0

We have an up-to-date Centos 5.8 with Apache, Postfix and Dovecot installed and running without problem.

Someone or something keeps logging in to postfix/dovecot as the apache user and spamming @comcast.net email addresses. The log entries look like this:

Mar 13 13:33:34 postfix/smtpd[26456]: D05AE1A900BC: client=unknown[84.51.170.132], sasl_method=LOGIN, sasl_username=apache
Mar 13 13:33:35 postfix/cleanup[26460]: D05AE1A900BC: message-id=<[email protected]>
Mar 13 13:33:35 postfix/qmgr[2361]: D05AE1A900BC: from=<[email protected]>, size=3576, nrcpt=1 (queue active)
Mar 13 13:33:36 postfix/smtp[27125]: D05AE1A900BC: to=<[email protected]>, relay=mta5.am0.yahoodns.net[209.191.88.254]:25, delay=1.9, delays=0.38/0/0.64/0.85, dsn=2.0.0, status=sent (250 ok dirdel)
Mar 13 13:33:36 postfix/qmgr[2361]: D05AE1A900BC: removed

--snip--

Mar 13 16:18:13 postfix/smtpd[13861]: E50DE1A90037: client=unknown[72.54.180.241], sasl_method=LOGIN, sasl_username=apache
Mar 13 16:18:19 postfix/cleanup[13867]: E50DE1A90037: message-id=<[email protected]>
Mar 13 16:18:19 postfix/qmgr[2361]: E50DE1A90037: from=<[email protected]>, size=3779, nrcpt=25 (queue active)
Mar 13 16:18:20 postfix/smtp[13868]: E50DE1A90037: to=<[email protected]>, relay=none, delay=6.4, delays=6.4/0/0.02/0, dsn=5.4.4, status=bounced (Host or domain name not found. Name service error for name=comcast.con type=A: Host not found)
Mar 13 16:18:22 postfix/smtp[13869]: E50DE1A90037: to=<[email protected]>, relay=mx2.comcast.net[76.96.30.116]:25, delay=9, delays=6.4/0.01/1.1/1.5, dsn=5.1.1, status=bounced (host mx2.comcast.net[76.96.30.116] said: 550 5.1.1 Not our Customer (in reply to RCPT TO command))
Mar 13 16:18:23 postfix/smtp[13869]: E50DE1A90037: to=<[email protected]>, relay=mx2.comcast.net[76.96.30.116]:25, delay=9.9, delays=6.4/0.01/1.1/2.3, dsn=5.1.1, status=bounced (host mx2.comcast.net[76.96.30.116] said: 550 5.1.1 <[email protected]> Account not available (in reply to RCPT TO command))
--snip--
Mar 13 16:18:55 postfix/smtp[13869]: E50DE1A90037: to=<[email protected]>, relay=mx2.comcast.net[76.96.30.116]:25, delay=42, delays=6.4/0.01/1.1/35, dsn=2.0.0, status=sent (250 2.0.0 l4JL1i00l248zeQ0N4JMLQ mail accepted for delivery)
Mar 13 16:18:55 postfix/bounce[13870]: E50DE1A90037: sender non-delivery notification: A96601A900C9
Mar 13 16:18:55 postfix/qmgr[2361]: E50DE1A90037: removed

This has happened twice in recent times and the telltale sign that this is the same person/thing is responsible is that they send their first email to [email protected]. They are careful to only send a small number of emails in a batch of a few minutes, presumably to avoid detection and to ensure our server isn't blocked as a spam relay.

How is it possible to authenticate as apache and how can I stop this?

Thanks in advance for your help

1 Answer 1

1

Without more details it will be hard to track down for us. For example, you don't mention whether the mail server is running on the same machine as the webserver. Nor do you mention how you are authenticating clients with Postfix (we can see the SASL line there but to what authentication mechanism is this going to? PAM? A separate database? plain files?).

I would suggest that your machine is compromised in some way. By the looks of that log, someone may have altered the shadow file to allow login using the apache username (which is disabled by default unless you altered this). They are now logging in from different IP addresses and using postfix to send spam. Look in /etc/shadow at the apache line and see whether it has !! in the second column:

apache:!!:

Either this or your Postfix configuration is working as an open relay and the login is apache is actually failing but Postfix is accepting the mail regardless. The default Postfix configuration is to not work as a relay so this must have been enabled by you at some point.

You need to track down what might have happened and considering wiping the machine and restoring from known good backups (you do have backups don't you?).

The IP addresses you have there look like they're from compromised machines as one is a broadband provider and the other a cloud host (so probably a compromised webserver there).

6
  • Everything is running on the one box with Postfix authenticating against Dovecot.
    – wp232
    Mar 14, 2012 at 11:17
  • Oops Anyway I've been watching the logs since I built the server so I doubt there as been any malicious access and the iptables firewall is blocking SSH and FTP apart from our office IP. I don't think it is an open relay because our clients occasionally typo their passwords and can't send email. The /etc/shadow line looks like: apache::15237:0:99999:7:::
    – wp232
    Mar 14, 2012 at 11:20
  • That apache line means you have no password set for that username. Either you have done this or someone else has. I don't think this is the default so I think someone has altered it. The firewall won't protect you if someone has managed to exploit something with your SMTP or webserver (or the application code in your web server).
    – webtoe
    Mar 14, 2012 at 11:27
  • So can I just put !! into the shadow file to stop this?
    – wp232
    Mar 14, 2012 at 11:29
  • I've set the password to ! which has done the appropriate disabling of the username so thank you for highlighting that. The date on the password change was the day the server was commissioned so was it given to us like that or is there some way of changing the password without changing the date?
    – wp232
    Mar 14, 2012 at 11:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .