For the past couple of days, at certain intervals, a huge load of email is dumped on my Exchange 2003 server and relayed out until it gets blacklisted everywhere.
Nothing like this happened for many years and I don't think the server is an open-relay. Online tests on the web say it's not, and the configurations are as follows:
- On the smtp properties window, access tab, relay button; "only the list below" is checked, the list is empty and "all computers that successfully authenticate" is checked.
- On the Authentication button, all three authentication options are enabled.
I need this server to relay messages from the internal network to the outside, but I also need it to relay messages from internal users on devices outside the network to the outside, and I also need external servers to send email to internal users, so I don't see how I can restrict those settings further.
I suspected that it was either an internal pc that got infected, or a user account that got compromised and is being used from the outside. I looked through the logs and it appears that the communication is coming from the outside, so I thought the later was true, however, I can't seem to identify the user that was used to authenticate from the logs, so that I can change their passwords.
I thought I enabled all relevant logging fields and this is what I got:
2013-06-15 07:10:54 184.108.40.206 User MyServerName 192.168.0.1 EHLO - +User 250 0 304 9 2250 - - 2013-06-15 07:10:55 220.127.116.11 User MyServerName 192.168.0.1 MAIL - +FROM:<firstname.lastname@example.org> 250 0 44 31 0 - - 2013-06-15 07:10:55 18.104.22.168 User MyServerName 192.168.0.1 RCPT - +TO:<email@example.com> 250 0 32 29 0 - - 2013-06-15 07:10:56 22.214.171.124 User MyServerName 192.168.0.1 DATA - <MyServerNameQFvW0000000b@mx.mydomain.com> 250 0 122 1452 797 - - 2013-06-15 07:10:56 126.96.36.199 User MyServerName 192.168.0.1 QUIT - User 240 5343 58 4 0 - -
The email in the from field is not an internal domain.
So, my primary question would be how to identify the culprit. A secondary question would be if I should be configuring relaying differently, so these problems wouldn't happen.