-1

I have an Ubuntu (14.04.1 LTS) install on AWS with sendmail.

I keep getting messages from mail servers that are unable to deliver some of my messages (I did not send) and all are about sex.

So I figure someone is using my server to spam people.

How do I start handling this?

Can anyone direct me to article or tutorial explaining this?

Improve this question

1 Answer 1

Reset to default
0

If sendmail is sending out those messages, you should check the logs. Bit cheap of me, but please start at the link be below. Combine the email addresses, time stamps mentioned in the NDR's (Non-Delivery Report) and check the logs.

where-to-check-log-of-sendmail

But, you might not be even sending those emails from your server.

It could be bounce back/backscatter, some other server sending spam --but using your domainname as the sender. When the receiving server can't (or won't) deliver them it returns a NDR to your server with the help of the DNS MX records.

You might be able to see if this is the case if you look at the headers & messages of the NDR reports you receive.

What might help (...but not 100% of the time...) in these cases is making it harder for spammers to abuse your domainname. With the help of SPF & DKIM records.

See: bounce-back-backscatter-spam-who-stole-my-email-address

Improve this answer
7
  • Thanks for this Checking the log, looks like someone is sending those email from the server: I get lots of log records all saying from=<some_name@my_domain_name> (the right names here…) Any suggestions?
    – ShimonD
    Apr 9, 2015 at 9:47
  • Can you see the ip address from where the connection came from? Does this belong to the user in question? (alteast the correct region?) If not, consider checking with the user if his/her password might have been "guessed" and someone is sending email mail through your server smtp services. Any other services running on the server that could be being exploited, for instance, www (wordpress)?
    – Sinn3d
    Apr 9, 2015 at 12:31
  • Thanks for your replay, I am including a small part of the log here I have no users as such, I keep web sites on this server and I have Drupal installed
    – ShimonD
    Apr 10, 2015 at 17:41
  • Here is the extract:
    – ShimonD
    Apr 10, 2015 at 17:41
  • Apr 5 06:29:50 ip-172-30-0-66 postfix/smtp[13750]: connect to mx5.o2.pl[193.17.41.45]:25: Connection timed out Apr 5 06:29:50 ip-172-30-0-66 postfix/smtp[13765]: C19C5691E6: to=<[email protected]>, relay=none, delay=69208, delays=69058/0/150/0, dsn=4.4.1, status=deferred (connect to mx3.o2.pl[193.17.41.214]:25: Connection timed out) Apr 5 06:29:50 ip-172-30-0-66 postfix/smtp[13750]: C07CA698B9: to=<[email protected]>, relay=none, delay=65047, delays=64897/0/150/0, dsn=4.4.1, status=deferred (connect
    – ShimonD
    Apr 10, 2015 at 17:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .