<HTML>
<HEAD>
<META content="text/html; charset=iso-8859-1" http-equiv=Content-Type>
<META content="OPENWEBMAIL" name=GENERATOR>
</HEAD>
<BODY bgColor=#ffffff>
<font size="2">And while you're at it - block their further attempts to find/exploit another username/password.
<br />
<br />The easiest way to do it - block it with IP Tables. Use this to block that oneI IP:
<br />/sbin/iptables -I acctin 1 -d 41.210.18.88/32 -j DROP
<br />
<br />But since changing their IP is easy, I'd recommend blocking at least the whole /24 network they are on. Use
<br />/sbin/iptables -I acctin 1 -d 41.210.18.0/24 -j DROP
<br />
<br />In my own case, I couldn't care less about e-mails from Ghana. I'd lock out the entire block of IPs assigned to that country with
<br />/sbin/iptables -I acctin 1 -d 41.210.0.0/16 -j DROP
<br />
<br />Any of these rules will block further traffic from that IP or their networks. But remember - this is temporary. The next time you boot the server, or create a website - IP Tables are reloaded and your temp rule is gone. Then they're back at your server. Making the rule permanent is a bit more involved.
<br />
<br />
<br />
<br />Chuck
<br />
<br />
<br />
<br /></font><font size="2">
<br /><b>---------- Original Message
-----------</b>
<br />
From: Michael Stauber <mstauber@blueonyx.it>
<br />
To: BlueOnyx General Mailing List <blueonyx@blueonyx.it>
<br />
Sent: Tue, 8 Jun 2010 01:25:00 +0200
<br />
Subject: [BlueOnyx:04707] Re: send mail Relay exploit
<br />
<br />> Hi Hugo,
<br />>
<br />>
> since friday our server has been exploited as a relay for several domains
<br />>
> who are spammers
<br />>
<br />>
Do you have SMTP-Auth enabled? If not, enable it. But from what I see it in
<br />>
your logs it should be on already. With SMTP-Auth enabled only users
<br />>
authenticated with their username and password can send emails through your
<br />>
server.
<br />>
<br />>
> Here is some logs
<br />>
<br />>
>From those log lines only one entry indicates the actual relaying of emails
<br />>
through your server:
<br />>
<br />>
Jun 7 16:23:14 ns1 sendmail[23694]: o57LMj4U023694:
<br />>
from=<tbent@wanadoo.co.uk>, size=1509, class=0, nrcpts=50,
<br />>
msgid=<201006072122.o57LMj4U023694@ns1.abaco.net.mx>, proto=ESMTP,
daemon=MTA,
<br />>
relay=adsl1888.4u.com.gh [41.210.18.88]
<br />>
<br />>
Someone from the IP [41.210.18.88] sent a 1509 byte large mail to 50
<br />>
recipients in one go. The line "proto=ESMTP" indicates that he used
SMTP-Auth
<br />>
to authenticate against Sendmail and that was apparently done with a valid
<br />>
username and password.
<br />>
<br />>
Then the next snippet shows how four of the 50 generated emails were sent out:
<br />>
<br />>
Jun 7 16:23:16 ns1 sendmail[23755]: o57LMj4U023694:
<br />>
to=<fultonmr@aol.com>,<fultimeslackervb@aol.com>,<fulmoon19@aol.com>,<fulltipz@aol.com>,
<br />>
delay=00:00:27, xdelay=00:00:02, mailer=esmtp, pri=1591509,
<br />>
relay=mailin-02.mx.aol.com. [205.188.155.110], dsn=2.0.0, stat=Sent (2.0.0 Ok:
<br />>
queued as 3EC3F38000CAD)
<br />>
<br />>
This went to some AOL users in one go.
<br />>
<br />>
So it appears someone has guessed, sniffed or brute forced the login details
<br />>
of one of your email users.
<br />>
<br />>
How to find out which account that's from?
<br />>
<br />>
Check /var/log/maillog and find the entries immediately above this one:
<br />>
<br />>
Jun 7 16:23:14 ns1 sendmail[23694]: o57LMj4U023694:
<br />>
from=<tbent@wanadoo.co.uk> [...]
<br />>
<br />>
There should be a line like this:
<br />>
<br />>
Jun 7 16:23:14 ns1 sendmail[XXX]: AUTH=server,
relay=adsl1888.4u.com.gh
<br />>
[41.210.18.88], authid=USERNAME, mech=PLAIN, bits=0
<br />>
<br />>
That shows "authid=" and the username they used to send the email.
<br />>
<br />>
Or you can use cat and grep to search for it like this:
<br />>
<br />>
cat /var/log/maillog | grep AUTH=server | grep 41.210.18.88
<br />>
<br />>
That searches for "AUTH=server" (which identifies the SMTP-Auth
logins) and
<br />>
for the IP address of the sender of the email. That will return all matching
<br />>
log entries and the "authid=" part will reveal the compromised
username.
<br />>
<br />>
--
<br />>
With best regards
<br />>
<br />>
Michael Stauber
<br />>
<br />>
_______________________________________________
<br />>
Blueonyx mailing list
<br />>
Blueonyx@blueonyx.it
<br />>
<a target="_blank" href="http://www.blueonyx.it/mailman/listinfo/blueonyx">http://www.blueonyx.it/mailman/listinfo/blueonyx</a>
<br /><b>------- End of Original Message
-------</b>
<br />
</font>
</BODY>
</HTML>