Re: [CentOS] SMTP Auth Spam Mail Attack

2013-10-05 Thread John R Pierce
On 10/5/2013 9:19 AM, Paul Shuttleworth wrote: > I have changed the password on the domain in question and they are still > getting in. > I have tried changing the password and sending mail with the old password, > this gets .. relying denied, so SMTP auth is working ok. > I have been through the s

Re: [CentOS] SMTP Auth Spam Mail Attack

2013-10-05 Thread Paul Shuttleworth
> Baseline is, there is or has been a user "jon" usable for SMTP AUTH as > you have shown by the log entry: > > Oct 5 15:17:53 www sendmail[6972]: AUTH=server, > relay=pppoe9.net109-120-27.se1.omkc.ru [109.120.27.9] (may be forged), > authid=jon, mech=LOGIN, bits=0 > > Alexander > Hi Alexander

Re: [CentOS] SMTP Auth Spam Mail Attack

2013-10-05 Thread Alexander Dalloz
Am 05.10.2013 18:19, schrieb Paul Shuttleworth: > Has anyone any idea how they can be authenticating against SMTP auth with > a username that does not exist on the server ? > > Any pointers towards next steps appreciated, as I am running out of ideas > to try and lock this server down. > > > Che