Null log ins used to create spam
I have been plagued by several spammers / spam bots that have been injecting spam into qmail via a null user login
# cat /usr/local/psa/var/log/maillog |grep null
Jun 17 09:02:46 penguin4 smtp_auth: SMTP connect from (null)@13.224.136.219.broad.gz.gd.dynamic.163data.com.cn [219.136.224.13]
Jun 17 09:02:46 penguin4 smtp_auth: smtp_auth: SMTP user : logged in from (null)@13.224.136.219.broad.gz.gd.dynamic.163data.com.cn [219.136.224.13]
I have spent alot of time researching this over the last month and belive I may have an answer for those that want to stop this before the patch of 8.4.1.
let me continue with a bit more information before I give conclusion
Plesk Control Panel version
psa v8.4.0_build84080514.18 os_FedoraCore 6
Operating system
GenuineIntel, Intel(R) Xeon(R)CPU 5130 @ 2.00GHz
Linux 2.6.18-1.2798.fc6
My first move was to add the domain 163data.com.cn to the blacklist.
I have never seen anything but spam come from 163data anyway.
So thought all was solved for the server until the next day when sure enough 100's more spam from 163data.com.cn.
So next step was to add
ALL: .163data.com.cn : DENY
to /etc/hosts.allow
this was sure to get these buggers
Well come the next few days things seemed ok
then bam! they where back again and they sure had me baffled
so this had to be a user or internal was my thoughts
at which point I looked at the smtp-auth, discovered the null logins
and also noticed that they where using my reverse.DNS names as the senders name,
I thought this curious and noted that this was a way to get thru the hosts.allow block
I proceeded to recreate how they where getting thru and sure enough a simple
telnet MYDOMAIN.com 25
smtp_auth: AUTH
[email protected]
smtp_auth: PASS (null)
got me thru
WOW how could this be?
I tried removing the reverse DNS in the thoughts that relaylock would pick it up
(NOPE didn't work)
Was so frustrated that I decided to move all the server IPs in the hope of at least tracking why (really didn't want to do this)
It was when I got to the point of actually moving the IP's did I notice one common denominator.
The IP's that they where using for the names (reverseDNS names) had NO SITES ON THEM
I had added a block of IP's in preparation for several sever migration moves and never needed all of them but just left them in-place for future additions.
at this point I have removed unused ones and added a site to one they picked on the most
- after 3 days I see their failed null attempts but the spam is gone
hope this helps
Jerry The Mouse
Facebook
Twitter