I'm running Server 2003. Exchange 2007.
I've got something on the system sending out tons of spam, and now mostly blocked from the outside world. (We can receive, but not send because we're on spamlists.)
This is a server I have zero experience with, with no maintenance records or anyone to ask for help. I'm going in blind.
Before I go into details, the absolute key here is:
- Exchange is sending out spam using our domain name, but randomly generated user names.
From what I understand, the possible vectors for spam are:
Server itself with a virus.
Infected network computer.
External computer abusing NDR (backscatter), or an Open Relay.
The server issues:
There WAS a horrific password policy. I won't say what it is, but almost all of the accounts use one of the worst passwords imaginable, and others use one good password but many share it.
There was a Zero Access rootkit detected by Anti-Malware bytes. I also ran TDSSkiller afterward, and detects no instances anymore. However, it's possible that it's still in an alternate filestream. But that's a separate issue.
Many windows updates/security updates are failing to install.
It's running RRAS with no firewall on a DMZ of a router. I can't enable it yet until I get a list of services that should be running.
The spam issues:
Exchange was throwing out backscatter/NDR spam and I fixed that with some transport rules. I have "if e-mail is FROM outside and TO outside, silently drop it." as well as "if e-mail is TO outside and subject contains 'Undeliverable:', silently drop".
I tried following various guides to "disable open relay" but many of them say to remove "accept-all-recipients" permission for NT AUTHORITY\Anonymous account across all connectors. HOWEVER, this causes all incoming mail to fail. Is this normal? It seems like this should only disable using wildcard/randomly-generated usernames.
A specific user was compromised and sending spam. I disabled his mailbox. Those don't show up anymore. (Let's call him Dave@domain.com)
What remains are tons of random users that DO NOT exist on the Active Directory. (email@example.com, firstname.lastname@example.org, email@example.com... hundreds a minute)
I have turned on net logon logging. (Dave@domain.com is spamming to get in and failing. There ARE a couple other users trying to log in but it's not obvious if they're compromised or just normal activity.)
So what I need to do is:
Find out: What is the proper way to ensure you're not an open relay, while still allowing incoming mail?
Find out if I can restrict sending e-mails ONLY from valid AD user addresses (and/or hardcoded ones for other custom services/programs we run.)
Even further, restrict only sending e-mail from your AD name (that is, firstname.lastname@example.org cannot send from email@example.com.)
Find out how to track down what is telling Exchange to send these e-mails. Is there a way to track down who is sending them?
For example, in the Message Queue (which has ~180,000 messages waiting due to other people spam blocking us for only two days of saved e-mails) shows this e-mail:
Subject: Current Open Position
Internet Message ID: <0CDA6CACCF886A682B2C6E3DDAB080C1@xizyrafo>
From Address: firstname.lastname@example.org
Size (KB): 2
Message Source Name: SMTP:Client SERVERNAME
Source IP: 184.108.40.206
Date Received: 1/23/2016 2:57:20 PM
Expiration Time: 1/25/2016 2:57:20 PM
Queue ID: servername\368722
Is there a way to use this information to track down where it's coming from / who is causing it to be sent?
I've tried to figure out what Source IP means (whether it's the send-to IP or the IP of the request sender) but nothing I've read actually explains it.