Spam sent by our server using SMTP AUTH

[uweiss]

Hello

Since today we have a big problem. Multiple spammers (most from china) are able to send spam through our server using smtp authentication. As soon i disable the smtp authentication they can not send spam anymore.

Two possibilities:
1. qMail has a bug with smtp auth
2. Someone catched an user and password from an user

I dumped some network traffic and tried it manually with telnet:

$ telnet 12.34.56.78 25
Trying 12.34.56.78...
Connected to 12.34.56.78.
Escape character is '^]'.
220 myserver.domain.com ESMTP
EHLO gub
250-myserver.domain.com
250-AUTH=LOGIN CRAM-MD5 PLAIN
250-AUTH LOGIN CRAM-MD5 PLAIN
250-STARTTLS
250-PIPELINING
250 8BITMIME
AUTH LOGIN
334 VXNlcm5hbWU6
aW5mbw==
334 UGFzc3dvcmQ6
YWRtaW4=
235 go ahead
mail from: [email protected]
250 ok
rcpt to: [email protected]
250 ok
data
354 go ahead
asdf
asdf
asdf
.
250 ok 1201260277 qp 16005
QUIT

What do you think about that?
Is there a way to find out which user account they may use??

Thank you very much for your help.
Urs

 

[uweiss]

Hello

Has no one any ideas?
Today the same Problem started again. Only solution was to disable SMTP-Authentication. Can i somehow enable some more debugging on qmail to see which users are trying to connect over SMTP-Auth??

Or is there at least a possibility to block a recipient domain?

Thanks
Urs

 

[uweiss]

I now found out that the communication is base64 encoded. So it is very simple to decode it and find out the user:

aW5mbw==  ==>  info
YWRtaW4=  ==>  admin (great password....)

To find out which user and domain it is from i used this MySQL query within the psa database:

select mail.mail_name,domains.name,accounts.password from mail,domains,accounts where accounts.password='admin' and mail.dom_id=domains.id and accounts.id=mail.account_id;

Maybe helps someone else.

Urs

 

[faris]

Urs,

I think you will save a lot of people a lot of trouble in the future (as long as they know how to search the forum ).

Thank you very much for posting this very useful info.

Faris.

 

[atomicturtle]

A follow up on this, if you go to Server->Mail and select "Check the passwords for mailboxes in the dictionary" this will do a reasonable job of enforcing good password selection on mailboxes for your users. It will absolutely catch joe accounts like this (info/admin, test/test, guest/guest, etc).

 

[uweiss]

The password check option was enabled all the time. But don't seems to really work. I didn't had time to look why it does not work. Maybe tomorrow.
I disabled an re-enabled the option, but still can set the password "admin".

We will see....

 

[uweiss]

OK, seems that the bin which checks the passwords does not work well:

# /usr/local/psa/admin/sbin/checkpw admin
/usr/local/psa/etc/dict: magic mismatch
checkpw: System Error: unable to open dictionary files at path: /usr/local/psa/etc/dict.*
checkpw: System Error: unable to open dictionary files at path: /usr/local/psa/etc/dict.*

I found something about that after googeling a bit. The problem may occurs on 64-Bit machines only. I generated a dictionary to be sure that they are correct. Same error with them. So, i think it's a problem of the binary itself (/usr/local/psa/admin/sbin/checkpw).

Maybe this is fixed after updating to Plesk 8.3 (if i really do the update...)

 

[Netcomseth]

Can you describe the steps you took to figure out which user was sending the spam? I am currently experiencing the same issue. Thank you for your time.

 

[uweiss]

1. Dump some traffic with tcpdump or snort (whatever you like) f.ex. like this

# tcpdump -w /home/whatever/dump_1 not port ssh and port smtp
(This dumps in raw format to load the file into wireshark after download)

or maybe something like this if you want it readably directly in a file:

# tcpdump -el -vvv -XX -nn not port ssh and port smtp > dump_1


2. Then have a look into the file (in wireshark if you dumped the raw stuff or on command line) and search for "AUTH LOGIN" parts. Near there you should find the base64 encoded username and password (see example of the connection on my first post).
You may have to look a bit around to find the correct user which sends a lot of mails.


3. Decode the encoded user/pass with an online base64 decoder (you can find some of them on Google by serching for "online base64 decoder")

Hope that helps solving your problem
Urs