<HTML>
<HEAD>
<META content="text/html; charset=iso-8859-1" http-equiv=Content-Type>
<META content="OPENWEBMAIL" name=GENERATOR>
</HEAD>
<BODY bgColor=#ffffff>
<font size="2">>
> So, first and easiest thing to do to stop it is firewall out that
<br />>
> address. At the command line, enter:
<br />>
> iptables -I acctin 1 -s 200.111.101.0/24 -j DROP
<br />>
> That will stop the scumbag from relaying any e-mail through you, even if
<br />>
> he changes his IP to another in his network.
<br />>
<br />>
The /24 rejection may or may not be a bit severe (especially if there
<br />>
are any other legitimate users from that range) but then again, if you
<br />>
don't have any legitimate users using the ISP "EntelChile" in
Santiago,
<br />>
Chile then it will certainly be effective!
<br />>
<br />>
The only problem I have with this has nothing to do with Chuck's
<br />>
suggestion, which is valid. It's the fact that if a user account is in
<br />>
fact compromised, then there's a good chance there is a spam gang with
<br />>
IP's around the world all using the account. Then it becomes an issue
<br />>
similar to the Dutch boy sticking his fingers in the leaking dam.
<br />>
That's where the next part comes in.
<br />
<br />The /24 may be considered severe to some - but it prevents a scum who has access to a block of IPs (whether for a company or RWIPs for home) from changing the IP slightly and doing it again. In my case, the ISP I mainly support does most of their business for businesses. They don't care if they can't get e-mail from Chile, Russia, China, Netherlands, or Twain. They only care about their US service working - so I block entire /8 networks and /16 networks when they're overseas. It also cuts down on the amount of hacking activity.
<br />
<br />You're right Chris. Typically when a account is exploited - it starts with just one IP, and by the end of the week is coming from a dozen IPs all over the world. That's why its important to find the exploited account or exploit on the server that's being used - and stop it there.
<br />
<br />
<br />
<br />>
> Once you've figured out which account is being used, simply change the
<br />>
> password. That should stop it. Worse case, delete that account.
I had
<br />>
> one just like it two weeks ago, and even suspending the account didn't
<br />>
> prevent him from relaying through the server. So I just deleted the
<br />>
> account which put a end to it.
<br />>
<br />>
Yes, changing the password would be my recommendation. Deleting the
<br />>
account will be effective, but of course if it's attached to a legit
<br />>
user and then you wipe out his account and all his email, webmail
<br />>
settings, etc. you're likely to have a cranky customer on your hands.
<br />
<br />But you've got to look at it another way Chris.
<br />
<br />When our server was recently being abused - valid/bill-paying customers were complaining because Yahoo, Gmail, Hotmail, and even big companies like AT&T were blocking their valid e-mail, because of the other crap coming from our server. The other crud wound up getting the server blacklisted with a "poor reputation" - and valid e-mail wouldn't go out. So if I chance ticking off one customer by backing up his "mbox" and deleting the account -- I'll risk it to solve the e-mail problems for X numbers of users on Y sites on the server. In the recent case - that added up to almost 1,500 users who were experiencing blacklist problems. I found the account (it turned out to be a OLD phantom account no one could explain or admit to adding to the server), deleted it, changed the RWIP on the server - and blacklist problem solved for the other 1,500 users.
<br />
<br />In other cases in the past - we've found businesses that INTENTIONALLY gave out the username/password to a account to their customers, so they could FTP up/down. That wasn't too big a deal - till one of them posted that info on a webpage! That's when our server started being abused! We deleted the account, had a chat with the business about what their actions had caused, set them up with a small Anonymous FTP, and everyone was happy. Most of the time - its simply lack of knowledge about what can happen. But whether it ticks off one customer or not - I've got to protect the rest of the users. Or as someone else said "Sometimes the needs of the many outweigh the needs of the few; Or the one".
<br />
<br />
<br />
<br />Chuck
<br />
<br />
<br />
<br />P.S. - That's something I've never understood, and REALLY don't like about BlueQuartz and now BlueOnyx. You've got 50 domains on the server with 50 virtual sites and 50 different IPs assigned, but all OUTGOING e-mail originates from the main server IP. So when just one user in just one domain starts abusing the server - it gets everyone blacklisted! I really wish outgoing connections would originate from the IP assigned to that virtual site/domain. But I assume that would take some major time & coding - so I've learned to live with it.
<br />
<br />
<br />
<br />
<br />
<br />
</font>
</BODY>
</HTML>