up vote -2 down vote favorite
share [g+] share [fb]

I have a mail server on x.x.x.x global IP. But it is blocked by SpamCop DNSbl spamcop dot net and CBL DNSbl cbl dot abuseat dot org .They inform that from my mail server lot of virus is generated. .Lan user using the 192.168.2.1 eth1 interface for communicate with the server. So please guide me what should I do now to protect my server to be a blacklisted mail server?Pls help,

link|improve this question
1  
please edit the question and add more details, like: what operating system/software is running on the mail server? Does the mail server have its own external IP or are other hosts NATed to the same IP (own IP for mail server will reduce the odds that you get onto a blacklist for another system behaving badly)? Is the mail server only for sending mails out (who may send mails to the mail server?), or also as a MX for receiving mails? – mihi Jun 21 '09 at 13:35
I already solve my problem .pls see my ans below – riad Jun 28 '09 at 11:18
feedback

6 Answers

up vote 7 down vote

I am sorry, but I don't think you will get a solution to your problem here, as it depends on just too many different possibilities.

Frankly, the biggest issue appears to be that you don't really understand that much about how the mail system works. Unfortunately, to solve this problem, you will have to understand at least some of the topics involved. Depending on how urgent this is, your best option might be to hire a consultant to help you setting up a secure system.

If the consultant is out of the question, you might get better answers here if you would describe your network layout much more detailed, including the software used, how the clients are configured to send mail etc.

link|improve this answer
i know about my lack.That's why i am asking over net.If i am a expert, hope then no need to ask question.Also your second solution is known by everybody [call an expert].I think its not a great solution to hire and hire.If every time need to call experts is a solution then why people ask or share knowledge each other? – riad Jun 21 '09 at 11:18
2  
Sometimes, "call an expert" is the only route to go, if time is important. Also, in your question, you tell nothing that could help us to help you (as I suggested in my last paragraph). Without this information, we could either write endless tractats covering all possible problems or make random shots. I tried to write something helpful, but the tree of options to cover kept growing as I wrote with every sentence. – SvenW Jun 21 '09 at 12:22
2  
riad, it isn't that people are unwelcome here unless they are "experts" but rather that a level of knowledge and experience is required to do some things, and sometimes a solution requires having that level and using that plus a knowledge of your business requirements to make an informed decision - as opposed to just following a "cookbook" solution. If you go into hospital for an operation you want the person doing it to be a surgeon rather than a first year medical student, and that isn't going to change no matter how clear the instructions the medical student is following. – DJ Pon3 Jun 21 '09 at 15:03
feedback
up vote 4 down vote

Your first step: find the culprit. That means: try to find out which computer/server is using your SMTP to send spam/viruses (check your log files). If you see suspicious activity from an internal IP address, first disconnect that PC from the network and run your antivirus/antispyware and be sure you're able to clean the computer - this is not always an easy task.

It could also be possible that your actual mail server is not sending the emails, but that the infected PC is sending them. In that case you could allow only your mail server to use port 25 on outgoing connection until the problem is found.

link|improve this answer
i have almost more than 100 Lan pc.So, its very difficult to find the culprit. Is their any other way to detect the pc?also i check the mail log on /var/log/maillog but no such suspect was detected.I use the /etc/host.allow file for only use the lan pc to mail the outside.How i bound the mail server only to use the port 25?using iptables? if yes pls guide me... – riad Jun 21 '09 at 11:09
1  
I would block port 25 for all client computers. google.com/search?hl=en&q=iptables+block+outgoing+port+25 – splattne♦ Jun 21 '09 at 11:18
feedback
up vote 3 down vote

It sounds like either:

  • Your mail server is acting as an "open relay". A mail server should only accept mail that is for a domain it is responsible for (ie., your domain), OR from an IP within your network. Allowing random IPs on the Internet to forward mail through your mail server, is going to cause problems.

  • You have another computer that shares the IP address (eg. you're behind NAT or a proxy) and it is sending spam.

You need to work out what exact problem you're facing, before knowing where to go.

link|improve this answer
feedback
up vote 2 down vote

I already solve my problem.

  1. Just install the tcpdump rpm from net

  2. Run the command

    tcpdump -i eth1|grep smtp

[My LAN part switch is connected on server’s eth1 Ethernet card.that’s why I have to check the eth1 for detect LAN spammer]

This command easily shows the infected pc. In my case the infacted pc was 192.168.2.4 From this pc more than 10 mail was send per second.Using this process you can easity detect the lan spammer and after that I request all the blacklist web site to remove my IP from blacklist. Then they check my IP and become sure it is not spamming anymore. Blacklist IP checker: http://www.anti-abuse.org/

Thanks again to all

link|improve this answer
feedback
up vote 2 down vote

If you have an internal mailserver: - Block tcp/25 (smtp) outgoing for everyone except the mailserver

If you use an external mailserver: - Block tcp/25 outgoing to everywhere except to your smtp server

This is a good practice and should be enforced on all networks.

link|improve this answer
feedback
up vote 0 down vote

Now you don't want to do that... If you block port 25 outgoing, you won't be able to send any emails which is usually the goal of a mail server.

What you actually should do is put some effort into securing your mail server with some sort of authentification whether based on IP (all of the computers in your local network) or username/password based.

link|improve this answer
could u pls guide me exactly what should i do now ? We can block the port 25 and give access to particular user...how i can do that?waiting for your responce... – riad Jun 21 '09 at 9:54
Depends on the MTA/MDA you are using... For postfix, you can enable SASL authentification and disable access to anyone who is not authentified. – Antoine Benkemoun Jun 21 '09 at 12:38
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.