Solved

exchange 2003, user spoof, sending spam using one of our users

Posted on 2013-06-11
10
395 Views
Last Modified: 2013-06-16
I have a mail server, in Queue, there's multiple outgoing mails are stuck on sending from a specific user. But the user's outlook doesn't show she sent mails out. The outgoing emails are also seem to be spam going to external random addresses. I think changing/correcting settings at SMTP virtual server of the mail server can resolve this problem. Can you advise?

Relay under SMTP virtual server/properties/Access/Relay is restricted to our LAN IPs of a few servers.

Under SMTP virtual server/properties/Access/Authentication, both Anonymous access and Integrated Windows Authentication are checked.

Unser SMTP virtual server/properties/Delivery/Outbound Security, Anonymous access is checked.

Windows 2003 SP2
Exhcnage 2003 SP2
0
Comment
Question by:crcsupport
  • 5
  • 3
  • 2
10 Comments
 
LVL 52

Assisted Solution

by:Manpreet SIngh Khatra
Manpreet SIngh Khatra earned 250 total points
ID: 39238465
If you say your domain\connector isnt set to Open relay then yes it could be user so use Exmon and try to find the user and then clean his machine and disconnect his mailbox if you find it causing some issues as well

http://www.microsoft.com/en-us/download/details.aspx?id=11461

- Rancy
0
 
LVL 1

Author Comment

by:crcsupport
ID: 39238534
I was looking at SMTP virtual server.
Yes, I have a connector set up at Routing groups/First Routing Group/Connectors/Connector. It shows, Connector/properties/Delivery Restriction shows 'By default, messages from everyone are Accepted'.

Is there a way to restrict to accept messages only from LAN IPs? We have a dummy email (no mailbox) addresss 'do-not-reply@mydomain.com' to send out some emails to clients. If I restrict by user account, I think the email won't work.

Also, is it possible any outside pc can telnet to the server and send out email using our mail server with 'from' as one of our user's email address even though relay is off?

I scanned the trouble user's pc, didn't find any problem.
0
 
LVL 1

Author Comment

by:crcsupport
ID: 39238542
I will test using exmon
0
Does Powershell have you tied up in knots?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
LVL 76

Assisted Solution

by:Alan Hardisty
Alan Hardisty earned 250 total points
ID: 39238559
If anyone knows a useraccount and password, they will always be able to relay via your server if you have relaying enabled.

Hackers always enjoy cracking an Exchange 2003 server account and then abuse the hell out of it until you realise, stop the problem and prevent it from happening again.

Can you see the subject of the emails that are not going anywhere?  Are they spam-like?

Alan
0
 
LVL 52

Assisted Solution

by:Manpreet SIngh Khatra
Manpreet SIngh Khatra earned 250 total points
ID: 39238566
Also, is it possible any outside pc can telnet to the server and send out email using our mail server with 'from' as one of our user's email address even though relay is off? - If your server is allowed for Open relay compared to restricted IP's to be allowed for relay

Why dont you stop the SMTP service if possible and let emails pile and check their content or source and work with Sender\Recipient filtering options in Exchange

- Rancy
0
 
LVL 1

Author Comment

by:crcsupport
ID: 39238681
Yes, it's spam, subject shows all medicine stuffs... I changed the password of her and see what happens.

I have relay setting as shown in the attached image on my SMTP virtual server.
Basically it has 5 LAN IPs are allowed to relay, there's websites in dev and production to do relay to the mail server to send. But the 5 computers are all clean with virus. But I noticed that in the users tab, the Domain Users are allowed to relay. I can restrict this to certain users only, correct?
So in my case, relay is on...

Besides relay, what else can make possible for outside email client can send emails using our mail server pretending the troubled user account without knowing password?
relay.jpg
0
 
LVL 1

Author Comment

by:crcsupport
ID: 39238712
I changed her password, but it keeps sending mails out from her  account. So I think someone outside connecting to my mail server and send out emails without logging in with her account
0
 
LVL 76

Accepted Solution

by:
Alan Hardisty earned 250 total points
ID: 39238726
0
 
LVL 1

Author Comment

by:crcsupport
ID: 39238971
It looks like the account was hacked. I just checked again the queue, I don't see emails going out with her account.
Alanharddisty, thanks for the article. I need to set account lockout policy so that hacker can't run brute-force against our exchange server.
0
 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 39239002
Yes - always a good plan, plus setting strong passwords and forcing regular changes is also a good way to minimise hacked accounts.

Alan
0

Featured Post

Free Tool: Postgres Monitoring System

A PHP and Perl based system to collect and display usage statistics from PostgreSQL databases.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

This article runs through the process of deploying a single EXE application selectively to a group of user.
This article describes my battle tested process for setting up delegation. I use this process anywhere that I need to setup delegation. In the article I will show how it applies to Active Directory
This video discusses moving either the default database or any database to a new volume.
A short tutorial showing how to set up an email signature in Outlook on the Web (previously known as OWA). For free email signatures designs, visit https://www.mail-signatures.com/articles/signature-templates/?sts=6651 If you want to manage em…

789 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question