Server used in for spam with ghost accounts

SimonBalk

Verified User
Joined
Mar 9, 2011
Messages
5
Hi,

I've been searching for a few weeks now and since I found no solution I decided to post my problem here.

Somehow it's possilble for spammers to add e-mail accounts to my DA user accounts with which they can use my SMTP to send spam. One time I even saw that there was a new user created with an e-mail account.

About once a week my server is used to sent spam. When I search for these "ghost" accounts, delete them and delete te mail queue the sending of spam stops. I've also tested my server if it was an open relay but this was not the case.

Now I know how to stop the sending of spam but I want to prevent this ofcource. But after searching alot the last few weeks I can't find the solition/fix for this.

I'm running DA on Debian 5 and have updated DA to the latest version last friday. I hope someone can point me in the right direction.
 

Arieh

Verified User
Joined
May 27, 2008
Messages
1,261
Location
The Netherlands
If even a user is created under admin (or a reseller?) then it looks like they simply log in. Have you changed your password?
 

SimonBalk

Verified User
Joined
Mar 9, 2011
Messages
5
I've changed my password a couple of times. The passwords are strong (8 or longer, lowercase, uppercase, numeric and special chars) so I don't think my password is hacked.
 

nobaloney

NoBaloney Internet Svcs - In Memoriam †
Joined
Jun 16, 2003
Messages
26,119
Location
California
Some hacker could have previously created a back door which is still open.

Are these linux user accounts with mailboxes, DirectAdmin accounts created either under the admin or other reseller accounts? Do they show up in the DirectAdmin login?

Jeff
 

SimonBalk

Verified User
Joined
Mar 9, 2011
Messages
5
Sorry for the delayed reaction.

One time there was a DirectAdmin account. All other times there where email accounts added to DA user acounts.

Since I started this topic nothing happend but the interval of de spam runs is often about 7-10 days. Hope I can find the solution soon.
 
Top