Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Plesk 9.5 mail server (cm.snowbarre.co.za) on Ubuntu 8.04 LTS which forwards all SMTP traffic to an anti-spam server cacti.snowbarre.co.za. Many times I see the headers on the anti-spam server to contain from addresses not hosted on the mail server and I have checked and confirmed that my server is not an open relay server. How can a spammer be using my server to relay spam traffic? How can I stop this?

Open relay test:

paddington@paddington-MS-7387:~$ telnet cm 25

Trying 196.201.x.x...

Connected to cm.

Escape character is '^]'.

220 cm.snowbarre.co.za ESMTP Postfix (Ubuntu)

mail from:test@facebook.com

250 2.1.0 Ok

rcpt:paddington@yahoo.co.uk

221 2.7.0 Error: I can break rules, too. Goodbye.

Connection closed by foreign host.

paddington@paddington-MS-7387:~$ 

A typical headers is:

*Received    from cm.snowbarre.co.za (cm.snowbarre.co.za[196.201.x.x])  by cacti.snowbarre.co.za (Postfix) with ESMTPS id 00B601881AD;  Mon, 27 Aug 2012 14:03:29 +0200 (SAST)

Received     from cm.snowbarre.co.za (localhost [127.0.0.1])    by cm.snowbarre.co.za (Postfix) with ESMTP id 81627367E007; Mon, 27 Aug 2012 14:02:50 +0200 (SAST)

Received     from User (ml82.128.x.x.multilinksg.com [82.128.x.x])  by cm.snowbarre.co.za (Postfix) with ESMTP; Mon, 27 Aug 2012 14:02:49 +0200 (SAST)

Reply-To     <amsnkeuri@ymail.com>

From     "Ms Nkeuri Aguiyi"<admin@jogor.net>

Subject Your Unpaid Fund.

Date    Mon, 27 Aug 2012 05:03:22 -0700

MIME-Version    1.0
Content-Type    text/html;  charset="Windows-1251"
Content-Transfer-Encoding   7bit
X-Priority  3
X-MSMail-Priority   Normal
X-Mailer    Microsoft Outlook Express 6.00.2600.0000

X-MimeOLE   Produced By Microsoft MimeOLE V6.00.2600.0000

X-Antivirus avast! (VPS 120821-0, 08/21/2012), Outbound message

X-Antivirus-Status  Clean

Message-Id  <20120827120250.81627367E007@cm.snowbarre.co.za>

To  undisclosed-recipients:;*
share|improve this question
    
Your telnet conversation is not correct. Try using rcpt to: instead of rcpt and see what happens. –  drcelus Aug 31 '12 at 8:38
    
drcelus, most mailservers will accept the short form of the command, so mail: and rcpt:will give the same result as mail to:and rcpt to:. –  Jenny D Aug 31 '12 at 9:55
    
What I'm missing here is info about what the mailservers do. Are they only for incoming or for outgoing, or for both with limits on who can send where? What do the logs say for this message, in both servers? –  Jenny D Aug 31 '12 at 9:58
    
the CM server is for both incoming and out going mail (SMTP and POP), it forwards all SMTP traffic destined for a domain not residing on itself to our anti spam server (called Cacti) which relays it out. My issue is on my anti spam server I am seeing emails from CM that show headers of domains not hosted on CM. This is a big is worrying since this means someone is relaying spam via my CM server and it is serving domains it does not host. The CM server only servers SMTP for domains resident on it. –  Paddington Sep 15 '12 at 11:15
add comment

1 Answer 1

Just because there's a line in the headers which looks as if an SMTP request from ml82.128.x.x.multilinksg.com is being relayed - that's not necessarily the truth.

If you've got an open web proxy or someone has ssh access to your network then they could easily be relaying these emails from elsewhere - the only difference is that the emails are not entering your network via SMTP.

(this may not be the case here - but checking it should be at the top of your list).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.