Istvan Köpe wrote:
Hello,
I have been listed in a blacklist and I can't delist myself, because
as they say there is spam coming from my IP address. The mail server
is also a router.
Not the best scenario, but I understand it can sometimes be unavoidable.
Scenario 1.
I have no clue how to catch the infected machine. Theoretically there
should not be any zombie machine because I have up-to-date antivirus
on every station. But what if even like that I have a zombie machine?
Theoretically if I control the router I should be able to filter all
the traffic, but I don't know what application to use, what method to
use and what am I looking for?
Any suggestions?
You could force all traffic yo port 25 to your server using the
firewall. This may make some of your users unhappy, but would force all
outgoing email to be routed through your mail server. You would
redirect any traffic on port 25 (and possibly 587) to your mail server's
IP address instead.
Depending on your environment, you may even have a machine you don't
know about sending the spam. I worked for Time Warner for a couple years
and we would make weekly sweeps of the offices (15 in all, all across
town) looking for wireless signals that were not supposed to be there
and for unknown MAC addresses. You would be surprised how many
employees would bring an acces s point into the office so that they
could get a wireless signal outside (they liked to sit outside at the
picnic tables and work). We also had a couple younger employees that
would bring their laptops from home and hide them under
desks/plants/whatever so they could get faster downloads on their
torrents (I ran the Roadrunner installation department - we had a
**BIG** pipe in the main office). We found laptops connected for
torrenting that were dripping with malware.
you could also use wireshark to monitor your network for traffic
outgoing on port 25 and see if you could glean the MAC/IP of the
offending machine (which may or may not help, depending on if someone
hid a laptop under an office plant).
Scenario 2.
Somebody cracked a password of a user and is using the account to send
spam. I checked the logs, but there is so much spam traffic, that I
don't know what to look for. I don't know exactly how the logs work,
but I couldn't find anything interesting. Theoretically in
/var/log/qmail/send there should be all the outgoing mails, but I
found a lot of spam like subjects here. I presume that those are
related to the aliases and forwards. Is this correct?
Please give me a clue what to look for? And how to look for?
You should just see outgoing messages from authenticated users in the
send and submission logs. If you're seeing spam there, then check the IP
as that will probably be your offending machine. You are correct in
that it may be aliases or forwards. You could turn on spam scanning for
local addresses (the instructions should be in the wiki). You could also
enable taps and tap your domain and look at the emails to see where the
spam is coming from. Not sure what country you're in, so this may not be
legal in your country.
Is there other possible scenarios?
Yeah, like I mentioned above with users bringing their own equipment in.
Without a witch hunt it's hard to track that sort of stuff unless you
keep EXTREMELY meticilous logs on things like what computers are plugged
into what ports on switches, where the wall plates are, etc.
Good luck!
---------------------------------------------------------------------
QmailToaster hosted by: VR Hosted <http://www.vr.org>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
