Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

From time to time, a 2003 server starts dumping huge amounts of email to the internet. When this happens, I stop the service and clear all the spam and put it back online, however, the damage is usually done in the form of listings on black lists.

I try to determine why this happens but so far, I've been unsuccessful. I don't think it's a open relay (confirmed with mxtoolbox's test), and looking at the server's configuration and its logs, I believe there's a compromised account that authenticates with the server and relays all that email outwards, however, the logs doesn't say which account was responsible for that.

My questions is, is there a way to further secure my server to avoid/minimize this problem while retaining the functionality I require? If not, is there a way to figure out which account is compromised?

Requirements:

  1. I need the server to send emails internally;
  2. I need it to accept emails from the internet and deliver them to internal users;
  3. I need it to accept emails from internal users (that might outside the internal network) and relay them to 3rd party internet domains.

SMTP configuration:

Access:

  • Anonymous access - enabled
  • Basic authentication - enabled
  • Integrated Windows Authentication - enabled

Relay:

  • Only the list below - enabled (list is empty)
  • Allow all computers which successfully authenticate... - enabled

Log sample of a spam connection

2013-11-05 09:49:55 192.168.1.1 User SMTPSVC1 MAILSERVER 192.168.1.2 0 EHLO - +User 250 0 301 9 2250 SMTP - - - -

2013-11-05 09:49:55 192.168.1.1 User SMTPSVC1 MAILSERVER 192.168.1.2 0 MAIL - +FROM:noreply@ubs.ch 250 0 39 26 0 SMTP - - - -

2013-11-05 09:49:55 192.168.1.1 User SMTPSVC1 MAILSERVER 192.168.1.2 0 RCPT - +TO:p.loser@msv-wiesen.ch 250 0 34 31 0 SMTP - - - -

2013-11-05 09:49:55 192.168.1.1 User SMTPSVC1 MAILSERVER 192.168.1.2 0 RCPT - +TO:p.loshal@t-online.org 250 0 34 31 0 SMTP - - - -

2013-11-05 09:49:56 192.168.1.1 User SMTPSVC1 MAILSERVER 192.168.1.2 0 RCPT - +TO:p.losio@bluewin.ch 250 0 31 28 0 SMTP - - - -

2013-11-05 09:49:56 192.168.1.1 User SMTPSVC1 MAILSERVER 192.168.1.2 0 RCPT - +TO:p.loskum@apache.tv 250 0 31 28 0 SMTP - - - -

2013-11-05 09:49:56 192.168.1.1 User SMTPSVC1 MAILSERVER 192.168.1.2 0 RCPT - +TO:p.lottenbach@bluewin.ch 250 0 36 33 0 SMTP - - - -

2013-11-05 09:49:56 192.168.1.1 User SMTPSVC1 MAILSERVER 192.168.1.2 0 DATA - MAILSERVERPefL0000032b@smtp.myinternetdomain.com (changed, this is my domain) 250 0 122 884 547 SMTP - - - -

2013-11-05 09:49:57 192.168.1.1 User SMTPSVC1 MAILSERVER 192.168.1.2 0 QUIT - User 240 4844 58 4 0 SMTP - - - -

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.