Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

From time to time, a 2003 server starts dumping huge amounts of email to the internet. When this happens, I stop the service and clear all the spam and put it back online, however, the damage is usually done in the form of listings on black lists.

I try to determine why this happens but so far, I've been unsuccessful. I don't think it's a open relay (confirmed with mxtoolbox's test), and looking at the server's configuration and its logs, I believe there's a compromised account that authenticates with the server and relays all that email outwards, however, the logs doesn't say which account was responsible for that.

My questions is, is there a way to further secure my server to avoid/minimize this problem while retaining the functionality I require? If not, is there a way to figure out which account is compromised?

Requirements:

  1. I need the server to send emails internally;
  2. I need it to accept emails from the internet and deliver them to internal users;
  3. I need it to accept emails from internal users (that might outside the internal network) and relay them to 3rd party internet domains.

SMTP configuration:

Access:

  • Anonymous access - enabled
  • Basic authentication - enabled
  • Integrated Windows Authentication - enabled

Relay:

  • Only the list below - enabled (list is empty)
  • Allow all computers which successfully authenticate... - enabled

Log sample of a spam connection

2013-11-05 09:49:55 192.168.1.1 User SMTPSVC1 MAILSERVER 192.168.1.2 0 EHLO - +User 250 0 301 9 2250 SMTP - - - -

2013-11-05 09:49:55 192.168.1.1 User SMTPSVC1 MAILSERVER 192.168.1.2 0 MAIL - +FROM:noreply@ubs.ch 250 0 39 26 0 SMTP - - - -

2013-11-05 09:49:55 192.168.1.1 User SMTPSVC1 MAILSERVER 192.168.1.2 0 RCPT - +TO:p.loser@msv-wiesen.ch 250 0 34 31 0 SMTP - - - -

2013-11-05 09:49:55 192.168.1.1 User SMTPSVC1 MAILSERVER 192.168.1.2 0 RCPT - +TO:p.loshal@t-online.org 250 0 34 31 0 SMTP - - - -

2013-11-05 09:49:56 192.168.1.1 User SMTPSVC1 MAILSERVER 192.168.1.2 0 RCPT - +TO:p.losio@bluewin.ch 250 0 31 28 0 SMTP - - - -

2013-11-05 09:49:56 192.168.1.1 User SMTPSVC1 MAILSERVER 192.168.1.2 0 RCPT - +TO:p.loskum@apache.tv 250 0 31 28 0 SMTP - - - -

2013-11-05 09:49:56 192.168.1.1 User SMTPSVC1 MAILSERVER 192.168.1.2 0 RCPT - +TO:p.lottenbach@bluewin.ch 250 0 36 33 0 SMTP - - - -

2013-11-05 09:49:56 192.168.1.1 User SMTPSVC1 MAILSERVER 192.168.1.2 0 DATA - MAILSERVERPefL0000032b@smtp.myinternetdomain.com (changed, this is my domain) 250 0 122 884 547 SMTP - - - -

2013-11-05 09:49:57 192.168.1.1 User SMTPSVC1 MAILSERVER 192.168.1.2 0 QUIT - User 240 4844 58 4 0 SMTP - - - -

share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.