3

I have Ubuntu server which is more or less acting as a web and mysql server. There is no postfix or anything similar installed. With a help of Virtualbox there is also virtualised Ubuntu server which is acting like a mail server with a help of iredmail.

I use it for a project I'm a part of and mail server is used only for contacting clients (no more than 10 mails per day for now).

The problem is that we're blacklisted for sending spam and we also have been notified from ISP about that problem which forwarded me an example of send email. I checked logs on both servers and there was nothing sent other than from our team and to our clients. Just a couple of

Helo command rejected: need fully-qualified hostname

and

Relay access denied

There is no other computers in the network with installed mail clients or servers.

This is header of one of the spam mail sent

Received: from jhkbabkgjkceaej.meetgir.com (redacted.static.t-2.net [redacted])
    by mtaig-mcd06.mx.aol.com (Internet Inbound) with SMTP id 444BD700000A7
    for <redacted@aol.com>; Thu, 16 Oct 2014 13:43:19 -0400 (EDT)
Return-Path: <E8C3CE86-9F7E-4A9D-8BEF-30BDAC6E0E08@jhkbabkgjkceaej.meetgir.com>
From: "Melanie Richards" <vymylaru@jhkbabkgjkceaej.meetgir.com>
To: <redacted@aol.com>
References: <6588B419-1082-714E-2FAF-ECC392B86E3C@jhkbabkgjkceaej.meetgir.com>
Subject: From a pleasant-looking neighbor girl...
Date: Thu, 16 Oct 2014 21:44:48 +0200
Message-ID: <6588B419-1082-714E-2FAF-ECC392B86E3C@jhkbabkgjkceaej.meetgir.com>
MIME-Version: 1.0
Content-Type: text/plain;
    format=flowed;
    charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Outlook 14.0
Thread-Index: AQKotpYqBnSwfJ0T5FucSHP5//9yxAKotpYq

Is there anything I can do to solve this problem? I appreciate your time and help. Thanks

1
Received: from jhkbabkgjkceaej.meetgir.com (redacted.static.t-2.net [redacted])

That first line is a pretty good indication that you have an infection on the webserver. If you had some sort of accidental relaying enabled it would be "from" your usual host name. What you probably have is a script directly making SMTP connections to destination mail servers from your server.

Removing an infection is a topic all its own, but what you can do right away to get your client emails delivered again is to configure your chrooted mail server to relay your outgoing mail to a relaying service. Most cable-company accounts will come with a relay server you can use, and they monitor it for spam on the fly so it doesn't get blacklisted. There are also paid services available that do the same thing. The virus won't know to use this relay, so the real mail will go through and the spam coming from your server will still get blocked by the blacklist.

In the longer run, what you can do is set up firewall rules to block outgoing mail connections to any server other than your official relay, and set off some kind of alert that lets you know your server has been infected.

| improve this answer | |
  • Thank you for this explanation. But wouldn't that leave some logs? There is no outgoing mail logged except from legitimate mail. I do have however a lot of this and similar: connect from server88-208-233-4.live-servers.net[88.208.233.4] lost connection after UNKNOWN from server88-208-233-4.live-servers.net[88.208.233.4] disconnect from server88-208-233-4.live-servers.net[88.208.233.4] – Soriyyx Oct 29 '14 at 18:07
  • 1
    Nope. If the infection makes a direct TCP connection to the target mail server, they aren't going through any of your mail infrastructure. The only thing you would find in any log is if this is a PHP script or CGI script, then you will see someone making a web request with strange parameters. (unless they've disguised it really well) – M Conrad Oct 30 '14 at 5:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.