1

I have been using sendmail since 1995. I have an Ubuntu 12.04LTS server which my best information is, uses sendmail 8.14.4. I am having a problem that mail is coming in from an IP address addressed to a local address, with a delivery status notification request apparently from a user in an unrelated domain, I believe a DDOS targetted domain. Even with:

FEATURE(`require_rdns')dnl

FEATURE(`block_bad_helo')dnl

FEATURE(`badmx')dnl

I have no idea why sendmail is not flagging this as a forgery and a likely spam and just rejecting it, but that is a separate issue. If I could solve this aspect, it would avoid the problem of what is coming next.

To be clear, the mail is to a local user, so the original message is not recognized as an attempt to relay. By requesting a delivery status notification, the email is causing my server to send an email out to the apparent sender, who I am sure never sent the original email, and is actually the target of a DDOS attack. The message going out the apparent sender is failing, and sendmail is continuing to attempt to send this delivery status notification.

I have set (please excuse that I am walking from one computer to another retyping and may not have it character perfect here):

define('conf_PRIVACY_FLAGS','......,noreceipts')dnl in the sendmail.mc

and have verified that leads to

O PrivacyOptions=.....,noreceipts in sendmail.cf

I have done sudo reloads, and rebooted the server at least twice, is should be working with the new sendmail.cf file. I have googled, and found scant information on DSN, only a recommendation to insert "noreceipts", and another recommendation to not do that, that that is too strict and will cause problems.

What I am concerned is happening is one of two things:

Either a DDOS attacker is using a spam route to succeed: He has found a way to send emails apparently from the target domain to my server, so as to pass regular checks on forged mail, and my server is delivering the spam locally -- it is spam, I checked -- and then in repeatedly trying to provide the requested success notification. This leads to the DDOS attacker's original intended result where my server is participating in delivering a DDOS attack on the apparent originating domain, relying on my server's repeated attempts to resend the notification frequently. My logs are full of these attempts. If there are many thousands of other servers doing the same, the DDOS is probably successful.

Or... a botnet has indeed compromised something in my network (as CBL reports) and this has landed my server on a refuse list used by the sending domains, and that is why the success notifications for spam are not being delivered... But the spam keeps coming apparently from these domains, and keeps requesting DSN.

But both of these beg the question, why is sendmail ignoring "noreceipts" and continuing to try to send these notifications after I edited .mc, compiled to .cf, and performed reloads and reboots and manually flushing the mqueue repeatedly?

How exactly do I prevent sendmail 8.14 from generating successful delivery status notifications?

Thank you

0

You must log in to answer this question.

Browse other questions tagged .