I have a mail server on x.x.x.x global IP. But it is blocked by SpamCop DNSbl spamcop dot net and CBL DNSbl cbl dot abuseat dot org .They inform that from my mail server lot of virus is generated. .Lan user using the 192.168.2.1 eth1 interface for communicate with the server. So please guide me what should I do now to protect my server to be a blacklisted mail server?Pls help,
I am sorry, but I don't think you will get a solution to your problem here, as it depends on just too many different possibilities.
Frankly, the biggest issue appears to be that you don't really understand that much about how the mail system works. Unfortunately, to solve this problem, you will have to understand at least some of the topics involved. Depending on how urgent this is, your best option might be to hire a consultant to help you setting up a secure system.
If the consultant is out of the question, you might get better answers here if you would describe your network layout much more detailed, including the software used, how the clients are configured to send mail etc.
Your first step: find the culprit. That means: try to find out which computer/server is using your SMTP to send spam/viruses (check your log files). If you see suspicious activity from an internal IP address, first disconnect that PC from the network and run your antivirus/antispyware and be sure you're able to clean the computer - this is not always an easy task.
It could also be possible that your actual mail server is not sending the emails, but that the infected PC is sending them. In that case you could allow only your mail server to use port 25 on outgoing connection until the problem is found.
It sounds like either:
Your mail server is acting as an "open relay". A mail server should only accept mail that is for a domain it is responsible for (ie., your domain), OR from an IP within your network. Allowing random IPs on the Internet to forward mail through your mail server, is going to cause problems.
You have another computer that shares the IP address (eg. you're behind NAT or a proxy) and it is sending spam.
You need to work out what exact problem you're facing, before knowing where to go.
If you have an internal mailserver: - Block tcp/25 (smtp) outgoing for everyone except the mailserver
If you use an external mailserver: - Block tcp/25 outgoing to everywhere except to your smtp server
This is a good practice and should be enforced on all networks.
I already solve my problem.
- Just install the tcpdump rpm from net
Run the command
tcpdump -i eth1|grep smtp
[My LAN part switch is connected on server’s eth1 Ethernet card.that’s why I have to check the eth1 for detect LAN spammer]
This command easily shows the infected pc. In my case the infacted pc was 192.168.2.4 From this pc more than 10 mail was send per second.Using this process you can easity detect the lan spammer and after that I request all the blacklist web site to remove my IP from blacklist. Then they check my IP and become sure it is not spamming anymore. Blacklist IP checker: http://www.anti-abuse.org/
Thanks again to all
Now you don't want to do that... If you block port 25 outgoing, you won't be able to send any emails which is usually the goal of a mail server.
What you actually should do is put some effort into securing your mail server with some sort of authentification whether based on IP (all of the computers in your local network) or username/password based.