up vote 0 down vote favorite
share [g+] share [fb]

Few months ago, my host reported spam going from one of the 3 ips on our server. The host null routed the ip and all was good. We didn't have anything hosted on that ip so it wasn't a big deal.

The host is going to remove the null route since it's not a permanent fix. However, I still haven't been able to figure out the source of the problem.

How can I identify the glitch allowing spam to go through and close it? The server is Debian and I can see sendmail processes.

Note that the ip is null routed so I cannot do any external scans on it for open port until the null route is removed. However, removing the null route also opens up potential for new spam.

You can see the spam reports here: http://www.projecthoneypot.org/ip_69.197.166.100

link|improve this question
Do you regularly patch the system? – cmorse Jan 5 at 6:42
its likely operating as an open relay, or its been compromised and is sending it itsself. - either way, removing sendmail and put something like postfix on it is always a good start, assuming it needs mail ability at all. – Sirex Jan 5 at 8:21
feedback

1 Answer

up vote 0 down vote

First you need to carefully check the logs of sendmail and see if anything is going on. If it looks fine and sendmail is NOT an open relay it's possible some other process are sending out email. It could be many things, such as a php script being abused (is it running apache?), or it could be a hijacked account and the attacker installed something like an irc server through which it controls the spamming (I've dealt with cleaning up exactly that kind of thing before).

Also check other logs for suspicious activity, see who logged in and from where. Is /var/log/auth.log full of failed log in attempts? (fail2ban is a useful tool to stop brute force password guessing).

If you can't find any obvious easy to fix causes then the best thing to do is to totally wipe the system and re-install the OS. It's quite possible that if your system was compromised in any way the attacker patched tools such as ps to avoid being caught.

Also carefully read this: http://www.debian.org/doc/manuals/securing-debian-howto/

Especially: http://www.debian.org/doc/manuals/securing-debian-howto/ch-after-compromise.en.html

It may be wise to try and find out how the compromise happened before wiping the system, or to replace the system and then do some forensics when a replacement is in operation.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.