5

I have a Linux box acting as Virtual Host for domain hosting. It runs CentOS and Parallels Plesk 9.x. Regardless of the following, the SPAM keeps flowing in at 1-3 / second.

An explanation of the problem

The xinetd service listens for SMTP connections and forwards to qmail-smtpd. The qmail service only process the queue, but does not control messages coming into the queue... that's why stopping it has no effect. If you stop xinetd AND qmail, then kill any open qmail-smtpd processes, all mail flow comes to a stop SOMETIMES.

Problem is, qmail-smtpd is not smart enough to check for valid mailboxes on the localhost before accepting the mail. So, it accepts bad mail with a forged replyto address which gets processed in the queue by qmail. Qmail cannot deliver locally and bounces to the forged replyto address.

We believe the fix is to patch the qmail-smtpd process to give it the intelligence to check for the existence of local mailboxes BEFORE accepting the message. The problem is when we try to compile the chkuser patch we run into failures due to the Plesk Control Panel.

Is anyone aware of something we could do differently or better?

Other things that have NOT worked thus far:

  • Turning off any and all mail processes (to check as an indicator that an individual account has been compromised. This has been verified as NOT the case.)

  • Turning off mail AND http server processes (in the case of a compromised formmail)

  • Running Exim in lieu of qmail (easy/quick install, but xinetd forces exim to close and restarts qmail on its own)

  • Turned on SPF protection via Plesk GUI. Does not help.

  • Turned on Greylisting via Plesk GUI. Does not help.

  • Disabled Bounce notifications via command line

Things which MIGHT work but have complications:

  • Use Postfix instead of qmail (No knowledge of Postfix and don't want to bother with it unless anyone knows it has potential to handle backscatter WELL before investing time)

  • As mentioned above, compiling a chkusr patch, we believe will STOP this problem, along with qmail (because of Plesk in the mix, the compile fails every time and Parallels Plesk support is unresponsive unless I cough up money)

If I don't clear out the SPAM from the outgoing mail queue nightly, then it clogs up with millions of SPAMs and will bring down the OUTGOING email services.

2
  • 2
    Postfix does this correctly out of the box, for what it's worth.
    – Bill Weiss
    Feb 23, 2010 at 20:37
  • There is no such thing as too much detail!
    – MDMarra
    Apr 19, 2010 at 18:43

6 Answers 6

3

You can replace the stock qmail-smtpd with qpsmtpd. Then you can use the plugin check_badrcptto to validate recipient address and reject emails if it is not valid.

1

Check out this useful patch as well:

http://qmail.jms1.net/patches/validrcptto.cdb.shtml

Uses a cdb file to list valid recipients. Might be a good alternative to using qpsmtpd.

1

As a long time qmail admin, I chose to use this 'realrcpto' patch (http://code.dogmap.org./qmail/#realrcptto) because it best integrated with my users' existing dot-qmail files and didn't require any maintenance of other configuration files or databases.

(If only the anti-spam server we now use in front of qmail could do RCPT verification via SMTP... Sigh!)

1

i got this reply from UCE Protect:

Our customer support team personnel has replied to your support request #340135

I don't believe QMAIL is capable of doing this, but if you can code in C then it shouldn't be a big deal to hardcode a quick and dirty 1 liner inside that part that does the DNSBL Handling and compile it afterwards:

  1. You must find the Variables that contains the Envelope from (We name it $MF in our example) 2. You must find the Variable that reads DNSBL-Names from your config (We name it $DNSN in our example) 3. You must find the loop inside the programm that cycles thru the configured DNSBLS (We assume no match as NEXT-LIST in our example)

Now insert a line like following BEFORE the regular DNSBL CHECK line in that section that kicks ips.backscatterer out the test if Mail from is NOT NULL SENDER:

If {$DNSN == "ips.backscatterer.org" && $MF != "<>") then NEXT-LIST

That should lead to ips.backscatterer.org Not being asked as long as MAIL FROM is not empty.

Possibly there is a better trick available in Qmail but I really don't know.

--

We hope this response has sufficiently answered your questions. If not, please do not send another email. Instead, reply to this email.

--

Tech Director UCEPROTECT-Network http://www.uceprotect.net

0

I don't know if it's still the case, but checking for valid rcpt to allows someone to probe your network for valid addresses. Accepting the message and then bouncing it requires a little extra effort on the spammers part. In your case with the bad reply-to headers, you're stuck holding the bag.

I am not familiar with Plesk, but the standard qmail configuration using tcpserver instead of xinetd allows you insert rblsmtpd before qmail-smtpd. You can then point rblsmtpd at one of the blacklisting services and this should reduce the amount of spam you're accepting.

With a little more effort you can take the spam that continues to arrive, parse out the IP addresses of the sending server and create your own blacklist with rbldns. This helped reduce the amount of spam we were accepting but did not eliminate it completely.

Another useful patch checks the mail from domain to make sure it's valid, but this requires a DNS lookup and it's best to run a local DNS cache.

Fighting spam is a pain! Good Luck!

0

Check out the valid user check function of Open Source edition Magic Mail http://www.linuxmagic.com/opensource/magicmail/magic-smtpd/magic-smtpd-0.8.4-2.tar.gz

I use it along with SpamDyke to drop more than 95% of mails that hit the server. server_args = -Rt0 /var/qmail/bin/spamdyke --config-file /etc/spamdyke.conf /var/qmail/bin/relaylock /var/qmail/bin/magic_mail

Valid user check can be implemented by an external script. I use a bash script that checks /var/qmail/users/assign if a mail ID exists.

Magic mail is a binary and not a script like qpsmtpd and thus not susceptible to load spikes on a high traffic server.

Hope this helps.

[EDIT]

Today I found that Plesk from Version 7.5 onwards natively supports SMTP connection level valid user checking. The smtp plugin is located in /var/qmail/plugins/chkrcptto. For this to work, you only need to set the mails to non-existent user to be rejected at each domain's mail settings.

If spam is coming into just one or two domains, talk to your client and make sure that the setting is enabled. The domain name thus included should be listed in /var/qmail/control/rejectnonexist.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .