Hello All: Seems there is unauthorized mail being sent from my server and I cannot figure out how. I've tested the server from several different open relay sites and it comes up good. I've scanned from viruses with the latest defs and it also came up good. From the log files, I can see that mail is being relayed and I cannot figure out how. Below is a few lines from the smtp logs. Any help would be appreciated. Thanks in advance. 2007-11-20 05:00:33 69.42.57.92 mxserv30.com.57.42.69.in-addr.arpa SMTPSVC1 0 250 2007-11-20 05:00:33 69.42.57.92 mxserv30.com.57.42.69.in-addr.arpa SMTPSVC1 0 240 2007-11-20 05:00:39 194.2.0.80 OutboundConnectionResponse SMTPSVC1 25 0 2007-11-20 05:00:39 194.2.0.80 OutboundConnectionCommand SMTPSVC1 25 0 2007-11-20 05:00:39 194.2.0.80 OutboundConnectionResponse SMTPSVC1 25 0 2007-11-20 05:02:07 76.4.105.92 fl-76-4-105-92.dhcp.embarqhsd.net SMTPSVC1 0 250 2007-11-20 05:02:07 76.4.105.92 fl-76-4-105-92.dhcp.embarqhsd.net SMTPSVC1 0 250 2007-11-20 05:02:07 76.4.105.92 fl-76-4-105-92.dhcp.embarqhsd.net SMTPSVC1 0 250 2007-11-20 05:02:07 76.4.105.92 fl-76-4-105-92.dhcp.embarqhsd.net SMTPSVC1 0 250 2007-11-20 05:02:07 76.4.105.92 fl-76-4-105-92.dhcp.embarqhsd.net SMTPSVC1 0 240 2007-11-20 05:02:43 64.71.41.19 OutboundConnectionResponse SMTPSVC1 25 0
Microsoft News Groups <DJ> wrote: > Hello All: > > Seems there is unauthorized mail being sent from my server and I > cannot figure out how. I've tested the server from several different > open relay sites and it comes up good. I've scanned from viruses with > the latest defs and it also came up good. From the log files, I can > see that mail is being relayed and I cannot figure out how. Below is > a few lines from the smtp logs. Any help would be appreciated. Thanks > in advance. <snip> The logs you've included don't indicate you're being used as a relay (although they aren't detailed enough to demonstrate either way). Let's start with the basics - what precisely makes you believe you're being used as one? See http://www.msexchange.org/tutorials/MF005.html for a good overview of relaying and spam. E2k/2003 do not permit open relay by default, although they do permit authenticated relay. If you don't have strong/complex password policies enabled, force regular password changes, have enabled guest, etc., someone may exploit authenticated relay. If you don't need authenticated relay, disable it. You can always have any external POP users use their own ISP's SMTP server for outbound mail anyway. See http://www.vamsoft.com/orf/authattack.asp
