Jake Posted January 23, 2007 Posted January 23, 2007 Cant remember the last time I looked at the queue, but our mailserver is showing thousands of messages in the queue. Looking at the SMTP connectors, it seems we have hundreds upon hundreds of connections from all kinds of asian places and taiwanese and what not. It almost looks as if we are being used as a relay for spam, though I was sure we were all nicely configured to prevent that. Anyone seen something similar?
Lee_K_81 Posted January 23, 2007 Posted January 23, 2007 Which queue are they in? Have you set up intelligent message filtering?
Dos_Box Posted January 23, 2007 Posted January 23, 2007 You server is compromised to hell!!! Click 'Diable outbound mail' immediatly and dig into KB is my quick answer. You are not being used as a relay, but as a source of spam!! Is it on a global IP?
Geoff Posted January 23, 2007 Posted January 23, 2007 It's a spam attack on your server. Either by brute force or dictionary based. We have a Linux box as a front end mail server to deal with such things. Exchange is dreadful at coping with them. It's also very easy to make a mistake with the configuration, causing you to be an open relay.
Jake Posted January 23, 2007 Author Posted January 23, 2007 Yeah been fiddling with it a bit, from what I have read it appears to be a "SMTP Auth" attack, somehow one of our users details have been comprised and those details are now being used to authenticate against our server for relaying mail. We were configured to prevent unauthenticated relaying, but not for relaying via "legitimate" authentication. I have implemented a few procedures I found at msexchange.org and so far it seems to be doing the trick
Disease Posted January 23, 2007 Posted January 23, 2007 The server is not comprimised, its just relaying spam.
Dos_Box Posted January 23, 2007 Posted January 23, 2007 You can't setup Exchange connectors without compromising and directly controlling the machine.
Jake Posted January 23, 2007 Author Posted January 23, 2007 Thats my fault, I worded the original post poorly, I didnt mean actual connectors, I meant the connections list in the queue. Personally I blame a lack of female cybertechbabe today
webman Posted January 23, 2007 Posted January 23, 2007 You could always blame Microsoft's poor-quality product
Geoff Posted January 23, 2007 Posted January 23, 2007 If your using SMTP AUTH (or any internet facing service) you need to make sure you users use hard to guess/brute force complex passwords and change them regularly.
Jake Posted January 23, 2007 Author Posted January 23, 2007 That would be lovely, sadly our teachers can barely remember a password like "apple" , let alone something as complex as something alphanumeric. Sometimes they even forget their usernames, (first initial + surname) !!
NetworkGeezer Posted January 23, 2007 Posted January 23, 2007 @Jake Just unsubscribe from the "Pictures of Hot IT Chicks " newsletter and queues will drop down to the normal level
webman Posted January 23, 2007 Posted January 23, 2007 I didn't know hwpr0n had a mailing list :shock: (That'll keep 'im going
mac_shinobi Posted January 23, 2007 Posted January 23, 2007 If they all have memory sticks, you could get them to save a complex password in a text file on the memory stick and just copy n paste the password(s), if they lose it , just make sure it gets reset to something else after they report its lost or stolen or w/e. http://www.grc.com/password I think thats the url, creates long strong cryptographic passwords afaik.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now