SMTP Relay Hijacked, Host is Worthless!

[BrandonK]

So a few months back, we submitted a trouble ticket with our host (who shall remain nameless, but I've mentioned them before on here I think) about our server reaching it's SMTP Relay limit of 1000 daily e-mails. Now the sites I run that use this host are very small and it's crazy to think that they would have sent over 1000 e-mails in a single day -- even more so to think that this problem would continue to happen for a few days in a row. After digging in to the server on my own (mind you that I know next to nothing about *nix), I found that there are thousands of SPAM e-mails being sent out, but I don't know how. I haven't been able to track down which e-mail account they are using to send the e-mails (though I can see some logs of people logging in to POP3 to check their accounts). After multiple calls to the host, they have said that they will take a look for $75 an hour, but they can't say if they will be able to fix it or how long it will take. There's no way in hell I would do that! Their opinion is that since I opted to purchase a (virtual) dedicated server through them, I should be able to maintain my own server. My opinion is that since I am LEASING a server, they should at least help with mild support like this.
** A little background: I work for a medium sized ecommerce store that leases a dedicated server and our host there will do ANYTHING we ask at a moment's notice. They have even built a clone of our server to make sure that their upgrades would go smoothly. **
Anyways... here it is a few months later and nothing is resolved. I was wondering if someone here can possibly help me rescue my server. I have made sure that my server is not allowing open relays in Plesk, and I have even gone through and tried to change the password for every e-mail account I have on my server, but I obviously haven't fixed the problem.

Is there a log I can look at to see which account a specific e-mail was sent under? Is there an EASY way to delete 3000 e-mails without deleting all of them? I was given a script (from my host) to wipe the e-mails out and rebuild the directories, but I actually would like to receive my e-mails!

Any help would be amazing. I am at a lost and once I get my server back, I will be looking for a new, knowledgeable host. I also install a version of Linux on a spare machine here so I can try and get some experience under my belt.

Thanks,

Brandon

 

[atomicturtle]

that sounds like an exploitable web application. I put together a procedure determine that here:

http://www.atomicorp.com/wiki/index.php/Spam

To selectively clean out spam messages, check out qmHandle. RPM's are available in my archive.

 

[BrandonK]

Thank you. I will look into that this weekend and get back to you with any questions. I may have a problem installing the rpm because my server is insanely outdated, but I don't even want to start ranting about that right now!

 

[BrandonK]

I knew that there would be problems.

My server does not have yum installed, and when I tried to install it via some directions I found online, I get some errors saying

/bin/sh: line 1: msgmerge: command not found
msgmerge -v of <<lang>> failed
...
make[1]: msgfmt: Command not found
make[1]: *** [cs.mo] Error 127
...
make: *** [all] Error 2

I can't see any pages that address how to install msgmerge.

When I said that my server was old and outdated, I wasn't lieing. My server is running Red Hat 9.

My host recommends that I upgrade to Fedora Core 6, but will offer no help in backing up and restoring my data!

 

[atomicturtle]

Ouch, yeah you're pretty far behind with RH9 there. I think I stopped supporting that about 2 years ago.

If you can, get a 2nd system, and then use the PSA migration manager and/or backup utils and do this in parallel. That way you can avoid any downtime.

 

[BrandonK]

They don't allow me to have both instances run at the same time, so I am just going to move hosts. I am really beyond frustrated with my host, so I am going to find a host that offers the configuration I need while offering support as well.

Thanks for your help Atomic

 

[adamluz]

Atomic, I followed your Spam wiki and returned two user id's which is interesting.

[root@akiracreativegroup ~]# grep 110 /etc/passwd
popuser:x:110:31OP3 service user:/var/qmail/popuser:/sbin/nologin
frontpage:x:10110:10001::/var/www/vhosts/zyoxxwheels.com/web_users/frontpage:/bin/false


Both pop and frontpage?

 

[atomicturtle]

you just caught the second one because it was similar with grep. This tells me that the spam is coming from a compromised user account (smtp_auth, or possibly pop_locking)

 

[adamluz]

I downloaded a program today that could give me reports for q-mail and found something interesting. Mail is being sent from @[]... ehhh wtf is that? 15% of the mail sent from my server is coming from that address. Is there a way to block this?

Heres what the report gave me


1 @[] 1,168 15.7 % 5.25 M
2 @mojoblue.us 96 1.3 % 417.15 k
3 @devida.gob.pe 80 1.1 % 352.83 k
4 @padresok.cl 80 1.1 % 345.03 k
5 @smartgate.com 78 1.1 % 347.94 k
6 @vr-web.de 60 0.8 % 268.36 k
7 @axel.ocn.ne.jp 60 0.8 % 281.11 k
8 @mtco.com 60 0.8 % 276.11 k
9 @forestmanagement.com 60 0.8 % 271.85 k
10 @mmsrep.com 59 0.8 % 274.01 k

Full e-mail address is #@[]