, proto=ESMTP, daemon=MTA,<br>
relay=<a href="http://adsl1888.4u.com.gh" target="_blank">adsl1888.4u.com.gh</a> [41.210.18.88]<br>
<br>
</div>Someone from the IP [41.210.18.88] sent a 1509 byte large mail to 50<br>
recipients in one go. The line "proto=ESMTP" indicates that he used SMTP-Auth<br>
to authenticate against Sendmail and that was apparently done with a valid<br>
username and password.<br>
<br>
Then the next snippet shows how four of the 50 generated emails were sent out:<br>
<div class="im"><br>
Jun 7 16:23:16 ns1 sendmail[23755]: o57LMj4U023694:<br>
to=<<a href="mailto:fultonmr@aol.com">fultonmr@aol.com</a>>,<<a href="mailto:fultimeslackervb@aol.com">fultimeslackervb@aol.com</a>>,<<a href="mailto:fulmoon19@aol.com">fulmoon19@aol.com</a>>,<<a href="mailto:fulltipz@aol.com">fulltipz@aol.com</a>>,<br>
delay=00:00:27, xdelay=00:00:02, mailer=esmtp, pri=1591509,<br>
relay=<a href="http://mailin-02.mx.aol.com" target="_blank">mailin-02.mx.aol.com</a>. [205.188.155.110], dsn=2.0.0, stat=Sent (2.0.0 Ok:<br>
queued as 3EC3F38000CAD)<br>
<br>
</div>This went to some AOL users in one go.<br>
<br>
So it appears someone has guessed, sniffed or brute forced the login details<br>
of one of your email users.<br>
<br>
How to find out which account that's from?<br>
<br>
Check /var/log/maillog and find the entries immediately above this one:<br>
<div class="im"><br>
Jun 7 16:23:14 ns1 sendmail[23694]: o57LMj4U023694:<br>
</div>from=<<a href="mailto:tbent@wanadoo.co.uk">tbent@wanadoo.co.uk</a>> [...]<br>
<br>
There should be a line like this:<br>
<br>
Jun 7 16:23:14 ns1 sendmail[XXX]: AUTH=server, relay=<a href="http://adsl1888.4u.com.gh" target="_blank">adsl1888.4u.com.gh</a><br>
[41.210.18.88], authid=USERNAME, mech=PLAIN, bits=0<br>
<br>
That shows "authid=" and the username they used to send the email.<br>
<br>
Or you can use cat and grep to search for it like this:<br>
<br>
cat /var/log/maillog | grep AUTH=server | grep 41.210.18.88<br>
<br>
That searches for "AUTH=server" (which identifies the SMTP-Auth logins) and<br>
for the IP address of the sender of the email. That will return all matching<br>
log entries and the "authid=" part will reveal the compromised username.<br>
<br>
--<br>
With best regards<br>
<font color="#888888"><br>
Michael Stauber<br>
</font><div><div></div><div class="h5"><br>
_______________________________________________<br>
Blueonyx mailing list<br>
<a href="mailto:Blueonyx@blueonyx.it">Blueonyx@blueonyx.it</a><br>
<a href="http://www.blueonyx.it/mailman/listinfo/blueonyx" target="_blank">http://www.blueonyx.it/mailman/listinfo/blueonyx</a><br>
</div></div></blockquote></div><br>