Is my server being used to forward spam?

sgb · Post by **sgb** » Tue Mar 07, 2006 10:00 am

My server is really slow and all these messages are comming through in the log. My server went down last night and I'm hoping these are the emails being processed from last night, but I see a lot of the same email addresses over and over again like

----------------------------------------

Mar 7 10:52:20 mi6 amavis[3163]: (03163-03-3) Blocked SPAM, LOCAL [192.168.1.1] [120.4.222.88] -> ,,,,, Message-ID: , mail_id: FLxtoPiLnuqU, Hits: 40.77, 18436 ms

-----------------------------------------

Also, I have sent myself a few email tests and have not come through, I sent them from zimbra to hotmail and the other way around.
Thanks for any help..
Here is part of the log
Mar 7 10:52:15 mi6 amavis[3160]: (03160-02-3) ESMTP::10024 /opt/zimbra/amavisd/tmp/amavis-20060307T104940-03160: -> ,,,,, Received: SIZE=5455 from mi6.extier.com ([127.0.0.1]) by localhost (mi6.extier.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 03160-02-3; Tue, 7 Mar 2006 10:52:14 -0500 (EST)

Mar 7 10:52:15 mi6 amavis[3156]: (03156-05-3) Checking: AGFhLbhq2UKB [192.168.1.1] -> ,,,,,,,,,

Mar 7 10:52:15 mi6 amavis[3160]: (03160-02-3) Checking: DDz5scZb-H5b [192.168.1.1] -> ,,,,,

Mar 7 10:52:15 mi6 amavis[3160]: (03160-02-3) cached 5b3e8a38400a77ea117f120c179e642d from (1,1)

Mar 7 10:52:15 mi6 amavis[3160]: (03160-02-3) BAD HEADER from : Non-encoded 8-bit data (char BE hex) in message header 'From': From: "\276\345\276\354\276\345\276\354\276\345\276\354\276\345\276\354...

Mar 7 10:52:15 mi6 amavis[3160]: (03160-02-3) NOTICE: Not sending DSN, spam level exceeds DSN cutoff level for all recips, mail intentionally dropped

Mar 7 10:52:16 mi6 amavis[3160]: (03160-02-3) Blocked SPAM, LOCAL [192.168.1.1] -> ,,,,,, Message-ID: , mail_id: DDz5scZb-H5b, Hits: 44.405, 2024 ms

Mar 7 10:52:16 mi6 amavis[3158]: (03158-03-5) ESMTP::10024 /opt/zimbra/amavisd/tmp/amavis-20060307T104940-03158: -> ,,,,,,, Received: SIZE=2748 from mi6.extier.com ([127.0.0.1]) by localhost (mi6.extier.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 03158-03-5; Tue, 7 Mar 2006 10:52:12 -0500 (EST)

Mar 7 10:52:17 mi6 amavis[3158]: (03158-03-5) Checking: Vaoh2HfWj1cT [192.168.1.1] -> ,,,,,,,

Mar 7 10:52:20 mi6 amavis[3163]: (03163-03-3) BAD HEADER from : Non-encoded 8-bit data (char C0 hex) in message header 'From': From: "abner\300\260\261z\273P\267R\244\374\267\276\263qph...

Mar 7 10:52:20 mi6 amavis[3163]: (03163-03-3) NOTICE: Not sending DSN, spam level exceeds DSN cutoff level for all recips, mail intentionally dropped

Mar 7 10:52:20 mi6 amavis[3163]: (03163-03-3) Blocked SPAM, LOCAL [192.168.1.1] [120.4.222.88] -> ,,,,, Message-ID: , mail_id: FLxtoPiLnuqU, Hits: 40.77, 18436 ms

marcmac · Post by **marcmac** » Tue Mar 07, 2006 10:12 am

That's not good at all.
Check the logs right before that for the postfix logs - that will tell you where this mail is being submitted from.
If I had to guess, there's a PC (Windows Box) on your network that's got a virus.
If that's the case, it's possible your IP has been blacklisted for sending spam.

sgb · Post by **sgb** » Tue Mar 07, 2006 10:20 am

Is there any way that I can stop this? like only allowing the local server to send out email??

my windows servers are running fine and they have antivirus scanners and the latest virus definitions... I'm running an scan manually but has found nothing so far. All the emails I'm seeing are coming from my firewall ip therefore I believe they are comming from the internet, can anybody relay messages without authentication???
Please help

phoenix · Post by **phoenix** » Tue Mar 07, 2006 11:43 am

You can always use this test or this to see if you're a relay.

sgb · Post by **sgb** » Tue Mar 07, 2006 12:17 pm

Thanks for your help, I did the second test and the server passed, which the site said it means it is not relaying emails. But why am I only seeing my firewall ip address if that's the case?

Would changing the zimbra user password have any effect on the functionality of the server? I see sessions being closed for that user in the logs frequently and I'm thinking somebody might have craked the password, although I don't remember if I set a password for that user to beging with..
Thanks for your help I really appreciate it, and hopefully you can help me figure this out.
Thanks
Mar 7 12:56:56 mi6 amavis[9705]: (09705-01) Blocked SPAM, LOCAL [192.168.1.1] [197.64.0.106] -> , Message-ID: , mail_id: P8RgCJ5+rLwU, Hits: 60.903, 104228 ms

Mar 7 12:57:22 mi6 zimbramon[5524]: 5524:info: 2006-03-07 12:38:13, STATUS: mi6.extier.com: mailbox: Running

Mar 7 12:57:26 mi6 zimbramon[5524]: 5524:info: 2006-03-07 12:38:13, STATUS: mi6.extier.com: mta: Running

Mar 7 12:57:30 mi6 zimbramon[5820]: 5820:info: 2006-03-07 12:39:12, STATUS: mi6.extier.com: antivirus: Running

Mar 7 12:57:01 mi6 crond(pam_unix)[10129]: session opened for user zimbra by (uid=0)

Mar 7 12:57:03 mi6 amavis[9704]: (09704-01) Blocked SPAM, LOCAL [192.168.1.1] [50.128.116.48] -> , Message-ID: , mail_id: jond6p1i-hxS, Hits: 54.911, 111320 ms

Mar 7 12:56:44 mi6 amavis[6977]: (06977-08) NOTICE: Not sending DSN, spam level exceeds DSN cutoff level for all recips, mail intentionally dropped

Mar 7 12:57:18 mi6 amavis[9646]: (09646-01) extra modules loaded: Net/LDAP/Bind.pm

Mar 7 12:57:19 mi6 amavis[7199]: (07199-07) Checking: PwPvrYULU2cz [192.168.1.1] ->

Mar 7 12:57:45 mi6 zimbramon[5820]: 5820:info: 2006-03-07 12:39:12, STATUS: mi6.extier.com: ldap: Running

Mar 7 12:57:46 mi6 zimbramon[5524]: 5524:info: 2006-03-07 12:38:13, STATUS: mi6.extier.com: snmp: Running

Mar 7 12:57:22 mi6 amavis[7023]: (07023-07-2) extra modules loaded: Net/LDAP/Bind.pm

Mar 7 12:57:22 mi6 amavis[9645]: (09645-01) extra modules loaded: Net/LDAP/Bind.pm

Mar 7 12:57:22 mi6 amavis[7200]: (07200-07) extra modules loaded: Net/LDAP/Bind.pm

Mar 7 12:57:32 mi6 amavis[6977]: (06977-08) Blocked SPAM, LOCAL [192.168.1.1] [167.79.22.60] -> , Message-ID: , mail_id: 1ewB37VmQuS4, Hits: 52.866, 141682 ms

marcmac · Post by **marcmac** » Tue Mar 07, 2006 12:26 pm

[quote user="sgb"]Thanks for your help, I did the second test and the server passed, which the site said it means it is not relaying emails. But why am I only seeing my firewall ip address if that's the case?

[/QUOTE]

Where are you seeing the firewall IP? Can you send the logs from POSTFIX for these emails, prior to them being handed to amavis?
THe mail flow here is:

external->postfix->amavis->postfix->mailbox
So amavis is going to receive all of it's mail from the local host (I assume that's 192.168.1.1?)
[QUOTE]

Would changing the zimbra user password have any effect on the functionality of the server? I see sessions being closed for that user in the logs frequently and I'm thinking somebody might have craked the password, although I don't remember if I set a password for that user to beging with..

[/QUOTE]

THe "session closed for user zimbra" stuff means that something ran out of cron - not related.

[QUOTE]
Thanks for your help I really appreciate it, and hopefully you can help me figure this out.
Thanks
Mar 7 12:56:56 mi6 amavis[9705]: (09705-01) Blocked SPAM, LOCAL [192.168.1.1] [197.64.0.106] -> , Message-ID: , mail_id: P8RgCJ5+rLwU, Hits: 60.903, 104228 ms

Mar 7 12:57:22 mi6 zimbramon[5524]: 5524:info: 2006-03-07 12:38:13, STATUS: mi6.extier.com: mailbox: Running

Mar 7 12:57:26 mi6 zimbramon[5524]: 5524:info: 2006-03-07 12:38:13, STATUS: mi6.extier.com: mta: Running

Mar 7 12:57:30 mi6 zimbramon[5820]: 5820:info: 2006-03-07 12:39:12, STATUS: mi6.extier.com: antivirus: Running

Mar 7 12:57:01 mi6 crond(pam_unix)[10129]: session opened for user zimbra by (uid=0)

Mar 7 12:57:03 mi6 amavis[9704]: (09704-01) Blocked SPAM, LOCAL [192.168.1.1] [50.128.116.48] -> , Message-ID: , mail_id: jond6p1i-hxS, Hits: 54.911, 111320 ms

Mar 7 12:56:44 mi6 amavis[6977]: (06977-08) NOTICE: Not sending DSN, spam level exceeds DSN cutoff level for all recips, mail intentionally dropped

Mar 7 12:57:18 mi6 amavis[9646]: (09646-01) extra modules loaded: Net/LDAP/Bind.pm

Mar 7 12:57:19 mi6 amavis[7199]: (07199-07) Checking: PwPvrYULU2cz [192.168.1.1] ->

Mar 7 12:57:45 mi6 zimbramon[5820]: 5820:info: 2006-03-07 12:39:12, STATUS: mi6.extier.com: ldap: Running

Mar 7 12:57:46 mi6 zimbramon[5524]: 5524:info: 2006-03-07 12:38:13, STATUS: mi6.extier.com: snmp: Running

Mar 7 12:57:22 mi6 amavis[7023]: (07023-07-2) extra modules loaded: Net/LDAP/Bind.pm

Mar 7 12:57:22 mi6 amavis[9645]: (09645-01) extra modules loaded: Net/LDAP/Bind.pm

Mar 7 12:57:22 mi6 amavis[7200]: (07200-07) extra modules loaded: Net/LDAP/Bind.pm

Mar 7 12:57:32 mi6 amavis[6977]: (06977-08) Blocked SPAM, LOCAL [192.168.1.1] [167.79.22.60] -> , Message-ID: , mail_id: 1ewB37VmQuS4, Hits: 52.866, 141682 ms[/QUOTE]

phoenix · Post by **phoenix** » Tue Mar 07, 2006 12:34 pm

I have a vague recollection that when I first installed Zimbra (many months ago) I had a similar (or the same problem), I think it's possible those messages you're seeing is spam coming into your system and for some reason Zimbra is trying to deliver them to their email addresses.
Unfortunately I can't for the life of me remember what caused it.

Is your DNS set-up correctly? Can you delete those messages from the postfix queues? Is it the same email being delivered over and over or are they all new emails?

marcmac · Post by **marcmac** » Tue Mar 07, 2006 12:38 pm

If you're on a shared network (eg, DSL line) and someone on a nearby IP tries to connect, postfix could have the wrong mynetworks setting.
zimbraMtaMyNetworks can fix this - check man 5 postconf for appropriate settings for your network.

sgb · Post by **sgb** » Tue Mar 07, 2006 1:07 pm

Where can I find the logs for Postfix??

I've looked in the /opt/zimbra/log directory

also in my /var/logs directory and the only thing I can find there is what I posted above.

marcmac · Post by **marcmac** » Tue Mar 07, 2006 1:08 pm

grep postfix /var/log/zimbra.log