Spam sent through server using authid=apache or mysql

[Stephen Pusey-2]

I'm new to this mailing list - but I am hoping that someone out there
may bring light to a problem I am having recently with spammers.  I do
not allow relaying through the server and external tests have
confirmed that there are no open relays.  I have also run a test for
open ports with pxytest - and none were found.  Email can only be
relayed by users logged on through SASL etc.  I have checked all the
user directories for old formmail programs and disabled any that I
found - but the apache logs do not show the spammer using POST or
formmail.  The record of the spam only appears in the maillog.  Here
is an example (I have changed the server name and the spammers
ipaddress):

May 21 08:12:32 thismachine sendmail[16842]: AUTH=server,
relay=ip68-92-154-163.z154-92-62.customer.algz.net [68.92.154.163],
authid=apache, mech=LOGIN, bits=0

spammers have also used authid=mysql

Y'awl probably think I am an idiot for not figuring this out - but I
would really appreciate your help - or direction to the right place.

Thanks,

SCP

[Mark Frey]

On 5/30/2008 12:49 PM, Stephen Pusey wrote:

> I'm new to this mailing list - but I am hoping that someone out there
> may bring light to a problem I am having recently with spammers.  I do
> not allow relaying through the server and external tests have
> confirmed that there are no open relays.  I have also run a test for
> open ports with pxytest - and none were found.  Email can only be
> relayed by users logged on through SASL etc.  I have checked all the
> user directories for old formmail programs and disabled any that I
> found - but the apache logs do not show the spammer using POST or
> formmail.  The record of the spam only appears in the maillog.  Here
> is an example (I have changed the server name and the spammers
> ipaddress):
>
> May 21 08:12:32 thismachine sendmail[16842]: AUTH=server,
> relay=ip68-92-154-163.z154-92-62.customer.algz.net [68.92.154.163],
> authid=apache, mech=LOGIN, bits=0

Looks like they guessed the password for your 'apache' user.

>
> spammers have also used authid=mysql

Same for mysql user.  Except neither of these users should have valid
password entries.

Or, something's wrong with your SASL so that it's authenticating valid
user names with non-existant passwords?

Try sending email yourself with SASL, username apache and blank password?

Mark.
>
> Y'awl probably think I am an idiot for not figuring this out - but I
> would really appreciate your help - or direction to the right place.
>
> Thanks,
>
> SCP
>

--
Mark Frey
IT Manager
Extend Communications Inc
49 Charlotte St
Brantford ON  N3T 2W4
519 759-6820
800 265-9975
Fax: [phone]

[John Jasen]

Stephen Pusey wrote:
> May 21 08:12:32 thismachine sendmail[16842]: AUTH=server,
> relay=ip68-92-154-163.z154-92-62.customer.algz.net [68.92.154.163],
> authid=apache, mech=LOGIN, bits=0
>
> spammers have also used authid=mysql
>
> Y'awl probably think I am an idiot for not figuring this out - but I
> would really appreciate your help - or direction to the right place.

Is sasl configured to use sasldb or another authentication source?

My immediate guess is that apache and mysql have easily guessed
passwords either in sasldb or elsewhere.

--
-- John E. Jasen (jjasen@...)
-- No one will sorrow for me when I die, because those who would
-- are dead already. -- Lan Mandragoran, The Wheel of Time, New Spring