Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Currently it appears that somehow someone is using my server to send spam as I'm seeing 100's of rejection emails from other email services (such as gmail) saying the message could not be delivered "return to sender" and sent to mydomain.com.

Upon investigation these email are coming via RELAY from a remote IP and not actually from the server itself (e.g. a virus etc...)

Is there anything I can do to prevent someone using my mail server (exim) for relay?

I have LFD on my server that monitors emails sent by relay and it's sending me the below alert. I have LFD set to block the sender if more than 200 come from that address.

Example LFD alert:

Subject: lfd on tent.myotherdomain.com: RELAY Alert for 187.23.175.140 (BR/Brazil/bb17af8c.virtua.com.br)
To: root@myotherdomain.com

Time:  Wed Dec  5 14:25:46 2012 +0000
Type:  RELAY, Remote IP - 187.23.175.140 (BR/Brazil/bb17af8c.virtua.com.br)
Count: 203 emails relayed
Blocked: Temporary Block

Sample of the first 10 emails:
2012-12-05 14:08:44 1TgFeV-0006I1-7b <= tenf@mydomain.com H=(Smkt) [187.23.175.140] P=esmtp S=339 T="smtp.mydomain.com:25" from <tenf@mydomain.com> for teste_pop3@hotmail.com
2012-12-05 14:08:44 1TgFeV-0006I2-Kn <= zbcvyj@mydomain.com H=(Smkt) [187.23.175.140] P=esmtp S=343 T="mail.mydomain.com:25" from <zbcvyj@mydomain.com> for teste_pop3@hotmail.com
2012-12-05 14:08:46 1TgFeX-0006I1-DR <= uwvdfg0s@mydomain.com H=(Smkt) [187.23.175.140] P=esmtp S=351 T="smtp.mydomain.com:25" from <uwvdfg0s@mydomain.com> for teste1.pop3@yahoo.com.br
2012-12-05 14:08:46 1TgFeX-0006I2-Lo <= qstxd1@mydomain.com H=(Smkt) [187.23.175.140] P=esmtp S=347 T="mail.mydomain.com:25" from <qstxd1@mydomain.com> for teste1.pop3@yahoo.com.br
etc...

Example message being sent out: (appearing sent from my personal domain)

Return-path: <hhfart6p@mydomain.com>
Received: from [187.23.175.140] (helo=Smkt)
        by tent.myotherdomain.com with esmtp (Exim 4.72)
        (envelope-from <hhfart6p@mydomain.com>)
        id 1TgFut-0006k5-1K; Wed, 05 Dec 2012 14:25:40 +0000
From: "TV Digital no PC" <hhfart6p@mydomain.com>
Subject: CANAIS ADULTOS em HD, FILMES, FUTEBOL
To: matoselias@terra.com.br
Content-Type: text/plain
Reply-To: fabiana_dietrich1001@yahoo.com.br
Date: Wed, 5 Dec 2012 12:25:36 -0200

Olá!

Já imaginou assistir em seu computador, notebook, tablet, etc... a inúmeros canais de televisão, inclusive os fechados?

Isso tudo usando apenas a Internet? E o melhor: Sem pagar assinatura Mensal!!!

Algumas vantagens:

- Com conexão banda larga, você pode assistir de qualquer computador;

- Não precisa instalar nenhum programa;

- Você assiste a canais de TV e Rádio do mundo todo;

- Filmes, Séries, Esportes, Jogos de Futebol que só passam na TV fechada, e muito mais!

Example reject being sent back: (to my personal domain)

---------- Forwarded message ----------
From: Mail Delivery System 
Date: Wednesday, December 5, 2012
Subject: Mail delivery failed: returning message to sender
To: hhfart6p@mydomain.com


This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

  someone@gmail.com
    SMTP error from remote mail server after end of data:
    host gmail-smtp-in.l.google.com [173.194.67.26]:
    550-5.7.1 [78.129.132.155       7] Our system has detected that this message is
    550-5.7.1 likely unsolicited mail. To reduce the amount of spam sent to Gmail,
    550-5.7.1 this message has been blocked. Please visit
    550-5.7.1 http://support.google.com/mail/bin/answer.py?hl=en&answer=188131 for
    550 5.7.1 more information. d60si3060066wej.11
  someoneelse@gmail.com
    SMTP error from remote mail server after end of data:
    host gmail-smtp-in.l.google.com [173.194.67.26]:
    550-5.7.1 [78.129.132.155       7] Our system has detected that this message is
    550-5.7.1 likely unsolicited mail. To reduce the amount of spam sent to Gmail,
    550-5.7.1 this message has been blocked. Please visit
    550-5.7.1 http://support.google.com/mail/bin/answer.py?hl=en&answer=188131 for
    550 5.7.1 more information. d60si3060066wej.11

--

Exim Conf

addresslist whitelist_senders = lsearch;/etc/virtual/whitelist_senders
addresslist blacklist_senders = lsearch;/etc/virtual/blacklist_senders
domainlist blacklist_domains = lsearch;/etc/virtual/blacklist_domains
domainlist whitelist_domains = lsearch;/etc/virtual/whitelist_domains
domainlist local_domains = lsearch;/etc/virtual/domains
domainlist relay_domains = lsearch;/etc/virtual/domains : localhost
domainlist use_rbl_domains = lsearch;/etc/virtual/use_rbl_domains
hostlist auth_relay_hosts = *
hostlist bad_sender_hosts = lsearch;/etc/virtual/bad_sender_hosts
hostlist bad_sender_hosts_ip = net-lsearch;/etc/virtual/bad_sender_hosts
hostlist relay_hosts = net-lsearch;/etc/virtual/pophosts
hostlist whitelist_hosts = lsearch;/etc/virtual/whitelist_hosts
hostlist whitelist_hosts_ip = net-lsearch;/etc/virtual/whitelist_hosts
share|improve this question

1 Answer 1

Please open your Exim configuration file (most likely it's /etc/exim/exim.conf) and look for the following directive:

hostlist relay_from_hosts = 127.0.0.1

It should be set to 127.0.0.1 to prevent your mail server from relaying emails from other hosts. Maybe, you have an external IP address there.

share|improve this answer
    
I've added the relevant exim.conf above, what needs changing? –  Pez Cuckow Dec 5 '12 at 15:18
    
Then I would check this file: /etc/virtual/pophosts In general it should contain list of the hosts allowed to relay. In most cases there should be only localhost. –  Andrew Dec 7 '12 at 12:40
    
This file is currently blank –  Pez Cuckow Dec 7 '12 at 12:43
    
I have a feeling like you use cPanel. If so, please open "Tweak Settings" and try setting "Initial default/catch-all forwarder" to "Fail". This should hep. –  Andrew Dec 7 '12 at 14:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.