Page 1 of 1
Spam through our server
Posted: Thu Mar 08, 2012 5:16 pm
by octet
Hi,
We recently started to get tons of spam through our server:
I have changed all email passwords for the domain flamingoblinds.co.uk and ban the IP address trying to connect to IMAP but it looks like it's still able to do it.
What am I doing wrong please?
Code: Select all
[root@zeus ~]# grep 10073 /etc/passwd
qscand:x:10073:156:Qmail-Scanner Account:/var/spool/qscan:/bin/false
[root@zeus ~]#
Re: Spam through our server
Posted: Fri Mar 09, 2012 10:37 am
by mikeshinn
If I understand you corrrectly, the qscand user isnt the one logging in thats the user the mailservers antivirus system uses. So if you didnt change the passwords for the mailuser then they may still be logging in as that user.
As for blacklisting the IP, thats done via the kernels firewalling system. What are your firewall rules:
iptables -L -n
Re: Spam through our server
Posted: Sat Mar 10, 2012 12:04 am
by octet
Hi Michael,
Thanks for your reply.
According to the dumps in qmhandle he is logging in using
info@flamingoblinds.co.uk?!?! There is no such mailuser, it's just an alias to a different user and I have changed all the passwords for that domain.
iptables rules here (long list, .cn, .br and .mx blocked):
http://seology.com/iptables.txt
More maillog concerning
info@flamingoblinds.co.uk here:
http://seology.com/spamfb.txt
Re: Spam through our server
Posted: Sat Mar 10, 2012 11:04 am
by faris
I'm not seeing what I expect to see from you /usr/psa/var/log/maillog
Assuming this user is sending via smtp, there should be a "connect" entry and/or a "login" entry before any "from" entries. I'm not seeing either in your log extract.
Authenticated smtp logs can also be found in /var/log/secure depending on your config.
Is romani-online your server? If not, then the header might be faked. The whole thing may be generated by a php or perl script. I'm also baffled as to why the bad guy is using a real domain on your server as the "from" address. I've not seen this done before (though I'm not saying it doesn't happen -- just saying I've not seen it done personally). Normally they use any old address.