my qmail is open relay

Le0x · Jan 10, 2007

hi my qmail is used to send spam i think is in open relay but i havent find the problem
before i download 1700 mails like that :
Hi. This is the qmail-send program at rocoto089.webperoni.de.
I tried to deliver a bounce message to this address, but the bounce bounced!

<[email protected]>:
Sorry, I couldn't find any host named malerfachbetrieb-heiko-elze.de. (#5.1.2)

--- Below this line is the original bounce.

Return-Path: <>
Received: (qmail 25638 invoked for bounce); 23 Dec 2006 16:25:23 +0100
Date: 23 Dec 2006 16:25:23 +0100
From: [email protected]
To: [email protected]
Subject: failure notice

Hi. This is the qmail-send program at rocoto089.webperoni.de.
I'm afraid I wasn't able to deliver your message to the following addresses.
This is a permanent error; I've given up. Sorry it didn't work out.

<[email protected]>:
194.25.134.75 does not like recipient.
Remote host said: 550 5.1.1 user unknown
Giving up on 194.25.134.75.

<[email protected]>:
213.165.64.100 does not like recipient.
Remote host said: 550 5.1.1 <[email protected]>... User is unknown {mx039}
Giving up on 213.165.64.100.

--- Below this line is a copy of the message.

Return-Path: <[email protected]>
Received: (qmail 18425 invoked from network); 23 Dec 2006 15:49:33 +0100
Received: from unknown (HELO net.in) (211.186.196.49)
by rocoto089.webperoni.de with SMTP; 23 Dec 2006 15:49:33 +0100
Message-ID: <0bab01c726a1$8fb01420$c2aa9f56@VUSJBI>
From: "Paustian Christian" <[email protected]>
To: "Paul" <[email protected]>
Subject: Fredy hat letzte Nacht 703.- EURO gewonnen
Date: Sat, 23 Dec 2006 07:45:45 -0800
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0BA8_01C7265E.818CD420"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180

This is a multi-part message in MIME format.

------=_NextPart_000_0BA8_01C7265E.818CD420
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 8bit

Frohe Adventszeit Paul,
Fredy hat letzte Nacht 703.- EURO gewonnen

http://gefraing.com/micro/16/

------=_NextPart_000_0BA8_01C7265E.818CD420
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<STYLE type=3Dtext/css>
</STYLE>

<META content=3D"MSHTML 6.00.2900.3020" name=3DGENERATOR></HEAD>
<BODY>
<TABLE width=3D550 align=3Dcenter border=3D0>
<TR>
<TD class=3Dt1 width=3D174>
<DIV align=3Dright>Las V</DIV></TD>
<TD class=3Dt1 width=3D90>egas</TD>
<TD class=3Dt1 width=3D70>
<DIV align=3Dright>Cas</DIV></TD>
<TD class=3Dt1 width=3D240>ino</TD></TR>
<TR>
<TD class=3Dt3 colSpan=3D4>
<HR>
</TD></TR>
<TR>
<TD class=3Dt2>
<DIV align=3Dright>500<BR>Start-<BR><BR>Jac<BR>2'257'<BR></DIV></TD>
<TD class=3Dt2 colSpan=3D2> US$<BR>Bonus<BR><BR>kpot<BR>015 US$</TD>
<TD class=3Dt3 width=3D240><B>So gewinnen Sie mit:</B><BR><BR>- Besuchen =
Sie unsere <B><A =
href=3D"http://gefraing.com/micro/16/">Webseite</A></B><BR>- Downloaden =
Sie das deutsche<BR>  Spiel-Modul <B><A =
href=3D"http://gefraing.com/micro/16/">hier</A></B><BR>- Registrieren Sie =
sich als Gast<BR>  oder Spieler ...
<P align=3Dright>.......und schon k=F6nnen<BR>Sie =
mitspielen</P></TD></TR></TABLE>
<P align=3Dcenter>Downloaden Sie das <A =
href=3D"http://gefraing.com/micro/16/">deutsche Spiel-Modul hier</A> und =
gewinnen Sie sofort mit</P></BODY></HTML>
------=_NextPart_000_0BA8_01C7265E.818CD420--

can you help me?

jwdick · Jan 10, 2007

Do you have the settings below check in <SERVER><MAIL>?

Relaying
authorization is required: "Checked"

SMTP "Checked"

Le0x · Jan 10, 2007

yes i have check this options in server>>mail in my opinion the problen is situated files situated in this dir /var/qmail/control

Beto · Jan 10, 2007

It can also help to disable the bounce messages and the catch all addresses.

aaabyss · Jan 24, 2007

Am I mistaken or aren't these 'double-bounces'?

How do you disable the bounce messages?

TIA

Beto · Jan 24, 2007

You can do this on the e-mail page on the domain level. (domain -> mail)...and if you don't want to do this domain / domain you can do this with group operations.

rs232 · Jan 26, 2007

It sounds like you are having problems with spammers using your site but don't know where it is coming from? I experienced the same issue a while back and it turned out to be PHP Insertion. Perhaps there is someone on your server with a weak php / perl script that is allowing spam? I had to shut down a few sites until they figured out how to get it to stop because of this issue.

lvalics · Jan 27, 2007

I think some of your site is used for mail injection.
You can fight against it by using mod_security and use a rule for CC and BCC

http://www.securephpwiki.com/index.php/Email_Injection

SecFilterSelective ARGS_VALUES "\n[[:space:]]*(to|bcc|cc)[[:space:]]*:.*@"

diadem.support · Mar 5, 2007

When I am implementing this rule in mod_security it is giving the
"Syntax error on line 35 of /etc/httpd/conf.d/modsecurity.conf:
Invalid command 'SecFilterSelective', perhaps mis-spelled or defined by a module not included in the server configuration".
We are using mod_security version 2.0, Web Server httpd-2.0.52-28.ent, With RHEL 4 and Plesk 8.1.0 for Linux. Please give me some suggestion.

Furthermore we have a problem of incoming SPAM mails with typical images; these are really hard to block as it comes with BMP/GIF images embedded in a TXT mail. There is no facility of blocking those mails through Spamassassin (We are using 4PSA SPAM Guardian). Can you please help me to solve this issue?

my qmail is open relay

Le0x

Guest

jwdick

Guest

Le0x

Guest

Beto

Guest

aaabyss

Guest

Beto

Guest

rs232

Guest

lvalics

Silver Pleskian

diadem.support

Guest

Similar threads