I'm in the process of restoring our mail server (imail for nt version 6.03
unlimited users) after it was hijacked by bulk e-mailers this weekend and
used to send out large amounts of spam. In order to get a better
understanding of security issues and prevent this from reoccurring, I have 3
questions.
1. Our mail users who have their account set up on their home computer are
required to use the SMTP of their ISP. However, I do need to enable imail
smtp for two purposes:
- users checking and administering their mail through the web browser
interface should be allowed to compose/send mail
- i am also hosting websites for a number of the domains and need smtp
services for the corresponding mail domain in order to process forms that
use mailto.exe to submit the form contents via e-mail
So my question is what is the best way to restrict smtp useage - in order to
avoid being hijacked again - without compromising those using web browsers
to send mail while travelling or the sending of form contents?
2. Going through the logs I found that the domain used for the bulk mailing
was nq.com and that someone had created an alias hmail.nq.com. I can't find
hmail.nq.com anywhere on the server - is this a red herring or something I
need to deal with?
3. Viewing the log for the night before the attack I found an unusual number
connections to ports on the server - port numbers I don't usually associate
with e-mail. I have copied and pasted a sample at the end of this message.
My question is whether this could be related to the hijacking or if it
indicates normal activity?
Thanks,
Tor
06:30 00:08 SMTPD(01BC01A8) [209.53.173.209] connect 209.53.173.209 port
2424
06:30 00:09 SMTPD(01BD01A8) [209.53.173.209] connect 209.53.173.209 port
2426
06:30 00:10 SMTPD(01BE01A8) [209.53.173.209] connect 209.53.173.209 port
2428
06:30 00:11 SMTPD(01BF01A8) [209.53.173.209] connect 209.53.173.209 port
2430
06:30 00:12 SMTPD(01C001A8) [209.53.173.209] connect 209.53.173.209 port
2432
06:30 00:13 SMTPD(01C101A8) [209.53.173.209] connect 209.53.173.209 port
2434
06:30 00:14 SMTPD(01C201A8) [209.53.173.209] connect 209.53.173.209 port
2436
06:30 00:15 SMTPD(01C301A8) [209.53.173.209] connect 209.53.173.209 port
2438
06:30 00:16 SMTPD(01C401A8) [209.53.173.209] connect 209.53.173.209 port
2440
06:30 00:17 SMTPD(01C501A8) [209.53.173.209] connect 209.53.173.209 port
2442
06:30 00:18 SMTPD(01C601A8) [209.53.173.209] connect 209.53.173.209 port
2444
06:30 00:19 SMTPD(01C701A8) [209.53.173.209] connect 209.53.173.209 port
2446
06:30 00:20 SMTPD(01C801A8) [209.53.173.209] connect 209.53.173.209 port
2448
06:30 00:21 SMTPD(01C901A8) [209.53.173.209] connect 209.53.173.209 port
2450
06:30 00:22 SMTPD(01CA01A8) [209.53.173.209] connect 209.53.173.209 port
2452
06:30 00:23 SMTPD(01CB01A8) [209.53.173.209] connect 209.53.173.209 port
2454
06:30 00:24 SMTPD(01CC01A8) [209.53.173.209] connect 209.53.173.209 port
2456
06:30 00:25 SMTPD(01CD01A8) [209.53.173.209] connect 209.53.173.209 port
2458
06:30 00:26 SMTPD(01CE01A8) [209.53.173.209] connect 209.53.173.209 port
2460
06:30 00:27 SMTPD(01CF01A8) [209.53.173.209] connect 209.53.173.209 port
2462
06:30 00:28 SMTPD(01D001A8) [209.53.173.209] connect 209.53.173.209 port
2464
06:30 00:29 SMTPD(01D101A8) [209.53.173.209] connect 209.53.173.209 port
2466
06:30 00:30 SMTPD(01D201A8) [209.53.173.209] connect 209.53.173.209 port
2468
06:30 00:31 SMTPD(01D301A8) [209.53.173.209] connect 209.53.173.209 port
2470
06:30 00:32 SMTPD(01D401A8) [209.53.173.209] connect 209.53.173.209 port
2472
06:30 00:33 SMTPD(01D501A8) [209.53.173.209] connect 209.53.173.209 port
2474
06:30 00:34 SMTPD(01D601A8) [209.53.173.209] connect 209.53.173.209 port
2476
06:30 00:35 SMTPD(01D701A8) [209.53.173.209] connect 209.53.173.209 port
2478
06:30 00:36 SMTPD(01D801A8) [209.53.173.209] connect 209.53.173.209 port
2480
06:30 00:37 SMTPD(01D901A8) [209.53.173.209] connect 209.53.173.209 port
2482
06:30 00:38 SMTPD(queue run) 7575 0 30
06:30 00:38 SMTPD(01DC01A8) [209.53.173.209] connect 209.53.173.209 port
2484
06:30 00:39 SMTPD(01DD01A8) [209.53.173.209] connect 209.53.173.209 port
2486
06:30 00:40 SMTPD(01DE01A8) [209.53.174.190] connect 208.160.10.20 port
45463
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
