[BlueOnyx:01696] Re: Sendmail attack, again
mstauber at blueonyx.it
Wed Jul 15 09:20:08 PET 2009
> I see things like this in the maillog, how do they do this, and how to stop
> Note that all the email's 18333 had one from
Ok, let us take a look at the first logged line:
> Jul 15 08:08:49 msi1 sendmail: n6FD4mxh018333:
> from=<vitaly at ihome.net.ua>, size=2749, class=0, nrcpts=49,
> msgid=<200907151305.n6FD4mxh018333 at msi1.portage.net>, proto=ESMTP,
> daemon=MTA, relay=[188.8.131.52]
We have the sender <vitaly at ihome.net.ua> (probably faked) comming from the IP
The line " size=2749, class=0, nrcpts=49" tells us that the email was 2749
bytes long and "nrcpts=49" means: This email had 49 individual recipients (To,
CC or BCC). So once this email got accepted by your mailserver, your Sendmail
attempted to deliver it to all 49 recipients - regardless if they were local
accounts or not.
Now the question is: Why was this box relaying for 184.108.40.206?
Is that IP in the Sendmail access list and allowed to relay? It is probably
not, but it's worth checking.
Did the sender use SMTP-Auth? If *that* is the case, check the log entry right
before that line in question. There should be something like this there:
sendmail: AUTH=server, relay=ihome.net.ua [220.127.116.11], authid=tom,
In that case the "authid=tom" would tell us that user "tom" used SMTP-Auth to
authenticate against SMTP.
That would then point the blame to user tom either being the spammer, or him
having used a weak and guesable password that got exploited by a spammer.
With best regards
More information about the Blueonyx