Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This question already has an answer here:

last night i see many mail undelivery messages but i have not send any messages. I have only one site live on it.

is there any way to find out more details about it. i don't know where to start

these are reject logs from exim

2013-03-01 03:27:31 H=114-42-128-4.dynamic.hinet.net (125.214.75.163) [114.42.128.4]:4227 rejected MAIL <z2007tw@yahoo.com.tw>: Access denied - Invalid HELO name (See RFC2821 4.1.3)
2013-03-01 05:13:10 H=(gyrvpwe.com) [27.41.134.95]:4702 F=<gpgjouczsr@gmail.com> rejected RCPT <vqvgb8924@yahoo.com.tw>: Please turn on SMTP Authentication in your mail client, or login to the IMAP/POP3 server before sending your message.  (gyrvpwe.com) [27.41.134.95]:4702 is not permitted to relay through this server without authentication.
2013-03-01 09:37:20 courier_plain authenticator failed for localhost [127.0.0.1]:53728: 435 Unable to authenticate at present (set_id=__cpanel__service__auth__exim__DTGm12zHmcIhHGj1OI5GgfzrB5j7sk5UEyxNaYj7UqGFGstIMLklIjsIMYvPpAIt): failed to connect to socket /var/spool/authdaemon/socket: Connection refused inside "and{...}" condition

these were the few logs from

/var/log/messages

Mar  1 05:13:03 cpanel named[1442]: network unreachable resolving 'ns4.apnic.net/A/IN': 2001:dc0:4001:1:0:1836:0:140#53
Mar  1 05:13:04 cpanel named[1442]: network unreachable resolving 'tinnie.apnic.net/AAAA/IN': 2001:dc0:2001:0:4608::25#53
Mar  1 05:13:08 cpanel named[1442]: network unreachable resolving 'yahoo.com.tw/MX/IN': 2001:b000:168::1:c:10#53
Mar  1 05:57:45 cpanel named[1442]: network unreachable resolving 'colorado.edu/NS/IN': 2001:503:cc2c::2:36#53
Mar  1 06:15:02 cpanel named[1442]: network unreachable resolving 'httpupdate.cpanel.net/A/IN': 2001:503:a83e::2:30#53
Mar  1 06:15:02 cpanel named[1442]: network unreachable resolving 'httpupdate.cpanel.net/A/IN': 2001:503:231d::2:30#53
Mar  1 06:15:02 cpanel named[1442]: network unreachable resolving 'httpupdate.cpanel.net/A/IN': 2620:0:28a0:1528::3:1#53
Mar  1 06:27:51 cpanel named[1442]: network unreachable resolving 'akamai.com/NS/IN': 2600:1406:1b::64#53
Mar  1 07:28:03 cpanel named[1442]: network unreachable resolving 'mit.edu/NS/IN': 2001:503:cc2c::2:36#53
Mar  1 08:18:15 cpanel named[1442]: network unreachable resolving 'comcast.net/NS/IN': 2001:558:fe23:8:69:252:250:103#53
Mar  1 08:18:19 cpanel named[1442]: network unreachable resolving 'comcast.net/NS/IN': 2001:558:100a:5:68:87:68:244#53
Mar  1 08:18:19 cpanel named[1442]: network unreachable resolving 'comcast.net/NS/IN': 2001:558:100e:5:68:87:72:244#53
Mar  1 08:34:46 cpanel named[1442]: network unreachable resolving 'ns1.my.smartdns.net.au/A/IN': 2001:500:856e::6:34#53
Mar  1 08:34:47 cpanel named[1442]: network unreachable resolving 'hotmail.com/MX/IN': 2a01:111:2005::1:1#53
Mar  1 08:34:47 cpanel named[1442]: network unreachable resolving 'hotmail.com/MX/IN': 2a01:111:2006:6::1:1#53
Mar  1 08:34:47 cpanel named[1442]: network unreachable resolving 'clearfieldjeffersonredcross.org/MX/IN': 2001:500:f::1#53
Mar  1 08:34:47 cpanel named[1442]: network unreachable resolving 'clearfieldjeffersonredcross.org/MX/IN': 2001:500:b::1#53
Mar  1 08:34:47 cpanel named[1442]: network unreachable resolving 'msn.com/MX/IN': 2a01:111:2020::1:1#53
share|improve this question

marked as duplicate by Michael Hampton, kce, Hennes, mdpc, Khaled Mar 2 '13 at 7:56

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

    
to see your sendmail config <code>cat /etc/mail/sendmail.mc</code> –  tiberious726 Mar 1 '13 at 2:16
    
@tiberious726 - He said he's running exim. –  Evan Anderson Mar 1 '13 at 2:55

1 Answer 1

up vote 2 down vote accepted

It has the look that you're either an open SMTP relay or, more likely, you've got software running on the server that is trying to send spam. If I had to guess, I'd suspect that your machine has been compromised.

I'd say you're in for restoring from known-clean backups or rebuilding the machine from the ground up.

share|improve this answer
    
how can i check that i have open smtp relay –  user75380 Mar 1 '13 at 1:45
    
which log files , i can check to see what could have happened –  user75380 Mar 1 '13 at 1:53
1  
There's some discussion on Server Fault about detecting open relays: serverfault.com/questions/358695/… It sounds like you're above your level of expertise, though, and you'd probably better get some help from someone more experienced. Incident response, assuming you have been compromised, isn't something you can just be talked through. –  Evan Anderson Mar 1 '13 at 2:56

Not the answer you're looking for? Browse other questions tagged or ask your own question.