SMTP Flooding - How can I stop it? | Unix Linux Forums | Security

  Go Back    


Security Discuss UNIX and Linux computer and network security, cyber security, cyber attacks, IT security, and more.

SMTP Flooding - How can I stop it?

Security


Tags
sendmail

Closed Thread    
 
Thread Tools Search this Thread Display Modes
    #1  
Old 01-11-2008
zaroundus zaroundus is offline
Registered User
 
Join Date: Jan 2008
Last Activity: 11 January 2008, 8:31 PM EST
Posts: 6
Thanks: 0
Thanked 0 Times in 0 Posts
SMTP Flooding - How can I stop it?

Please someone help! My SMTP server has been under attack for days and I'm at my wits end. I'm by no means a UNIX security expert but I've been reading and researching for days to no avail. I'm getting unauthorized mail from external servers being relayed or redirected through my SMTP server. The IP addresses change on almost every connection. I can post log excerpts and config file info if necessary. I just don't know what would be relevant. This is a virtual dedicated server from godaddy.com running RedHat Fedora and PLESK admin control panels. I really need help so anyone who might have any ideas or suggestions, please respond! Thanks everyone.
Sponsored Links
    #2  
Old 01-11-2008
reborg's Avatar
reborg reborg is offline Forum Advisor  
Administrator Emeritus
 
Join Date: Mar 2005
Last Activity: 29 March 2012, 7:00 PM EDT
Location: Ireland
Posts: 4,464
Thanks: 0
Thanked 11 Times in 11 Posts
Which MTA are you running (eg sendmail/postfix/other )?
Sponsored Links
    #3  
Old 01-11-2008
zaroundus zaroundus is offline
Registered User
 
Join Date: Jan 2008
Last Activity: 11 January 2008, 8:31 PM EST
Posts: 6
Thanks: 0
Thanked 0 Times in 0 Posts
I ran a top to see running processes and it looks like qmail. Though I thought qmail used sendmail somehow. Could be wrong though.... I'm okay with UNIX but only mostly for web server things. (Apache, MySQL, PHP...) I'm new to security and mail server testing/repair/hardening so I'm at a standstill. I made a few changes to the sendmail.cf file and one of the qmail files to throttle the connection rate and to pause 5 seconds before returning GREET. After switching Port 25 back on today the relays are no longer being passed on (I think...). My SMTP server is still being bombarded with connection requests so I'm not sure if I've completely resolved this or if I need to look elsewhere for connection restrictions. The connection attempt rate has, at times, approached 1.07 connections per second!
    #4  
Old 01-11-2008
reborg's Avatar
reborg reborg is offline Forum Advisor  
Administrator Emeritus
 
Join Date: Mar 2005
Last Activity: 29 March 2012, 7:00 PM EDT
Location: Ireland
Posts: 4,464
Thanks: 0
Thanked 11 Times in 11 Posts
Do you have this directory?

/var/qmail/control
Sponsored Links
    #5  
Old 01-11-2008
zaroundus zaroundus is offline
Registered User
 
Join Date: Jan 2008
Last Activity: 11 January 2008, 8:31 PM EST
Posts: 6
Thanks: 0
Thanked 0 Times in 0 Posts
Yes I do. I've been in here before. I believe it was to add to rcpthosts when I first got this server online.
Sponsored Links
    #6  
Old 01-11-2008
reborg's Avatar
reborg reborg is offline Forum Advisor  
Administrator Emeritus
 
Join Date: Mar 2005
Last Activity: 29 March 2012, 7:00 PM EDT
Location: Ireland
Posts: 4,464
Thanks: 0
Thanked 11 Times in 11 Posts
Ok, and that confirms qmail. What do you have in rcphosts, ie. is there anything other than your domain?
Sponsored Links
    #7  
Old 01-11-2008
zaroundus zaroundus is offline
Registered User
 
Join Date: Jan 2008
Last Activity: 11 January 2008, 8:31 PM EST
Posts: 6
Thanks: 0
Thanked 0 Times in 0 Posts
Below is the content of my rcpthosts file. All of the domains except gmail, yahoo, and hotmail are hosted on this server as virtual hosts and each has its own mail domain. Do you think I should remove the non-hosted domains from this file?

roundus.com
nestlincoln.com
screenink.com
bellabodyworks.com
kingsleymd.com
gmail.com
hotmail.com
yahoo.com
high5club.org
pkflynn.com
screeninc.com
Sponsored Links
Closed Thread

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

More UNIX and Linux Forum Topics You Might Find Helpful
Thread Thread Starter Forum Replies Last Post
Smtp balu_puttaganti UNIX for Dummies Questions & Answers 1 09-08-2009 10:33 AM
C Smtp grotesque Programming 1 02-15-2008 07:55 AM
Sendmail & SMTP KenLynch Solaris 9 01-10-2007 08:55 AM
how to stop others users to stop viewing what i am doing ? mobile01 UNIX for Advanced & Expert Users 5 12-04-2006 08:37 AM
Smtp vtran4270 UNIX for Advanced & Expert Users 1 12-10-2002 05:24 PM



All times are GMT -4. The time now is 03:05 PM.