Re: [imail] SPAM & Relay HELP!

[Jason Diskin]

Title: Message

Our SMTP requires either full athentication user/password or a computer in the assigned aerosurf ip address range.   Jason AeroSurf ----- Original Message ----- From: Ramtin S. To: [EMAIL PROTECTED] Sent: Thursday, July 24, 2003 9:37 AM Subject: RE: [imail] SPAM & Relay HELP! We have been monitoring the server, since I changed passwords the Spam reduced dramatically. But I also wanted to know, how can I check the authentication processes on the server? It looks like IMAIL does not log the SMTP authentication process. This is what I suspect is going on (for the remainder of spammers) They have a valid account with and then they use bogus email address in the sender field but use SMTP Authentication and send out SPAM. It seems like IMAIL only logs the sender field and not the actual user account that is used in SMTP Authentication process.   Thanks   Ramtin -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Paul Navarre Sent: Wednesday, July 23, 2003 6:06 PM To: [EMAIL PROTECTED] Subject: RE: [imail] SPAM & Relay HELP! Make sure that you have restarted the service since making the change to No Relay.   If you have and are still relaying spam, check in the logs to see if the spam senders are authenticating.   Paul Navarre     -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Ramtin S. Sent: Wednesday, July 23, 2003 3:30 PM To: [EMAIL PROTECTED] Subject: RE: [imail] SPAM & Relay HELP! Thanks Marcus, I will definitely go ahead and change all the passwords on the roots (they are all at default!) Anything else I should look out for?   Ramtin -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Marcus Anthonsen Sent: Wednesday, July 23, 2003 2:26 PM To: [EMAIL PROTECTED] Subject: Re: [imail] SPAM & Relay HELP! Ramtin,   Check your default user accounts such as root and so on to see what passwords are assigned to them.  By default iMail sets the password as "password" and spammers know it.  So most likely you're not really relaying mail but the mail might be hijacked by a weak password.  You might also want to check to see if common user names such as admin are being used and see if the password matches the user name.  Also an easy picking for the spammers.   Hope this helps.   Marcus ----- Original Message ----- From: Ramtin S. To: [EMAIL PROTECTED] Sent: Wednesday, July 23, 2003 4:47 PM Subject: [imail] SPAM & Relay HELP! Hi I am running IMAIL 6.06 on a NT4 server. We are getting bombarded with Spam. I have turned off the relay option (Set relay "No Relay") and Every night I clean the spool directory, Next morning I have about 50,000 files in spool directory to be relayed. Any ideas? I greatly appreciate any help and input on this matter.   Thanks   Ramtin