too much spam traffic....provider threatning to close account if continue using ispco

Discussion in 'General' started by dactor, Apr 21, 2008.

  1. dactor

    dactor New Member

    Hello

    I have a vps account unmanaged with a provider. when I look into my mail.log I see too much traffic that is not related to me domains.

    the following is an excerpt from my log:

    Apr 21 15:34:34 li7-94 postfix/smtp[19001]: 0F22D1469B: to=<[email protected]>, relay=none, delay=103575, delays=103545/0.08/30/0, dsn=4.4.1, status=deferred (connect to nextrasgr.it[195.46.218.192]: Connection timed out)
    Apr 21 15:34:34 li7-94 postfix/smtp[19004]: connect to unccvm.uncc.edu[152.15.40.22]: Connection timed out (port 25)
    Apr 21 15:34:34 li7-94 postfix/smtp[19004]: C683F14661: to=<[email protected]>, relay=none, delay=170726, delays=170696/0.09/30/0, dsn=4.4.1, status=deferred (connect to unccvm.uncc.edu[152.15.40.22]: Connection timed out)
    Apr 21 15:34:34 li7-94 postfix/smtp[19002]: connect to wishthumbs.vg[72.20.110.8]: Connection timed out (port 25)
    Apr 21 15:34:34 li7-94 postfix/smtp[19003]: connect to eumc.eu.int[193.154.180.197]: Connection timed out (port 25)
    Apr 21 15:34:34 li7-94 postfix/smtp[19003]: 3A3E714679: to=<[email protected]>, relay=none, delay=172677, delays=172647/0.11/30/0, dsn=4.4.1, status=deferred (connect to eumc.eu.int[193.154.180.197]: Connection timed out)
    Apr 21 15:35:04 li7-94 postfix/smtp[19002]: connect to wishthumbs.vg[208.87.149.250]: Connection timed out (port 25)
    Apr 21 15:35:04 li7-94 postfix/smtp[19002]: 4556814665: to=<[email protected]>, relay=none, delay=172761, delays=172701/0.06/60/0, dsn=4.4.1, status=deferred (connect to wishthumbs.vg[208.87.149.250]: Connection timed out)
    Apr 21 15:39:04 li7-94 postfix/qmgr[4400]: 3B43714654: from=<[email protected]>, size=1433, nrcpt=1 (queue active)
    Apr 21 15:39:04 li7-94 postfix/qmgr[4400]: 2E8BD146B5: from=<[email protected]>, size=1679, nrcpt=1 (queue active)
    Apr 21 15:39:04 li7-94 postfix/qmgr[4400]: 75491146BE: from=<[email protected]>, size=1689, nrcpt=1 (queue active)
    Apr 21 15:39:05 li7-94 postfix/smtp[19077]: connect to mail.tuttocitta.it[212.48.3.171]: Connection refused (port 25)
    Apr 21 15:39:05 li7-94 postfix/smtp[19077]: 2E8BD146B5: to=<[email protected]ta.it>, relay=none, delay=105631, delays=105631/0.07/0.4/0, dsn=4.4.1, status=deferred (connect to mail.tuttocitta.it[212.48.3.171]: Connection refused)
    Apr 21 15:39:08 li7-94 postfix/smtp[19079]: 75491146BE: to=<[email protected]>, relay=none, delay=55140, delays=55137/0.06/3.8/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=bandascecilialbavilla.it type=MX: Host not found, try again)
    Apr 21 15:39:35 li7-94 postfix/smtp[19078]: connect to neighborhoodexclusive.com[66.246.195.42]: Connection timed out (port 25)
    Apr 21 15:39:35 li7-94 postfix/smtp[19078]: 3B43714654: to=<[email protected]>, relay=none, delay=174929, delays=174899/0.08/30/0, dsn=4.4.1, status=deferred (connect to neighborhoodexclusive.com[66.246.195.42]: Connection timed out)
    Apr 21 15:44:04 li7-94 postfix/qmgr[4400]: 6F31A146C3: from=<[email protected]>, size=1679, nrcpt=1 (queue active)
    Apr 21 15:44:04 li7-94 postfix/qmgr[4400]: C6EE7146CC: from=<[email protected]>, size=1671, nrcpt=1 (queue active)
    Apr 21 15:44:04 li7-94 postfix/qmgr[4400]: BB520146D5: from=<[email protected]>, size=1647, nrcpt=1 (queue active)
    Apr 21 15:44:07 li7-94 postfix/smtp[19143]: C6EE7146CC: to=<[email protected]>, relay=none, delay=105564, delays=105560/0.07/3.2/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=spyroviaggi.it type=MX: Host not found, try again)
    Apr 21 15:44:34 li7-94 postfix/smtp[19144]: connect to krak.it[82.98.86.162]: Connection timed out (port 25)
    Apr 21 15:44:34 li7-94 postfix/smtp[19144]: BB520146D5: to=<[email protected]>, relay=none, delay=105556, delays=105526/0.06/30/0, dsn=4.4.1, status=deferred (connect to krak.it[82.98.86.162]: Connection timed out)
    Apr 21 15:44:34 li7-94 postfix/smtp[19142]: connect to almamegretta.com[66.246.195.42]: Connection timed out (port 25)
    Apr 21 15:44:34 li7-94 postfix/smtp[19142]: 6F31A146C3: to=<[email protected]>, relay=none, delay=48955, delays=48925/0.05/30/0, dsn=4.4.1, status=deferred (connect to almamegretta.com[66.246.195.42]: Connection timed out)
    Apr 21 15:49:04 li7-94 postfix/qmgr[4400]: 095DE146DC: from=<[email protected]>, size=1665, nrcpt=1 (queue active)
    Apr 21 15:49:04 li7-94 postfix/qmgr[4400]: 31AD6146A1: from=<[email protected]>, size=1667, nrcpt=1 (queue active)

    I tried to figure out what is the problem and why am I getting these hits but with no luck. The provider has shutdown the server couple of times till I resolve this issue. I dont see how can I go about investigating this further. My only catch I found was the clamAV is out of date and needed update. I am also not sure if it is a spamassassin problem.

    is there like a daily administration and maintenance steps to do on ISPconfig!!??

    can someone help me please. I dont want to remove ISPconfig and want to solve the issues.

    Ramis
     
  2. till

    till Super Moderator Staff Member ISPConfig Developer

    This wont help you at all as this is no ISPConfig problem.

    Your server is most likely a open relay or someone uses a website or script which is hosted on your server to send spam mails. Please post the content of the main.cf file
     
  3. dactor

    dactor New Member

    this is main.cf

    # See /usr/share/postfix/main.cf.dist for a commented, more complete version


    # Debian specific: Specifying a file name will cause the first
    # line of that file to be used as the name. The Debian default
    # is /etc/mailname.
    #myorigin = /etc/mailname

    smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
    biff = no

    # appending .domain is the MUA's job.
    append_dot_mydomain = no

    # Uncomment the next line to generate "delayed mail" warnings
    #delay_warning_time = 4h

    # TLS parameters
    smtpd_tls_cert_file = /etc/postfix/ssl/smtpd.crt
    smtpd_tls_key_file = /etc/postfix/ssl/smtpd.key
    smtpd_use_tls = yes
    smtpd_tls_session_cache_database = btree:${queue_directory}/smtpd_scache
    smtp_tls_session_cache_database = btree:${queue_directory}/smtp_scache

    # See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
    # information on enabling SSL in the smtp client.

    myhostname = li7-XX.members.XXX.com
    alias_maps = hash:/etc/aliases
    alias_database = hash:/etc/aliases
    myorigin = /etc/mailname
    #mydestination = li7-XX.members.XXX.com,localhost.li7-XX.members.XXX.com, localhost.localdomain, localhost
    relayhost =
    mynetworks = 127.0.0.0/8
    mailbox_command = procmail -a "$EXTENSION"
    mailbox_size_limit = 0
    recipient_delimiter = +
    inet_interfaces = all
    inet_protocols = all
    smtpd_sasl_local_domain =
    smtpd_sasl_auth_enable = yes
    smtpd_sasl_security_options = noanonymous
    broken_sasl_auth_clients = yes
    smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination
    smtpd_tls_auth_only = no
    smtp_use_tls = yes
    smtp_tls_note_starttls_offer = yes
    smtpd_tls_CAfile = /etc/postfix/ssl/cacert.pem
    smtpd_tls_loglevel = 1
    smtpd_tls_received_header = yes
    smtpd_tls_session_cache_timeout = 3600s
    tls_random_source = dev:/dev/urandom

    virtual_maps = hash:/etc/postfix/virtusertable

    mydestination = /etc/postfix/local-host-names



    i also have the old main.cf before installing ISPConfig
     
  4. till

    till Super Moderator Staff Member ISPConfig Developer

    The main.cf is fine and your server is not a open relay. But you should check this with a open relay test too:

    http://www.abuse.net/relay.html

    A possible other source of the spam is a vulnerable mail form or a cms system. You should check all mail forms and if possible update all CMS systems on your server to the latest versions.
     
  5. dactor

    dactor New Member

    Thanks a million Till for the verification,

    I did check my mail queue system to find that its full (as shown above), then I did:

    postsuper -d ALL (to delete all mail queue)

    then checked mailq:

    /usr/bin/mailq

    and found that things are back to normal (kinda). my mail log file has been reasonably active since yesterday clearing of mailq.

    this is weird though!!!!! lets wait and see...
     

Share This Page