OT: help needed with network problem
This has naught to do with vintage computers, but I need help, and this audience likely has one or more folks who can help. I run my own mail server; I have for many years. Lately, spamhaus.org has blocked me for ONE suspect email from my network. Here is ALL the bad activity from my IP for the last three months: (IP address, timestamp (UTC), and HELO string) 98.109.205.15 2022-03-28 10:15:00 instructure.com 98.109.205.15 2022-03-15 08:05:00 instructure.com 98.109.205.15 2022-01-21 16:10:00 localhost It's a funny kind of malware that sends two messages 15 days apart. I can't figure out where it's coming from, and my knowledge of iptables and tcpdump is insufficient to do the following jobs: 1. figure out where this bad email is coming from 2. block port 25 outbound at my firewall except from the ONE machine authorized to send email. I am willing to PAY for help with this. Email me if you think you can help and would like to try. Thanks, Bill Dudley This email is free of malware because I run Linux.
I assume you've done all the appropriate things regarding running a safe mail server on the internet? That means SPF and DMARC records, and you've run your MX host through the various mail checkers to see if they are all aligned and have a good reputation? mxtoolbox.com is my go-to when i'm having mail server issues - plug in your domain and see what it says. On Mon, Mar 28, 2022 at 10:25 AM William Dudley via vcf-midatlantic <vcf-midatlantic@lists.vcfed.org> wrote:
This has naught to do with vintage computers, but I need help, and this audience likely has one or more folks who can help.
I run my own mail server; I have for many years. Lately, spamhaus.org has blocked me for ONE suspect email from my network.
Here is ALL the bad activity from my IP for the last three months:
(IP address, timestamp (UTC), and HELO string) 98.109.205.15 2022-03-28 10:15:00 instructure.com 98.109.205.15 2022-03-15 08:05:00 instructure.com 98.109.205.15 2022-01-21 16:10:00 localhost
It's a funny kind of malware that sends two messages 15 days apart.
I can't figure out where it's coming from, and my knowledge of iptables and tcpdump is insufficient to do the following jobs:
1. figure out where this bad email is coming from 2. block port 25 outbound at my firewall except from the ONE machine authorized to send email.
I am willing to PAY for help with this.
Email me if you think you can help and would like to try.
Thanks, Bill Dudley
This email is free of malware because I run Linux.
-- Dave Shevett shevett@pobox.com
Yes, I'm all SPF'd and DMARC'd and checked on mxtoolbox.com and have been for some years now. The problem is some machine sending bad email every 15 days (with sample size of two). Server is casano.com, IP is 98.109.205.15 Bill Dudley This email is free of malware because I run Linux. On Mon, Mar 28, 2022 at 11:08 AM Dave Shevett <shevett@pobox.com> wrote:
I assume you've done all the appropriate things regarding running a safe mail server on the internet? That means SPF and DMARC records, and you've run your MX host through the various mail checkers to see if they are all aligned and have a good reputation?
mxtoolbox.com is my go-to when i'm having mail server issues - plug in your domain and see what it says.
On Mon, Mar 28, 2022 at 10:25 AM William Dudley via vcf-midatlantic <vcf-midatlantic@lists.vcfed.org> wrote:
This has naught to do with vintage computers, but I need help, and this audience likely has one or more folks who can help.
I run my own mail server; I have for many years. Lately, spamhaus.org has blocked me for ONE suspect email from my network.
Here is ALL the bad activity from my IP for the last three months:
(IP address, timestamp (UTC), and HELO string) 98.109.205.15 2022-03-28 10:15:00 instructure.com 98.109.205.15 2022-03-15 08:05:00 instructure.com 98.109.205.15 2022-01-21 16:10:00 localhost
It's a funny kind of malware that sends two messages 15 days apart.
I can't figure out where it's coming from, and my knowledge of iptables and tcpdump is insufficient to do the following jobs:
1. figure out where this bad email is coming from 2. block port 25 outbound at my firewall except from the ONE machine authorized to send email.
I am willing to PAY for help with this.
Email me if you think you can help and would like to try.
Thanks, Bill Dudley
This email is free of malware because I run Linux.
-- Dave Shevett shevett@pobox.com
Make sure none of your user accounts are compromised. On 757.org we had one of the user's accounts get popped and outsiders were slow rolling spams through it. Are you running web services on it? That is another potential point of entry. Outdated wordpress plugins and wordpress accounts, stuff like that. It's a PITA to troubleshoot. And a PITA to get removed from blocks, especially O365 and Google. - Ethan On Mon, 28 Mar 2022, William Dudley via vcf-midatlantic wrote:
This has naught to do with vintage computers, but I need help, and this audience likely has one or more folks who can help.
I run my own mail server; I have for many years. Lately, spamhaus.org has blocked me for ONE suspect email from my network.
Here is ALL the bad activity from my IP for the last three months:
(IP address, timestamp (UTC), and HELO string) 98.109.205.15 2022-03-28 10:15:00 instructure.com 98.109.205.15 2022-03-15 08:05:00 instructure.com 98.109.205.15 2022-01-21 16:10:00 localhost
It's a funny kind of malware that sends two messages 15 days apart.
I can't figure out where it's coming from, and my knowledge of iptables and tcpdump is insufficient to do the following jobs:
1. figure out where this bad email is coming from 2. block port 25 outbound at my firewall except from the ONE machine authorized to send email.
I am willing to PAY for help with this.
Email me if you think you can help and would like to try.
Thanks, Bill Dudley
This email is free of malware because I run Linux.
The only user accounts are me and my ex-wife, and she only interacts with my network via ssh (public key only, no passwords) and a simple web interface. I do run a web server, but all static pages OR Perl CGI driven pages; no Wordpress. I suppose I should get the ex-wife to run a malware check on her machine. Thanks for your thoughts. Bill Dudley This email is free of malware because I run Linux. On Mon, Mar 28, 2022 at 11:29 AM Ethan O'Toole <telmnstr@757.org> wrote:
Make sure none of your user accounts are compromised. On 757.org we had one of the user's accounts get popped and outsiders were slow rolling spams through it.
Are you running web services on it? That is another potential point of entry. Outdated wordpress plugins and wordpress accounts, stuff like that.
It's a PITA to troubleshoot. And a PITA to get removed from blocks, especially O365 and Google.
- Ethan
On Mon, 28 Mar 2022, William Dudley via vcf-midatlantic wrote:
This has naught to do with vintage computers, but I need help, and this audience likely has one or more folks who can help.
I run my own mail server; I have for many years. Lately, spamhaus.org has blocked me for ONE suspect email from my network.
Here is ALL the bad activity from my IP for the last three months:
(IP address, timestamp (UTC), and HELO string) 98.109.205.15 2022-03-28 10:15:00 instructure.com 98.109.205.15 2022-03-15 08:05:00 instructure.com 98.109.205.15 2022-01-21 16:10:00 localhost
It's a funny kind of malware that sends two messages 15 days apart.
I can't figure out where it's coming from, and my knowledge of iptables and tcpdump is insufficient to do the following jobs:
1. figure out where this bad email is coming from 2. block port 25 outbound at my firewall except from the ONE machine authorized to send email.
I am willing to PAY for help with this.
Email me if you think you can help and would like to try.
Thanks, Bill Dudley
This email is free of malware because I run Linux.
My guess is that someone is using your mail server as a passthrough gateway. You have to block incoming requests that do not originate from your mail server. Every mail server is different but the crux of it is that you're being used to send smtp traffic through your mail server. You need to look up your mail server and see what the specific process is. You may have it in passthrough mode. Yours would not be the only one with this issue. Once you fix, it should take about 48 hours for the blacklist to clear, or you can submit a blacklist removal ticket request. Bill On Mon, Mar 28, 2022 at 12:39 PM William Dudley via vcf-midatlantic < vcf-midatlantic@lists.vcfed.org> wrote:
The only user accounts are me and my ex-wife, and she only interacts with my network via ssh (public key only, no passwords) and a simple web interface. I do run a web server, but all static pages OR Perl CGI driven pages; no Wordpress. I suppose I should get the ex-wife to run a malware check on her machine.
Thanks for your thoughts.
Bill Dudley
This email is free of malware because I run Linux.
On Mon, Mar 28, 2022 at 11:29 AM Ethan O'Toole <telmnstr@757.org> wrote:
Make sure none of your user accounts are compromised. On 757.org we had one of the user's accounts get popped and outsiders were slow rolling spams through it.
Are you running web services on it? That is another potential point of entry. Outdated wordpress plugins and wordpress accounts, stuff like
that.
It's a PITA to troubleshoot. And a PITA to get removed from blocks, especially O365 and Google.
- Ethan
On Mon, 28 Mar 2022, William Dudley via vcf-midatlantic wrote:
This has naught to do with vintage computers, but I need help, and this audience likely has one or more folks who can help.
I run my own mail server; I have for many years. Lately, spamhaus.org has blocked me for ONE suspect email from my network.
Here is ALL the bad activity from my IP for the last three months:
(IP address, timestamp (UTC), and HELO string) 98.109.205.15 2022-03-28 10:15:00 instructure.com 98.109.205.15 2022-03-15 08:05:00 instructure.com 98.109.205.15 2022-01-21 16:10:00 localhost
It's a funny kind of malware that sends two messages 15 days apart.
I can't figure out where it's coming from, and my knowledge of iptables and tcpdump is insufficient to do the following jobs:
1. figure out where this bad email is coming from 2. block port 25 outbound at my firewall except from the ONE machine authorized to send email.
I am willing to PAY for help with this.
Email me if you think you can help and would like to try.
Thanks, Bill Dudley
This email is free of malware because I run Linux.
Bill, I've never heard of "passthrough mode", but I have head of "open relay", and my server does not allow relaying except for specific hosts on my network. (Relaying is denied by default on any even semi-recent sendmail installation.) I have relaying allowed for three specific machines on my LAN (and I just disabled one of those). Thanks for that suggestion, assuming that was your intent. The blacklist is already removed; spamhaus will remove a block on the assumption that you're working on the problem (assuming you ask nicely). Thanks, Bill Dudley This email is free of malware because I run Linux. On Mon, Mar 28, 2022 at 5:03 PM Bill Degnan via vcf-midatlantic < vcf-midatlantic@lists.vcfed.org> wrote:
My guess is that someone is using your mail server as a passthrough gateway. You have to block incoming requests that do not originate from your mail server. Every mail server is different but the crux of it is that you're being used to send smtp traffic through your mail server. You need to look up your mail server and see what the specific process is. You may have it in passthrough mode.
Yours would not be the only one with this issue. Once you fix, it should take about 48 hours for the blacklist to clear, or you can submit a blacklist removal ticket request.
Bill
On Mon, Mar 28, 2022 at 12:39 PM William Dudley via vcf-midatlantic < vcf-midatlantic@lists.vcfed.org> wrote:
The only user accounts are me and my ex-wife, and she only interacts with my network via ssh (public key only, no passwords) and a simple web interface. I do run a web server, but all static pages OR Perl CGI driven pages; no Wordpress. I suppose I should get the ex-wife to run a malware check on her machine.
Thanks for your thoughts.
Bill Dudley
This email is free of malware because I run Linux.
On Mon, Mar 28, 2022 at 11:29 AM Ethan O'Toole <telmnstr@757.org> wrote:
Make sure none of your user accounts are compromised. On 757.org we
had
one of the user's accounts get popped and outsiders were slow rolling spams through it.
Are you running web services on it? That is another potential point of entry. Outdated wordpress plugins and wordpress accounts, stuff like that.
It's a PITA to troubleshoot. And a PITA to get removed from blocks, especially O365 and Google.
- Ethan
On Mon, 28 Mar 2022, William Dudley via vcf-midatlantic wrote:
This has naught to do with vintage computers, but I need help, and this audience likely has one or more folks who can help.
I run my own mail server; I have for many years. Lately, spamhaus.org has blocked me for ONE suspect email from my network.
Here is ALL the bad activity from my IP for the last three months:
(IP address, timestamp (UTC), and HELO string) 98.109.205.15 2022-03-28 10:15:00 instructure.com 98.109.205.15 2022-03-15 08:05:00 instructure.com 98.109.205.15 2022-01-21 16:10:00 localhost
It's a funny kind of malware that sends two messages 15 days apart.
I can't figure out where it's coming from, and my knowledge of iptables and tcpdump is insufficient to do the following jobs:
1. figure out where this bad email is coming from 2. block port 25 outbound at my firewall except from the ONE machine authorized to send email.
I am willing to PAY for help with this.
Email me if you think you can help and would like to try.
Thanks, Bill Dudley
This email is free of malware because I run Linux.
participants (4)
-
Bill Degnan -
Dave Shevett -
Ethan O'Toole -
William Dudley