Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My server has been blocked by CBL for participating in curtwail spambot.

Initially we suspected that it was coming from a PC and not from the server, but the router is blocking all packets on 25 except those coming from the server.

I have just executed the tcpdump command and every 5 minutes I see a flurry of activity on port 25 that is very suspicious and I am sure that there is some process running on the server:

13:02:30.027436 IP exprod5og110.obsmtp.com.53803 > ubuntu.local.smtp: Flags [S], seq 171708781, win 5744, options [mss 1436,sackOK,TS val 3046699707 ecr 0,nop,wscale 2], length 0

I have stopped postfix, and yet there is still traffic on port 25 above.

But how can I find what process is actually communicating on port 25 as it only rund for a few seconds and so for example lsof -i :25 will never catch it.

I have been working on this now for 2 days, it is a live server and I cannot simply shut it down, any suggestion on how I can detect the source of this email bot process ?

share|improve this question
    
You've posted tcpdump data from incoming mail arriving at your server! –  Michael Hampton Oct 31 '13 at 4:49
    
Ahh, OK, but I am still sure that there is something running on the server that is sending emails.Is there any command that can listen and wait for activity on a port and then show the process id ? –  crankshaft Oct 31 '13 at 4:54
    
you should get someone who's familiar with such topics. really. –  that guy from over there Oct 31 '13 at 8:29

2 Answers 2

Maybe you should some tool like wireshark to analyse the traffic coming from the server? You should be able to identify unapproved traffic like Spam.

Follow this Guide: http://www.doitscared.com/738/holy-cow-batman-my-linux-server-got-hacked/ In addition to rkhunter and chkrootkit, check your server with tiger.

If this server is a productive system you rely on, you definitley got to be sure no bad guy can access the server anymore. If youre not sure the system is nice and clean again, you got to reinstall the system or grab a clean backup to be sure.

share|improve this answer

Usually, when postfix is not sending the spam, it's the webserver.

Therefore I'd use tcpdump to see if some spam is sent and then stop apache and check with tcpdump if some spam is still sent.

Now there is another point in question that I like : "How can I monitor which process uses port TCP number 12345? A kind of interactive lsof or netstat -ntp"

I think iftop can't do the trick.

This is IMHO the really interesting part in your question and you should ask it again as a standalone question, as it might be interesting a lot of readers.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.