Strange Spam behaviour

[coolemail]

We have Plesk 9.2.3 with ASL and CentOS5

Last week a mail account was compromised and LOADS of Spam was being sent, clogging up the mail server and causing our mail server to blacklisted in several places. We identified the compromised mail account and have secured it now. We have removed ourselves from all known lists, even though there are still some emails not being delivered with 4.4.1 deferral to certain domains (yahoo, hotmail, btinternet as the main ones).

Today we received an email from a customer (whose domain is hosted on our server but their outgoing mail goes via an external smarthost). Their email got to us OK. But they then got an email making it look as if they had sent loads of Spam (in the examples 82.xxx.xxx.xxx is our mail server):

-----Original Message-----
From: MAILER-DAEMON@plesk2.mydomain.co.uk [mailto:MAILER-DAEMON@plesk2.mydomain.co.uk]
Sent: 26 January 2010 13:21
To: Gordon
Subject: failure notice

Hi. This is the qmail-send program at plesk2.mydomain.co.uk.
I'm afraid I wasn't able to deliver your message to the following addresses.
This is a permanent error; I've given up. Sorry it didn't work out.

<randy.gregg@worldnet.att.net>:
Connected to 204.127.208.75 but sender was rejected.
Remote host said: 521-82.xxx.xxx.xxx blocked by sbc:blacklist.mailrelay.att.net.
521 DNSRBL: Blocked for abuse. See http://att.net/blocks

<randy.holt@netscape.net>:
64.12.138.88 does not like recipient.
Remote host said: 550 MAILBOX NOT FOUND
Giving up on 64.12.138.88.

<randy.pacheco@earthlink.net>:
209.86.93.227 does not like recipient.
Remote host said: 550 randy.pacheco@earthlink.net...User unknown Giving up on 209.86.93.227.

<randy.phillips@ameritech.net>:
Connected to 207.115.21.20 but sender was rejected.
Remote host said: 553 5.3.0 flpi183 - o0LAi1ds022387, DNSBL:ATTRBL 521< 82.xxx.xxx.xxx >_is_blocked.__For_information_see_http://att.net/blocks

<randy.rocker@aol.com>:
64.12.138.57 does not like recipient.
Remote host said: 550 MAILBOX NOT FOUND
Giving up on 64.12.138.57.

<randy.simmons@sbcglobal.net>:
Connected to 207.115.36.20 but sender was rejected.
Remote host said: 553 5.3.0 nlpi076 - o0LAi12o017702, DNSBL:ATTRBL 521< 82.xxx.xxx.xxx>_is_blocked.__For_information_see_http://att.net/blocks

etc. with lots more seeming Spam addresses. And at the bottom them all, it said:

--- Below this line is a copy of the message.

Return-Path: <customer@domain2.org.uk>
Received: (qmail 4577 invoked from network); 26 Jan 2010 13:20:48 +0000
Received-SPF: none (no valid SPF record)
Received: from lon-mail-relay-2.secondarymailserver.net (193.xxx.xxx.xxx)
by plesk2.mydomain.co.uk with (DHE-RSA-AES256-SHA encrypted) SMTP; 26 Jan 2010 13:20:48 +0000
Received: from smtp5.smarthost.net ([78.xxx.xxx.xxx])
by lon-mail-relay-2.secondarymailserver.net with esmtp (Exim 4.52 (FreeBSD))
id 1NZlLV-000BBQ-SH
for me@mydomain.com; Tue, 26 Jan 2010 13:20:41 +0000
Received: from remote.domain2.org.uk (unknown [78.xxx.xxx.xxx])
by smtp5.smarthost.net (Postfix) with ESMTP id EA7D3146B287
for <me@mydomain.com>; Tue, 26 Jan 2010 13:20:40 +0000 (UTC)
Received: from ELIMSBS-W2K8.sbselim.local ([fe80::9c2a:ab6976a]) by ELIMSBS-W2K8.sbselim.local ([fe80::9c2a:ab6976a%10]) with mapi; Tue, 26 Jan 2010 13:20:40 +0000
From: Gordon <customer@domain2.org.uk>
To: me@mydomain.com>
Date: Tue, 26 Jan 2010 13:20:39 +0000
Subject: Installations

etc.

The mail log shows no suspicious activity looking like emails were sent. But after the incident last week, we are very wary. Can anyone help on what could have caused this failure notice to be generated? Is there anywhere else we can check things on our server to see if all is OK? What can we do about it? And is there something encouraging that we can tell our customer?

Related but separate: can anyone advise us as to how we can get the emails sitting in our Mail Queue delivered while we struggle to find the various postmasters and persuade them to whitelist the mail server as there are thousands of:

deferral: Sorry,_I_wasn't_able_to_establish_an_SMTP_connection._(#4.4.1)/

being received.

Grateful as ever in advance for all help.

[coolemail]

Can anyone suggest anything to help? All emails being sent to yahoo and btinternet domains in the main are not being accepted by the remote servers, giving us 4.4.1 deferral.

Can we somehow get a different IP address to send the emails from our server? Forgive me if it is an obvious question. I can add another IP on the server, but without major reconfiguration of the server and ALL domains, can we get ourgoing mail to go from a different IP so that we can get through the btinternet and yahoo mail servers? If someone could tell us how to do that, I'd be really grateful. Our customers are getting so frustrated by emails not being delivered to some domains.

If I change the IP address for teh hostname of the server (plesk2.mydomain.com) to a different IP that I've added to the server, will that alone do it? Perhaps but I need reassurance. Also, customers logging in to manage domains do so by visiting https://plesk2.mydomain.com:8443. If they do this, will they then not be able to see their own domains? Perhaps I can change the shared IP address for all domains that are using that IP address? Really grateful for advice, please.

In hope and anticipation. Many thanks in advance.

[mikeshinn]

So heres a trick to get the mail to go out as a different IP address:

iptables -t nat -A POSTROUTING -p tcp --dport 25 -j SNAT --to-source IP_YOU_WANT_TO_USE

This will only work if the IP is on the same interface as your default route. So if you had two NICs for example this wont work, you'd have to use one of the more advanced techniques we discuss in our book. Basically advanced routing.

[coolemail]

Thank you Mike,
Do I need to create a new domain (say plesk3.mydomain.com) also and set up reverse DNS between that and the new IP address?
Or reverse DNS from the new IP address to the current hostname of the server?
Or does it not matter if the hostname remains the same?

EDIT:
I created a new domain as above, and reverse DNS also for it to the new IP address.
I kept the hostname the same (plesk2.mydomain.com)
I did what Mike suggested and for completeness rebooted the server just in case that was necessary to make the instruction take effect (was the reboot necessary??).
IT WORKED PERFECTLY!! THANK YOU MIKE.

P.S. What is your book called and is it in sufficiently layman terms that a relative newbie would understand? If so I would have no hesitation to buy it if it has lots of tips & tricks for things like this, but I would not want to feel that I am getting nothing from it.

P.P.S. I would be really grateful for comment on why we are still occasionally (and randomly) getting the emails like the one in the first post. They suggest that lots of Spam has been sent out and not delivered for various reasons. But looking at

Code: Select all

grep  smtp_auth /usr/local/psa/var/log/maillog

there are no outgoing Spam emails. Is there any way that emails can be sent from the server and not show up in the maillog?

EDIT 2:
Since this morning, we have had thousands of

Received From: plesk2->/var/log/httpd/error_log
Rule: 30104 fired (level 12) -> "Apache segmentation fault."
Portion of the log(s):

[Thu Jan 28 21:59:34 2010] [notice] child pid 22887 exit signal Segmentation fault (11)

and in the maillog one seemingly compromised mail account and an SMTP brute force attack. Are these coincidental or could they be linked?

Jan 28 13:04:41 plesk2 smtp_auth: SMTP connect from (null)@hostxxx-xx-xxx-xxx.range217-44.btcentralplus.com [xxx.xx.xxx.xxx]
Jan 28 13:04:41 plesk2 smtp_auth: smtp_auth: SMTP user info@domain.com : logged in from (null)@hostxxx-xx-xxx-xxx.range217-44.btcentralplus.com [xxx.xx.xxx.xxx]

Jan 28 19:06:51 plesk2 smtp_auth: SMTP connect from (null)@135.144.143.219.broad.bj.bj.dynamic.163data.com.cn [219.143.144.135]
Jan 28 19:06:51 plesk2 smtp_auth: smtp_auth: FAILED: admin - password incorrect from (null)@135.144.143.219.broad.bj.bj.dynamic.163data.com.cn [219.143.144.135]