Email Panick

Hey all, forgive me - I only searched for a moment for info but I am in a bit of a panick. My mail server which was located to a backup while my cluster was rebuilt failed today. I looked at the BAD message folders and outgoing gueues to find them full, the sever drive had 8kb. Well I then said F. Me and notices they were spam messages from [email protected]. I deleted all bad messages and deleted the postmaster account. The outgoing bad messages pretty much stopped. I looked at the open relay database and didn't find myself there, but spamcop says I have been spamming for 9 days. F. Me again. Now I am trying to determine the cause, sever break or some client on my network that is either intentionally spamming or got a bug. I know I can run Spybot on every machined but I was hopeing for some insight since I am panicking an perhaps we could learn from my mistakes? Thanks all peace.

Road old chap..... The customary OS, mailserver etc. etc. would help an awful lot.... ;)

Oh.... and how's your logging????

perhaps relaying is enabled?

LOL sorry, Exchange 2000 on Windows server 2k. All security patches antivirus firwall router safguards in place and patched. The server isn't relaying in the normal sense, still trying to determine cause but everytime I enable SMTP the thing chugs away. Logs don't show any 1706 1707 or 1708 type entries that would indicate a user account that has been compromised. If I watch the connections no one connects for very long. The email leaving was significantly reduced when I removed the option to allow authenticated relays but like I said this thing start burping out viagra adds when SMTP is on. Still working it and less panic's now. POS. :)

Greetings:

I agree with the others, in that you shouldn't be looking at the client-side (aka spambot and the like), but rather the server side.

Your server shouldn't be allowing this type of activity, regardless of what client-end apps are trying to get it to do.

Make sure that you have relaying turned off. Also, most mail server applications also can be configured to limit the total number of inbound/outbound e-mails sent/received by any individual account. This way, even if the client is using authentication to send out-bound e-mails in gross excess, your server will eventually stop the problem and flag you before it gets out of hand.

More specifics on your architecture would be helpful if you're interested in more specific answers.

softcomplex.com IP 216.117.134.103 connected for 256 seconds now? Ring a bell with anyone? The web page says IT consulting firm.

Thanks for the info JP, I am trying to work on it and juggle a few things at the same time. I "think" someone busted an exchange user account. I have active directory so the windows user acount authentication is the same for exchange. At least that's my working theory after examining everything. I have advanced my logging to determine who it is. Sorry if I am not pasting much. I am working with a friend on the phone.

I am burnt, fixed and cleaned. I had and authenticated relay so I got had by some poor password maintenance. It looks like the spammer authenticated my local box admin account with a bot. How you ask? Got me didn't know that could be possible through telnet? I now see some lacking in Exchange knowledge that I must fix. I had log entries of //MachineName/Administrator popping up the 1708 id. The cleanup was ugly I am tired so I'll talk more on it tomorrow if anyone want too. You can all beat me with the AO stick of justice.

Road Closed - Glad you sorted it - Do you know who the spammer was?

Note to less experienced members:

This just goes to demonstrate that even the senior members who have more knowledge than most don't know everything!

Keep learning folks

Steve

Quote:

---

This just goes to demonstrate that even the senior members who have more knowledge than most don't know everything!

---

Thank you Dr Zoidberg! *eats some trash. AO is nice for that because when someone writes a tutorial, it can't just be **** or nobody will read it. It gets looked over and reviewed by other people who know their stuff.

-Cheers-

Quote:

---

Originally posted here by RoadClosed
I am burnt, fixed and cleaned. I had and authenticated relay so I got had by some poor password maintenance. It looks like the spammer authenticated my local box admin account with a bot. How you ask? Got me didn't know that could be possible through telnet? I now see some lacking in Exchange knowledge that I must fix. I had log entries of //MachineName/Administrator popping up the 1708 id. The cleanup was ugly I am tired so I'll talk more on it tomorrow if anyone want too. You can all beat me with the AO stick of justice.

---

Hey Road - I try to mitigate the risk to the admin account by changing the admin account name to something cryptic, and I also give the account a very complex password. Now that the default name for the admin account is no longer valid, all telnet attempts to the "administrator" account will fail. I also have my IDS systems sniff failed FTP logon attempts, which helps me to resolve/trace telnet attacks against the admin aco****.

The view of "an ounce of prevention is worth a pound of cure."

Not trying to be preachy Road. I learned the hard way once also. Grrr!

Yawn. Sorry for the bad grammer, I re-read my last post and thought, WTF?

First thing, I didn't know it was possible to use a local account to athenticate exchange from port 25, over sight? I am no exchange guru for sure. I followed Microsofts lock down check list for Exchange relaying after the box was built by another person. In there checklist the default setting is to allow authenticated relay when ANY user successfully authenticates. Complacent oversight Number 1. Here is the line (ms site down, post link later), now anyone paying attention would ask... why is that especially since this is the only server for the organization. :rolleyes:

I have exceedingly difficult passwords on local admin accounts, except this one. Since I didn't build it, I took the baseline config sheet given to me and filed it. Oversight Number 2. I am not blaming the tech who built it, but my complacent trust enabled a bot to send a few million viagra adds. Talk about pissed off.
A few days ago I noticed and increase of disk space, quite a large increase. I concentrated on the information store and assumed a couple of email abusers were the cause. I did not look at the bad message que wich was oversight number 3, and is where my lack of specific knowledge in the exchange engine was lacking.

This is a temp box while the cluster was taken down for a hardware upgrade. Seems like you see that alot, stuff moved to a less secure temp box. And in hindsight you say, duh. And beat yourself over the head with a bat. All the IDS connectors and Security event monitoring is on the Cluster. But as always there were clues that got lost in the daily grind.

I'll get the IP of the spammer, will be a bit later since I have to go tell the CEO what happened. :eek: