Exim getting abused?

[rohit]

Hi All,

Today I found out that yahoo is rejecting all the email from the server. Then I had a quick look the exim mails and realized there were heaps of mails that someone was trying to spam to yahoo / aol / hotmail users. Then I started to delete all of those emails. Below is the extract of the mail headers from one of them. By looking at the email headers it looks like that the the originator was a user on the system. The server is used as an outgoing mail server by few of the customers. Please have a look at below it looks like the user was an authenciated user for popb4smtp.

1JWKiS-0002ym-P9-H
mail 8 12
<[email protected]>
1204589348 2
-helo_name 41.219.218.1
-host_address 127.0.0.1.39110
-host_name localhost
-host_auth login
-interface_address 127.0.0.1.25
-received_protocol esmtpa
-body_linecount 33
-max_received_linelength 76
-auth_id [email protected]
YY [email protected]
YY [email protected]
....
....
....
....
....
....

list goes on n on.

Below are the email headers for this email.

214P Received: from localhost ([127.0.0.1] helo=41.219.218.1)
by server.aegnisolutions.com with esmtpa (Exim 4.69)
(envelope-from <[email protected]>)
id 1JWKiS-0002ym-P9; Tue, 04 Mar 2008 11:09:08 +1100
114P Received: from phpmailer ([41.219.218.1])
by 41.219.218.1 with HTTP (UebiMiau);
Tue, 4 Mar 2008 11:09:07 +1100
037 Date: Tue, 4 Mar 2008 11:09:07 +1100
043* Return-Path: [email protected]
029T To: undisclosed-recipients:;
059F From: "MR. AKANBI RAPHAEL" <[email protected]>
063R Reply-to: "MR. AKANBI RAPHAEL" <[email protected]>
056 Subject: CONTACT THE FEDEX COURIER AT +234-802-970-7488
060I Message-ID: <[email protected]>
014 X-Priority: 3
044 X-Mailer: UebiMiau [PHPMailer version 1.70]
018 MIME-Version: 1.0
032 Content-Transfer-Encoding: 8bit
048 Content-Type: text/html;
charset="iso-8859-1"


There were many emails of this kind. You think someone cracked the password for this user and then tried to send emails that way? IS there is a security setting that I am missing?

Hope to get some assistance on this urgent matter asap as this can happen to any server and any user account.


By looking at the below link, I am a bit confused regarding -host_auth and -auth_id

http://www.exim.org/exim-html-4.10/doc/html/spec_48.html

-host_auth <text>: If the message was received on an authenticated SMTP connection, this records the name of the authenticator - the value of the $sender_host_authenticated variable.


-auth_id <text>: The id information for a message received on an authenticated SMTP connection - the value of the $authenticated_id variable.



Thanks

Rohit

 

[hci]

>>044 X-Mailer: UebiMiau [PHPMailer version 1.70]

Most likely one of your users had a weak password on there email account. Or the user had a virus on there PC which allowed some hacker to steal there password. We only allow Squirrelmail as a webmail client and it adds a header to messages indicating who the Squirrelmail account belonged too. There is also a great pluggin for Squirrelmail that fixes these abuse issues also.

Restrict Senders
http://www.squirrelmail.org/plugin_view.php?id=213

This pluggin allows you to limit how many recipients a webmail message may have and how many messages a client may send per day. If I were you I would disable UebiMiau and add this plugin to Squirrelmail. Then limit to say 25 recipients and 50 messages a day. Would make it a slow process for a spammer to abuse.

You can also ratelimit in Exim so if they try to use authenticated SMTP instead of webmail they can only send so many an hour from any given IP.

warn ratelimit = 200 / 1h / per_rcpt / strict
delay = 10s
log_message = Sender $sender_address rate $sender_rate / $sender_rate_period excedes limit delayed 10 seconds

It would also be a good idea to run yum update if your system supports it. Do that with caution, some updates can break things.

And last of all installing rkhunter on the system is a good idea.

http://rkhunter.sourceforge.net/

Matt

 

[rohit]

Thanks Matt for the suggestions...

I did disable UebiMiau as you told and its definitely a smart move

Queries:

1. squirrelmail plugin: If I implement this plugin then I have to do this everytime, I upgrade a version of squirrelmail. Is there a better way to have this plugin installed everytime, I do an upgrade. I am currently using update.script to upgrade the versions of squirrelmail, which creates a new directory for the newer version of squirrelmail and then links squirrelmail to that directory.

2. ratelimit - I read about ratelimit quickly and it definitely is a good solution. But does it also affect the "root" user? Where exactly should this be added to the exim.conf. Do I need to create a new acl like check_ratelimit or something? Please provide an example to work on.

Thanks

 

[hci]

1. squirrelmail plugin: If I implement this plugin then I have to do this everytime, I upgrade a version of squirrelmail. Is there a better way to have this plugin installed everytime, I do an upgrade. I am currently using update.script to upgrade the versions of squirrelmail, which creates a new directory for the newer version of squirrelmail and then links squirrelmail to that directory.

I hear what your saying. I updated Squirrelmail right before I installed the plugin for this very reason. Perhaps when Squirrelmail updates it copies the plugin directory over? Not sure. Either way, a Squirrelmail update is not 'required' that often.

You likely know you will have to do this to enable the plugin.

perl /var/www/html/squirrelmail-1.4.13/config/conf.pl

After you add it to the plugins directory. You will then need to modify:

/var/www/html/squirrelmail-1.4.13/plugins/restrict_senders/data/config.php

To your liking.

2. ratelimit - I read about ratelimit quickly and it definitely is a good solution. But does it also affect the "root" user? Where exactly should this be added to the exim.conf. Do I need to create a new acl like check_ratelimit or something? Please provide an example to work on.

Goes in ACL after check recipient somewhere. If you have this in Exim.conf

# accept mail to hostmaster in any local domain, regardless of source
accept local_parts = hostmaster
domains =+local_domains

Put it after it. I have this on a server with 2000+ email accounts and no issues in several months its been setup with ratelimit. I do grep the mainlog once in a while to see what its hitting on.

Matt