2

We have a number of hosted clients on one of our servers.

One client in particular, which has four active mailboxes is repeatedly getting just one (and always the same one) mailbox infected so that hundreds of spam messages are being sent from the mailbox. This causes the IP address we route mail via on this server to get blacklisted and then we have to set up a new IP address for mail again.

We've carried out extensive investigation into this numerous times now and it is definitely something locally at the client's end that is getting attacked/hacked. Changing the password for the mailbox instantly resolves the problem which is also indicative of this.

Only problem is, this keeps happening - a month after the password has been changed, issue happens again.

Without real time mail log monitoring or similar, I'm unsure of a method that we can really identify this happening before it's too late.

Can anyone suggest something for CentOS that will detect and block outgoing spam before it gets out of hand - or any other solutions for that matter?

Thanks in advance.

3
  • 1
    If they're a hosted client, I'd think about dropping them. It's obvious something is going on and there should be something against spam abuse in your policies.
    – Nathan C
    Jul 16, 2013 at 13:38
  • They aren't sending spam intentionally might I add, but they clearly have local security based issues on this one system potentially which is causing the same mailbox to be brute forced or something similar. Either way, dropping them as a hosted client is becoming a likely step despite suggestions and recommendations to migrate their mail over to Google Apps.
    – zigojacko
    Jul 16, 2013 at 15:21
  • Right. Also, depending on your mail server there may be a way to throttle outbound emails. Not sure though.
    – Nathan C
    Jul 16, 2013 at 15:25

4 Answers 4

0

I don't know exactly how it works, but may be Parallels Premium Outbound Antispam can help you?

http://download1.parallels.com/Plesk/PP11/11.0/Doc/en-US/online/plesk-administrator-guide/index.htm?fileName=71441.htm

2

As discussed in the comments, you have a couple options:

1) Figure out a way to throttle outbound emails with your mail server,

2) Fire the client. :-)

1
  • 3
    I am a fan of option 2. Your terms of use for your mail service should CLEARLY AND EXPLICITLY FORBID the sending of unsolicited commercial email (UCE, or as we affectionally call it in the industry "f@#!ing SPAM!"). By not fixing their problem your client is violating said terms of use, and is therefore no longer entitled to the privilege of using your servers to send mail.
    – voretaq7
    Jul 16, 2013 at 15:46
1

I'm using Policyd but only to limit number of emails per sender IP and SASL username (30-50 emails per hour is more than enough for normal usage)

0

You could try to use Postfix session count and request rate control daemon http://www.postfix.org/anvil.8.html or use some additional policy server - http://postfwd.org

## Usage of rate and size
# The following temporary rejects requests from "unknown" clients, if they
# 1. exceeded 30 requests per hour or
# 2. tried to send more than 1.5mb within 10 minutes
   id=RATE01 ;  client_name==unknown ;  protocol_state==RCPT
      action=rate(client_address/30/3600/450 4.7.1 sorry, max 30 requests per hour)
   id=SIZE01 ;  client_name==unknown ;  protocol_state==END-OF-MESSAGE
      action=size(client_address/1572864/600/450 4.7.1 sorry, max 1.5mb per 10 minutes)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .