<div>
Found the problem:<br />
<br />
<a href="http://en.wikipedia.org/wiki/Backscatter_%28e-mail%29" rel="ugc">http://en.wikipedia.org/wiki/Backscatter_%28e-mail%29</a><br />
<br />

</div>


Found the problem:

http://en.wikipedia.org/wiki/Backscatter_%28e-mail%29 [http://en.wikipedia.org/wiki/Backscatter_%28e-mail%29]



<div>
<div class="content wysiwyg-content">
Our Centos 5 server hosts a couple of hundred domains, and several hundred mailboxes, all using authenticated SMTP.<br />
<br />
Recently, our maillogs have grown to almost 1GB / day! On further investigation there are 20,000 messages in the mail queue, all of them outgoing spam.<br />
<br />
Centos 5 running Webmin / Virtualmin<br />
Postfix<br />
Dovecot<br />
<br />
I need to find the cause of the spam, because our IP is now blacklisted. I don't know if it is coming through a mailbox, or an insecure web script.<br />
<br />

</div>
</div>


Our Centos 5 server hosts a couple of hundred domains, and several hundred mailboxes, all using authenticated SMTP.

Recently, our maillogs have grown to almost 1GB / day! On further investigation there are 20,000 messages in the mail queue, all of them outgoing spam.

Centos 5 running Webmin / Virtualmin
Postfix
Dovecot

I need to find the cause of the spam, because our IP is now blacklisted. I don't know if it is coming through a mailbox, or an insecure web script.



Prevent server being used as a spam gateway

Interactions between email servers and clients are governed by email protocols. The three most common email protocols are POP, IMAP and MAPI. Most email software operates under one of these (and many products support more than one).  The correct protocol must be selected, and correctly configured, if you want your email account to work.

Email Protocols

A vulnerability is a weakness which allows an attacker to reduce a system's information assurance. Vulnerability is the intersection of three elements: a system susceptibility or flaw, attacker access to the flaw, and attacker capability to exploit the flaw. To exploit a vulnerability, an attacker must have at least one applicable tool or technique that can connect to a system weakness, known as the attack surface. Vulnerability management is the cyclical practice of identifying, classifying, remediating, and mitigating vulnerabilities. Other vulnerabilities include security risks, security defects and constructs in programming languages that are difficult to use properly.

Vulnerabilities

The Linux operating system, in all its flavors, has its own share of security flaws that allow intrusions, but there are various mechanisms by which these flaws can be removed, generally divided into two parts: authentication and access control. Authentication is responsible for ensuring that a user requesting access to the system is really the user with the account, while access control is responsible for controlling which resources each account has access to and what kind of access is permitted.